Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Fix pre-existing PII annotation debt and add pii_check to CI

Abierto
  • ¿Algo no está bien?
#845 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
68/100
Tipo de issue
Refactorización
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
github-actions, python, yaml
Área
backend, ci-cd, security

Línea de trabajo

Start with .annotation_safe_list.yml, the model files under src/, and .github/workflows/ci.yml; run tox -e pii_check to reproduce the duplicate and uncovered-model failures. Review each listed model's data and add exactly one accurate annotation, remove the two redundant safelist entries, add pii_check to the CI matrix, and confirm the check passes with 100% coverage.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Background

make pii_check runs code_annotations against every Django model in openedx-core's own
tree and requires each one to carry a .. no_pii: (or .. pii:) annotation, either inline in
the model's docstring or as an entry in .annotation_safe_list.yml. tox.ini's envlist
already includes a pii_check environment, but .github/workflows/ci.yml's test matrix lists
toxenv: ["django52", "package", "quality", "docs"], which does not include it. CI never runs
pii_check, so nothing currently blocks a merge that breaks it, and two problems have
accumulated on main as a result, confirmed by running tox -e pii_check directly:

Two models are double-covered, which is a lint error, not a coverage gap.
openedx_content.Draft and openedx_content.PublishableEntityVersion each carry an inline
.. no_pii: annotation in their own docstring (src/openedx_content/applets/publishing/models/draft_log.py
and .../models/publishable_entity.py), and each also has a now-redundant entry in
.annotation_safe_list.yml. code_annotations treats a model with both as annotated twice and
fails with a lint error rather than a coverage number:

openedx_content.Draft is annotated, but also in the safelist.
openedx_content.PublishableEntityVersion is annotated, but also in the safelist.

Twenty models are uncovered, confirmed by removing those two stale safelist entries and
re-running tox -e pii_check: 67 models total, 47 annotated, 20 uncovered, 70.1% coverage
against a 100% target. The twenty:

  • Seven oel_* backcompat shim models: oel_collections.Collection, oel_components.Component,
    oel_publishing.Container, oel_publishing.DraftChangeLog, oel_publishing.DraftChangeLogRecord,
    oel_publishing.LearningPackage, oel_publishing.PublishableEntity
  • Two openedx_catalog models: CatalogCourse, CourseRun
  • Three openedx_content models: ComponentVersionMedia, ContainerType, Media
  • Two models from the installed edx-organizations package: organizations.HistoricalOrganization,
    organizations.HistoricalOrganizationCourse
  • Six test-only models in test_django_app: ContainerContainer, ContainerContainerVersion,
    TestContainer, TestContainerVersion, TestEntity, TestEntityVersion

None of these twenty are models that #613 (the CBE competency models) adds, and none of #613's
own PRs touch them. This debt predates #613 and is unrelated to it.

What to do

  1. Remove the openedx_content.Draft and openedx_content.PublishableEntityVersion entries
    from .annotation_safe_list.yml; both are already covered by their own inline annotation.
  2. Annotate each of the twenty uncovered models above as .. no_pii: or .. pii:, whichever is
    accurate, either inline in the model's own docstring (for a model defined in this repo's
    src/) or in .annotation_safe_list.yml (for a model defined in an installed package, such
    as the two organizations.Historical* models).
  3. Add pii_check to the toxenv list in .github/workflows/ci.yml's test matrix, so a future
    PR that breaks PII coverage or introduces a double-covered model fails CI instead of only
    failing silently for whoever happens to run make pii_check locally.

Acceptance criteria

  • tox -e pii_check passes locally with no lint error and 100% coverage.
  • .github/workflows/ci.yml's test matrix includes pii_check in toxenv, and the CI run
    on the pull request shows a pii_check job that passes.
  • No model's annotation is both inline and in the safelist at once.
  • Every one of the twenty models listed above carries exactly one annotation, inline or in
    the safelist, accurately describing whether it stores personal data.

Out of scope

Anything in #613, #641, or #642: the CBE competency models, their own PII annotations, and the
openedx-platform safelist entries for them. This issue is unrelated to that work and does not
block or get blocked by it.

Lenguaje dominante
Python
Estrellas
10
Forks
33
Merge medio
2 d 16 h
PR fusionados (30 d)
10

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de openedx/openedx-core

Todos los issues de openedx/openedx-core

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.