hackforla / hackforla/website

Epic: Manage CodeQL deployment

Open
#5,005 84 comments 0 reactions 0 assignees View on GitHub
Complexity: See issue making label Feature: Code Alerts Issue Making: Level 2 role: back end/devOps role: front end size: 2pt
Dominant language
JavaScript
Stars
363
Forks
872
Avg merge
2d 21h
Merged PRs (30d)
18

Description

### Overview
We require issues to support resolution of current open CodeQL alerts as well as automation for creation of issues for new CodeQL alerts. We also need to manage CodeQL extraction errors and consider implementing CodeQL for VS Code extension.

### Dependencies
- [ ] #5242
- [ ] #6463
- [ ] #5159
- [x] #5059
- [x] #5234
- [ ] #6548
- [x] #5180
- [x] #6691

### Action Items
- [x] View the code scanning page[^1] for hackforla/website, and understand the elements of CodeQL code scanning[^2]
- [x] Create issue template #5242
- [x] Create a sample issue - #5642
- [x] Create a level 1 issue making issue with a list of required issues - see #5159
- [x] Create an issue for creation of a wiki page "How to manage CodeQL alerts" - #6463
- [ ] fix link from Action Item to alert
- [ ] set role label based on path of affected code file
- [ ] if path starts with `.github` or `github-actions` => apply `role: back end/devOps
- [ ] otherwise apply `role: front end` label
- [ ] determine if the code file is in production
- [ ] for pages, check YAML front matter for `published: `
- [ ] for layouts, check `_config.yml`

### Resources/Instructions
[^1]: [Code Scanning results for hackforla/website](https://github.com/hackforla/website/security/code-scanning)
[^2]: [About code scanning with CodeQL](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql)
[^3]: spreadsheet [HfLA website: CodeQL scan alerts (issue #5060)](https://docs.google.com/spreadsheets/d/1B3R-fI8OW0LcYuwZICQZ2fB8sjlE3VsfyGIXoReNBIs/edit#gid=0)
- This Epic was created from #4963

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.