How should repo level issues be handled?

Open
#2,964 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
28/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
typescript
Domain
ci-cd, security

Research direction

Start with the SARIF example in the issue and trace how an empty artifactLocation.uri is handled for repository-level findings. No source file or test is named, so identify the relevant handling entry point and existing coverage first. Done means the expected treatment of repo-level issues and any required behavior change are clearly established and tested.

Written by the indexing model from the issue text.

Description

Not all issues have a uri associated with them. For example:

{"ruleId":"Branch-Protection - BranchProtectionID (sscs-scorecard)","level":"error","message":{"text":"score is 5: branch protection is not maximal on development and all release branches:\nWarn: \u0026#39;last push approval\u0026#39; disabled on branch \u0026#39;main\u0026#39;\nWarn: number of required reviewers is 1 on branch \u0026#39;main\u0026#39;, while the ideal suggested is 2\nWarn: stale review dismissal disabled on branch \u0026#39;main\u0026#39;"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"","description":{"text":"Issue Found in your GitHub repository"}}

Is the issue that "uri":"" was specified by checkmarx here and should have been omitted?

With kind regards,

Giles

Dominant language
TypeScript
Stars
1.6k
Forks
493
Avg merge
1d 13h
Merged PRs (30d)
44

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/codeql-action

All issues in github/codeql-action

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.