GitHub Actions: Implement CodeQL

[macho-catt]

Overview

As a developer, we need to ensure that we write secure code and defend against vulnerabilities. To do so, we need to configure code scanning using CodeQL.

Action Items

• Research and investigate how we can use CodeQL
  • Any notes should be documented in this ticket or should be stored on the website team's Google Drive
• We want CodeQL to scan the vulnerabilities for the following:
  • JS code
  • GitHub Actions
  • Liquid
• Create a prototype on your own fork of the repository
• Schedule a time with the dev team and the lead to demo your findings and implementation
• Once approved, write a pull request to implement CodeQL

Resources/Instructions

Code Scanning in GitHub
About CodeQL
Events that trigger workflows
Workflow syntax for GitHub Actions
actions/github-script
GitHub RESTAPI

[SAUMILDHANKAR]

Progress update:

• For working with liquid code, I created a custom script for if there is liquid code with syntax, {{ xxx }}, in the comments of an html file, there should be a code scanning alert. I was able to generate the code scanning alert for an instance created in a test html file.
• I am using this query in a yaml file to generate the code scanning alerts for this case.
• Next, I will clean up my code so it is ready for demo before reaching out to leads for feedback. Planning to reach out by coming Sunday.
• We can also discuss if other custom queries should be explored.

Blockers: No blockers.
Availability: 5 hours per week.
ETA: 5/10/23

[SAUMILDHANKAR]

Progress update:

• I have cleaned up my documentation and am ready for demo to the leads.

Blockers: No blockers.
Availability: 5 hours per week.
ETA: 5/25/23

@jdingeman Hi Justin, I would like to demo my research on this issue before making a pull request. Please recommend a suitable time to connect. My schedule is flexible, and I can make it around team meeting slots or any other time as well. Will leave a note on slack as well. Thank you.

[SAUMILDHANKAR]

Progress update:

• Following up with dev team if demo might be preferred before making the pull request.

Blockers: No blockers.
Availability: 5 hours per week.
ETA: 6/20/23

[t-will-gillis]

Hi @SAUMILDHANKAR thanks so much for your extensive work on this issue. There is a lot of info here to digest and I apologize if I am asking questions that you have already answered, but just to confirm- the current implementation will scan all of the js files in the website repo and generate in this case the 57 notifications that we could address one by one. Then it is also scanning future PRs, correct? You indicate that it will block merging for critical or high security issues- for the others I assume it would flag the issues so they could be addressed before merging?

Side discussion: As a group, do we need to decide which “Protection rules” to use, i.e. what “Security” level and “Errors, Warnings, or Any”- or for now do we go with the defaults?

Lastly, the 3 linked comments I believe refer to custom queries you wrote for scanning yaml and liquid code. Would these scans run at the same time as scans for the js files?

Thank you again- this is going to be very useful when it is up and running