Fix failing OSSAR static analysis reporting

[martgil]

From Roma:

By the way, we have also some automated scanning configured in flowcrypt-browser repo, can also check opened issues at https://github.com/FlowCrypt/flowcrypt-browser/security/code-scanning and find why ESLint fails there.

Reference: https://github.com/FlowCrypt/flowcrypt-security/issues/277

[martgil]

Hello @sosnovsky, I believe I have already found the root cause of this issue. The GitHub action OSSAR is still using 'node 16', from which ESLint's requirements doesn't support.

OSSAR action file:
https://github.com/github/ossar-action/blob/fae13e456b9973657a670eef6bccc3a4c2b5153d/action.yml#L16

[sosnovsky]

Hello @martgil, thanks for your investigation, hope they'll get it merged soon!

[martgil]

I noticed that there's something wrong going on only for push event's where checking out the repo doesn't seems so well and marked as not finished if we take a look at the GitHub action overview.

Consider the following example:

https://github.com/FlowCrypt/flowcrypt-browser/actions/runs/9095908805/job/25036158252 - its from the master branch.

But in general most PRs should experience such issue, where OSSAR with "push" event tags does have the same issues where tags "OSSAR / OSSAR-Scan (pull_request)" finishes correctly.

There's no way we can review the logs for that step.

[martgil]

I think the GitHub security tab considers a "skipped" job/tasks as an error so it fails -- I'll check that case too. On top of this, a push event OSSAR shouldn't be running on pull_request event.

[martgil]

Hello @sosnovsky I had to re-open this GitHub issue since the error on the Security tab didn't disappears. Meanwhile, I have completely tried to create the same OSSAR GitHub action on a test organization that I created to verify this and while both has the same similar OSSAR configuration, the error only appears on the FlowCrypt browser extension report. So I think a maintainance should have done on the repo's Settings under code scanning, specially it would help if we could have remove other define workflows where file's didn't exists in .github/workflows within the FlowCrypt browser extension's report - https://github.com/FlowCrypt/flowcrypt-browser/security/code-scanning/tools/CodeQL/status

I have invited you the test organization that i made to cross check this - https://github.com/An-Example-Org/sample-ossar/security.

[martgil]

Another option to try could be re-initializing the OSSAR Github Action - since it works very well with against my test repo under the test organization.

[sosnovsky]

It seems eslint fails with some errors when running in OSSAR Action

Maybe it happens because OSSAR Action uses outdated eslint 7.32.0, while our project is configured to work with eslint v8. I also re-checked OSSAR and we need only eslint from this action, as other tools there are for checking Python and C code. So it'll should be simpler to use just ESLint action - https://github.com/FlowCrypt/flowcrypt-browser/new/master?filename=.github%2Fworkflows%2Feslint.yml&workflow_template=code-scanning%2Feslint

[martgil]

Thanks @sosnovsky, I understand. I'll be more efficient by using ESLint action instead of OSSAR for a well-defined project like ours. I'll check it out.