ci(codeql): move config to a file and exclude rust/cleartext-logging

[tonibergholm]

What

Code scanning had 145 open high alerts, every one of them from rust/cleartext-logging. This excludes that rule and moves the CodeQL exclusions out of the workflow's inline config: block into .github/codeql/codeql-config.yml, so each one carries its reason somewhere reviewable.

Why the rule is noise here

rust/cleartext-logging taints anything flowing out of a type or function whose name contains Secret, then flags every println!/eprintln! downstream. In this codebase that is the entire secrets API by design, so all 145 alerts landed on metadata that is public by construction:

• eprintln!("skipped (no key): {path}") — a file path (~30 alerts, across switch, sparse, ws, workspace)
• eprintln!("warning: not authorized for secret {name}; skipping") — a secret name, i.e. public registry data
• println!("{index:<3} landed @ {}", merged_tip.short()) — a snapshot id
• println!("{}", serve_tls_fingerprint(&root)?) — a cert fingerprint, which is the entire point of the command
• assert_eq!(..., "{path}: decrypts back to ...") — a test assertion message

None print plaintext. Secret plaintext has exactly one sanctioned egress — the child-process env injected by sc run (ADR-0008). There is no sc secret show; sc secret list emits names plus a recipient count. The one intentional plaintext print is sc serve token add, which prints a freshly minted token once and stores only its hash (ADR-0040).

What this exclusion costs

It would hide a genuine cleartext egress if one were ever added. That trade-off is recorded in the config file itself, along with the compensating controls: docs/THREAT-MODEL.md and the P5 commit-time secret scanner.

The critical alert

Alert #166 (rust/hard-coded-cryptographic-value at crates/crypto/src/envelope.rs:427) is let wrong = [0u8; 32]; — a deliberately-wrong key in a #[cfg(test)] negative test asserting decrypt_path rejects it. Dismissed as a false positive rather than filtered: tests are inline per CLAUDE.md, so a paths-ignore entry would also blind that rule to the real crypto in the same file. The rule stays armed for crates/crypto.

Verification

• Both YAML files parse.
• Code scanning default setup is not-configured and all recent analyses carry the workflow's /language:* categories, so the config-file will actually be honored (a config file is silently ignored under default setup).

🤖 Generated with Claude Code