fix(ci): scope the code scan instead of annotating it, and drop a duplicated MCP constant block

[lusoris]

Summary

CodeQL is not off. It analysed refs/heads/master at 2026-09-07T06:52:38Z
with 57 results; Semgrep uploads both its SARIF categories on every master push;
code-scanning/default-setup reporting not-configured is correct, because
the repo uses the advanced workflow and the two are mutually exclusive.

The 20 alerts never clear for two mechanical reasons, neither of which is
visible from the code.

1. # nosemgrep does not remove a result from the SARIF

Semgrep's docs: a nosemgrep comment "still generates findings records that
are automatically set to Ignored triage state, rather than excluding code
from scanning entirely." That triage state lives on the Semgrep platform. This
workflow writes SARIF and hands it to upload-sarif, so GitHub sees a result
and keeps the alert open.

Four alerts sit on correct, already-annotated code for this reason: three
SHA-1 memoisation cache keys in compat/python-vmaf/tools/decorator.py that
already pass usedforsecurity=False, and an 0o660 Unix-domain socket in
ai/sidecar/online_trainer.py shared with a same-group Go peer. Writing more
nosemgrep directives will never close them.

2. paths-ignore is inert for compiled languages that are built

GitHub limits paths / paths-ignore to interpreted languages and to compiled
languages analysed without building. The CodeQL job builds C/C++ with meson

• ninja, so every translation unit it compiles is extracted regardless — which
  is why core/test is listed in paths-ignore and still produces alerts.

Compounding it, a bare build matches only a top-level directory. The
fork's build trees are core/build, core/build-cuda, … — which is how alert
1018 landed on core/build/meson-private/tmpu2z1n35e/testfile.c, a probe file
meson generates to test compiler features.

Fixed here: paths-ignore becomes **/build, **/build-*, **/builddir,
and the config records the built-language limitation inline with the doc link so
the next reader doesn't add entries expecting them to work.

The one alert that pointed at a real defect

py/unused-global-variable flagged _VALID_AOM_CTCS / _VALID_NFLX_CTCS in
mcp-server/.../server.py. Following it upstream found a duplicated constant
block:

Name	Defined at	Values
_VALID_TINY_DEVICES	375 and 504	identical
_VALID_TINY_RESIZES	389 and 518	identical
_VALID_BACKENDS	391 and 523	identical
_VALID_PIXFMTS	392 and 521	identical
_VALID_BITDEPTHS	393 and 522	identical
_VALID_AOM_CTCS / _VALID_AOM_CTC	373 / 519	identical, only the singular is read
_VALID_NFLX_CTCS / _VALID_NFLX_CTC	374 / 520	identical, only the singular is read

CodeQL could only see the two whose names differ. The other five are shadowed
rebindings — the second definition silently wins, so adding a backend at line
391 would have changed nothing. Values agree today, so there is no live wrong
behaviour; it is a trap that surfaces later as "I added it and it didn't take
effect". The dead block is removed and _VALID_OUTPUT_FMTS, the one live name
in it, is folded into the canonical block.

Reproducer / smoke test

# 1. the scanners are running on master
gh api "repos/VMAFx/vmafx/code-scanning/analyses?ref=refs/heads/master&per_page=10" \
  -q '.[]|"\(.created_at) \(.tool.name) cat=\(.category) results=\(.results_count)"'

# 2. no duplicate or unused _VALID_* names remain
cd mcp-server/vmaf-mcp && python3 - <<'PY'
import ast, re, pathlib
src = pathlib.Path("src/vmaf_mcp/server.py").read_text()
defs = {}
for n in ast.parse(src).body:
    tg = n.targets if isinstance(n, ast.Assign) else ([n.target] if isinstance(n, ast.AnnAssign) else [])
    for t in tg:
        if isinstance(t, ast.Name) and t.id.startswith("_VALID_"):
            defs.setdefault(t.id, []).append(n.lineno)
assert not {k: v for k, v in defs.items() if len(v) > 1}, "duplicate definitions"
assert not [k for k in defs if len(re.findall(r"\b%s\b" % k, src)) < 2], "unused"
print("ok:", len(defs), "constants, no duplicates, none unused")
PY

# 3. the MCP suite is unchanged
python3 -m pytest tests -q

318 passed, 42 skipped. The 3 failures in test_score_extras_adr1117.py are
pre-existing on master — verified by running the same file on a pristine
origin/master checkout, which fails identically. They come from the path
allowlist being checked before parameter validation when the repo sits at a
non-allowlisted root; unrelated to this change and left alone.

No alert was dismissed

Every remaining alert has a written disposition in the ADR's table — 1005 is
deliberately unfixed (widening the multiply breaks the ADR-0138 bit-exactness
invariant, and the overflow is unreachable), 1002/1003 and 951 are query false
positives, 168/927, 908/943/955, 917/918, 946 and 947–949 are correct as
written, and 1/3 are Scorecard repo-process metrics. Per the standing project
rule, agents analyse and fix; dismissal is the maintainer's call. The ADR
also lays out the two options that would actually clear the "correct as written"
alerts — a SARIF post-processing allowlist, or manual dismissal — and takes
neither.

Deep-dive deliverables (ADR-0108)

• Research digest — docs/research/2039-why-code-scanning-alerts-never-clear.md: both mechanisms with the doc quotes, the shadowed-constant table, and the four generalisable points.
• Decision matrix — docs/adr/1222-code-scanning-alert-triage-and-scope.md ## Alternatives considered (five options; the runner-up "post-process the SARIF" is a dismissal mechanism in different clothes and is left to the maintainer).
• AGENTS.md invariant note — no rebase-sensitive invariants: this touches .github/codeql-config.yml and a fork-local MCP module, neither of which the upstream rebase story reads.
• Reproducer / smoke-test command — see the Reproducer section above.
• CHANGELOG fragment — changelog.d/fixed/1222-code-scanning-scope.md.
• Rebase note in docs/rebase-notes.md — entry ADR-1222 — code-scanning scope, not code-scanning annotations (2026-09-07).

Docs (rule 10)

• no docs needed: no user-discoverable surface changes. The CodeQL config and the removed constants are internal; the reasoning that a future maintainer needs lives in the ADR and the digest.

Bug status (rule 13 / ADR-0165)

• docs/state.md — closes T-CODE-SCANNING-ALERTS-NEVER-CLEAR-2026-09-07.

🤖 Generated with Claude Code