hackforla / hackforla/website

Epic: Enable code scanning on JS files

Open
#6,378 14 comments 0 reactions 0 assignees View on GitHub
Complexity: Large Complexity: See issue making label Dependency epic Feature: Code Alerts Feature: Refactor JS / Liquid Issue Making: Level 2 role: back end/devOps role: front end size: 1pt
Dominant language
JavaScript
Stars
363
Forks
872
Avg merge
2d 21h
Merged PRs (30d)
18

Description

### Dependency

- https://github.com/hackforla/website/issues/6548

### Overview
Explore options to enable scanning, including the option of modifying the Javascript code to eliminate non-JS statements, as well as the option of performing CodeQL scanning after the Jekyll build.

### Details
Many of our Javascript code files cannot be scanned by CodeQL as-is because they contain non-JS (liquid) code which cause extraction errors.
- [ ] See issue #5234 for details on the problem. To summarize, these are the problematic code files:

**Summary: Non-JS code in these files**
* `hamburger-nav.js`: YAML front-matter with a title
* `toolkit.js`: 1 line of Liquid, empty YAML front-matter
* `wins.js` : 2 lines (Liquid), empty YAML front-matter
* `project.js` : 2 lines (Liquid), empty YAML front-matter
* `about.js`: for loop (Liquid), empty YAML front-matter
* `current-project.js`: 2 lines + for loop (Liquid), empty YAML front-matter

- Separately, we have observed problems with CodeQL scanning of HTML with embedded liquid statements - see #6485

### Action Items
- [ ] Create an issue to modify the workflow [codeql.yml](https://github.com/hackforla/website/blob/gh-pages/.github/workflows/codeql.yml) so that code is scanned after the Jekyll build.
- [ ] Add the following action item to the bottom of the issue
```
- [ ] If this issue was successful in allowing us to us to perform CodeQL scanning after the Jekyll build, close the epic #6378 with a comment indicating that this issue (include issue number) was successful at resolving the requirement
- [ ] If this issue is not successful, move the epic #6378 from the icebox to the new issue approval column, check off the dependency, remove dependency label, add the ready for dev lead label.
```
- [ ] Add the issue you just created as a dependency on this issue, add dependency label, and move this issue to the icebox and unassign yourself
- [ ] If the approach outlined in the previous action item is not feasible, then we could modify the above code files to remove non-JS statements. In some instances, liquid/YAML can be moved into HTML. See #5258 in which changes were made to segregate liquid from js in order to avoid ESLint errors.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.