docs(security): rewrite .bestpractices.json to canonical autofill schema (RAN-58)#47
Merged
Merged
Conversation
…ema (RAN-58) Rewrite `.bestpractices.json` from the custom group structure (status / evidence / audit) to the flat per-criterion schema that bestpractices.dev's autofill robot reads, so the board can flip project 12646 to `passing` without hand-typing 67 answers. - 67 canonical criteria from criteria.yml `'0':` block (43 MUST, 10 SHOULD, 14 SUGGESTED) - 65 Met + 2 honest N/A: crypto_password_storage (no password storage; bearer-token auth only) and dynamic_analysis_unsafe (Go is memory-safe; no unsafe.Pointer in app code) - All 8 url-required criteria carry `_url` evidence - Meta fields preserved: project_id, name, description, homepage_url, repo_url, license, level: "passing" - Add CONTRIBUTING.md to back the `contribution` MUST plus the test / lint / signed-commit policy criteria honestly Refs: RAN-58 Schema: coreinfrastructure/best-practices-badge:docs/bestpractices-json.md Co-Authored-By: Paperclip <noreply@paperclip.ing>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Rewrites
.bestpractices.jsonfrom the legacy custom group structure (status/evidence/auditkeys, which bestpractices.dev's autofill ignores) to the canonical flat per-criterion schema documented atcoreinfrastructure/best-practices-badge:docs/bestpractices-json.md. Once this lands, the board can flip project 12646 and the autofill robot will pre-fill all 67 questionnaire answers from this file.Closes RAN-58. Companion to RAN-53 (OSS-CLI security stack — already on
mainvia #34) and the parallel rewrites for codeiq (RAN-52), snipIT (RAN-54), vigil (RAN-55).What changed
.bestpractices.json— 67 canonical criteria fromcriteria.yml'0':block (43 MUST + 10 SHOULD + 14 SUGGESTED). Each entry has<key>_status,<key>_justification, and (for the 8 url-required criteria)<key>_url. 21 additional_urlfields enrich evidence beyond the minimum.CONTRIBUTING.md(new) — minimal contributor guide so thecontributionMUST,contribution_requirementsSHOULD, andtest_policy/tests_documented_addedMUSTs all have honest backing evidence. Documents the CI gates already in place:go test -race,go vet, golangci-lint, OSV-Scanner, Trivy, Semgrep, Gitleaks, jscpd.Status distribution (67 / 67)
crypto_password_storage→ N/A (otelcontext authenticates via bearerAPI_KEYor Azure Entra; no user passwords stored)dynamic_analysis_unsafe→ N/A (Go is memory-safe; nounsafe.Pointerin application code)All eight
met_url_requiredcriteria (contribution,contribution_requirements,license_location,release_notes,report_process,report_archive,vulnerability_report_process,vulnerability_report_private) carry concrete_urlfields. No?placeholders.Acceptance check (from RAN-58)
.bestpractices.jsonrewritten against the canonical flat per-criterion schemaproject_id,name,description,homepage_url,repo_url,license,level: "passing"Met(orN/Awherena_allowed) with concrete file-path / URL evidence in_justificationMetwhere true (and one honestN/A); no?placeholders needed<key>_urlprovided wherecriteria.ymlrequires it (8/8)passing— board admin stepValidation
jq empty .bestpractices.json→ clean parse_statuskeys ↔ 67 canonical criteria (1:1 map, zero missing, zero extra)_justificationkeys_urlTest plan
jq empty .bestpractices.json— JSON validatescriteria.yml'0':block (verified programmatically:set(canonical) == set(file_keys))passingand posts@TechLead approved(per RAN-50 flip-gate)🤖 Generated with Claude Code — Co-Authored-By: Paperclip