.codacy.yaml

# Codacy's in-repo config can only exclude paths -- it cannot disable individual patterns (dashboard-only).
# These paths carry findings the repo already covers elsewhere or has consciously decided against:
# - config/semgrep/: our Semgrep rule files; Codacy's own Semgrep misfires on the `- id:` each rule declares.
# - dotnet-data1/Program.cs: Codacy's CA1054 wants URI-typed params, but [JSImport] partial methods can only
#   marshal `string` across the JS boundary; DeepSource covers the C# there and reports no such issue.
# - .github/workflows/ + .github/actions/: Codacy flags GitHub Actions `uses:` not pinned to a commit SHA, but
#   this repo deliberately pins actions by tag (config/zizmor.yaml turns off zizmor's matching hash-pin policy for
#   the same reason). Workflows + composite actions are already linted by actionlint, zizmor, action-validator, the
#   ast-grep gha rules, and the gha* conftest policies; since Codacy cannot disable an individual pattern in-repo,
#   excluding these trees is the only way to silence its pin rule globally.
# - AGENTS.md: Codacy's prose rules (undefined-acronym, absolute-rule-without-escape-hatch) fight this
#   agent-instructions doc, which is imperative and full of deliberate absolutes ("NEVER ...", "ALWAYS ...") by
#   design; dprint + typos + editorconfig already lint it, so Codacy adds only false positives here.
# - services/ws-web-runner/mingw-shim/msvc_crt_alloc.c: MISRA-21.3-unavoidable heap-allocation code Codacy cannot
#   suppress per line; isolated into that one file so this exclude stays minimal. Full rationale lives in the
#   file's own header comment (its canonical home, since more than one analyzer config may exclude the same file).
# - services/ws-web-runner/mingw-shim/msvc_crt_locale_cache.c: the locale wrappers' write-once symbol caches, which
#   Codacy's "Local static variable" rule flags for audit and cannot suppress per line. Isolated into that one file
#   so this exclude stays minimal; rationale in its header. The ucrt_resolve_once resolver it calls stays analyzed.
# - libs/wasi-guest/src/coverage.rs: the WASI guests' shared minicov coverage dump, whose unsafe Codacy flags for
#   audit and cannot suppress per line. Isolated into that one-function file so the exclude stays minimal;
#   rationale in its header. The rest of the crate, and every guest depending on it, stays analyzed.
# - services/ws-test-server/src/bin/cov-server.rs: the wasm-agent-cov launcher reads its marker-file path from
#   argv (args_os); Codacy's Rust security rule flags args_os-into-a-file-operation and cannot suppress per line.
#   A false positive -- the path comes from the trusted mise task -- and taking it as an argument beats hardcoding
#   one. Already this one minimal file; rationale lives in its header. Still covered by clippy + DeepSource Rust.
# - utilities/wasm-cov-wrapper/src/main.rs: a RUSTC_WORKSPACE_WRAPPER that reads its own argv (args_os) and forwards
#   it to rustc; Codacy's Rust security rule flags args_os-into-a-subprocess as a command-injection shape and cannot
#   suppress per line. It is a false positive -- the args are cargo's own trusted rustc invocation -- and forwarding
#   argv to rustc is the whole file's purpose, so no code change removes it. The crate is already this one minimal
#   file; rationale lives in its header. Still covered by clippy + DeepSource Rust.
# - uv.lock: the uv workspace's machine-generated dependency lock. Codacy's line-count metric flags its 500+ rows,
#   but it is not hand-authored source and has nothing to review; the other lock files are well-known names Codacy
#   already skips, whereas uv.lock is new enough that it isn't on that list yet.
# - utilities/cli/src/hub_ws_url.rs: the only `ws://` scheme et-cli writes, which Codacy's "Insecure WebSocket
#   Detected" rule flags and cannot suppress per line. Isolated into that two-function file so this exclude stays
#   minimal; rationale in its header. Every other line of the generators stays analyzed.
# - verification/{local,published}/output/*/k3s.yaml: the same finding in the manifests that file's output reaches,
#   which are generated rather than hand-authored so they can hold no marker of their own. Only these manifests are
#   excluded, not the scenario trees around them, and the Kubernetes security rules Codacy would otherwise apply to
#   them are covered before push by trivy-check (the same KSV ruleset) plus kubeconform-check.
exclude_paths:
  - ".github/actions/**"
  - ".github/workflows/**"
  - "AGENTS.md"
  - "config/semgrep/**"
  - "services/ws-modules/dotnet-data1/Program.cs"
  - "libs/wasi-guest/src/coverage.rs"
  - "services/ws-test-server/src/bin/cov-server.rs"
  - "services/ws-web-runner/mingw-shim/msvc_crt_alloc.c"
  - "services/ws-web-runner/mingw-shim/msvc_crt_locale_cache.c"
  - "utilities/cli/src/hub_ws_url.rs"
  - "utilities/wasm-cov-wrapper/src/main.rs"
  - "uv.lock"
  - "verification/local/output/*/k3s.yaml"
  - "verification/published/output/*/k3s.yaml"