Contributing to Security Scorecards

Thank you for contributing your time and expertise to the Security Scorecards project. This document describes the contribution guidelines for the project.

Note: Before you start contributing, you must read and abide by our Code of Conduct.

Contributing code

Getting started

Environment Setup

You must install these tools:

git: For source control
go: You need go version v1.15 or higher.
docker: v18.9 or higher.

Contributing steps

Submit an issue describing your proposed change to the repo in question.
The repo owners will respond to your issue promptly.
Fork the desired repo, develop and test your code changes.
Submit a pull request.

How to build scorecard locally

Note that, by building the scorecard from the source code we are allowed to test the changes made locally.

Run the following command to clone your fork of the project locally

git clone git@github.com:<user>/scorecard.git $GOPATH/src/github.com/<user>/scorecard.git

Ensure you activate module support before continue ($ export GO111MODULE=on)
Run the command make build to build the source code

What to do before submitting a pull request

Following the targets that can be used to test your changes locally.

Command	Description	Is called in the CI?
make all	Runs go test,golangci lint checks, fmt, go mod tidy	yes
make build	Runs go build	yes
make e2e	Runs e2e tests	yes

Permission for GitHub personal access tokens

The personal access token need the following scopes:

repo:status - Access commit status
repo_deployment - Access deployment status
public_repo - Access public repositories

Where the CI Tests are configured

See the action files to check its tests, and the scripts used on it.

Adding New Checks

Each check is currently just a function of type CheckFn. The signature is:

type CheckFn func(c.Checker) CheckResult

Checks are registered in an init function:

	AllChecks = append(AllChecks, NamedCheck{
		Name: "Code-Review",
		Fn:   DoesCodeReview,
	})

Currently only one set of checks can be run. In the future, we'll allow declaring multiple suites and configuring which checks get run.

2.9 KiB Raw Blame History