Week_7 : Coding period - Progress Report

GSoC Projects Plugin Ecosystem Security
1

Did a few things this week :

(For testings)

  • Published a package similar to plugin-repo-cli for testing the updated workflow when the reviewer add status: approved label.

  • Added workflow and code for plugin-repo-cli, did few testings on plugins by adding the label. Will be finalizing the code for this and opening a pr this week.

Finalized the CodeQL rules (if not changed in future), did testings on 11 custom made plugins by using the code of the mock test written in the official repository.

Test Report : Testing Report for Custom Joplin CodeQL Rules - #3 by akshajrawat
(There is webpack.config.js noise because I forgot to limit the scan to the src directory, though the rules were 100% identical to my testing local rules so we can ignore webpack.config.js findings)

I will be testing all of these code again once I merge the code from fork to the official repository.

Also, ran the code scan locally on top 20 joplin official plugins, all of them passed with no findings.

DELIVERABLE DATE :

24 july :

  • Finalize the code for plugin-repo-cli.
  • Get the plugin-repo-cli code merged.
  • Test the scan on the rest of the Recommended Plugins

2 August :

  • Get the top 20 plugins test workflow running (Which will run whenever there is change in codeql rules and it should find no findings)
  • Get the update repository manifest, README, github release and plugins folder update workflow done.

10 August :

  • Get the 2nd half of the generator-joplin code merged

14 August :

  • Do the final set of testings.
  • Merge all the local code to the official plugins-test repository.
  • Open issues on the official repository with test-plugins to test the final workflow
  • Deliver the video showing the whole workflow working correctly
2

Will be working on this and will raise a pr soon