From 0199f49cd6452923aa6a090b6bbd362bee80e647 Mon Sep 17 00:00:00 2001
From: JOY <5027251+JOY@users.noreply.github.com>
Date: Mon, 21 Sep 2026 23:03:33 +0700
Subject: [PATCH] chore(ci): remove one-off CodeQL dismissal workflow

GITHUB_TOKEN can read code scanning alerts but cannot dismiss them: the
dismissal endpoint is restricted to user tokens for the dismissed_by audit
trail and returns 404 even with security-events: write. The dismissal needs
the operator user token with security_events scope instead. Alert 1567 stays
open until then; the containment guard from PR #43 remains in place.
---
 .github/workflows/oneoff-dismiss-alert.yml | 42 ----------------------
 1 file changed, 42 deletions(-)
 delete mode 100644 .github/workflows/oneoff-dismiss-alert.yml

diff --git a/.github/workflows/oneoff-dismiss-alert.yml b/.github/workflows/oneoff-dismiss-alert.yml
deleted file mode 100644
index 6c5a8133d8..0000000000
--- a/.github/workflows/oneoff-dismiss-alert.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-name: One-off - dismiss CodeQL alert 1567
-
-# One-off utility: dismisses CodeQL alert 1567 (js/path-injection,
-# LocalStorage.removeFile) which was hardened in PR #43 with a containment
-# guard and verified not attacker-reachable. The interactive CLI dismissal
-# needs a security_events scope the operator token does not carry, so this
-# runs with GITHUB_TOKEN security-events:write instead.
-# REMOVE THIS FILE after the alert is dismissed.
-
-on:
-  workflow_dispatch:
-
-permissions:
-  security-events: write
-
-jobs:
-  dismiss:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Debug - GET the alert as GITHUB_TOKEN
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          echo "=== GET alert 1567 ==="
-          gh api repos/DOS/Crove-Post/code-scanning/alerts/1567 2>&1 | head -30 || true
-          echo "=== GET open alerts on dev ==="
-          gh api "repos/DOS/Crove-Post/code-scanning/alerts?ref=dev&state=open" --jq '.[] | {number: .number, rule: .rule.id, url: .html_url}' 2>&1 | head -10 || true
-      - name: Dismiss alert
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh api -X PUT repos/DOS/Crove-Post/code-scanning/alerts/1567 \
-            -f state=dismissed \
-            -f reason=false_positive \
-            -f comment="Hardened in PR #43 and verified not attacker-reachable: (1) containment guard in LocalStorage.removeFile - the requested path is resolved and rejected unless it stays inside the upload directory (path.relative / isAbsolute / '..' rejection); (2) caller audit: every removeFile caller passes server-generated values (multer-generated public URL, internally constructed date-based keys, DB-stored generated names); no public API or user input flows into removeFile. CodeQL dataflow reports residual taint through the guard; the guard is kept as defense-in-depth." \
-            --jq '{state: .state, dismissed_reason: .dismissed_reason}'
-      - name: Verify
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh api "repos/DOS/Crove-Post/code-scanning/alerts?ref=dev&state=dismissed" \
-            --jq '.[] | select(.number == 1567) | {number: .number, state: .state, dismissed_reason: .dismissed_reason}'