QG 4 checks (Release 24.05)

almadigabor commented 5 months ago

QG checks

Please keep this issue open until QG is concluded and will be managed by the Issue Creator! We will inform you about finding and proposals in separated issues, this issue here is for the Overview of the Checks!

Please keep this issue open until QG is concluded!

Product Owner: @drcgjung Dev SPOC: @drcgjung Helm Chart Version: 1.12.19 App Version: 1.12.19

Release Managemnet Reference Issue:

Check of Tractus-X Release Guidelines

Currently implemented automatic checks can be found under your product on our Release Guidelines Checks Board
This QG Check is depending on the mandatory information from our current Release Guidelines

TRG 1 Documentation

[x] TRG 1.01 appropriate README.md
[x] TRG 1.02 appropriate install instructions either INSTALL.md or in README.md
[x] TRG 1.03 appropriate CHANGELOG.md
[x] TRG 1.04 editable static files

TRG 2 Git

[x] TRG 2.01 default branch is named main
[x] TRG 2.03 repository structure
[x] TRG 2.04 leading product repository
[x] TRG 2.05 .tractusx metafile in a proper format

TRG 3 Kubernetes

[x] TRG 3.02 persistent volume and persistent volume claim is used when needed

TRG 4 Container

[x] TRG 4.01 semantic versioning and tagging
[x] TRG 4.02 base image is agreed
[x] TRG 4.03 image has USER command and Non Root Container
[x] TRG 4.05 released image must be placed in DockerHub, remove GHCR references
[x] TRG 4.06 separate notice file for DockerHub has all necessary information

TRG 5 Helm

[x] TRG 5.01 Helm chart requirements
[x] TRG 5.02 Helm chart location in /charts directory and correct structure
[x] TRG 5.03 proper version strategy
[x] TRG 5.04 CPU / MEM resource requests and limits and are properly set
[x] TRG 5.06 Application must be configurable through the Helm chart
[x] TRG 5.07 Dependencies are present and properly configured in the Chart.yaml
[x] TRG 5.08 Product has a single deployable helm chart that contains all components
[x] TRG 5.09 Helm Test running properly
[x] TRG 5.10 Products need to support 3 versions at a time
[x] TRG 5.11 Upgradeability

TRG 6 Released Helm Chart

[x] TRG 6.01 Released Helm Chart

TRG 7 Open Source Governance

[x] TRG 7.01 Legal Documentation
[x] TRG 7.02 License and copyright header
[x] TRG 7.03 IP checks for project content
[x] TRG 7.04 IP checks for 3rd party content
[x] TRG 7.05 Legal information for distributions
[x] TRG 7.06 Legal information for end user content
[x] TRG 7.07 Legal notice for documentation
[x] TRG 7.08 Legal notice for KIT documentation

TRG 8 Security

[x] #128
[x] TRG 8.02 Mitigate high and above findings in KICS
[x] TRG 8.03 Mitigate high and above findings in GitGuardian
[x] TRG 8.04 Mitigate high and above findings in Trivy

Hints

Information Sharing

almadigabor commented 5 months ago

Hi all, before I start I need the following info:

Product Owner:
Dev SPOC:
Helm Chart Version:
App Version:

Also I will need a volunteer committer who does the checks alongside with me. Can you find me someone? Thanks!

almadigabor commented 5 months ago

Version I'm checking: 1.12.19

almadigabor commented 5 months ago

I'm done with the first round of checks. There is one issues open regarding critical security findings in the knowledge-agents repository by CodeQL. https://github.com/eclipse-tractusx/knowledge-agents/issues/128

RolaH1t commented 5 months ago

@drcgjung & @almadigabor do we expect a resolution on this one today?

drcgjung commented 5 months ago

@drcgjung & @almadigabor do we expect a resolution on this one today?

here https://github.com/eclipse-tractusx/knowledge-agents-edc/pull/196 and here https://github.com/eclipse-tractusx/knowledge-agents/pull/131

Best, CGJ

RolaH1t commented 5 months ago

cool! so please mark #122(https://github.com/eclipse-tractusx/knowledge-agents/issues/122) completed and update #641(https://github.com/eclipse-tractusx/sig-release/issues/641) so QG can be fully approved

RoKrish14 commented 5 months ago

CodeQl: I approve the findings as FP. The security checks is approved.

almadigabor commented 5 months ago

As the security findings were false positives as they've already been fixed, the last check is also marked. I approve the QG with the following versions:

App version: 1.12.19 Chart version: 1.12.19

eclipse-tractusx / knowledge-agents