Inline suppression for `codeql[py/unused-global-variable]` stopped working

[amotl]

Problem

Hi there. We started to observe security issues being flagged recently, although those are false positives we had suppressed using the corresponding inline code marker, which we think worked well for years.

codeql[py/unused-global-variable]

Details

The relevant CodeQL configuration sections.

• https://github.com/crate/crate-python/blob/main/.github/workflows/codeql.yml#L53-L60
• https://github.com/crate/crate-python/blob/main/.github/workflows/codeql.yml#L69-L87

Suppressions are defined here, per out-of-band configuration, and inline.

• https://github.com/crate/crate-python/blob/main/.github/codeql.yml
• https://github.com/crate/crate-python/blob/main/src/crate/client/__init__.py#L46-L49

Those spots have been flagged recently.

• https://github.com/crate/crate-python/security/code-scanning/116
• https://github.com/crate/crate-python/security/code-scanning/117
• https://github.com/crate/crate-python/security/code-scanning/118

The relevant MITRE item.

• https://cwe.mitre.org/data/definitions/563.html

Example