name: Sim CodeQL config

# Trims the extraction surface. CodeQL parses every matching file into a
# database before a single query runs, and that phase dominates runtime on a
# ~12.7k-file JS/TS tree. Test and fixture code is not attacker-reachable, so
# excluding it costs no real coverage.
#
# paths-ignore applies to analysis. The workflow's `on.pull_request.paths`
# filter is separate and decides whether the run happens at all.
paths-ignore:
  - '**/*.test.ts'
  - '**/*.test.tsx'
  - '**/*.test.js'
  - '**/*.spec.ts'
  - '**/*.spec.tsx'
  - '**/__tests__/**'
  - '**/__mocks__/**'
  - '**/__fixtures__/**'
  - '**/e2e/**'
  # Deliberately no '**/test/**' or '**/tests/**'. A directory named `test` is a
  # routable Next.js path segment, not necessarily test code: those globs
  # excluded the real endpoint
  # apps/sim/app/api/organizations/[id]/data-drains/[drainId]/test/route.ts,
  # which authorizes, decrypts destination credentials, and makes an outbound
  # request. CodeQL's paths-ignore has no `!` negation to carve it back out
  # ("The filter pattern characters ?, +, [, ], and ! are not supported and will
  # be matched literally"), and the globs only covered 76 of 12,716 files, so
  # the naming convention above is the safer filter.
  - '**/*.d.ts'
  - '**/node_modules/**'
  - '**/dist/**'
  - '**/.next/**'
  - 'apps/docs/content/**'