Week_7 : Coding period - Progress Report

GSoC Projects Plugin Ecosystem Security
1

Did a few things this week :

(For testings)

  • Published a package similar to plugin-repo-cli for testing the updated workflow when the reviewer add status: approved label.

  • Added workflow and code for plugin-repo-cli, did few testings on plugins by adding the label. Will be finalizing the code for this and opening a pr this week.

Finalized the CodeQL rules (if not changed in future), did testings on 11 custom made plugins by using the code of the mock test written in the official repository.

Test Report : Testing Report for Custom Joplin CodeQL Rules - #3 by akshajrawat
(There is webpack.config.js noise because I forgot to limit the scan to the src directory, though the rules were 100% identical to my testing local rules so we can ignore webpack.config.js findings)

I will be testing all of these code again once I merge the code from fork to the official repository.

Also, ran the code scan locally on top 20 joplin official plugins, all of them passed with no findings.

DELIVERABLE DATE :

24 july :

  • Finalize the code for plugin-repo-cli.
  • Get the plugin-repo-cli code merged.
  • Test the scan on the rest of the Recommended Plugins

2 August :

  • Get the top 20 plugins test workflow running (Which will run whenever there is change in codeql rules and it should find no findings)
  • Get the update repository manifest, README, github release and plugins folder update workflow done.

10 August :

  • Get the 2nd half of the generator-joplin code merged

14 August :

  • Do the final set of testings.
  • Merge all the local code to the official plugins-test repository.
  • Open issues on the official repository with test-plugins to test the final workflow
  • Deliver the video showing the whole workflow working correctly
2

Will be working on this and will raise a pr soon

3

@akshajrawat, when writing your report please link to the relevant part in the repository.

Also I noticed that all code appears to be on your personal repository not https://github.com/joplin/plugins-test. Why is that? And could you please move the code to that repository?

4

Sure, I'll move it to the official repo. I just though you'll get a lot of useless notifications because I was opening a lot of issues, etc.

5

I'm having a hard time believing what you say sometimes. Assuming you're serious, I have to ask - are you working on other project-related stuff you didn't tell me about because you think I'd get "useless notifications"?

6

I appologize but I did not understood what you meant by this, I have been working on fork because I am opening several test issues, so I though there will be some notification to you each time I open an issue since the repo is in the main joplin account. For that I mentioned a special date where I will update the code in the main repo :

In case you have any doubt my last commit has been 4 days ago on : Commits · akshajrawat/plugins-test · GitHub
This is completely transparent whenever you wanted to check. Though I'll be merging the code with the official branch as asked.

In contemporary, I have been giving a weekly report as was mentioned at the starting. I missed by last report because of an very urgent travel, I'll include week 8 too in week 9 report. Before travelling I opened the pr which was sheduled to be done before 24 july here : Tools: Resolves #15974: Added new publish plugin command in plugin-repo-cli by akshajrawat · Pull Request #15981 · laurent22/joplin · GitHub

Also, I have another pr ready that I will be opening till night today as both of them can independantly merged.

In case you are thinking about the "protest" thing I edited out it is completely not related to any of this and does not mean I will be gone for many weeks as I feel like it was a useless info to share for no reason as it is something which is happening here and should be kept here.
I hope you'll understand

7

But plugins-test is not official, it's a test repository that was created so that you can run your tests. The official one would be joplin/plugins

So now I know your work is on another repository so it's fine, but eventually all that will indeed have to be moved to the Joplin org repository. And you don't need to worry about notifications, I can manage that