mkanal commented 1 month ago

name: Quality Gate Checklist about: 'product check for a upcoming Release' title: 'QG X checks (Release x.x)' labels: documentation assignees: ''

QG checks

Please open and fill in this issue in your product repository to document the compliance with our Tractus-X Release Guideline (TRGs)

Show compliance with TRGs by referencing to a tagged link in the respective repository where possible, example: TRG 1.01 (see github.com/eclipse-tractusx/example-repo/tree/1.0.0/README.md)

Close this issue once the compliance with the TRGs has been documented

Committer(s): https://github.com/eclipse-tractusx/item-relationship-service/blob/main/AUTHORS.md Helm Chart Version: item-relationship-service-7.4.0 App Version: 5.4.0

Release Management Reference Issue:

Check of Tractus-X Release Guidelines

Currently implemented automatic checks can be found under your product on our Release Guidelines Checks Board
This QG Check is depending on the mandatory information from our current Release Guidelines

TRG 1 Documentation

[x] TRG 1.01 appropriate README.md
[x] TRG 1.02 appropriate install instructions either INSTALL.md or in README.md
[x] TRG 1.03 appropriate CHANGELOG.md
[x] TRG 1.04 editable static files

TRG 2 Git

[x] TRG 2.01 default branch is named main
[x] TRG 2.03 repository structure
[x] TRG 2.04 leading product repository
[x] TRG 2.05 .tractusx metafile in a proper format
[x] TRG 2.06 Dependabot

TRG 3 Kubernetes

[x] TRG 3.02 persistent volume and persistent volume claim or database dependency (subchart) are in place when needed

TRG 4 Container

[x] TRG 4.07 root file system is set to read access by default, but can be overwritten by the user
[x] TRG 4.01 semantic versioning and tagging
[x] TRG 4.02 base image is agreed
[x] TRG 4.03 image has USER command and Non Root Container
[x] TRG 4.05 released image must be placed in DockerHub, remove GHCR references
[x] TRG 4.06 separate notice file for DockerHub has all necessary information

TRG 5 Helm

[x] TRG 5.01 Helm chart requirements
[x] TRG 5.02 Helm chart location in /charts directory and correct structure
[x] TRG 5.03 proper version strategy
[x] TRG 5.04 CPU / MEM resource requests and limits and are properly set
[x] TRG 5.06 Application must be configurable through the Helm chart
[x] TRG 5.07 Dependencies are present and properly configured in the Chart.yaml
[x] TRG 5.08 Product has a single deployable helm chart that contains all components
[x] TRG 5.09 Helm Test running properly
[x] TRG 5.10 Products need to support 3 versions at a time
[x] TRG 5.11 Upgradeability

TRG 6 Released Helm Chart

[x] TRG 6.01 Released Helm Chart

TRG 7 Open Source Governance

[x] TRG 7.01 Legal Documentation
[x] TRG 7.02 License and copyright header
[x] TRG 7.03 IP checks for project content
[x] TRG 7.04 IP checks for 3rd party content
[x] TRG 7.05 Legal information for distributions
[x] TRG 7.06 Legal information for end user content
[x] TRG 7.07 Legal notice for documentation
[x] TRG 7.08 Legal notice for KIT documentation

TRG 8 Security

[x] TRG 8.01 Mitigate high and above findings in CodeQL
[x] TRG 8.02 Mitigate high and above findings in KICS
[x] TRG 8.04 Mitigate high and above findings in Trivy
[x] TRG 8.03 No secret findings by GitGuardian or TruffleHog

Hints

Information Sharing

mkanal commented 1 month ago

Hi @ds-mwesener would you please proceed the TRG checks for IRS. Thank you very much.

mkanal commented 1 month ago

TRG 1.01 appropriate README.md

[x] Basic documentation of the repository, its content and its structure
Update Source Layout
If installation instructions for your product are too complex being part of README.md move its content to a separate INSTALL.md file, see TRG 1.02.
[x] Installation instructions
https://github.com/eclipse-tractusx/item-relationship-service/issues/823
[x] If required necessary step(s) to finish the installation
[x] Usage examples and intended use of your product
https://github.com/eclipse-tractusx/item-relationship-service/blob/main/USAGE.md
[x] License information
https://github.com/eclipse-tractusx/item-relationship-service/blob/main/LICENSE
[x] Troubleshooting and FAQs to help users solve common problems
https://github.com/eclipse-tractusx/item-relationship-service/blob/main/FAQ.md
https://github.com/eclipse-tractusx/item-relationship-service/issues/824
[x] Reference your Contribution guideline in the CONTRIBUTING.md file
[x] Contact information to help users getting in touch with you
[x] Badges to show the status of your project (e.g. build status, code coverage, etc.)

mkanal commented 1 month ago

TRG 1.04 editable static files

[ ] These diagram code files (.puml,.mmd,.mermaid) and / or static diagram .svg files must be stored within the docs/ folder as described in TRG 2.03.
[ ] All digrams in documentation PUML was used for conceptional work mermaid is used as Github is able to render this instantly

mkanal commented 1 month ago

TRG 2.03 repository structure

[x] /docs
[x] /charts
[x] CODE_OF_CONDUCT.md
[x] CONTRIBUTING.md
[x] DEPENDENCIES
[x] LICENSE
[x] NOTICE.md
[x] README.md
[x] SECURITY.md
[x] AUTHORS.md
[x] INSTALL.md

mkanal commented 1 month ago

TRG 2.06 Dependabot

[x] https://github.com/eclipse-tractusx/item-relationship-service/blob/main/.github/dependabot.yml

mkanal commented 1 month ago

TRG 3.02 persistent volume and persistent volume claim or database dependency (subchart) are in place when needed

mkanal commented 1 month ago

@ds-mwesener would you please check the open tasks. Thank you very much.

Open Checks

TRG 4 Container

[x] TRG 4.02 base image is agreed
[x] TRG 4.03 image has USER command and Non Root Container
[x] TRG 4.05 released image must be placed in DockerHub, remove GHCR references
[x] [TRG 4.07] (https://eclipse-tractusx.github.io/docs/release/trg-4/trg-4-07) root file system is set to read access by default, but can be overwritten by the user

TRG 5 Helm

[x] TRG 5.01 Helm chart requirements
[x] TRG 5.02 Helm chart location in /charts directory and correct structure
[x] TRG 5.03 proper version strategy
[x] TRG 5.04 CPU / MEM resource requests and limits and are properly set
[x] TRG 5.06 Application must be configurable through the Helm chart
[x] TRG 5.07 Dependencies are present and properly configured in the Chart.yaml
[x] TRG 5.08 Product has a single deployable helm chart that contains all components
[x] TRG 5.09 Helm Test running properly
[x] TRG 5.10 Products need to support 3 versions at a time
[x] TRG 5.11 Upgradeability

TRG 6 Released Helm Chart

[x] TRG 6.01 Released Helm Chart

mkanal commented 1 month ago

TRG 7.01 Legal Documentation

[x] LICENSE
[x] LICENSE_non-code
[x] NOTICE.md
[x] DEPENDENCIES
[x] SECURITY.md
[x] CONTRIBUTING.md
[x] CODE_OF_CONDUCT.md
[x] Apache-2.0 for code https://github.com/eclipse-tractusx/item-relationship-service/blob/main/LICENSE
[x] CC-BY-4.0 for non-code https://github.com/eclipse-tractusx/item-relationship-service/blob/main/LICENSE_non-code

mkanal commented 1 month ago

TRG 7.03 IP checks for project content

mkanal commented 1 month ago

TRG 7.05 Legal information for distributions

[x] LICENSE
[x] NOTICE.md
[x] DEPENDENCIES file(s) - if existing
[x] SECURITY.md

mkanal commented 1 month ago

ds-jhartmann commented 1 month ago

TRGs 4, 5 and 6 checked and verified ✅

TRG 4 Container

TRG 5 Helm

TRG 6 Released Helm Chart

[x] TRG 6.01 See https://eclipse-tractusx.github.io/item-relationship-service/index.yaml

ds-jhartmann commented 1 month ago

@mkanal all QG checks are done, please verify and close this issue if everything looks good.

mkanal commented 1 month ago

LGFM all TRG passed.

eclipse-tractusx / item-relationship-service

[IRS] QG 4 checks (Release 24.08) #817

QG checks

Close this issue once the compliance with the TRGs has been documented

Check of Tractus-X Release Guidelines

TRG 1 Documentation

TRG 2 Git

TRG 3 Kubernetes

TRG 4 Container

TRG 5 Helm

TRG 6 Released Helm Chart

TRG 7 Open Source Governance

TRG 8 Security

Hints

Information Sharing

Open Checks

TRG 4 Container

TRG 5 Helm

TRG 6 Released Helm Chart

TRG 4 Container

TRG 5 Helm

TRG 6 Released Helm Chart