chore: adopt buildless CodeQL analysis (Standards §4.4) - #33
Merged
Conversation
Auth's codeql.yml predated the revised canonical workflow (standards PR #21), so the standards audit's 3.0.1 (workflow content) check was failing for this repo. Adopt the canonical codeql.yml verbatim: move the init step to `build-mode: none` and drop the explicit Setup .NET / Restore / Build steps. This is load-bearing, not a simplification. GitHub honours the `paths-ignore` filter only under buildless extraction — under a compiled build every file the compiler sees is analysed, obj/ included, so this repo's `**/obj/**` exclusion was silently inert and the xUnit auto-generated entry point in obj/ was being analysed. Buildless extraction also reads every TFM at once, where autobuild could pick a single TFM and analyse half the code. Query coverage is unchanged: security-and-quality still runs, the two P/Invoke audit queries stay excluded via query-filters. No open code-scanning alerts. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
StuartMeeks
added a commit
that referenced
this pull request
Aug 22, 2026
#34) The corrected buildless CodeQL analysis (adopted in #33) surfaced a cs/dereferenced-value-may-be-null alert on FileCredentialManager.cs: the provider-match guard was written `credential?.ProviderName.Equals(…) == true`, and CodeQL's flow analysis does not narrow `credential` to non-null through the `?.… == true` idiom, so the dereferences in the block body read as potential null accesses. The code was already safe (a null credential makes the guard false), but the guard is rewritten to `credential is not null && …` so the null state flows into the block — the whole body dereferences `credential` — letting both the compiler and CodeQL prove it safe. Behavior is unchanged. Build clean (0 warnings, TreatWarningsAsErrors on); 334 tests pass on net8.0 and net10.0. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adopts the revised canonical
codeql.yml(NextIteration.Standards PR #21) so this repo passes the standards audit's 3.0.1 (workflow content) check, which was the only failing clause for Auth.build-mode: none.Setup .NET,Restore, andBuildsteps.templates/.github/workflows/codeql.yml.Why it's load-bearing, not a cleanup
GitHub applies the
paths-ignorefilter only under buildless extraction. Under a compiled build, every file the compiler sees is analysed —obj/included — so this repo's existing**/obj/**exclusion was silently inert and the xUnit auto-generated entry point inobj/was being analysed. Buildless extraction honours the filter, and also reads every target framework at once (autobuild could pick a single TFM and analyse half the code).Code scanning
Checked before and after: no open code-scanning alerts. The 30
cs/call-to-unmanaged-codefindings are alldismissed, and their queries stay excluded viaquery-filters— genuine native interop, no code change resolves them. Query coverage (security-and-quality) is otherwise unchanged, so nothing real is dropped.Verification
NextIteration.Standards/scripts/audit-drift.sh— Auth's3.0.1 workflow contentflips FAIL → PASS; all 32 clauses now green for Auth.🤖 Generated with Claude Code