ci: exclude the test tree from CodeQL analysis - #16

What & why

CodeQL surfaced parse-error diagnostics on intentionally-malformed test fixtures:

test/error_code/src.js: A parse error occurred: `'var' can not be used as shorthand property`
test/syntax_cache/invalid.js: A parse error occurred: `Unexpected token`

Those files are deliberately invalid — they exist so browserify's tests can exercise its syntax-error handling. CodeQL can't parse them (by design), so it logs noise. Fork test trees also run bundles through vm.runInNewContext(...), which trips CodeQL's code-injection heuristics as false positives.

Neither the fixtures nor the harness is the security target for a library — the shipped code (index.js, lib/, bin/) is.

Change

Add a paths-ignore to the reusable CodeQL workflow's init step (inline config) so test/ and tests/ are excluded from analysis:

config: |
  paths-ignore:
    - test
    - tests

Applies to every fork through the shared reusable workflow — one change, no per-repo edits.

Rollout

Forks pick it up when their unabandoned/.github digest pin bumps (Renovate — and those bumps now auto-merge on green, via renovate-config #17). The diagnostic is non-blocking in the meantime.

Type of change

• fix / feat / perf — consumer-facing
• deps — dependency update
• chore / ci / build / docs / test / refactor — maintenance (ci)

Checklist

• Workflow YAML + inline CodeQL config validated
• Commits follow Conventional Commits

Generated by Claude Code