Description of the false positive
CodeQL seems to produce false positives for Rust variables in format strings.
Code samples or links to source code
On 2026-08-13, the folllowing Rust snippet got flagged by CodeQL on alltheplaces/osm-diffs#660. CodeQL posted a notice, claiming Variable 'name' is not used. However, the variable does get used in this snippet, via a format! macro. We also check for unused variables with clippy, which does not flag an unused variable for this code. So, this looks like a false positive from CodeQL.
let producers: Vec<_> = sources
.into_iter()
.map(|(name, reader)| {
let tx = tx.clone();
s.spawn(move || -> Result<()> {
for record in reader.iter()? {
let bytes = record?;
let fti = FeatureToIndex::decode(bytes.as_slice()).with_context(|| {
format!("failed to decode a FeatureToIndex record from {name}")
})?;
tx.send(fti)?;
progress_bar.inc(1);
}
Ok(())
})
})
.collect();
URL to the alert on GitHub code scanning (optional)
https://github.com/alltheplaces/osm-diffs/security/code-scanning/30
Description of the false positive
CodeQL seems to produce false positives for Rust variables in format strings.
Code samples or links to source code
On 2026-08-13, the folllowing Rust snippet got flagged by CodeQL on alltheplaces/osm-diffs#660. CodeQL posted a notice, claiming
Variable 'name' is not used. However, the variable does get used in this snippet, via aformat!macro. We also check for unused variables with clippy, which does not flag an unused variable for this code. So, this looks like a false positive from CodeQL.URL to the alert on GitHub code scanning (optional)
https://github.com/alltheplaces/osm-diffs/security/code-scanning/30