Metrics Outbound Review Report

[IsaacMilarky]

DSACMS/metrics Outbound Review Report

Gitleaks

• Ran gitleaks detect => 1 leak found
• Found a generic-api-key from Root/env/lib/python3.9/……. from a commit back in July
• Because we deleted the Root/env directory from the repo and is an api key generated for a python package, this is not that important to remove
• BUT we did remove this from commit history using git filter-repo

Repolinter

• All required files are included now.
  • Added SUPPORT.md
  • Added CHANGELOG.md
• Got minor warnings for python-package-metadata-exists and javascript-package-metadata-exists even though the required files exist. Unsure how to resolve the warnings but we manually checked that those files exists (package.json, setup.py, requirements.txt)

Proper git config authorship info

• Added DCO Bot
• Natalia forgot to sign off on all of her commits (OOPSIE 😭)
• Added a DCO bot to make sure all commits are signed off
• Branch Protection
• Creating a dev branch to push all our changes
• Main branch will be used for deployment of our public releases
• Added branch protection rules to both dev and main branches
  • Dev branch and main both require:
  • pull requests to merge
  • require approvals
  • dismiss stale reviews when new commits are pushed to a pr
  • only Natlia; Isaac and Remy can dismiss reviews. They also both require conversations to be resolved before a pr can be accepted.
• Main branch requires checks to pass before it can be merged to.

[decause-gov]

@IsaacMilarky Excellent work!

Questions/Thoughts (non-blocking):

1. We may not need a DCO bot for signed commits (this could be a "large" tshirt size requirement, in our soon-to-be outbound review hierarchy.)
2. I think that proper git config author is probably enough for small/medium tshirt sized outbound projects, as opposed to full-on signed commits, but, since the work is already done, I'll let y'all decide :)

Again, great work y'all LGTM +1 🚢