From a17cd877e45d7b11b0d015df282d14aef4608162 Mon Sep 17 00:00:00 2001
From: Krzysztof Liszankowski <39725441+Torgh@users.noreply.github.com>
Date: Mon, 26 Oct 2026 17:42:38 +0100
Subject: [PATCH] CodeQL: drop alerts in node_modules

The Java analysis builds the APK, so it also compiles Capacitor's sources from
node_modules and reported a java/xss in Capacitor's MessageHandler. paths-ignore
has no effect on compiled languages, so the results in node_modules are filtered
out of the SARIF before it is uploaded.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/codeql.yml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 35367a4..5c97f1c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -63,6 +63,20 @@ jobs:
           cd mobile/android
           sh ./gradlew assembleDebug --no-daemon
 
+      # Alerts only for our code: the build compiles Capacitor's Java from node_modules, and
+      # paths-ignore has no effect on compiled languages, so its results are dropped here.
       - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           category: /language:${{ matrix.language }}
+          upload: never
+          output: sarif-results
+      - name: Drop results in dependencies
+        run: |
+          for f in sarif-results/*.sarif; do
+            jq '.runs[].results |= map(select(any(.locations[]?; .physicalLocation.artifactLocation.uri | startswith("node_modules/")) | not))' "$f" > "$f.tmp"
+            mv "$f.tmp" "$f"
+          done
+      - uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          sarif_file: sarif-results
+          category: /language:${{ matrix.language }}