Create codeql-analysis.yml

[Flyingmana]

Description (*)

Related Pull Requests

Fixed Issues (if relevant)

1. Fixes Replace LGTM.com as it's going to shutdown in Dec. 2022 #2642

Manual testing scenarios (*)

1. ...
2. ...

Questions or comments

Contribution checklist (*)

• Pull request has a meaningful description of its purpose
• All commits are accompanied by meaningful commit messages
• All automated tests passed successfully (all builds are green)
• Add yourself to contributors list

[sreichel]

Seems LGTM is down ... last check already runs for a hour. (https://github.com/OpenMage/magento-lts/runs/9753202323)

@Flyingmana can you please disable?

[ADDISON74]

Can we move forward with this issue? LGTM.com is already shut down.

[fballiano]

it seems this PR is already complete

[sreichel]

it seems this PR is already complete

But ... 92 new alerts including 87 high severity security vulnerabilities. Should we fix that first?

[fballiano]

where do you see those errors?

[sreichel]

https://github.com/OpenMage/magento-lts/runs/8675295733

[fballiano]

uff, prototype and tinymce = 99% impossible to solve

[Flyingmana]

we dont need to solve this "new errors", maybe put them into an ignore or mark it as allowed to fail

[sreichel]

There seems to be a baseline option ... needs some test?!?

[Flyingmana]

will look into it

[sreichel]

Do we need this? Set path to js only?

[Flyingmana]

removed the cron trigger.
We dont have any js files outside the js directory? then makes sense to add it, too

[fballiano]

we've a lot of .js in /skin/

can it also check the inline js in templates?

[sreichel]

I'd use include **/*.js instead of ... to run it only when js files changed.

    paths-ignore:
      - '**/*.md'
      - '**/*.txt'

[sreichel]

Nice, LGTM.

I'd add it to current workflow later.

[github-actions]

Unit Test Results

7 tests   5 ✔️  0s ⏱️
1 suites  2 💤
1 files    0 ❌

Results for commit 71da6e1.

♻️ This comment has been updated with latest results.

[ADDISON74]

@Flyingmana - Nice work and super fast.

[Flyingmana]

I now got all errors covered with paths-ignore.
Baseline is a bit more complicated I think, as the state of errors is stored in github, where we can mark the alerts as ignored then one by one.

[fballiano]

Could we test the js in templates?

[Flyingmana]

Could we test the js in templates?

iam not sure, first it should replace the LGTM what we had before. I dont think it was able to parse the templates.

But it might be able with codeql, although its a bit more work, why I would delay it for a later time

[sreichel]

But it might be able with codeql, although its a bit more work

If we have a working js code coverage ... 👍