Merge pull request #468 from github/bounty_template_forms

port all-for-one template to issue forms

Author: xcorail

.github/ISSUE_TEMPLATE/all-for-one.md

@@ -0,0 +1,90 @@
+name: All for One, One For All bounty submission
+description: Submit a CodeQL query for the All For One, One For All bounty (https://securitylab.github.com/bounties#allforone)
+title: "[<language>]: <short description>"
+labels: [All For One]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        # Introduction
+
+        Thank you for submitting a query to the GitHub CodeQL project!
+
+        After you submit this issue, the GitHub Security Lab and CodeQL teams will triage the submission and, if it meets the Query Bounty Program requirements, we will grant you a bounty through our HackerOne program.
+
+        Please make sure to carefully read the [bounty program description and conditions](https://securitylab.github.com/bounties#allforone)
+
+        # Questionnaire
+  - type: input
+    id: pr_url 
+    attributes:
+      label: Query PR
+      description: Link to pull request with your CodeQL query
+      placeholder: |
+        ex. https://github.com/github/codeql/pull/nnnn
+    validations:
+      required: true
+  - type: dropdown
+    id: language
+    attributes:
+      label: Language
+      description: What programming language is your query written for?
+      options:
+        - Java
+        - Javascript
+        - GoLang
+        - Python
+        - C/C++
+        - C#
+    validations:
+      required: true
+  - type: textarea
+    id: cve_ids
+    attributes:
+      label: CVE(s) ID list
+      description: Enter a list of the CVE ID(s) associated with this query, one bullet for each distinct CVE. GitHub will automatically link CVE IDs to the [GitHub Advisory Database](https://github.com/advisories). If the result(s) is **NOT YET** fixed **nor disclosed**, and you are still waiting for a CVE, then you can privately share your result via email to [security@github.com](mailto:security@github.com?subject=[BugBounty]%20Issue%20#000%20useful%20result)
+      placeholder: |
+        ex.
+        - [CVE-20nn-xxxx](<relevant URL>)
+        - [CVE-20nn-yyyy](<relevant URL>)
+    validations:
+      required: true
+  - type: input
+    id: cwe
+    attributes:
+      label: CWE
+      description: "[CWE](https://cwe.mitre.org/data/index.html) that best fits the vulnerability class modeled with your query"
+      placeholder: |
+        ex. CWE-502: Deserialization of Untrusted Data
+    validations:
+      required: false
+  - type: textarea
+    id: report
+    attributes:
+      label: Report
+      description: Describe the vulnerability. Provide any information you think will help GitHub assess the impact your query has on the open source community.
+      placeholder: |
+        1. What is the vulnerability?
+        2. How does the vulnerability work?
+        3. What strategy do you use in your query to find the vulnerability?
+        4. How have you reduced the number of **false positives**?
+        5. Other information?
+    validations:
+      required: true
+  - type: checkboxes
+    id: social 
+    attributes:
+      label: Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). 
+      description: We would love to have you spread the word about the good work you are doing
+      options:
+        - label: "Yes"
+        - label: "No" 
+    validations:
+      required: true
+  - type: input
+    id: social_url
+    attributes:
+      label: Blog post link
+      description: If you have already blogged about your query, please provide a link.
+    validations:
+      required: false