From 247152af9471b4dc22dcde7bca30996f416bedba Mon Sep 17 00:00:00 2001 From: chris-colinsky Date: Thu, 23 Jul 2026 12:54:35 -0700 Subject: [PATCH] Exclude py/cyclic-import from CodeQL scan The rule fires on TYPE_CHECKING-gated typed-module cycles between graph and observability that do not exist at runtime (import of graph.events resolves clean). It is the broader sibling of py/unsafe-cyclic-import, already excluded here for the same reason. Pyright's reportImportCycles remains the backstop for genuine runtime cycles, so the rule adds only noise. --- .github/codeql/codeql-config.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml index 909e9d4e..331eb9aa 100644 --- a/.github/codeql/codeql-config.yml +++ b/.github/codeql/codeql-config.yml @@ -68,3 +68,23 @@ query-filters: # the CodeQL rule doesn't lose signal. - exclude: id: py/unsafe-cyclic-import + # ``py/cyclic-import`` is the broader sibling of + # ``py/unsafe-cyclic-import`` (above) and fires on the same + # false-positive class: TYPE_CHECKING-gated typed-module cycles + # that do not exist at runtime. The current instances are the + # ``graph`` <-> ``observability`` typing boundary: + # + # - ``observability/correlation.py``, ``observability/tool_call.py``, + # and ``observability/metadata.py`` import graph event/observer + # types only inside ``if TYPE_CHECKING:`` blocks (with + # ``from __future__ import annotations``), while ``graph/events.py`` + # imports the ``AttributeValue`` type alias from + # ``observability.metadata`` at runtime. The back-edges never + # execute, so ``import openarmature.graph.events`` resolves with + # no runtime cycle (verified). + # + # As with ``py/unsafe-cyclic-import``, pyright's + # ``reportImportCycles`` covers the genuine runtime-cycle cases at + # type-check time, so dropping the CodeQL rule doesn't lose signal. + - exclude: + id: py/cyclic-import