You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fixes most markdownlint-related errors and warnings for *.md files
in this project. Improves consistency of markdown documentation,
including these files:
- `CONTRIBUTING.md`
- `README.md`
- `SECURITY.md`
- `SUPPORT.md`
- `javascript/frameworks/*/README.md`
Hi there! We're thrilled that you'd like to contribute to this project. Your help is essential for keeping it great.
@@ -10,24 +9,26 @@ Contributions to this project are [released](https://help.github.com/articles/gi
10
9
11
10
Please note that this project is released with a [Contributor Code of Conduct](CODE_OF_CONDUCT.md). By participating in this project you agree to abide by its terms.
12
11
13
-
## Submitting a pull request
12
+
## Submitting a Pull Request
14
13
15
-
1.[Fork][fork] and clone the repository
16
-
1. Configure and install the [CodeQL CLI](https://github.com/github/codeql-cli-binaries/releases) specified in the `qlt.conf.json` file
17
-
1. Create a new branch: `git checkout -b my-branch-name`
18
-
1. Make your changes
19
-
1. Make sure the QL tests pass on your machine
20
-
1. Ensure the files are appropriately formatted (QL files should be formatted with `codeql query format`)
21
-
1. Push to your fork and [submit a draft pull request](https://github.com/advanced-security/codeql-sap-js/compare). Make sure to select **Create Draft Pull Request**.
22
-
7. Address failed checks, if any.
23
-
8. Mark the [pull request ready for review](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review).
24
-
9. Pat your self on the back and wait for your pull request to be reviewed and merged.
14
+
1.[Fork][fork] and clone the repository.
15
+
1. Configure and install the [CodeQL CLI](https://github.com/github/codeql-cli-binaries/releases) specified in the `qlt.conf.json` file.
16
+
1. Create a new branch: `git checkout -b my-branch-name`.
17
+
1. Make your changes.
18
+
1. Make sure the QL tests pass on your machine.
19
+
1. Ensure the files are appropriately formatted (QL files should be formatted with `codeql query format`).
20
+
1. Push to your fork and [submit a draft Pull Request](https://github.com/advanced-security/codeql-sap-js/compare). Make sure to select **Create Draft Pull Request**.
21
+
1. Address failed checks, if any.
22
+
1. Mark the [Pull Request ready for review](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review).
23
+
1. Pat yourself on the back and wait for your Pull Request to be reviewed and merged.
25
24
26
-
Here are a few things you can do that will increase the likelihood of your pull request being accepted:
25
+
## Helping Your Pull Request Get Accepted
26
+
27
+
Here are a few things you can do that will increase the likelihood of your Pull Request being accepted:
27
28
28
29
- Follow the [CodeQL style guide][style].
29
30
- Write good tests.
30
-
- Keep your change as focused as possible. If there are multiple changes you would like to make that are not dependent upon each other, consider submitting them as separate pull requests.
31
+
- Keep your change as focused as possible. If there are multiple changes you would like to make that are not dependent upon each other, consider submitting them as separate Pull Requests.
31
32
- Write a [good commit message](http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html).
### Analyzing a repository with [Code Scanning](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#using-query-packs)
18
+
15
19
Example workflow file:
20
+
16
21
```yaml
17
22
jobs:
18
23
analyze-javascript:
@@ -45,7 +50,9 @@ jobs:
45
50
LGTM_INDEX_XML_MODE: all
46
51
LGTM_INDEX_FILETYPES: ".json:JSON\n.cds:JSON"
47
52
```
53
+
48
54
Example configuration file:
55
+
49
56
```yaml
50
57
name: "My CodeQL config"
51
58
@@ -60,15 +67,19 @@ packs:
60
67
paths-ignore:
61
68
- "**/node_modules"
62
69
```
70
+
63
71
### Building and analyzing the CodeQL database with the CodeQL CLI
64
72
65
73
1. Include and index XML, JSON and CDS files by setting the necessary environment variables:
### Example `codeql database create` with CDS Extractor Invocation
109
+
110
+
The following example invocation of `codeql database create` includes the `--command` option to invoke the CDS extractor as an extension of the `javascript` extractor, which is used by `codeql` to create the database. The `pre-finalize.sh` script is a minimal wrapper around the `codeql database index-files` command, which we expect to run the `extractors/cds/tools/index-files.js` script to index the JSON files pre-generated by the CDS extractor.
GitHub takes the security of our software products and services seriously, including all of the open source code repositories managed through our GitHub organizations, such as [GitHub](https://github.com/GitHub).
6
6
7
-
Even though [open source repositories are outside of the scope of our bug bounty program](https://bounty.github.com/index.html#scope) and therefore not eligible for bounty rewards, we will ensure that your finding gets passed along to the appropriate maintainers for remediation.
7
+
Even though [open source repositories are outside of the scope of our bug bounty program](https://bounty.github.com/index.html#scope) and therefore not eligible for bounty rewards, we will ensure that your finding gets passed along to the appropriate maintainers for remediation.
8
8
9
9
## Reporting Security Issues
10
10
@@ -16,16 +16,16 @@ Instead, please send an email to opensource-security[@]github.com.
16
16
17
17
Please include as much of the information listed below as you can to help us better understand and resolve the issue:
18
18
19
-
* The type of issue (e.g., buffer overflow, SQL injection, or cross-site scripting)
20
-
* Full paths of source file(s) related to the manifestation of the issue
21
-
* The location of the affected source code (tag/branch/commit or direct URL)
22
-
* Any special configuration required to reproduce the issue
23
-
* Step-by-step instructions to reproduce the issue
24
-
* Proof-of-concept or exploit code (if possible)
25
-
* Impact of the issue, including how an attacker might exploit the issue
19
+
* The type of issue (e.g., buffer overflow, SQL injection, or cross-site scripting)
20
+
* Full paths of source file(s) related to the manifestation of the issue
21
+
* The location of the affected source code (tag/branch/commit or direct URL)
22
+
* Any special configuration required to reproduce the issue
23
+
* Step-by-step instructions to reproduce the issue
24
+
* Proof-of-concept or exploit code (if possible)
25
+
* Impact of the issue, including how an attacker might exploit the issue
26
26
27
27
This information will help us triage your report more quickly.
28
28
29
29
## Policy
30
30
31
-
See [GitHub's Safe Harbor Policy](https://docs.github.com/en/site-policy/security-policies/github-bug-bounty-program-legal-safe-harbor#1-safe-harbor-terms)
31
+
See [GitHub's Safe Harbor Policy](https://docs.github.com/en/site-policy/security-policies/github-bug-bounty-program-legal-safe-harbor#1-safe-harbor-terms).
0 commit comments