name: "Octop CodeQL"

# Upstream connectors that must SHA-256 secrets for protocol request signing
# (not password storage). GHAS does not reliably honor inline # codeql[...]
# suppressions, so exclude these modules like the Fliggy adapter.
paths-ignore:
  - src/octop/infra/connectors/gateway/adapters/fliggy.py
  - src/octop/infra/connectors/gateway/wecom_creds.py