ER: Review protection rules for CodeQL PR check failure

[SAUMILDHANKAR]

Emergent Requirement - Problem

Currently, the protection rules for CodeQL PR check failure are set to default levels. So, the PR check fails if there is a security alert of level high or critical or if there is an error. We would like to review these and decide if the protection rules should be made stricter, more relaxed or fine as it is.

Issue you discovered this emergent requirement in

• codeql-implementation #4886

Date discovered

6/26/2023

Did you have to do something temporarily

• YES
• NO

Who was involved

@roslynwythe @t-will-gillis @SAUMILDHANKAR

What happens if this is not addressed

CodeQL PR checks would continue running at default levels. PR checks won't pass if alert belongs to high/critical/error.

Resources

For more information about GitHub code scanning, check out the documentation.
Code Scan Results
List of all CodeQL JS queries

Recommended Action Items

• Make a new issue
• Discuss with team
• Let a Team Lead know

Potential solutions [draft]

First approach could be to go through the alert levels displayed currently for the website repo and based on that decide if PR check should fail for any similar alert level and update the rules accordingly.

More detailed analysis might involve going through the alert levels of all the JS queries in the following folder: https://github.com/github/codeql/tree/main/javascript/ql/src and then based on HfLA website repo's codebase decide the level of protection rules that would align with the team preference.

[github-actions]

Hi @SAUMILDHANKAR.

Please don't forget to add the proper labels to this issue. Currently, the labels for the following are missing:
Complexity, Role, Feature

NOTE: Please ignore the adding proper labels comment if you do not have 'write' access to this directory.

To add a label, take a look at Github's documentation here.

Also, don't forget to remove the "missing labels" afterwards.
To remove a label, the process is similar to adding a label, but you select a currently added label to remove it.

After the proper labels are added, the merge team will review the issue and add a "Ready for Prioritization" label once it is ready for prioritization.

Additional Resources:

• Wiki: How to create issues
• Wiki: How to read and interpret labels

[SAUMILDHANKAR]

@roslynwythe just wanted to let you know that this ER is ready for PM approval. Thank you.