ER: GHA to create issues to manage CodeQL alerts

[roslynwythe]

Emergent Requirement - Problem

We require issues to track each CodeQL alert. The issue that tracks a CodeQL alert will require the analysis of the alert and either a code change to "fix" the alert or a recommendation to "dismiss" the alert (for example, as a false positive). Currently, the tracking issues have been created manually, but it would be desirable to generate the issues automatically.

Details

• If any GitHub issue contains a CodeQL alert URL in a task item, the issue will become a tracking issue to the alert.
• In this ER we are only concerned with alerts raised on production code, not on alerts within pull requests.
• Since GitHub will block merging of any PR with a high or critical severity, the only new alerts will result from medium or lower severity alerts, or from changes in queries.

Issue you discovered this emergent requirement in

• codeql-implementation #4886

Date discovered

6/23/2023

Did you have to do something temporarily

• YES
• NO

Who was involved

@SAUMILDHANKAR @t-will-gillis @roslynwythe

What happens if this is not addressed

Tracking issues will have to be created manually for each CodeQL alerts, and new alerts may go unnoticed.

Resources

• GitHub CodeQL documentation
• Create Issues for Analysis of CodeQL alerts #5060

Recommended Action Items

• Make a new issue
• Discuss with team
• Let a Team Lead know

Potential solutions [draft]

Develop a GHA that examines every open CodeQL alert for each one, check for a tracking issue and for the source. If a CodeQL alert from gh-pages does not have a tracking issue, create a new issue based on the template below, move the issue to "New Issue Approval" column with "ready for dev lead" label.

[github-actions]

Hi @roslynwythe.

Please don't forget to add the proper labels to this issue. Currently, the labels for the following are missing:
Complexity, Role, Feature

NOTE: Please ignore the adding proper labels comment if you do not have 'write' access to this directory.

To add a label, take a look at Github's documentation here.

Also, don't forget to remove the "missing labels" afterwards.
To remove a label, the process is similar to adding a label, but you select a currently added label to remove it.

After the proper labels are added, the merge team will review the issue and add a "Ready for Prioritization" label once it is ready for prioritization.

Additional Resources:

• Wiki: How to create issues
• Wiki: How to read and interpret labels