Epic: Manage CodeQL deployment
- Dominant language
- JavaScript
- Stars
- 363
- Forks
- 872
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 18
Description
### Overview
We require issues to support resolution of current open CodeQL alerts as well as automation for creation of issues for new CodeQL alerts. We also need to manage CodeQL extraction errors and consider implementing CodeQL for VS Code extension.
### Dependencies
- [ ] #5242
- [ ] #6463
- [ ] #5159
- [x] #5059
- [x] #5234
- [ ] #6548
- [x] #5180
- [x] #6691
### Action Items
- [x] View the code scanning page[^1] for hackforla/website, and understand the elements of CodeQL code scanning[^2]
- [x] Create issue template #5242
- [x] Create a sample issue - #5642
- [x] Create a level 1 issue making issue with a list of required issues - see #5159
- [x] Create an issue for creation of a wiki page "How to manage CodeQL alerts" - #6463
- [ ] fix link from Action Item to alert
- [ ] set role label based on path of affected code file
- [ ] if path starts with `.github` or `github-actions` => apply `role: back end/devOps
- [ ] otherwise apply `role: front end` label
- [ ] determine if the code file is in production
- [ ] for pages, check YAML front matter for `published: `
- [ ] for layouts, check `_config.yml`
### Resources/Instructions
[^1]: [Code Scanning results for hackforla/website](https://github.com/hackforla/website/security/code-scanning)
[^2]: [About code scanning with CodeQL](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql)
[^3]: spreadsheet [HfLA website: CodeQL scan alerts (issue #5060)](https://docs.google.com/spreadsheets/d/1B3R-fI8OW0LcYuwZICQZ2fB8sjlE3VsfyGIXoReNBIs/edit#gid=0)
- This Epic was created from #4963
Contributor guide
Assessment
This issue has not been assessed yet.