Skip to content

codeql_database_create: support custom CodeQL config file with paths-ignore for extraction exclusions #213

@data-douser

Description

@data-douser

Context

Sub-issue of #208Area 3: Python database extracts node_modules/ template files

Problem

The codeql_database_create tool's Python extractor picks up template .py files from node_modules/ (e.g. aws-cdk init templates with placeholder syntax). These produce py/syntax-error results in the analysis that are always false positives.

Approach

The codeql database analyze CLI does not have specific arguments for excluding paths. Instead, it supports a --codescanning-config flag that accepts a Code Scanning configuration file. This config file supports a paths-ignore list of file/directory paths to exclude during CodeQL dataset extraction (part of database creation).

The right approach is for the ql-mcp server to support managing and consistently referencing its own custom Code Scanning (CodeQL) config file.

From codeql database analyze -h -vv:

      --codescanning-config=<file>
                             [Advanced] Read a Code Scanning configuration file
                               specifying options on how to create the CodeQL
                               databases and what queries to run in later
                               steps. For more details on the format of this
                               configuration file, refer to https://aka.
                               ms/code-scanning-docs/config-file. To run
                               queries from this file in a later step, invoke
                               codeql database analyze without any other
                               queries specified.

Requirements

  • Add support for the ql-mcp server to manage and reference a custom CodeQL Code Scanning config file (with paths-ignore support)
  • The wrapping vscode-codeql-development-mcp-server extension (for VSIX installations) should expose extension config settings allowing the user to customize:
    1. The path of the custom CodeQL config file used by the ql-mcp server
    2. The value(s) of commonly used custom CodeQL config fields like paths-ignore
  • Default the config to exclude node_modules/ for Python and JavaScript database creation (matching CodeQL's own LGTM.com behavior)

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions