From 78bd6230649aee3f7731ffbce603742f31c2295e Mon Sep 17 00:00:00 2001
From: hathach <thach@tinyusb.org>
Date: Tue, 28 Oct 2025 17:56:07 +0700
Subject: filter out sarif for codeql hw/mcu and lib/

---
 .github/workflows/static_analysis.yml | 43 ++++++++++++-----------------------
 1 file changed, 15 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/static_analysis.yml b/.github/workflows/static_analysis.yml
index 5d2a6c962..7e74f77ce 100644
--- a/.github/workflows/static_analysis.yml
+++ b/.github/workflows/static_analysis.yml
@@ -65,36 +65,23 @@ jobs:
         uses: github/codeql-action/analyze@v4
         with:
           category: CodeQL
-          upload: always
+          upload: false
         id: analyze
 
-#      - name: Filter out unwanted errors and warnings
-#        uses: advanced-security/filter-sarif@v1
-#        with:
-#          patterns: |
-#            -**:cpp/path-injection
-#            -**:cpp/world-writable-file-creation
-#            -**:cpp/poorly-documented-function
-#            -**:cpp/potentially-dangerous-function
-#            -**:cpp/use-of-goto
-#            -**:cpp/integer-multiplication-cast-to-long
-#            -**:cpp/comparison-with-wider-type
-#            -**:cpp/leap-year/*
-#            -**:cpp/ambiguously-signed-bit-field
-#            -**:cpp/suspicious-pointer-scaling
-#            -**:cpp/suspicious-pointer-scaling-void
-#            -**:cpp/unsigned-comparison-zero
-#            -**/third*party/**
-#            -**/3rd*party/**
-#            -**/external/**
-#          input: ${{ steps.analyze.outputs.sarif-output }}/cpp.sarif
-#          output: ${{ steps.analyze.outputs.sarif-output }}/cpp.sarif
-#
-#      - name: Upload SARIF
-#        uses: github/codeql-action/upload-sarif@v4
-#        with:
-#          sarif_file: ${{ steps.analyze.outputs.sarif-output }}
-#          category: CodeQL
+      - name: Filter SARIF report
+        uses: advanced-security/filter-sarif@v1
+        with:
+          patterns: |
+            -hw/mcu/**
+            -lib/**
+          input: ${{ steps.analyze.outputs.sarif-output }}/cpp.sarif
+          output: ${{ steps.analyze.outputs.sarif-output }}/cpp.sarif
+
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: ${{ steps.analyze.outputs.sarif-output }}
+          category: CodeQL
 
       - name: Upload artifact
         uses: actions/upload-artifact@v5
-- 
cgit v1.3.1