Skip to content

Commit aac2364

Browse files
gimlichaelgimlichael
authored
Ossf/gha scorecard (#10)
👷 support for OpenSSF Scorecard 💬 updated community health pages
1 parent c09d767 commit aac2364

File tree

7 files changed

+252
-3
lines changed

7 files changed

+252
-3
lines changed

‎.github/CODE_OF_CONDUCT.md

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
# Contributor Covenant Code of Conduct
2+
3+
This document is adapted from the Contributor Covenant which is used by many open source projects,
4+
including those under the [.NET Foundation](https://dotnetfoundation.org/code-of-conduct).
5+
6+
## Our Pledge
7+
8+
We as members, contributors, and leaders pledge to make participation in our
9+
community a harassment-free experience for everyone, regardless of age, body
10+
size, visible or invisible disability, ethnicity, sex characteristics, gender
11+
identity and expression, level of experience, education, socio-economic status,
12+
nationality, personal appearance, race, caste, color, religion, or sexual identity
13+
and orientation.
14+
15+
We pledge to act and interact in ways that contribute to an open, welcoming,
16+
diverse, inclusive, and healthy community.
17+
18+
## Our Standards
19+
20+
Examples of behavior that contributes to a positive environment for our
21+
community include:
22+
23+
* Demonstrating empathy and kindness toward other people
24+
* Being respectful of differing opinions, viewpoints, and experiences
25+
* Giving and gracefully accepting constructive feedback
26+
* Accepting responsibility and apologizing to those affected by our mistakes,
27+
and learning from the experience
28+
* Focusing on what is best not just for us as individuals, but for the
29+
overall community
30+
31+
Examples of unacceptable behavior include:
32+
33+
* The use of sexualized language or imagery, and sexual attention or
34+
advances of any kind
35+
* Trolling, insulting or derogatory comments, and personal or political attacks
36+
* Public or private harassment
37+
* Publishing others' private information, such as a physical or email
38+
address, without their explicit permission
39+
* Other conduct which could reasonably be considered inappropriate in a
40+
professional setting
41+
42+
## Enforcement Responsibilities
43+
44+
Community leaders are responsible for clarifying and enforcing our standards of
45+
acceptable behavior and will take appropriate and fair corrective action in
46+
response to any behavior that they deem inappropriate, threatening, offensive,
47+
or harmful.
48+
49+
Community leaders have the right and responsibility to remove, edit, or reject
50+
comments, commits, code, wiki edits, issues, and other contributions that are
51+
not aligned to this Code of Conduct, and will communicate reasons for moderation
52+
decisions when appropriate.
53+
54+
## Scope
55+
56+
This Code of Conduct applies within all community spaces, and also applies when
57+
an individual is officially representing the community in public spaces.
58+
Examples of representing our community include using an official e-mail address,
59+
posting via an official social media account, or acting as an appointed
60+
representative at an online or offline event.
61+
62+
## Enforcement
63+
64+
Instances of abusive, harassing, or otherwise unacceptable behavior may be
65+
reported to the community leaders responsible for enforcement at
66+
[INSERT CONTACT METHOD].
67+
All complaints will be reviewed and investigated promptly and fairly.
68+
69+
All community leaders are obligated to respect the privacy and security of the
70+
reporter of any incident.
71+
72+
## Enforcement Guidelines
73+
74+
Community leaders will follow these Community Impact Guidelines in determining
75+
the consequences for any action they deem in violation of this Code of Conduct:
76+
77+
### 1. Correction
78+
79+
**Community Impact**: Use of inappropriate language or other behavior deemed
80+
unprofessional or unwelcome in the community.
81+
82+
**Consequence**: A private, written warning from community leaders, providing
83+
clarity around the nature of the violation and an explanation of why the
84+
behavior was inappropriate. A public apology may be requested.
85+
86+
### 2. Warning
87+
88+
**Community Impact**: A violation through a single incident or series
89+
of actions.
90+
91+
**Consequence**: A warning with consequences for continued behavior. No
92+
interaction with the people involved, including unsolicited interaction with
93+
those enforcing the Code of Conduct, for a specified period of time. This
94+
includes avoiding interactions in community spaces as well as external channels
95+
like social media. Violating these terms may lead to a temporary or
96+
permanent ban.
97+
98+
### 3. Temporary Ban
99+
100+
**Community Impact**: A serious violation of community standards, including
101+
sustained inappropriate behavior.
102+
103+
**Consequence**: A temporary ban from any sort of interaction or public
104+
communication with the community for a specified period of time. No public or
105+
private interaction with the people involved, including unsolicited interaction
106+
with those enforcing the Code of Conduct, is allowed during this period.
107+
Violating these terms may lead to a permanent ban.
108+
109+
### 4. Permanent Ban
110+
111+
**Community Impact**: Demonstrating a pattern of violation of community
112+
standards, including sustained inappropriate behavior, harassment of an
113+
individual, or aggression toward or disparagement of classes of individuals.
114+
115+
**Consequence**: A permanent ban from any sort of public interaction within
116+
the community.
117+
118+
## Attribution
119+
120+
This Code of Conduct is adapted from the [Contributor Covenant][homepage],
121+
version 2.0, available at
122+
[https://www.contributor-covenant.org/version/2/0/code_of_conduct.html][v2.0].
123+
124+
Community Impact Guidelines were inspired by
125+
[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
126+
127+
For answers to common questions about this code of conduct, see the FAQ at
128+
[https://www.contributor-covenant.org/faq][FAQ]. Translations are available
129+
at [https://www.contributor-covenant.org/translations][translations].
130+
131+
[homepage]: https://www.contributor-covenant.org
132+
[v2.0]: https://www.contributor-covenant.org/version/2/0/code_of_conduct.html
133+
[Mozilla CoC]: https://github.com/mozilla/diversity
134+
[FAQ]: https://www.contributor-covenant.org/faq
135+
[translations]: https://www.contributor-covenant.org/translations

‎.github/CONTRIBUTING.md

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# Contributing to `Shared Kernel API by Codebelt`
2+
When contributing to this repository, please first discuss the change you wish to make via issue,
3+
email, or any other method with the owners of this repository before making a change.
4+
5+
Please note we have a code of conduct, please follow it in all your interactions with the project.
6+
7+
## Code of Conduct
8+
Please review our [code of conduct](CODE_OF_CONDUCT.md).
9+
10+
## Our Development Process
11+
We use `trunk` based branching model that is aligned with todays DevSecOps practices.
12+
All new features and/or fixes are merged into the `main` branch by creating a Pull Request.
13+
14+
## Pull Requests
15+
We actively welcome your pull requests.
16+
17+
1. Fork the repo and create your branch from `main`
18+
2. If you've added code that should be tested, add tests (DO follow [Microsoft Engineering Guidelines](https://github.com/dotnet/aspnetcore/wiki/Engineering-guidelines))
19+
3. Any changes or additions requires documentation in the form of documenting public members
20+
4. Ensure that all existing as well as new test passes
21+
5. Issue that pull request with a big and heartful thanks for contributing
22+
23+
## Issues
24+
We use GitHub issues to track public bugs. Please ensure your description is
25+
clear and has sufficient instructions to be able to reproduce the issue.
26+
27+
## Coding Guidelines
28+
* Please follow [Framework Design Guidelines](https://learn.microsoft.com/en-us/dotnet/standard/design-guidelines/)
29+
* Please follow SOLID principles
30+
* Please follow [Microsoft Engineering Guidelines](https://github.com/dotnet/aspnetcore/wiki/Engineering-guidelines)
31+
32+
## Manifesto
33+
As aspiring Software Craftsmen we are raising the bar of professional software development by practicing it and helping others learn the craft.
34+
35+
Through this work we have come to value:
36+
37+
* Not only working software,
38+
but also well-crafted software
39+
* Not only responding to change,
40+
but also steadily adding value
41+
* Not only individuals and interactions,
42+
but also a community of professionals
43+
* Not only customer collaboration,
44+
but also productive partnerships
45+
46+
That is, in pursuit of the items on the left we have found the items on the right to be indispensable.
47+
48+
[Manifesto for Software Craftsmanship](https://manifesto.softwarecraftsmanship.org/) is the originator of this text.
49+
50+
## License
51+
By contributing to `Shared Kernel API by Codebelt`, you agree that your contributions will be licensed
52+
under the MIT license.

‎.github/codecov.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
ignore:
2+
- "test"

‎.github/dependabot.yml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "nuget"
4+
directory: "/src"
5+
schedule:
6+
interval: "weekly"
7+
open-pull-requests-limit: 0
8+
- package-ecosystem: "nuget"
9+
directory: "/test"
10+
schedule:
11+
interval: "weekly"
12+
open-pull-requests-limit: 0
13+
- package-ecosystem: "github-actions"
14+
directory: "/.github/workflows"
15+
schedule:
16+
interval: "weekly"
17+
open-pull-requests-limit: 0

‎.github/workflows/pipelines.yml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,10 @@ on:
33
pull_request:
44
branches: [main]
55
paths-ignore:
6-
- .github/**
6+
- .codecov/**
7+
- .docfx/**
78
- .nuget/**
8-
- '**.md'
9+
- '**/*.md'
910
workflow_dispatch:
1011
inputs:
1112
configuration:

‎.github/workflows/scorecard.yml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: Scorecard supply-chain security
2+
on:
3+
branch_protection_rule:
4+
schedule:
5+
- cron: '45 17 * * 2'
6+
push:
7+
branches: [ "main" ]
8+
9+
permissions: read-all
10+
11+
jobs:
12+
analysis:
13+
name: Scorecard analysis
14+
runs-on: ubuntu-latest
15+
permissions:
16+
security-events: write
17+
id-token: write
18+
19+
steps:
20+
- name: "Checkout code"
21+
uses: actions/checkout@v4
22+
with:
23+
persist-credentials: false
24+
25+
- name: "Run analysis"
26+
uses: ossf/[email protected]
27+
with:
28+
results_file: results.sarif
29+
results_format: sarif
30+
publish_results: true
31+
32+
- name: "Upload artifact"
33+
uses: actions/upload-artifact@v4
34+
with:
35+
name: SARIF file
36+
path: results.sarif
37+
retention-days: 5
38+
39+
- name: "Upload to code-scanning"
40+
uses: github/codeql-action/upload-sarif@v3
41+
with:
42+
sarif_file: results.sarif

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
# Shared Kernel API by Codebelt
44

5-
[![Shared Kernel CI/CD Pipeline](https://github.com/codebeltnet/shared-kernel/actions/workflows/pipelines.yml/badge.svg)](https://github.com/codebeltnet/shared-kernel/actions/workflows/pipelines.yml) [![codecov](https://codecov.io/gh/codebeltnet/shared-kernel/graph/badge.svg?token=xdDAkBq1s3)](https://codecov.io/gh/codebeltnet/shared-kernel) [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=sharedkernel&metric=alert_status)](https://sonarcloud.io/dashboard?id=sharedkernel) [![Maintainability Rating](https://sonarcloud.io/api/project_badges/measure?project=sharedkernel&metric=sqale_rating)](https://sonarcloud.io/dashboard?id=sharedkernel) [![Reliability Rating](https://sonarcloud.io/api/project_badges/measure?project=sharedkernel&metric=reliability_rating)](https://sonarcloud.io/dashboard?id=sharedkernel) [![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=sharedkernel&metric=security_rating)](https://sonarcloud.io/dashboard?id=sharedkernel)
5+
[![Shared Kernel CI/CD Pipeline](https://github.com/codebeltnet/shared-kernel/actions/workflows/pipelines.yml/badge.svg)](https://github.com/codebeltnet/shared-kernel/actions/workflows/pipelines.yml) [![codecov](https://codecov.io/gh/codebeltnet/shared-kernel/graph/badge.svg?token=xdDAkBq1s3)](https://codecov.io/gh/codebeltnet/shared-kernel) [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=sharedkernel&metric=alert_status)](https://sonarcloud.io/dashboard?id=sharedkernel) [![Maintainability Rating](https://sonarcloud.io/api/project_badges/measure?project=sharedkernel&metric=sqale_rating)](https://sonarcloud.io/dashboard?id=sharedkernel) [![Reliability Rating](https://sonarcloud.io/api/project_badges/measure?project=sharedkernel&metric=reliability_rating)](https://sonarcloud.io/dashboard?id=sharedkernel) [![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=sharedkernel&metric=security_rating)](https://sonarcloud.io/dashboard?id=sharedkernel) [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/codebeltnet/shared-kernel/badge)](https://scorecard.dev/viewer/?uri=github.com/codebeltnet/shared-kernel)
66

77
An open-source project offering a lightweight .NET library with essential components for implementing the shared kernel pattern within the context of Domain-Driven Design (DDD). It provides generic and reusable (Single) Value Objects utilizing the [Savvyio.Domain](https://www.nuget.org/packages/Savvyio.Domain) package for fundamental classes, records and interfaces.
88

0 commit comments

Comments
 (0)