chore(security): scope CodeQL to shipped product code

[debpalash]

Scope CodeQL to shipped product code

CodeQL reports 459 open alerts on main (the Security tab's "100" is just first-page truncation). After triaging every group, the headline (1 critical + 58 high) is dominated by non-shipped code and design-correct false positives — there is no remotely-exploitable issue in default loopback mode.

This PR removes the largest, cleanest chunk: alerts in code that never ships in the installer's runtime path.

Change

A single CodeQL config addition (paths-ignore, valid here because build-mode: none = interpreted analysis), scoping analysis to product code:

paths-ignore:
  - omnivoice/eval        # offline eval harnesses (file-not-closed cluster)
  - research              # incl. legacy_gradio (path-injection FPs)
  - tests                 # bind-all in test fixtures, side-effect asserts
  - backend/migrations    # alembic boilerplate (unused-global FPs)
  - "**/*.test.{js,jsx,ts,tsx}"

security-and-quality queries move into the inline config so there's one source of truth. No product code changes. On the next scan, the excluded-tree alerts auto-resolve.

Deliberately NOT done (assessed against this app's threat model)

• Stack-trace-exposure (detail=str(e) across ~15 routers): these are the intentional, helpful one-line diagnostics from the error-transparency work (b64f53b). On a loopback/single-user app, genericizing them would regress a product value for ~zero benefit.
• "Critical" command-injection (exports.py:73) + high path-injections (settings.py, system.py FFMPEG_PATH): design-correct FPs — list-form argv (no shell), and the destination / model-dir / ffmpeg paths are arbitrary user-chosen paths by design (the native save/picker dialog). Containment guards would break the features. The right tool for these is dismiss-with-justification, not code surgery.

Remaining after this merge

The in-product FPs (10 zustand superfluous-trailing-arguments from the documented (set, get, api) pattern, plus the design-correct path/cmd sinks above) are best dismissed with justification — happy to do that as a follow-up.

Verified: security.yml + the embedded CodeQL config both parse as valid YAML.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated security scanning workflow configuration to optimize code analysis coverage by refining repository scoping rules.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: c3e47ef3-9d84-4cd2-ad85-11f6551524e2

📥 Commits

Reviewing files that changed from the base of the PR and between 672f106 and 2732939.

📒 Files selected for processing (1)

• .github/workflows/security.yml

---

📝 Walkthrough

Walkthrough

This PR refines the CodeQL security analysis scope by expanding the workflow configuration to exclude test, evaluation, research, and migration code paths. The init action config now pairs query selection with explicit path-ignore rules that direct analysis toward production code.

Changes

CodeQL Security Scanning Configuration

Layer / File(s)	Summary
CodeQL paths exclusion configuration .github/workflows/security.yml	The github/codeql-action/init config extends from a queries-only setup to add paths-ignore rules that exclude omnivoice/eval, research, tests, backend/migrations directories and JS/TS test file globs (**/*.test.{js,jsx,ts,tsx}), with inline comments clarifying the intent to focus analysis on production code paths.

---

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description provides detailed context (459 alerts, triage findings, threat model assessment) and explains the single-line YAML config change, but omits required template sections like Summary, Changes list, Type checkbox, Testing, and Checklist.	Add the missing template sections: populate Summary, Changes, Type (select 🔧 CI/Build), Testing, and complete the Checklist items to meet repository standards.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'chore(security): scope CodeQL to shipped product code' directly and clearly describes the main change: configuring CodeQL to analyze only shipped product code by excluding non-product paths.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/codeql-scope-shipped-code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[greptile-apps]

Greptile Summary

This PR scopes the CodeQL SAST workflow to shipped product code by replacing the bare queries: security-and-quality key with an inline config: block that adds paths-ignore entries for offline eval harnesses, research experiments, the test tree, Alembic migration boilerplate, and *.test.* JS/TS files. No production code is changed.

• The queries key moves into the inline config, keeping it co-located with paths-ignore — a clean single-source-of-truth approach that is valid for build-mode: none (interpreted) analysis.
• The excluded directories (omnivoice/eval, research, backend/migrations) are clearly non-shipped; tests and the glob patterns follow the same rationale, though .spec.* files and co-located Python test_*.py files outside the tests/ root are not covered by the new exclusions.

Confidence Score: 4/5

Safe to merge — the change is CI-only, touches no production code, and the exclusion rationale is well-documented and accurate.

The inline config is syntactically valid, the paths-ignore entries match their stated intent, and moving queries into the config block is the correct pattern for build-mode: none. The two minor gaps — .spec.* frontend test files and co-located Python test_*.py files — won't cause false negatives in production-code analysis; they'd only leave some test-file noise unreduced.

.github/workflows/security.yml is the only changed file; the exclusion patterns are worth a quick spot-check against the actual directory structure to confirm no .spec.* or co-located test_*.py files fall outside the covered paths.

Important Files Changed

Filename	Overview
.github/workflows/security.yml	Switches CodeQL from a top-level queries key to an inline config: block that adds paths-ignore to scope analysis to shipped product code; excludes eval harnesses, research, tests, migrations, and *.test.* JS/TS files.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[CodeQL Init] --> B{Inline config block}
    B --> C[queries: security-and-quality]
    B --> D[paths-ignore]
    D --> E[omnivoice/eval\noffline eval harnesses]
    D --> F[research\nlegacy Gradio / experiments]
    D --> G[tests\ntest fixtures]
    D --> H[backend/migrations\nAlembic boilerplate]
    D --> I["**/*.test.{js,jsx,ts,tsx}"\nfrontend test files]
    C --> J[Analyze step]
    J --> K[Security tab alerts\nlimited to shipped product code]

Loading

_{Reviews (1): Last reviewed commit: "chore(security): scope CodeQL to shipped..." | Re-trigger Greptile}

[greptile-apps]

.spec.* test files not excluded

The four patterns only cover *.test.{js,jsx,ts,tsx}. If any frontend tests use the .spec. naming convention (common in Vitest/Playwright setups), those files will still be analysed. If they contain the same "bind-all in fixtures" pattern you're eliminating from tests/, you'd still see noise from them. Worth adding **/*.spec.js, **/*.spec.jsx, **/*.spec.ts, **/*.spec.tsx if the project uses that convention, or verifying that no .spec.* files exist outside the already-excluded tests/ directory.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[greptile-apps]

Python test files outside tests/ not excluded

The tests entry only covers the top-level tests/ directory. Python projects commonly co-locate test files alongside source as test_*.py or *_test.py (e.g. backend/api/test_routes.py). If any such files exist outside the tests/ tree, they'll remain in scope and can still contribute the bind-all or side-effect-assert findings you're trying to remove. A supplementary **/test_*.py pattern would close this gap.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!