Dismiss false-positive CodeQL alerts blocking PR #945 #955

Problem

PR #945 (main → stable) is blocked by the CodeQL check (github-advanced-security) reporting new alerts. Both are false positives.

Alert #4: py/incomplete-url-substring-sanitization (HIGH)

File: tests/infra/test_pretty_output.py:530
Code: assert "https://example.com" in text

This is a test assertion verifying that formatted hook output contains the expected URL from test fixture data. It is not performing URL sanitization.

This is the same rule that was already dismissed as alert #3 on tests/contracts/test_process_issues_contracts.py:72 (dismissed by @Trecek with reason "used in tests"). Same dismissal applies here.

Alert #6: py/clear-text-logging-sensitive-data (HIGH)

File: src/autoskillit/cli/_init_helpers.py:270
Code: print(f" {_D}{_SECRET_SCAN_BYPASS_PHRASE}{_R}\n")
Message: "This expression logs sensitive data (secret) as clear text / logs sensitive data (password) as clear text."

CodeQL flags this because the variable name contains "SECRET". The actual value is a user-facing confirmation phrase:

_SECRET_SCAN_BYPASS_PHRASE = "I accept the risk of leaking secrets without pre-commit scanning"

This is intentionally displayed to the user so they can type it back to confirm they want to bypass the pre-commit secret scanner check. It is not an actual secret, password, or credential.

Fix

Add inline CodeQL suppression comments on the flagged lines. This silences the specific rules without changing any logic:

tests/infra/test_pretty_output.py:530:

assert "https://example.com" in text  # lgtm[py/incomplete-url-substring-sanitization]

src/autoskillit/cli/_init_helpers.py:270:

print(f"  {_D}{_SECRET_SCAN_BYPASS_PHRASE}{_R}\n")  # lgtm[py/clear-text-logging-sensitive-data]

The # lgtm[rule-id] comment is the standard inline suppression syntax recognized by CodeQL. No test logic or application behavior changes needed.

Context

• Blocking PR: test #945 (main → stable promotion)
• Related: Gate api-simulator dev dependency to Linux only #954 (api-simulator Linux gating — the other PR test #945 blocker)