Epic: Enable code scanning on JS files
- Dominant language
- JavaScript
- Stars
- 363
- Forks
- 872
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 18
Description
### Dependency
- https://github.com/hackforla/website/issues/6548
### Overview
Explore options to enable scanning, including the option of modifying the Javascript code to eliminate non-JS statements, as well as the option of performing CodeQL scanning after the Jekyll build.
### Details
Many of our Javascript code files cannot be scanned by CodeQL as-is because they contain non-JS (liquid) code which cause extraction errors.
- [ ] See issue #5234 for details on the problem. To summarize, these are the problematic code files:
**Summary: Non-JS code in these files**
* `hamburger-nav.js`: YAML front-matter with a title
* `toolkit.js`: 1 line of Liquid, empty YAML front-matter
* `wins.js` : 2 lines (Liquid), empty YAML front-matter
* `project.js` : 2 lines (Liquid), empty YAML front-matter
* `about.js`: for loop (Liquid), empty YAML front-matter
* `current-project.js`: 2 lines + for loop (Liquid), empty YAML front-matter
- Separately, we have observed problems with CodeQL scanning of HTML with embedded liquid statements - see #6485
### Action Items
- [ ] Create an issue to modify the workflow [codeql.yml](https://github.com/hackforla/website/blob/gh-pages/.github/workflows/codeql.yml) so that code is scanned after the Jekyll build.
- [ ] Add the following action item to the bottom of the issue
```
- [ ] If this issue was successful in allowing us to us to perform CodeQL scanning after the Jekyll build, close the epic #6378 with a comment indicating that this issue (include issue number) was successful at resolving the requirement
- [ ] If this issue is not successful, move the epic #6378 from the icebox to the new issue approval column, check off the dependency, remove dependency label, add the ready for dev lead label.
```
- [ ] Add the issue you just created as a dependency on this issue, add dependency label, and move this issue to the icebox and unassign yourself
- [ ] If the approach outlined in the previous action item is not feasible, then we could modify the above code files to remove non-JS statements. In some instances, liquid/YAML can be moved into HTML. See #5258 in which changes were made to segregate liquid from js in order to avoid ESLint errors.
Contributor guide
Assessment
This issue has not been assessed yet.