Open roslynwythe opened 1 year ago
Hi @roslynwythe.
Please don't forget to add the proper labels to this issue. Currently, the labels for the following are missing: Complexity, Role, Feature
NOTE: Please ignore the adding proper labels comment if you do not have 'write' access to this directory.
To add a label, take a look at Github's documentation here.
Also, don't forget to remove the "missing labels" afterwards. To remove a label, the process is similar to adding a label, but you select a currently added label to remove it.
After the proper labels are added, the merge team will review the issue and add a "Ready for Prioritization" label once it is ready for prioritization.
Additional Resources:
As developers. we need to analyze CodeQL query alert INSERT-ALERTID and to either recommend dismissal of the alert or update the code to resolve the alert.
dismiss as test
, dismiss as false positive
, dismiss as won't fix
, or update code
. An example of a 'false positive' is a report of a JavaScript syntax error that is caused by markdown or liquid symbols such as ---
or {%
. Questions/In Review
and apply the label ready for dev lead
. When #5059 is merged, this issue may be unnecessary, because the codeql.yml workflow will automatically generate issues to address open CodeQL alerts from the codebase. The only possible reason we would require an issue template for resolution of CodeQL alerts is if a CodeQL alert appears in a Pull Request and the assignee cannot resolve it, and we want a resolution prior to merging the code.
Dependency
Overview
We require a generic issue template that can be used to resolve all CodeQL alerts. The only information required to target a particular alert is the alert number, which provides a link to the alert detail page, from which all details such as file path are available, along with an explanation of the alert and recommendations for resolution.
Action Items
.github/ISSUE_TEMPLATE/resolve-CodeQL-alert.md
Content of issue template
Resources/Instructions
Testing Issue Templates