Kick-off First Merge into Upstream GSA Repo

[ohsh6o]

Extended Description

Per discussion with the 10x developer team, we will need to adapt GSA/fedramp-automation#53, need to apply the strategy and procedure and actually test out continued development in 18F/fedramp-automation and sprint branch and then merge that into GSA/fedramp-automation master for review.

Preconditions

• [X] Adding all relevant dev users in the proper group for GSA/fedramp-automation access
• [x] Wiki updates for procedures

Acceptance Critera

• [x] A repeatable, low-friction procedure and process for sprint branching and review in a repeatable way
• [x] A successful publication of code on GSA/fedramp-automation

Story Tasks

• [x] PR successfully reviewed and merged into GSA/fedramp-automation

Definition of Done

• [x] Acceptance criteria met - Each user story should meet the acceptance criteria in the description
• [x] Code reviewed - Code reviewed by at least one other team members (or developed by a pair)
• [x] Source code merged - Code that’s demoed must be in source control and merged
• [x] Code must successfully build and deploy into staging environment (from QASP): this may evolve from xslt sh pipline into something more
• [x] Security reviewed and reported - Conduct vulnerability and compliance scanning. threat modeling?
• [x] Code submitted must be free of medium- and high-level static and dynamic security vulnerabilities (from QASP)
• [x] Documentation generated - update readme or contributing markdown as necessary.
• [x] Architectural Decision Record completed as necessary for significant design choices

[ohsh6o]

We can take a whack at this tomorrow or early next week. Updated documentation found via wiki update eaa4343.

/cc @danielnaab @GaryGapinski

[ohsh6o]

Updated Dependabot settings not just to scan, but to include PRs. Current vulnerable deps (ws and electron) are dev dependencies and moderate, so presumed priority is low. Will try and determine a way to make changes and keep the dev fork in sync with the upstream over the long-term, not just this issue.