ER: Modify the current GitHub Actions PR comment

[SAUMILDHANKAR]

Emergent Requirement - Problem

Currently, CodeQL blocks merging a PR only if the severity level of security alerts is high/critical/error. To see a complete list of alerts generated because of a PR, a reviewer can use a custom link to view them. It would be really useful for the reviewers if we can add this info in the comment generated by GitHub actions when a PR is created.

Issue you discovered this emergent requirement in

• In PR codeql-implementation #4886, the CodeQL alerts generated because of this PR can be viewed using the link https://github.com/hackforla/website/security/code-scanning?query=pr%3A4886+is%3Aopen which follows the format https://github.com/hackforla/website/security/code-scanning?query=pr%3A[REPLACE WITH PR#]+is%3Aopen. This info should be made available in this comment.

Date discovered

6/26/2023

Did you have to do something temporarily

• YES
• NO

Who was involved

@roslynwythe @t-will-gillis @SAUMILDHANKAR

What happens if this is not addressed

• It would result in extra work for PR reviewers to see the additional CodeQL alerts generated because of a PR.

Resources

For more information about GitHub code scanning, check out the documentation.
Code Scan Results
GitHub Actions

Recommended Action Items

• Make a new issue
• Discuss with team
• Let a Team Lead know

Potential solutions [draft]

Add a template URL like https://github.com/hackforla/website/security/code-scanning?query=pr%3A[REPLACE WITH PR#]+is%3Aopen, in the file: https://github.com/hackforla/website/blob/gh-pages/github-actions/pr-instructions/pr-instructions-template.md

[github-actions]

Hi @SAUMILDHANKAR.

Please don't forget to add the proper labels to this issue. Currently, the labels for the following are missing:
Complexity, Role, Feature

NOTE: Please ignore the adding proper labels comment if you do not have 'write' access to this directory.

To add a label, take a look at Github's documentation here.

Also, don't forget to remove the "missing labels" afterwards.
To remove a label, the process is similar to adding a label, but you select a currently added label to remove it.

After the proper labels are added, the merge team will review the issue and add a "Ready for Prioritization" label once it is ready for prioritization.

Additional Resources:

• Wiki: How to create issues
• Wiki: How to read and interpret labels

[SAUMILDHANKAR]

@roslynwythe This ER is ready for PM approval. Please let me know if more information is required. Also, I have added this to the project board (ER). Hope that is fine. Thanks for your guidance.