Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

Fix pre-existing PII annotation debt and add pii_check to CI

Đang mở
  • Có gì không ổn?
#845 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
68/100
Loại issue
Tái cấu trúc
Độ rõ ràng
Đặc tả rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
github-actions, python, yaml
Lĩnh vực
backend, ci-cd, security

Hướng nghiên cứu

Start with .annotation_safe_list.yml, the model files under src/, and .github/workflows/ci.yml; run tox -e pii_check to reproduce the duplicate and uncovered-model failures. Review each listed model's data and add exactly one accurate annotation, remove the two redundant safelist entries, add pii_check to the CI matrix, and confirm the check passes with 100% coverage.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

Background

make pii_check runs code_annotations against every Django model in openedx-core's own
tree and requires each one to carry a .. no_pii: (or .. pii:) annotation, either inline in
the model's docstring or as an entry in .annotation_safe_list.yml. tox.ini's envlist
already includes a pii_check environment, but .github/workflows/ci.yml's test matrix lists
toxenv: ["django52", "package", "quality", "docs"], which does not include it. CI never runs
pii_check, so nothing currently blocks a merge that breaks it, and two problems have
accumulated on main as a result, confirmed by running tox -e pii_check directly:

Two models are double-covered, which is a lint error, not a coverage gap.
openedx_content.Draft and openedx_content.PublishableEntityVersion each carry an inline
.. no_pii: annotation in their own docstring (src/openedx_content/applets/publishing/models/draft_log.py
and .../models/publishable_entity.py), and each also has a now-redundant entry in
.annotation_safe_list.yml. code_annotations treats a model with both as annotated twice and
fails with a lint error rather than a coverage number:

openedx_content.Draft is annotated, but also in the safelist.
openedx_content.PublishableEntityVersion is annotated, but also in the safelist.

Twenty models are uncovered, confirmed by removing those two stale safelist entries and
re-running tox -e pii_check: 67 models total, 47 annotated, 20 uncovered, 70.1% coverage
against a 100% target. The twenty:

  • Seven oel_* backcompat shim models: oel_collections.Collection, oel_components.Component,
    oel_publishing.Container, oel_publishing.DraftChangeLog, oel_publishing.DraftChangeLogRecord,
    oel_publishing.LearningPackage, oel_publishing.PublishableEntity
  • Two openedx_catalog models: CatalogCourse, CourseRun
  • Three openedx_content models: ComponentVersionMedia, ContainerType, Media
  • Two models from the installed edx-organizations package: organizations.HistoricalOrganization,
    organizations.HistoricalOrganizationCourse
  • Six test-only models in test_django_app: ContainerContainer, ContainerContainerVersion,
    TestContainer, TestContainerVersion, TestEntity, TestEntityVersion

None of these twenty are models that #613 (the CBE competency models) adds, and none of #613's
own PRs touch them. This debt predates #613 and is unrelated to it.

What to do

  1. Remove the openedx_content.Draft and openedx_content.PublishableEntityVersion entries
    from .annotation_safe_list.yml; both are already covered by their own inline annotation.
  2. Annotate each of the twenty uncovered models above as .. no_pii: or .. pii:, whichever is
    accurate, either inline in the model's own docstring (for a model defined in this repo's
    src/) or in .annotation_safe_list.yml (for a model defined in an installed package, such
    as the two organizations.Historical* models).
  3. Add pii_check to the toxenv list in .github/workflows/ci.yml's test matrix, so a future
    PR that breaks PII coverage or introduces a double-covered model fails CI instead of only
    failing silently for whoever happens to run make pii_check locally.

Acceptance criteria

  • tox -e pii_check passes locally with no lint error and 100% coverage.
  • .github/workflows/ci.yml's test matrix includes pii_check in toxenv, and the CI run
    on the pull request shows a pii_check job that passes.
  • No model's annotation is both inline and in the safelist at once.
  • Every one of the twenty models listed above carries exactly one annotation, inline or in
    the safelist, accurately describing whether it stores personal data.

Out of scope

Anything in #613, #641, or #642: the CBE competency models, their own PII annotations, and the
openedx-platform safelist entries for them. This issue is unrelated to that work and does not
block or get blocked by it.

Ngôn ngữ chính
Python
Star
10
Fork
33
Merge trung bình
2 ngày 18 giờ
Pull request đã merge (30 ngày)
28

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của openedx/openedx-core

Tất cả issue của openedx/openedx-core

Issue tương tự

Thêm issue về Python

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.