-
Notifications
You must be signed in to change notification settings - Fork 2
codeql_database_create: support custom CodeQL config file with paths-ignore for extraction exclusions #213
Description
Context
Sub-issue of #208 — Area 3: Python database extracts node_modules/ template files
Problem
The codeql_database_create tool's Python extractor picks up template .py files from node_modules/ (e.g. aws-cdk init templates with placeholder syntax). These produce py/syntax-error results in the analysis that are always false positives.
Approach
The codeql database analyze CLI does not have specific arguments for excluding paths. Instead, it supports a --codescanning-config flag that accepts a Code Scanning configuration file. This config file supports a paths-ignore list of file/directory paths to exclude during CodeQL dataset extraction (part of database creation).
The right approach is for the ql-mcp server to support managing and consistently referencing its own custom Code Scanning (CodeQL) config file.
From codeql database analyze -h -vv:
--codescanning-config=<file>
[Advanced] Read a Code Scanning configuration file
specifying options on how to create the CodeQL
databases and what queries to run in later
steps. For more details on the format of this
configuration file, refer to https://aka.
ms/code-scanning-docs/config-file. To run
queries from this file in a later step, invoke
codeql database analyze without any other
queries specified.
Requirements
- Add support for the
ql-mcpserver to manage and reference a custom CodeQL Code Scanning config file (withpaths-ignoresupport) - The wrapping
vscode-codeql-development-mcp-serverextension (for VSIX installations) should expose extension config settings allowing the user to customize:- The path of the custom CodeQL config file used by the
ql-mcpserver - The value(s) of commonly used custom CodeQL config fields like
paths-ignore
- The path of the custom CodeQL config file used by the
- Default the config to exclude
node_modules/for Python and JavaScript database creation (matching CodeQL's own LGTM.com behavior)