Suppress CodeQL false positives for billing report output - #21
Conversation
Reviewer's guide (collapsed on small PRs)Reviewer's GuideAdds inline CodeQL suppressions matching the existing project pattern for billing-report data that is intentionally printed or written as report output, without changing report content or control flow. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| Secrets |  |
Sep 9, 2026 9:09p.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="src/github_usage/cli.py" line_range="303-305" />
<code_context>
)
if args.dry_run:
- print(html_body if html_body is not None else body, end="")
+ print(
+ html_body if html_body is not None else body, end=""
+ ) # codeql[py/clear-text-logging-sensitive-data]
return 0
recipient = (getattr(args, "to", None) or "").strip() or os.environ.get(
</code_context>
<issue_to_address>
**issue:** The CodeQL suppression comments are attached to the closing-parenthesis lines instead of the lines containing the flagged `print`/`write` sink or its sensitive argument. CodeQL therefore does not associate these suppressions with the alerts, so the clear-text findings remain reported.
**Triggers:** When CodeQL reports the multiline calls at their opening call or argument line, as it does for Python AST locations.
**Suggested fix:** Place each `codeql[...]` comment on the sink or argument line that CodeQL reports, or use the exact suppression placement from the working precedent.
```suggestion
print( # codeql[py/clear-text-logging-sensitive-data]
html_body if html_body is not None else body, end=""
)
```
</issue_to_address>
|
| Filename | Overview |
|---|---|
| src/github_usage/cli.py | Reformats the existing dry-run print and adds a targeted CodeQL suppression without behavioral change. |
| src/github_usage/export_text.py | Reformats the existing report write and suppresses clear-text logging and storage findings without changing output. |
| src/github_usage/report_products.py | Adds a CodeQL suppression to an existing billing-savings print statement. |
| src/github_usage/report_summary.py | Reformats an existing discount summary print and adds a CodeQL suppression. |
| src/github_usage/report_summary_insights.py | Adds a CodeQL suppression to existing impactful-finding output. |
| uv.lock | Updates the locked pip artifact from 26.1.2 to 26.2 with corresponding hashes. |
Reviews (1): Last reviewed commit: "Suppress CodeQL false positives for bill..." | Re-trigger Greptile
|
1 participant
Add inline CodeQL suppression comments for false-positive clear-text logging/storage alerts on intentional billing-report output.
These are false positives: the code prints aggregate billing data (totals, discounts, repo usage breakdowns), not secrets or credentials.
Changes:
Next step: manually dismiss the 6 open CodeQL alerts as "False positive" in the GitHub Security tab, referencing these suppressions. Automatic dismissal via workflow is not recommended for this repo because the default CodeQL setup does not emit SARIF suppressions, and a correct auto-dismiss workflow would require Advanced setup.