Skip to content

Latest commit

 

History

History
93 lines (63 loc) · 9.1 KB

CONTRIBUTING.md

File metadata and controls

93 lines (63 loc) · 9.1 KB

Contributing

Hi there! We are thrilled that you'd like to contribute to this project. Your help is essential for keeping it great. The following is a set of guidelines for contributing to Security Requirement Analysis GitHub Action which is hosted in the VeriDevOps Organization on GitHub.

Table Of Contents

Code of Conduct

How Can I Contribute?

Additional Notes

Code of Conduct

This project and everyone participating in it is governed by the Security Requirement Analysis GitHub Action Code of Conduct. By participating, you agree to abide by its terms. Please report unacceptable behavior to r.talalaeva@innopolis.university.

How Can I Contribute?

Reporting and Fixing Bugs

  • Ensure the bug was not already reported by searching on GitHub under Issues.

  • If you're unable to find an open issue addressing the problem, open a new one and choose Bug report type. Be sure to include a title and clear description, as much relevant information as possible, and a workflow code sample or an executable test case demonstrating the expected and actual behavior.

  • Fix bug and submit a PR.

New Features

  1. Suggest your change via opening a new issue and choose Feature request type.

  2. Implement a new feature and submit a PR, after acceptance through Issue.

Submitting a Pull Request

  1. Fork and clone the repository.

  2. Configure and install the dependencies:

    1. In the project we use Node v16.14.0 with npm v8.3.1. Use nvm tool to easily control different versions of Node. Or install manually.
    2. Install dependencies via: npm install.

  3. Make your change to the code under src/ folder. Try preserve the structure:

    File name Description
    index.ts It is a main file. It has a function run() that is responsible for the whole action.
    apiService.ts Contains functions that are responsible to make API calls to ARQAN model or other services outside the GitHub.
    github.ts Contains functions that are working with github context.
    interfaces.ts Contains all interfaces that are used in the code.
    requirement.ts Contains all logic that is connected with classification Issue as a requirement and suggestion appropriate STIGs to it.
    rqcode.ts Contains all logic that is connected with RQCODE repository: searching test cases for the list of STIGs, commenting about found tests, opening issues in RQCODE and commenting about opened issues.

    NOTE: If you add another file for covering your logic, update the table above accordingly, please.

  4. If you added new input or output for the action, make sure you have updated the action.yml. See the documentation.

  5. Build your code with npm run prettier && npm run build.

  6. Push to your fork and submit a pull request. Ensure the PR description clearly describes the problem/new feature and solution. Include the relevant issue number if applicable.

  7. Wait for your pull request to be reviewed and merged.

Here are a few things you can do that will increase the likelihood of your pull request being accepted:

  • Keep your change as focused as possible. If there are multiple changes you would like to make that are not dependent upon each other, consider submitting them as separate pull requests.
  • Write a good commit message.

Additional Notes

Issue and Pull Request Labels

This section lists the labels we use to help us track and manage issues and pull requests.

Type of Issue and Issue State

Label name VeriDevOps/security-requirement-analysis 🔎 Description
enhancement search Feature requests.
bug search Confirmed bugs or reports that are very likely to be bugs.
good first issue search Less complex issues which would be good first issues to work on for users who want to contribute to Security Requirement Analysis GitHub Action.
question search Questions more than bug reports or feature requests (e.g. how do I do X).
help wanted search The VeriDevOps core team would appreciate help from the community in resolving these issues.
duplicate search Issues which are duplicates of other issues, i.e. they have been reported before.
wontfix search The VeriDevOps core team has decided not to fix these issues for now, either because they're working as intended or for some other reason.
dependencies search Label for dependabot Pull Requests or for users updates on dependencies.
security search Label for classifying Issues that are Security Requirements.
testing search Label used for classifying Issues that are opened for the test purposes.

Resources