You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: server/src/prompts/run-query-and-summarize-false-positives.prompt.md
+5-6Lines changed: 5 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,12 +12,12 @@ Help a developer discover what kinds of false positives are produced by their cu
12
12
13
13
1. Read the provided CodeQL query to understand what patterns it is designed to detect.
14
14
2. Discover the results of this query on a real database, by:
15
-
- Running the tool `list_query_run_results` to find existing runs for this query
16
-
- If no existing runs are found, run the query on a relevant database using `codeql_query_run` tool
15
+
- Running the tool `list_query_run_results` to find existing runs for this query
16
+
- If no existing runs are found, run the query on a relevant database using `codeql_query_run` tool
17
17
3. Analyze and group the results into what appear to be similar types of results. This may mean:
18
-
- Grouping results in the same file
19
-
- Grouping results that reference the same elements
20
-
- Grouping results with similar messages
18
+
- Grouping results in the same file
19
+
- Grouping results that reference the same elements
20
+
- Grouping results with similar messages
21
21
4. For each group, explore the actual code for a sample of alerts in that group, using the `read_database_source` tool to triage the results and determine which groups appear to be false positives
22
22
5. For each false positive case discovered in this exploration, group them into categories of similar root causes. For example, a query might not properly account for unreachable code, or there may be a commonly used library that violates the query's assumptions but is actually safe.
23
23
6. Explain these results to the user in order of most common to least common, so they can understand where their query may need improvement to reduce false positives.
@@ -77,7 +77,6 @@ The tool `read_database_source` can be used to read the code of a particular fin
77
77
-**Mark uncertainty**: Use lower confidence scores when code snippets are missing
78
78
-**Avoid false confidence**: If you cannot determine FP status, mark confidence as low
79
79
80
-
81
80
## Output Format
82
81
83
82
Return a JSON array of ranked results, ordered by FP likelihood (highest first):
0 commit comments