From 77b4052fced97d908b895c5c0cce77153a42777d Mon Sep 17 00:00:00 2001 From: Elsa Mayra Irgens Date: Mon, 13 Nov 2023 13:05:44 +0100 Subject: [PATCH] Update information --- CONTRIBUTING.md | 37 +++++++++++++++++++++++++++++++++++++ README.md | 10 ++++++++++ SECURITY.md | 18 ++++++++++++++++++ 3 files changed, 65 insertions(+) create mode 100644 CONTRIBUTING.md create mode 100644 SECURITY.md diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..76851a2 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,37 @@ +# How to contribute to this repo + +We love your input! We want to make contributing to this project as easy and transparent as possible, whether it's: + +- Reporting a bug +- Proposing new features +- Discussing the current state of the code +- Submitting a fix + +This is how you should do it: + +Use our [issue list](../../issues) to report a **bug** or **propose a new feature**, including + +### For **bug report** +- A quick summary and/or background +- Steps to reproduce + - Be specific! + - Give sample code if you can +- What you expected would happen +- What actually happens + +The team love thorough bug reports - no it's not a joke! + +### For **feature request** +- Brief description of the feature +- What problem/issue will this solve +- A sort of Definition of Done - "How should it look when finsihed" + +### When submitting a fix using a Pull Request (PR) + +- Fork this repository from GitHub +- Once, you have a local copy (after forking) you can make edits to the code, make formatting changes, reorganise the code, add documentation etc … +- After you have made the changes, you have to create a pull request + +We will review the pull request and if it appropriate and there are no clashes or vulnerabilities, it will be merged to the main code + +Voila! you have contributed to a piece of software and the cycle repeats. diff --git a/README.md b/README.md index 03c5c76..b67e0f5 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,5 @@ +![build workflow](https://github.com/equinor/radix-vulnerability-scanner/actions/workflows/build-push.yml/badge.svg) + # radix-vulnerability-scanner ## Introduction @@ -48,6 +50,10 @@ Every command line argument can be specified as an environment variable by prefi You need Go (>=1.21) installed. Make sure GOPATH and GOROOT are properly set up. Clone the repo into your GOPATH and run go mod download +## Contribution + +Want to contribute? Read our [contributing guidelines](./CONTRIBUTING.md) + ### Generating mocks We use gomock to generate mocks used in unit test. You need to regenerate mocks if you make changes to any of the interface types used by the application. @@ -58,3 +64,7 @@ make mocks ### Debugging locally Create a copy of .env.template and name it .env. Set variables to allow local debugging. This file is ignored by git. + +## Security + +This is how we handle [security issues](./SECURITY.md) \ No newline at end of file diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..5df104d --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,18 @@ +# Security + +If you discover a security vulnerability in this project, please follow these steps to responsibly disclose it: + +1. **Do not** create a public GitHub issue for the vulnerability. +2. Follow our guideline for Responsible Disclosure Policy at [https://www.equinor.com/about-us/csirt](https://www.equinor.com/about-us/csirt) to report the issue + +The following information will help us triage your report more quickly: + +- Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.) +- Full paths of source file(s) related to the manifestation of the issue +- The location of the affected source code (tag/branch/commit or direct URL) +- Any special configuration required to reproduce the issue +- Step-by-step instructions to reproduce the issue +- Proof-of-concept or exploit code (if possible) +- Impact of the issue, including how an attacker might exploit the issue + +We prefer all communications to be in English.