paths-ignore doesn't seem to work

[huangminchn]

Hi team,

I added a customized config file to ask for ignoring 3 files: linkedin/venice@3ee4b75
but it appears that CodeQL still scans them and reports; am I doing anything wrong here? Any help will be highly appreciated!

Thanks!

[smowton]

I'm afraid that setting only takes effect for languages that scan for all files in your repository (JavaScript, Python, Ruby (see https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/customizing-code-scanning#specifying-directories-to-scan)). Java analysis works by following along with your build process, so if you want to exclude particular files from analysis you need to specify a build process that does not build those files.

[aibaars]

Another approach is to use the advanced-security/filter-sarif Action to filter out results before reporting them.

[evelikov]

Perhaps the CodeQL team can add a post-scanning filtering similar to the one linked?

It would be amazing if we don't need a third-party action, or more importantly options like path/path-ignore are generic and independent of the language used.

[smowton]

Actually since this issue was created, Java analysis using build-mode: none will now obey instructions given using the paths and paths-ignore options. C# has also gained similar functionality; other languages that gain support for build-mode: none in the future are expected to behave similarly.

Note that at least for Java, it is necessary to specify a subset of files that could be compiled together (e.g., if type A uses type B and we include the file defining type A, then we must include the file defining type B). If this is not done, analysis will still run but will be of lower quality due to not recognising the types of certain expressions and the targets of certain function calls or field accesses.

[nmargono]

@smowton am trying to do what you just described using the codeql client for our Java project; mostly to exclude target/ folders -- I did this via codeql-config.yml file. But, am not quite sure that it's working -- is there a way to validate? If I set it to verbose mode, will there be a log like "Skipping target/ directory..."?

Thanks for your help in advance!

[kevinli-webbertech]

Hi there,

The following double quote or single quote will break my container, saying not valid yml. Any idea? I would like to just exclude a few single files.

name: "Custom CodeQL Configuration"
queries:
  - uses: security-and-quality
paths-ignore:
  - "src/js/something.bundle.js"
  - src/webapp/assets/
  - target/

I tried - "src/js/*.bundle.js", it does not work either.

[aeisenberg]

@kevinli-webbertech, can you please create a new issue for this? Include the relevant snippets in your logs and a link to the workflow run (if this is a public repository).

[kevinli-webbertech]

Thanks Andrew! I am going to double check my statement is true and if it still stays true, I will file another one for sure!