name: "MCP Memory Service CodeQL Config"

# Paths to exclude from analysis (reduces false positives)
paths-ignore:
  - 'tests/**'              # Test files
  - 'archive/**'            # Archived code
  - 'docs/**'               # Documentation
  - 'scripts/**'            # Utility scripts
  - '.worktrees/**'         # Git worktrees
  - 'examples/**'           # Example code
  - '**/__pycache__/**'     # Python cache
  - '**/node_modules/**'    # Node modules (if any)

# Paths to always include (even if in exclude patterns)
paths:
  - 'src/mcp_memory_service/**'

# Query suites to run
queries:
  - uses: security-and-quality  # Comprehensive security + code quality checks

# Disable specific queries that cause false positives
disable-default-queries: false

# Suppress false positives
query-filters:
  - exclude:
      id: py/clear-text-storage-of-sensitive-data  # .env files are clear-text by design
  - exclude:
      id: py/ssrf  # account_id validated to [a-f0-9]{32} before URL construction
