Epic: Manage CodeQL deployment

[roslynwythe]

Overview

We require issues to support resolution of current open CodeQL alerts as well as automation for creation of issues for new CodeQL alerts. We also need to manage CodeQL extraction errors and consider implementing CodeQL for VS Code extension.

Dependencies

• Create new issue template for resolution of CodeQL alert #5242
• Create wiki page to guide developers how to manage CodeQL alerts #6463
• Create issues to resolve all open CodeQL alerts #5159
• Create GHA to create issues when new CodeQL alerts are detected #5059
• Resolve CodeQL extraction errors #5234
• Update codeql.yml to exclude YAML front-matter and Liquid code #6548
• Feasibility and DR: use of CodeQL for VS Code #5180
• Refactor codeql.yml file #6691

Action Items

• View the code scanning page¹ for hackforla/website, and understand the elements of CodeQL code scanning²
• Create issue template Create new issue template for resolution of CodeQL alert #5242
• Create a sample issue - Resolve CodeQL alert 25 #5642
• Create a level 1 issue making issue with a list of required issues - see Create issues to resolve all open CodeQL alerts #5159
• Create an issue for creation of a wiki page "How to manage CodeQL alerts" - Create wiki page to guide developers how to manage CodeQL alerts #6463
• fix link from Action Item to alert
• set role label based on path of affected code file
  • if path starts with .github or github-actions => apply `role: back end/devOps
  • otherwise apply role: front end label
• determine if the code file is in production
  • for pages, check YAML front matter for published:
  • for layouts, check _config.yml

Resources/Instructions

• This Epic was created from ER: Analyze CodeQL security/code quality alerts #4963

Footnotes

1. Code Scanning results for hackforla/website ↩

2. About code scanning with CodeQL ↩

[HackforLABot]

@roslynwythe

Please add update using the below template (even if you have a pull request). Afterwards, remove the '2 weeks inactive' label and add the 'Status: Updated' label.

1. Progress: "What is the current status of your project? What have you completed and what is left to do?"
2. Blockers: "Difficulties or errors encountered."
3. Availability: "How much time will you have this week to work on this issue?"
4. ETA: "When do you expect this issue to be completed?"
5. Pictures (optional): "Add any pictures of the visual changes made to the site so far."

If you need help, be sure to either: 1) place your issue in the Questions/In Review column of the Project Board and ask for help at your next meeting, 2) put a "Status: Help Wanted" label on your issue and pull request, or 3) put up a request for assistance on the #hfla-site channel. Please note that including your questions in the issue comments- along with screenshots, if applicable- will help us to help you. Here and here are examples of well-formed questions.

_{You are receiving this comment because your last comment was before Monday, November 18, 2024 at 11:04 PM PST.}

[HackforLABot]

@roslynwythe

Please add update using the below template (even if you have a pull request). Afterwards, remove the '2 weeks inactive' label and add the 'Status: Updated' label.

1. Progress: "What is the current status of your project? What have you completed and what is left to do?"
2. Blockers: "Difficulties or errors encountered."
3. Availability: "How much time will you have this week to work on this issue?"
4. ETA: "When do you expect this issue to be completed?"
5. Pictures (optional): "Add any pictures of the visual changes made to the site so far."

If you need help, be sure to either: 1) place your issue in the Questions/In Review column of the Project Board and ask for help at your next meeting, 2) put a "Status: Help Wanted" label on your issue and pull request, or 3) put up a request for assistance on the #hfla-site channel. Please note that including your questions in the issue comments- along with screenshots, if applicable- will help us to help you. Here and here are examples of well-formed questions.

_{You are receiving this comment because your last comment was before Monday, November 25, 2024 at 11:04 PM PST.}