Exclude py/cyclic-import from CodeQL scan#234
Merged
Conversation
The rule fires on TYPE_CHECKING-gated typed-module cycles between graph and observability that do not exist at runtime (import of graph.events resolves clean). It is the broader sibling of py/unsafe-cyclic-import, already excluded here for the same reason. Pyright's reportImportCycles remains the backstop for genuine runtime cycles, so the rule adds only noise.
There was a problem hiding this comment.
Pull request overview
This PR updates the repository’s CodeQL configuration to suppress a known false-positive Python query (py/cyclic-import) in order to reduce noise from note-level “cyclic import” alerts that are already covered by pyright’s import-cycle checking.
Changes:
- Add
py/cyclic-importto.github/codeql/codeql-config.ymlquery-filtersexcludes. - Document the rationale and affected module boundary (
graph↔observability) alongside the existingpy/unsafe-cyclic-importsuppression.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
py/cyclic-importto the CodeQL config'squery-filters, clearing three note-level code-scanning alerts onmain:src/openarmature/graph/events.py:21src/openarmature/graph/observer.py:37src/openarmature/observability/correlation.py:39These are the same false-positive class the config already suppresses for the broader rule's sibling,
py/unsafe-cyclic-import: CodeQL flags the textual import shape without honoringif TYPE_CHECKING:gates. Everyobservability -> graphback-edge (correlation, tool_call, metadata) lives inside aTYPE_CHECKINGblock withfrom __future__ import annotations; the only runtime leg isgraph.eventsimporting theAttributeValuetype alias fromobservability.metadata. The back-edges never execute, soimport openarmature.graph.eventsresolves with no runtime cycle (verified locally).Consistent with the existing exclusions, pyright's
reportImportCyclesremains the backstop for genuine runtime cycles, so dropping the CodeQL rule does not lose signal. No source or runtime change.Config-only; the alerts clear on the next CodeQL analysis of
mainafter merge.