Configure CodeQL to exclude test directories from security scanning

.github/codeql-config.yml

@@ -0,0 +1,21 @@
+# CodeQL Configuration
+# This configuration excludes test directories from CodeQL security scanning
+# to focus analysis on production code and reduce noise from test files.
+#
+# For more information, see:
+# - https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#excluding-directories-from-code-scanning
+# - https://github.com/github/codeql-action
+
+name: "CodeQL Config for xAPI Java"
+
+# Exclude test directories from analysis
+paths-ignore:
+  - "**/src/test/**"
+  - "**/test/**"
+  - "**/*Test.java"
+  - "**/*Tests.java"
+
+# Additional paths to ignore (build outputs, dependencies)
+  - "**/target/**"
+  - "**/build/**"
+  - "**/.mvn/**"

.github/workflows/codeql.yml

@@ -9,14 +9,26 @@
 # the `language` matrix defined below to confirm you have the correct set of
 # supported CodeQL languages.
 #
+# This workflow uses a custom CodeQL configuration file (.github/codeql-config.yml)
+# to exclude test directories from security scanning. This focuses analysis on
+# production code and reduces noise from test files.
+#
 name: "CodeQL"
 
 on:
   push:
     branches: [ "main" ]
+    # Exclude test directories from triggering workflow
+    paths-ignore:
+      - "**/src/test/**"
+      - "**/test/**"
   pull_request:
     # The branches below must be a subset of the branches above
     branches: [ "main" ]
+    # Exclude test directories from triggering workflow
+    paths-ignore:
+      - "**/src/test/**"
+      - "**/test/**"
   schedule:
     - cron: '17 4 * * 5'
 
@@ -48,10 +60,12 @@ jobs:
         java-version: '25'
 
     # Initializes the CodeQL tools for scanning.
+    # Uses custom configuration file to exclude test directories from analysis.
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
+        config-file: ./.github/codeql-config.yml
         # If you wish to specify custom queries, you can do so here or in a config file.
         # By default, queries listed here will override any specified in a config file.
         # Prefix the list here with "+" to use these queries and those in the config file.