https://github.com/phan/phan/blob/master/.phan/plugins/UnusedSuppressionPlugin.php is an upstream plugin that does this, but we'd just want it to warn about SecurityCheck-* ones.
This would have caught https://gerrit.wikimedia.org/r/457074 for example.
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Add UnusedSuppressionPlugin limited to our warnings | mediawiki/tools/phan/SecurityCheckPlugin | master | +22 -19 |
I tried to do this as part of the plugin upgrade. However, phan has no way to filter unused suppressions. I think our best bet is to add the config option to phan. This problem wouldn't be a thing if seccheck ran in the same job as phan does (where unusedsuppression is enabled), but I doubt this is something we'd want to do in the near future.
Opened PR upstream for https://github.com/phan/phan/issues/2961. Will be included in seccheck 3.x, after the upgrade to phan 2.x.
Change 523108 had a related patch set uploaded (by Daimona Eaytoy; owner: Daimona Eaytoy):
[mediawiki/tools/phan/SecurityCheckPlugin@master] Add UnusedSuppressionPlugin limited to our warnings
Change 523108 merged by jenkins-bot:
[mediawiki/tools/phan/SecurityCheckPlugin@master] Add UnusedSuppressionPlugin limited to our warnings