ci(codeql): honor alert suppression comments (#3745)

Author: jiparis

.github/workflows/codeql.yml

@@ -66,6 +66,9 @@ jobs:
         uses: github/codeql-action/init@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8
         with:
           languages: ${{ matrix.language }}
+          # The alert suppression query marks the alerts that a `// codeql[<query-id>]`
+          # comment covers with a SARIF suppressions field. The default queries still run.
+          packs: codeql/go-queries:AlertSuppression.ql
 
       - name: Autobuild
         uses: github/codeql-action/autobuild@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8

app/controlplane/internal/service/casredirect.go

@@ -308,5 +308,6 @@ func (s *CASRedirectService) setDownloadVerifierCookie(w http.ResponseWriter, fl
 		cookie.MaxAge = -1
 		cookie.Expires = time.Unix(1, 0)
 	}
+	// codeql[go/cookie-secure-not-set] Secure is true, and false only in development mode.
 	http.SetCookie(w, cookie)
 }

internal/redaction/redaction.go

@@ -597,6 +597,7 @@ func (w *rewriter) redactLeaf(s, path string) string {
 	w.count += n
 
 	var out string
+	// codeql[go/unsafe-quoting] body is escaped by encodeStringBody, and the sink is a JSON decode.
 	if err := json.Unmarshal([]byte(`"`+body+`"`), &out); err != nil {
 		// A replacement cut through a JSON escape sequence. Drop the whole leaf
 		// rather than risk leaving part of the secret behind.