Update codeql.yml to exclude YAML front-matter and Liquid code

.github/workflows/codeql-scan-job.yml

@@ -45,13 +45,14 @@ jobs:
       uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
-        queries: security-and-quality
+        queries: ./codeql-queries/exclude-patterns.ql,security-and-quality
         # If you wish to specify custom queries, you can do so here or in a config file.
         # By default, queries listed here will override any specified in a config file.
         # Prefix the list here with "+" to use these queries and those in the config file.
 
         # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
         # queries: security-extended,security-and-quality
+        # added codeql-queries/exclude-patterns.ql for issue #6548
 
 
     # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).

codeql-queries/exclude-patterns.ql

@@ -0,0 +1,10 @@
+// This file was created for issue  #6548
+// File: codeql-queries/exclude-patterns.ql
+
+import javascript
+
+from File file
+where (file.getExtension() = "js" or file.getExtension() = "html")
+  and not file.getCode().matches(".*\\{%-?\\s*[a-zA-Z]+.*%\\}.*") // Exclude Liquid code
+  and not file.getCode().matches("(?s).*---.*---.*") // Exclude YAML front matter
+select file