Our internal infrastructure that periodically runs CodeQL and creates automated bug reports is changing how it accepts warning suppressions.

🏚️ Old suppression comments

The suppression comments that we've been using, of the form // lgtm [cpp/too-many-puppies], are now rejected with:

cpp/policy/alert-suppression-without-justification
[SM03936] Alert Suppression Without Justification
A legacy (LGTM) CodeQL suppression comment without a justification was detected.

🪄 New suppression comments

The new form that we must use is:

// CodeQL [OpaqueID] Justification consisting of 25 or more characters

This comment can appear on the affected line, or immediately above it.

Note that the opaque ID SM03936 for Alert Suppression Without Justification isn't what we ever want to use - we need to use the opaque ID for the underlying warning. I believe I've correctly looked these up, but we'll have to wait for the next round of automated bug reports to confirm.

🧹 Control flow cleanup

I'm changing how we handle _System_error_message. The behavior is unchanged, except that it replaces an _STL_INTERNAL_CHECK (can't happen) with emitting "unknown error".

🤫 Original suppression PRs

• fix codeql warnings #3489
• Fix CodeQL warnings, part 2 #3585
• Silence CodeQL false positive warnings #4942

🐞 Internal bugs fixed

• VSO-2255050 / AB#2255050
• VSO-2255054 / AB#2255054
• VSO-2255066 / AB#2255066
• VSO-2255071 / AB#2255071
• VSO-2255089 / AB#2255089
• VSO-2255098 / AB#2255098
• VSO-2255102 / AB#2255102
• VSO-2255103 / AB#2255103
• VSO-2255111 / AB#2255111