You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: CONTRIBUTING.md
+5-5
Original file line number
Diff line number
Diff line change
@@ -4,13 +4,13 @@ The CLOMonitor project accepts contributions via [GitHub pull requests](https://
4
4
5
5
## Issues and discussions
6
6
7
-
Feature requests, bug reports, and support requests all occur through GitHub issues and discussions. If you would like to file an issue, view existing issues, or comment on an issue please engage with issues at <https://github.com/cncf/clomonitor/issues>. You can create new discussions, view existing ones and comment on them at <https://github.com/cncf/clomonitor/discussions>.
7
+
Feature requests, bug reports, and support requests all occur through GitHub issues and discussions. If you would like to file an issue, view existing issues, or comment on an issue, please engage with issues at <https://github.com/cncf/clomonitor/issues>. You can create new discussions, view existing ones and comment on them at <https://github.com/cncf/clomonitor/discussions>.
8
8
9
9
## Pull Requests
10
10
11
-
All changes to the source code and documentation are made through [GitHub pull requests](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/about-pull-requests). If you would like to make a change to the source, documentation, or other component in the repository please open a pull request with the change.
11
+
All changes to the source code and documentation are made through [GitHub pull requests](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/about-pull-requests). If you would like to make a change to the source, documentation, or other component in the repository, please open a pull request with the change.
12
12
13
-
If you are unsure if the change will be welcome you may want to file an issue first. The issue can detail the change and you can get feedback from the maintainers prior to starting to make the change.
13
+
If you are unsure if the change will be welcome, you may want to file an issue first. The issue can detail the change and you can get feedback from the maintainers prior to starting to make the change.
14
14
15
15
You can find the existing pull requests at <https://github.com/cncf/clomonitor/pulls>.
Notice how the `Author` and `Signed-off-by` lines match. If they do not match the PR will be rejected by the automated DCO check.
91
+
Notice how the `Author` and `Signed-off-by` lines match. If they do not match, the PR will be rejected by the automated DCO check.
92
92
93
-
If more than one person contributed to a commit than there can be more than one `Signed-off-by` line where each line is a signoff from a different person who contributed to the commit.
93
+
If more than one person contributed to a commit, then there can be more than one `Signed-off-by` line where each line is a signoff from a different person who contributed to the commit.
Copy file name to clipboardexpand all lines: docs/architecture.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -81,7 +81,7 @@ This layer represents a set of **Rust APIs** that provide some core functionalit
81
81
82
82
It's composed of two modules:
83
83
84
-
-**linter:** this module implements the core linting functionality of CLOMonitor. All checks currently run by CLOMonitor are handled by this module, and both the `CLI tool` and the `tracker` rely on it. The linter is able to run multiple `check sets` on each repository. Each `check set` defines a number of checks that will be run on the repository. For more details about what checks are run on each `check set` please see the [checks documentation](https://github.com/cncf/clomonitor/blob/main/docs/checks.md).
84
+
-**linter:** this module implements the core linting functionality of CLOMonitor. All checks currently run by CLOMonitor are handled by this module, and both the `CLI tool` and the `tracker` rely on it. The linter is able to run multiple `check sets` on each repository. Each `check set` defines a number of checks that will be run on the repository. For more details about what checks are run on each `check set`, please see the [checks documentation](https://github.com/cncf/clomonitor/blob/main/docs/checks.md).
85
85
86
86
-**score:** this module is in charge of scoring reports produced by the linter. The linter will produce different reports for each of the kinds supported, and each of the reports will be scored differently as well. In addition to the reports' scoring functionality, this module provides some score related features as well, like rating a given score or merging multiple scores.
Copy file name to clipboardexpand all lines: docs/checks.md
+10-10
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
3
3
**CLOMonitor** runs sets of checks periodically on all the repositories registered in the database. These checks are run *every hour*, provided the repository has changed since the last time it was checked. In the case of repositories that don't change often, we make sure that they are checked at least *once a day* anyway. This way we keep reports up to date with the latest checks additions and improvements.
4
4
5
-
Checks are organized in `check sets`. Each `check set` defines a number of checks that will be run on the repository and one or more `check sets` can be applied to a single repository. At the moment the following sets are supported: `code`, `code-lite`, `community` and `docs`. The set of checks run for each one are as follows:
5
+
Checks are organized in `check sets`. Each `check set` defines a number of checks that will be run on the repository and one or more `check sets` can be applied to a single repository. At the moment, the following sets are supported: `code`, `code-lite`, `community` and `docs`. The set of checks run for each one are as follows:
6
6
7
7
-**code** (recommended for projects' primary code repository)
8
8
@@ -65,7 +65,7 @@ Checks are organized in `check sets`. Each `check set` defines a number of check
65
65
66
66
Many checks rely on checking that certain files exists on a given path. Even though most of these checks support a number of variants, sometimes this won't work for some projects that may be using a different repository layout. In those cases, the recommended approach is to add a section to the `README` file of the repository pointing users to the document location. This will help users discovering this information and will make CLOMonitor happy :) At the moment we support detecting headers as well as links in `README` files that follow some patterns. Please see the reference below for more information on each case. Some projects have already proceeded this way successfully: [Kubernetes clomonitor PR](https://github.com/kubernetes/kubernetes/pull/108110), [KEDA clomonitor PR](https://github.com/kedacore/keda/pull/2704) and [Cilium clomonitor PR](https://github.com/cilium/cilium/pull/19037).
67
67
68
-
For more details about how each of the checks are performed, please see the reference below. Note that **CLOMonitor** does not follow symlinks when reading files content. If you find that any of the checks isn't working as expected or you have ideas about how to improve them please [file an issue](https://github.com/cncf/clomonitor/issues) or [open a discussion](https://github.com/cncf/clomonitor/discussions) in GitHub.
68
+
For more details about how each of the checks are performed, please see the reference below. Note that **CLOMonitor** does not follow symlinks when reading files content. If you find that any of the checks isn't working as expected or you have ideas about how to improve them, please [file an issue](https://github.com/cncf/clomonitor/issues) or [open a discussion](https://github.com/cncf/clomonitor/discussions) in GitHub.
69
69
70
70
## Exemptions
71
71
@@ -467,7 +467,7 @@ This check passes if:
467
467
468
468
**ID**: `openssf_scorecard_badge`
469
469
470
-
Scorecard assesses open source projects for security risks through a series of automated checks. For more information about the Scorecard badge please see <https://github.com/marketplace/actions/ossf-scorecard-action#scorecard-badge>.
470
+
Scorecard assesses open source projects for security risks through a series of automated checks. For more information about the Scorecard badge, please see <https://github.com/marketplace/actions/ossf-scorecard-action#scorecard-badge>.
471
471
472
472
This check passes if:
473
473
@@ -512,23 +512,23 @@ This check passes if:
512
512
513
513
This check determines whether the project has generated executable (binary) artifacts in the source repository.
514
514
515
-
*This is an OpenSSF Scorecard check. For more details please see the [check documentation](https://github.com/ossf/scorecard/blob/main/docs/checks.md#binary-artifacts) in the ossf/scorecard repository.*
515
+
*This is an OpenSSF Scorecard check. For more details, please see the [check documentation](https://github.com/ossf/scorecard/blob/main/docs/checks.md#binary-artifacts) in the ossf/scorecard repository.*
516
516
517
517
### Code review (from OpenSSF Scorecard)
518
518
519
519
**ID**: `code_review`
520
520
521
521
This check determines whether the project requires code review before pull requests (merge requests) are merged.
522
522
523
-
*This is an OpenSSF Scorecard check. For more details please see the [check documentation](https://github.com/ossf/scorecard/blob/main/docs/checks.md#code-review) in the ossf/scorecard repository.*
523
+
*This is an OpenSSF Scorecard check. For more details, please see the [check documentation](https://github.com/ossf/scorecard/blob/main/docs/checks.md#code-review) in the ossf/scorecard repository.*
524
524
525
525
### Dangerous workflow (from OpenSSF Scorecard)
526
526
527
527
**ID**: `dangerous_workflow`
528
528
529
529
This check determines whether the project's GitHub Action workflows has dangerous code patterns.
530
530
531
-
*This is an OpenSSF Scorecard check. For more details please see the [check documentation](https://github.com/ossf/scorecard/blob/main/docs/checks.md#dangerous-workflow) in the ossf/scorecard repository.*
531
+
*This is an OpenSSF Scorecard check. For more details, please see the [check documentation](https://github.com/ossf/scorecard/blob/main/docs/checks.md#dangerous-workflow) in the ossf/scorecard repository.*
532
532
533
533
### Dependencies policy
534
534
@@ -546,15 +546,15 @@ This check passes if:
546
546
547
547
This check tries to determine if the project uses a dependency update tool, specifically [dependabot](https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates) or [renovatebot](https://docs.renovatebot.com/configuration-options/).
548
548
549
-
*This is an OpenSSF Scorecard check. For more details please see the [check documentation](https://github.com/ossf/scorecard/blob/main/docs/checks.md#dependency-update-tool) in the ossf/scorecard repository.*
549
+
*This is an OpenSSF Scorecard check. For more details, please see the [check documentation](https://github.com/ossf/scorecard/blob/main/docs/checks.md#dependency-update-tool) in the ossf/scorecard repository.*
550
550
551
551
### Maintained (from OpenSSF Scorecard)
552
552
553
553
**ID**: `maintained`
554
554
555
555
This check determines whether the project is actively maintained.
556
556
557
-
*This is an OpenSSF Scorecard check. For more details please see the [check documentation](https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained) in the ossf/scorecard repository.*
557
+
*This is an OpenSSF Scorecard check. For more details, please see the [check documentation](https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained) in the ossf/scorecard repository.*
558
558
559
559
### Security insights
560
560
@@ -600,7 +600,7 @@ CASE SENSITIVE: false
600
600
601
601
This check tries to determine if the project cryptographically signs release artifacts.
602
602
603
-
*This is an OpenSSF Scorecard check. For more details please see the [check documentation](https://github.com/ossf/scorecard/blob/main/docs/checks.md#signed-releases) in the ossf/scorecard repository.*
603
+
*This is an OpenSSF Scorecard check. For more details, please see the [check documentation](https://github.com/ossf/scorecard/blob/main/docs/checks.md#signed-releases) in the ossf/scorecard repository.*
604
604
605
605
### Software bill of materials (SBOM)
606
606
@@ -631,7 +631,7 @@ This check passes if:
631
631
632
632
This check determines whether the project's automated workflows tokens are set to read-only by default.
633
633
634
-
*This is an OpenSSF Scorecard check. For more details please see the [check documentation](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions) in the ossf/scorecard repository.*
634
+
*This is an OpenSSF Scorecard check. For more details, please see the [check documentation](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions) in the ossf/scorecard repository.*
Copy file name to clipboardexpand all lines: docs/dev.md
+6-6
Original file line number
Diff line number
Diff line change
@@ -19,7 +19,7 @@ clomonitor_db_init
19
19
clomonitor_db_server
20
20
```
21
21
22
-
Once the database server is up an running, we can create the `clomonitor` database and we'll be ready to go:
22
+
Once the database server is up and running, we can create the `clomonitor` database and we'll be ready to go:
23
23
24
24
```sh
25
25
clomonitor_db_create
@@ -47,7 +47,7 @@ clomonitor_db_migrate
47
47
48
48
### Database tests
49
49
50
-
If you plan to do some work on the database layer, some extra setup is needed to be able to run the database tests. [Schema and database functions are tested](https://github.com/cncf/clomonitor/tree/main/database/tests) using the unit testing framework [pgTap](https://pgtap.org), so you need to [install](https://pgtap.org/documentation.html#installation) the pgTap PostgreSQL extension on your machine. To run the tests you will also need to install a perl tool called [pg_prove](https://pgtap.org/pg_prove.html) from CPAN (`cpan TAP::Parser::SourceHandler::pgTAP`).
50
+
If you plan to do some work on the database layer, some extra setup is needed to be able to run the database tests. [Schema and database functions are tested](https://github.com/cncf/clomonitor/tree/main/database/tests) using the unit testing framework [pgTap](https://pgtap.org), so you need to [install](https://pgtap.org/documentation.html#installation) the pgTap PostgreSQL extension on your machine. To run the tests, you will also need to install a perl tool called [pg_prove](https://pgtap.org/pg_prove.html) from CPAN (`cpan TAP::Parser::SourceHandler::pgTAP`).
51
51
52
52
Similarly to what we did during our initial database setup, we'll create a configuration file for Tern for the tests database in the same folder (`~/.config/clomonitor`), called `tern-tests.conf` with the following content (please adjust if needed):
53
53
@@ -81,7 +81,7 @@ insert into foundation values ('cncf', 'CNCF', 'https://raw.githubusercontent.co
81
81
82
82
The `registrar` component will process the foundations' data files and register the projects available.
83
83
84
-
At this point our database is ready to launch our local instance of CLOMonitor and start doing some work on it.
84
+
At this point, our database is ready to launch our local instance of CLOMonitor and start doing some work on it.
85
85
86
86
## Backend
87
87
@@ -122,7 +122,7 @@ Now you can run the `apiserver`:
122
122
clomonitor_apiserver
123
123
```
124
124
125
-
The `apiserver` process launches an http server that serves the web application and the API that powers it. Once it is up and running, you can point your browser to [http://localhost:8000](http://localhost:8000) and you should see the CLOMonitor web application. Initially there won't be any projects listed on it, but we'll take care of that in the next section.
125
+
The `apiserver` process launches an http server that serves the web application and the API that powers it. Once it is up and running, you can point your browser to [http://localhost:8000](http://localhost:8000) and you should see the CLOMonitor web application. Initially, there won't be any projects listed on it, but we'll take care of that in the next section.
126
126
127
127
### Registrar
128
128
@@ -181,7 +181,7 @@ Depending on the speed of your Internet connection and machine, this may take on
181
181
182
182
### Linter CLI
183
183
184
-
In the section above we saw how the `tracker` is able to lint all repositories registered in the database. But sometimes it may be desirable to lint a single repository manually in an isolated way, maybe to quickly test some checks or to integrate with some other processes, like continuous integration or deployment tools. The `linter CLI` tool is designed to help in those scenarios.
184
+
In the section above, we saw how the `tracker` is able to lint all repositories registered in the database. But sometimes, it may be desirable to lint a single repository manually in an isolated way, maybe to quickly test some checks or to integrate with some other processes, like continuous integration or deployment tools. The `linter CLI` tool is designed to help in those scenarios.
185
185
186
186
CLOMonitor delegates some of the security checks to [OpenSSF Scorecard](https://github.com/ossf/scorecard), so you'll need to [install it](https://github.com/ossf/scorecard#installation) before running `clomonitor-linter` locally. Both CLOMonitor and [OpenSSF Scorecard](https://github.com/ossf/scorecard) use the Github GraphQL API for some checks, which requires authentication. A Github token (with `public_repo` scope) **must** be provided via the `GITHUB_TOKEN` environment variable to authenticate those requests.
187
187
@@ -205,7 +205,7 @@ cargo test
205
205
206
206
The CLOMonitor frontend is a single page application written in [TypeScript](https://www.typescriptlang.org) using [React](https://reactjs.org).
207
207
208
-
In the backend section we mentioned how to install the frontend dependencies and build it. That should be enough if you are only going to work on the backend. However, if you are planning to do some work on the frontend, it's better to launch an additional server which will rebuild the web application as needed whenever a file is modified.
208
+
In the backend section, we mentioned how to install the frontend dependencies and build it. That should be enough if you are only going to work on the backend. However, if you are planning to do some work on the frontend, it's better to launch an additional server which will rebuild the web application as needed whenever a file is modified.
209
209
210
210
The frontend development server can be launched using the following command:
In the [clomonitor-core/src/linter/checks/util](https://github.com/cncf/clomonitor/tree/main/clomonitor-core/src/linter/checks/util) directory there are some helpers that can be useful when writing new checks.
22
+
In the [clomonitor-core/src/linter/checks/util](https://github.com/cncf/clomonitor/tree/main/clomonitor-core/src/linter/checks/util) directory, there are some helpers that can be useful when writing new checks.
0 commit comments