From c0374debe1a3f3f6f066f4d3cf0c9e12ffc7702c Mon Sep 17 00:00:00 2001
From: Speculator55005 <50082482+fas89@users.noreply.github.com>
Date: Mon, 12 Oct 2026 17:59:53 +0200
Subject: [PATCH 1/2] ci(codeql): advanced setup that keeps tests/ out of the
 analysis

Test contracts carry credential-shaped field names and fake secrets on
purpose, and CodeQL's sensitive-data heuristics treated them as taint
sources for alerts in production code (PR #712, alerts 308 and 310,
dismissed as false positives). The advanced setup analyses the same
languages with the default query suite and ignores tests/ through
.github/codeql/codeql-config.yml. Actions are pinned by commit SHA.
---
 .github/codeql/codeql-config.yml | 11 ++++++++
 .github/workflows/codeql.yml     | 47 ++++++++++++++++++++++++++++++++
 2 files changed, 58 insertions(+)
 create mode 100644 .github/codeql/codeql-config.yml
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
new file mode 100644
index 00000000..e1533192
--- /dev/null
+++ b/.github/codeql/codeql-config.yml
@@ -0,0 +1,11 @@
+# CodeQL configuration for the advanced setup in .github/workflows/codeql.yml.
+#
+# tests/ is excluded from analysis. Test contracts deliberately carry
+# credential-shaped field names and fake secrets (to prove they are refused
+# and never quoted), and CodeQL's sensitive-data heuristics treat them as
+# taint sources for alerts in production code (PR #712: alerts 308 and 310
+# were dismissed as false positives for exactly this). Production code is
+# still analysed in full, and is the only place a real secret can enter.
+name: forge-cli CodeQL
+paths-ignore:
+  - tests/**
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000..34dde7ea
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,47 @@
+# CodeQL advanced setup. It replaces GitHub's default setup (same languages,
+# same default query suite) so .github/codeql/codeql-config.yml can keep the
+# test suite out of the analysis. The default setup must be switched off in
+# the repository's code-security settings, or GitHub refuses this workflow's
+# uploads.
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "23 4 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [actions, javascript-typescript, python]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          config-file: ./.github/codeql/codeql-config.yml
+      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
+        with:
+          category: "/language:${{ matrix.language }}"

From c23bdd015bb63d3f3532c1c269e6282eef0dc0a8 Mon Sep 17 00:00:00 2001
From: Speculator55005 <50082482+fas89@users.noreply.github.com>
Date: Mon, 12 Oct 2026 18:25:20 +0200
Subject: [PATCH 2/2] ci(codeql): run the security-extended suite

The default suite keeps only the highest-precision queries. security-
extended adds lower-precision security queries (still security only; code
quality is reviewed separately on PRs). Threat models are not set: GitHub
supports them only for Java/Kotlin and C#, so a local threat model would
not change the Python analysis.
---
 .github/workflows/codeql.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 34dde7ea..7a7e63a5 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,7 +1,8 @@
-# CodeQL advanced setup. It replaces GitHub's default setup (same languages,
-# same default query suite) so .github/codeql/codeql-config.yml can keep the
-# test suite out of the analysis. The default setup must be switched off in
-# the repository's code-security settings, or GitHub refuses this workflow's
+# CodeQL advanced setup. It replaces GitHub's default setup (same languages)
+# so .github/codeql/codeql-config.yml can keep the test suite out of the
+# analysis, and it runs the security-extended suite: the default suite plus
+# lower-precision security queries. The default setup must stay off in the
+# repository's code-security settings, or GitHub refuses this workflow's
 # uploads.
 name: CodeQL
 
@@ -41,6 +42,7 @@ jobs:
         with:
           languages: ${{ matrix.language }}
           build-mode: none
+          queries: security-extended
           config-file: ./.github/codeql/codeql-config.yml
       - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
         with: