GHA CI: Filter out scan results from 3rd party codebases

[sledgehammer999]

Uses filter-sarif action

This is an attempt to reign in the verbosity of the github-advanced-security bot (AI).
AFAIK this bot is part of GitHub Advanced Security, which is normally a paid feature, but is automatically enabled on some public repos (including ours).

If anyone has better information on how to achieve the stated goal, please advise.

PS: I don't know how we can test if this works without merging it.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[glassez]

PS: I don't know how we can test if this works without merging it.

What if you create a separate test branch containing these changes? Then I could create an analog of the affected PR for this branch.

[sledgehammer999]

What if you create a separate test branch containing these changes? Then I could create an analog of the affected PR for this branch.

Here you go: https://github.com/qbittorrent/qBittorrent/tree/codeql_sarif

[glassez]

What if you create a separate test branch containing these changes? Then I could create an analog of the affected PR for this branch.

Here you go: https://github.com/qbittorrent/qBittorrent/tree/codeql_sarif

Seems it no more complains about 3rd party code 👍

[sledgehammer999]

@Chocobo1 when clicking "View details" on the CI result of CodeQL, there is a warning which I don't understand at all. Any ideas?

[Chocobo1]

@Chocobo1 when clicking "View details" on the CI result of CodeQL, there is a warning which I don't understand at all. Any ideas?

Sorry no idea. Maybe it is just a transient error?

[Chocobo1]

@Chocobo1 when clicking "View details" on the CI result of CodeQL, there is a warning which I don't understand at all. Any ideas?

@sledgehammer999
I figured it out. That warning is because you changed the category here from master to master lt 2.0.12 and master lt 2.1.0-rc1. The scan results is missing for the master category.
I would suggest just keep using master to simplify things as there is no such need to differentiate libtorrent versions. I'll prepare a PR to handle this.