You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CHANGELOG.md
+1-5Lines changed: 1 addition & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,16 +2,14 @@
2
2
3
3
All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
* minor bugs ([#4](https://github.com/ossf/scorecard-monitor/issues/4)) ([e07d7f7](https://github.com/ossf/scorecard-monitor/commits/e07d7f7dd38efa5caaf64d0c548752f2ae54ed45))
1. Create a [personal access token](https://docs.github.com/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens)
36
+
1. Set up your [development environment](#environment-setup)
37
37
38
38
### Environment Setup
39
39
40
40
You must install these tools:
41
41
42
-
1.[`git`](https://help.github.com/articles/set-up-git/): For source control
42
+
1.[`git`](https://help.github.com/articles/set-up-git/): For source control
43
43
44
-
1.[`node`](https://nodejs.org/en/download/package-manager): You need node version
45
-
`v20+`. The project includes support for [nvm](https://github.com/nvm-sh/nvm).
44
+
1.[`node`](https://nodejs.org/en/download/package-manager): You need node version `v20+`. The project includes support for [nvm](https://github.com/nvm-sh/nvm).
46
45
47
46
### New to Node.js?
48
47
49
48
If you're unfamiliar with Node.js, there are plenty of articles, resources, and books.
50
49
We recommend starting with several resources from the official Node.js website:
51
50
52
-
*[Introduction to Node.js](https://nodejs.org/en/learn/getting-started/introduction-to-nodejs)
51
+
-[Introduction to Node.js](https://nodejs.org/en/learn/getting-started/introduction-to-nodejs)
53
52
54
53
## Contributing steps
55
54
56
-
1.Identify an existing issue you would like to work on, or submit an issue describing your proposed change to the repo in question.
57
-
1.The maintainers will respond to your issue promptly.
58
-
1.Fork this repo, develop, and test your code changes.
59
-
1.Submit a pull request.
55
+
1. Identify an existing issue you would like to work on, or submit an issue describing your proposed change to the repo in question.
56
+
1. The maintainers will respond to your issue promptly.
57
+
1. Fork this repo, develop, and test your code changes.
58
+
1. Submit a pull request.
60
59
61
60
## Running the project locally
62
61
@@ -73,6 +72,7 @@ First, check that you are using Node v20+ and then execute `npm ci` instead of `
73
72
Currently, the project is using [Jest](https://jestjs.io/) and [Snapshot Testing](https://jestjs.io/docs/snapshot-testing).
74
73
75
74
You have several options to run the tests:
75
+
76
76
-`npm run test`: this will run the tests
77
77
-`npm run test:update`: this will run the tests and update the snapshots
78
78
-`npm run test:coverage` this will run the tests and generate a coverage report as terminal output and in HTML format that can be found in the `coverage/` folder
@@ -109,9 +109,8 @@ change, it's generally encouraged to submit the bugfix separately, but if you mu
109
109
110
110
## Where the CI Tests are configured
111
111
112
-
1. See the [action files](.github/workflows) to check its tests, and the
113
-
scripts used on it.
112
+
1. See the [action files](.github/workflows) to check its tests, and the scripts used on it.
114
113
115
114
## Updating Docs
116
115
117
-
The documentation can be found in the [README](./README.md). Any changes that are merged to `main` will be reflected directly on https://github.com/marketplace/actions/openssf-scorecard-monitor. Therefore, documentation changes do not require a specific release.
116
+
The documentation can be found in the [README](./README.md). Any changes that are merged to `main` will be reflected directly on the [GitHub Actions Marketplace](https://github.com/marketplace/actions/openssf-scorecard-monitor), so documentation changes do not require a specific release.
Copy file name to clipboardExpand all lines: README.md
+7-13Lines changed: 7 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,25 +2,19 @@
2
2
3
3
**Simplify OpenSSF Scorecard tracking in your organization with automated markdown and JSON reports, plus optional GitHub issue alerts.**
4
4
5
-
---
6
-
7
-
**📢 IMPORTANT**
8
-
9
-
This project is now part of the [OpenSSF](https://openssf.org/) organization. You can find more information about it in [this announcement](https://github.com/ossf/scorecard-monitor/issues/79).
10
-
11
-
---
5
+
*This project is part of [OpenSSF Scorecard](https://github.com/ossf/scorecard). Read [the announcement](https://github.com/ossf/scorecard-monitor/issues/79) for more details.*
12
6
13
7
## 🔮 About
14
8
15
-
If you're feeling overwhelmed by an avalanche of repository scorecards in your organization, you can breathe easy: Automation is here to make your life easier! It will streamline the process of keeping track of them all by providing a comprehensive report in Markdown and a local database in JSON with all the scores. Furthermore, to stay on top of any changes in the scores, you can choose to get notifications through Github Issues.
9
+
If you're feeling overwhelmed by an avalanche of scorecards across your organizations, you can breathe easy: automation is here to make your life easier! Scorecard Monitor streamlines the process of keeping track of them all by providing a comprehensive report in Markdown and a local database in JSON with all the scores. To stay on top of any changes in the scores, you can also choose to get notifications through Github Issues.
16
10
17
11
## ✅ Requirements
18
12
19
13
Please ensure that any repository you wish to track with Scorecard Monitor has already been analyzed by [OpenSSF Scorecard](https://github.com/ossf/scorecard) at least once. This can be accomplished using the official [GitHub Action](https://github.com/ossf/scorecard-action) or the [Scorecard CLI](https://github.com/ossf/scorecard?tab=readme-ov-file#scorecard-command-line-interface).
20
14
21
15
It's also possible that some repositories in your organization are already being [automatically tracked](https://github.com/ossf/scorecard/blob/main/docs/faq.md#can-i-preview-my-projects-score) by OpenSSF in this [CSV file](https://github.com/ossf/scorecard/blob/main/cron/internal/data/projects.csv) via weekly cronjob. One caveat: Automatically tracked projects _do not_ include [certain checks](https://github.com/ossf/scorecard/issues/3438) in their analysis (`CI-Tests,Contributors,Dependency-Update-Tool,Webhooks`).
22
16
23
-
If you're not sure whether a specific project is already using Scorecard, you can always spot-check with the following URL pattern: `https://securityscorecards.dev/viewer/?uri=github.com/<ORG_NAME>/<REPO_NAME>` (substitute `<ORG_NAME>` and `<REPO_NAME>` as appropriate). The [Scorecard API](https://api.securityscorecards.dev/) is also able to fetch scores for a given repository.
17
+
If you're not sure whether a specific project is already using OpenSSF Scorecard, you can always spot-check with the following URL pattern: `https://securityscorecards.dev/viewer/?uri=github.com/<ORG_NAME>/<REPO_NAME>` (substitute `<ORG_NAME>` and `<REPO_NAME>` as appropriate). The [Scorecard API](https://api.scorecard.dev/) is also able to fetch scores for a given repository.
24
18
25
19
## 📺 Tutorial
26
20
@@ -31,7 +25,7 @@ If you would like to contribute to the documentation, please feel free to open a
31
25
32
26
- Easy to use with great customization
33
27
- Easy to patch the scoring as the reports includes a direct link to [StepSecurity](https://app.stepsecurity.io)
34
-
- Easy way to visualize the scorecard results with [The Scorecard Visualizer](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node) or [deps.dev](https://deps.dev/project/github/nodejs%2Fnode)
28
+
- Easy way to visualize results with [Scorecard Visualizer](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node) or [deps.dev](https://deps.dev/project/github/nodejs%2Fnode)
35
29
- Cutting-edge feature that effortlessly compares OpenSSF scorecards between previous and current commits with [The Scorecard Visualizer Comparator](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node/compare/39a08ee8b8d3818677eb823cb566f36b1b1c4671/19fa9f1bc47b0666be0747583bea8cb3d8ad5eb1)
36
30
- Discovery mode: list all the repos in one or many organizations that are already being tracked with [OpenSSF Scorecard](https://github.com/ossf/scorecard)
37
31
- Reporting in Markdown with essential information (hash, date, score) and comparative against the prior score
@@ -42,7 +36,7 @@ If you would like to contribute to the documentation, please feel free to open a
42
36
- Extend the markdown template with you own content by using tags
43
37
- Easy to modify the files and ensure the integrity with JSON Schemas
44
38
- The report data is exported as an output and can be used in the pipeline
45
-
- Great test coverage (in progress)
39
+
- Great test coverage
46
40
47
41
### 🎉 Demo
48
42
@@ -136,7 +130,7 @@ jobs:
136
130
- `report-tags-enabled`: Defines if the markdown report must be created/updated around tags by default is disabled. This is useful if the report is going to be include in a file that has other content on it, like docusaurus docs site or similar
137
131
- `report-start-tag`Defines the start tag, default `<!-- OPENSSF-SCORECARD-MONITOR:START -->`
138
132
- `report-end-tag`: Defines the closing tag, default `<!-- OPENSSF-SCORECARD-MONITOR:END -->`
139
-
- `render-badge`: Defines if the OpenSSF badge must be rendered in the reportor to only show the score
133
+
- `render-badge`: Defines if the OpenSSF Scorecard badge must be rendered in the reporter to only show the score
140
134
- `report-tool`: Defines the reporting review tool in place: `scorecard-visualizer` [Example](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node) or `deps.dev` [Example](https://deps.dev/project/github/nodejs%2Fnode), by default `scorecard-visualizer`
141
135
142
136
### Outputs
@@ -285,4 +279,4 @@ Just for reference, the database will store the current value and previous value
285
279
286
280
## 💪 Contributing
287
281
288
-
Please read [CONTRIBUTING.md](https://github.com/UlisesGascon/.github/blob/main/contributing.md) for details on our code of conduct and the process for submitting pull requests to us. You need to accept DCO 1.1 in order to make contributions.
282
+
Please read [CONTRIBUTING.md](https://github.com/ossf/scorecard-monitor/blob/main/CONTRIBUTING.md) for details on our code of conduct and the process for submitting pull requests to us. You need to accept DCO 1.1 in order to make contributions.
Copy file name to clipboardExpand all lines: RELEASE.md
+3-5Lines changed: 3 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,14 +8,12 @@ This document describes the process for releasing a new version of the Scorecard
8
8
9
9
In order to generate a new release, it is recommended to use the commands:
10
10
11
-
12
-
```
11
+
```console
13
12
npm run release:minor
14
13
npm run release:patch
15
14
npm run release:major
16
15
```
17
16
18
-
19
17
This includes all the changes in the [CHANGELOG](./CHANGELOG.md) and ensures that the `package.json` and `package-lock.json` are up to date.
20
18
21
19
You can discard the tag that has been generated locally, as we won't use it.
@@ -33,5 +31,5 @@ In order to create a new release, follow these steps:
33
31
3. Target the new release version, like `v.1.0.3-beta5`. Note that you can use metadata like `-beta5` and you must include `v` as prefix.
34
32
4. Mark `Set as the latest release`
35
33
5. (Optionally) mark `Set as a pre-release` if it is non-production ready.
36
-
6.:bulb:**Hint:** You can check another release ([example](https://github.com/ossf/scorecard-monitor/releases/tag/v2.0.0-beta7)) to follow the style for title and description (_Main Changes, PRs, New contributions_).
37
-
7. Click the `Generate release notes` button in the top right to automatically populate the release description.
34
+
6.:bulb:**Hint:** You can check another release ([example](https://github.com/ossf/scorecard-monitor/releases/tag/v2.0.0-beta7)) to follow the style for title and description (_Main Changes, PRs, New contributions_).
35
+
7. Click the `Generate release notes` button in the top right to automatically populate the release description.
0 commit comments