GSA-SHARE-IT repository migration preparation

[sachin-panayil]

Problem

In preparation to migrate this repository to the GSA-SHARE-IT GitHub organization, we would like to ensure that all documentation is updated, code scanning warnings are resolved, and policies/processes of the repository are reflected accordingly.

Several policy files (CODE_OF_CONDUCT, CONTRIBUTING) were only inherited from the DSACMS org and would be lost after the transfer. code.json claimed maturityModelTier: 3, but the repository only met Tier 0. The site also had an XSS issue, several results bugs, accessibility gaps, and confusing behavior when GitHub's API rate limit was reached.

Solution

Code scanning and workflows

• Resolve the js/functionality-from-untrusted-source alert by removing the unused USWDS JavaScript bundle and adding an SRI hash to the USWDS stylesheet
• Resolve the actions/missing-workflow-permissions alert by specifying read permissions on the resolve-repolinter-json job
• Point the repository hygiene check at the Tier 3 repolinter config
• Add dependabot.yml for monthly GitHub Actions updates
• Add contributors.yml workflow to keep the contributors list in COMMUNITY.md up to date

Documentation (Tier 3)

• Add CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, and GOVERNANCE.md
• Add .github/CODEOWNERS.md
• Rewrite COMMUNITY.md with roles, maintainers, approvers, reviewers, contributors, alumni, and community guidelines
• Update README.md with the Tier 3 sections: development lifecycle, local development, branching model, feedback, glossary, and more
• Add a "Using a GitHub Token" guide to the README (closes How to create a GitHub Token section #6)
• Add homepageURL to code.json

Security and bug fixes

• Render results with textContent instead of innerHTML so untrusted code.json values (e.g. name) can't inject HTML/scripts
• Clear results between runs instead of appending to the previous run
• Fix owner/name from a previous repository leaking into the next result row
• Count code.json files whose contents can't be read as failures instead of successes
• Fix double-counted progress when a response fails to parse
• Decode code.json as UTF-8 so non-ASCII characters are preserved
• Add type="button" to chip remove buttons so they can't submit the form

Rate limiting

• Stop scanning at the first rate-limited response instead of continuing to send requests that will fail
• Keep and download everything scanned before the limit was reached, including partially listed organizations
• Show a notice when the index is incomplete, including when GitHub says the limit resets
• Show a clear error with the reset time when nothing could be scanned

UX and accessibility

• Turn an organization name typed without pressing Enter into a chip instead of failing validation
• Ignore Generate clicks while a run is in progress
• Report organizations that couldn't be fully scanned
• Scroll to results when a run finishes and announce them to screen readers
• Mark required fields
• Make "Generate Index" a real <button> so it works with a keyboard
• Make tooltips keyboard and screen reader accessible, wrap long text, and show them below the label on small screens (closes Tooltips are not media responsive #3)
• Use an <h1> for the page heading, fix the "Important links,,," aria-label, and fix the favicon type
• Remove the commented-out USA banner and its unused JavaScript

Result

The repository is ready to be migrated! It meets Tier 3 repolinter requirements, has no open code scanning alerts, and no longer depends on policy files inherited from the DSACMS organization. The site is safer and more accessible, and it handles rate limits gracefully.

After the transfer to GSA-SHARE-IT:

• Re-enable GitHub Pages
• Re-enable CodeQL default setup, secret scanning, and Dependabot alerts
• Add the REPOLINTER_AUTO_TOKEN secret
• Update DSACMS URLs in README.md, CONTRIBUTING.md, COMMUNITY.md, code.json, and index.html (the Pages URL will not redirect after a transfer)

Test Plan

Automated browser tests (headless Chrome with a mocked GitHub API) pass:

• Index downloads with the expected agency, version, and releases, and the counts are correct
• A code.json name of <img src=x onerror=...> renders as text and does not execute
• Running twice replaces the previous results
• An organization typed without pressing Enter is scanned
• Mixing a valid and a nonexistent organization reports the nonexistent one
• Rate limited partway through scanning: the scanned repositories are downloaded, a notice with the reset time is shown, and no further requests are sent
• Rate limited while listing repositories, and already rate limited before the run: a clear error with the reset time is shown
• Tooltips are reachable by keyboard and cause no horizontal overflow at 375px
• No console errors on page load, and the USWDS stylesheet loads with its SRI hash

Also checked:

• The docs pass the merged Tier 0–3 repolinter rules, except the three COMMUNITY.md heading rules (Maintainers List, Approvers List, Reviewers List). The repo-scaffolder template itself uses ### Maintainers:, ### Approvers: and ### Reviewers:, so I kept its wording to match codejson-generator.
• All workflow and Dependabot YAML parses

To verify manually:

1. python3 -m http.server 8000 and open http://localhost:8000
2. Generate an index for DSACMS with and without a GitHub token

[decause-gov]

OK, there are a few URLs to fix throughout, and one or two edits in other docs, but, overall, this is exciting.

I think we should consider the branding/banners after getting this up and deployed, but for now, it can ship with some of the CMS-specific design/front-end as is.

LGTM +1 🚢

[sachin-panayil]

yup, alot of the comments you made will be fixed via a patch PR once its gets ported over to GSA @decause-gov