# CodeQL configuration for ACE-Step-1.5
#
# This project is a local Gradio desktop application for music generation
# and LoRA/LoKr fine-tuning. It is NOT a web service exposed to the internet.
#
# CodeQL's py/path-injection query flags Gradio UI component values
# (gr.Textbox, gr.Dropdown, etc.) as "user-provided" taint sources.
# While technically the local user can edit these values, the application
# runs entirely on the user's own machine — the user IS the operator.
# There is no remote attacker surface.
#
# Additionally, all user-provided paths are validated through
# acestep.training.path_safety.safe_path() which performs
# os.path.normpath + startswith checks, but CodeQL does not recognise
# cross-function sanitisers.
#
# We therefore exclude the training and UI modules from path-injection
# analysis to suppress these confirmed false positives.

name: "ACE-Step CodeQL Config"

paths-ignore:
  # Training modules — local-only, paths validated via safe_path()
  - acestep/training
  - acestep/ui
  # Third-party vendored code
  - acestep/third_parts
  - third_party