Epic: Enable code scanning on JS files

[roslynwythe]

Dependency

• Update codeql.yml to exclude YAML front-matter and Liquid code #6548

Overview

Explore options to enable scanning, including the option of modifying the Javascript code to eliminate non-JS statements, as well as the option of performing CodeQL scanning after the Jekyll build.

Details

Many of our Javascript code files cannot be scanned by CodeQL as-is because they contain non-JS (liquid) code which cause extraction errors.

• See issue Resolve CodeQL extraction errors #5234 for details on the problem. To summarize, these are the problematic code files:

Summary: Non-JS code in these files

• hamburger-nav.js: YAML front-matter with a title
• toolkit.js: 1 line of Liquid, empty YAML front-matter
• wins.js : 2 lines (Liquid), empty YAML front-matter
• project.js : 2 lines (Liquid), empty YAML front-matter
• about.js: for loop (Liquid), empty YAML front-matter
• current-project.js: 2 lines + for loop (Liquid), empty YAML front-matter

• Separately, we have observed problems with CodeQL scanning of HTML with embedded liquid statements - see ER: CodeQL did not raise alerts on each instance of "Potentially unsafe external link" #6485

Action Items

• Create an issue to modify the workflow codeql.yml so that code is scanned after the Jekyll build.
  • Add the following action item to the bottom of the issue

    - [ ] If this issue was successful in allowing us to us to perform CodeQL scanning after the Jekyll build, close the epic #6378 with a comment indicating that this issue (include issue number) was successful at resolving the requirement
    - [ ] If this issue is not successful, move the epic #6378 from the icebox to the new issue approval column, check off the dependency, remove dependency label, add the ready for dev lead label.
    

  • Add the issue you just created as a dependency on this issue, add dependency label, and move this issue to the icebox and unassign yourself
• If the approach outlined in the previous action item is not feasible, then we could modify the above code files to remove non-JS statements. In some instances, liquid/YAML can be moved into HTML. See Update wins.html file to use liquid in this file #5258 in which changes were made to segregate liquid from js in order to avoid ESLint errors.

[gaylem]

• Created Update codeql.yml to exclude YAML front-matter and Liquid code #6548

[roslynwythe]

@gaylem @ExperimentsInHonesty see

• Update codeql.yml to exclude YAML front-matter and Liquid code #6548 (comment)
• Update codeql.yml to exclude YAML front-matter and Liquid code #6548 (comment)

[ExperimentsInHonesty]

@roslynwythe Sorry, I should have asked you about this one when we were online today.

• So does this issue get closed, or do you still think it might be viable if the two options in Update codeql.yml to exclude YAML front-matter and Liquid code #6548 are not successful?

[roslynwythe]

@roslynwythe Sorry, I should have asked you about this one when we were online today.

• So does this issue get closed, or do you still think it might be viable if the two options in Update codeql.yml to exclude YAML front-matter and Liquid code #6548 are not successful?

• @ExperimentsInHonesty - you are correct, if Update codeql.yml to exclude YAML front-matter and Liquid code #6548 is not successful, we will have to look for other solutions. @gaylem advised that the first item I listed under "Action Items" would not work because it is not possible to "delay" CodeQL scanning until after the Jekyll build. I believe that the second Action Item is still valid although it will require some research before writing issues.

[ExperimentsInHonesty]

I have removed the ready for labels... and when the dependency is satisfied, this issue will get looked at again by the merge team in the new issue approval column