QG checks (Release 24.05)

[carslen]

QG checks

Please keep this issue open until QG is concluded and will be managed by the Issue Creator! We will inform you about finding and proposals in separated issues, this issue here is for the Overview of the Checks!

Please keep this issue open until QG is concluded!

Product Owner:
Dev SPOC: @tom-rm-meyer-ISST
Helm Chart Version: tbd App Version: 2.0.0

Release Managemnet Reference Issue: eclipse-tractusx/sig-release#589

Check of Tractus-X Release Guidelines

• Currently implemented automatic checks can be found under your product on our Release Guidelines Checks Board
• This QG Check is depending on the mandatory information from our current Release Guidelines

TRG 1 Documentation

• [x] TRG 1.01 appropriate README.md
• [x] #385
• [x] TRG 1.03 appropriate CHANGELOG.md
• [x] TRG 1.04 editable static files

TRG 2 Git

• [x] TRG 2.01 default branch is named main
• [x] TRG 2.03 repository structure
• [x] TRG 2.04 leading product repository
• [x] TRG 2.05 .tractusx metafile in a proper format

TRG 3 Kubernetes

• [x] TRG 3.02 persistent volume and persistent volume claim is used when needed

TRG 4 Container

• [x] TRG 4.01 semantic versioning and tagging
• [x] TRG 4.02 base image is agreed
• [x] TRG 4.03 image has USER command and Non Root Container
• [x] TRG 4.05 released image must be placed in DockerHub, remove GHCR references
• [x] #386

TRG 5 Helm

• [x] #387
• [x] TRG 5.02 Helm chart location in /charts directory and correct structure
• [x] TRG 5.03 proper version strategy
• [x] TRG 5.04 CPU / MEM resource requests and limits and are properly set
• [x] TRG 5.06 Application must be configurable through the Helm chart
• [x] TRG 5.07 Dependencies are present and properly configured in the Chart.yaml
• [x] TRG 5.08 Product has a single deployable helm chart that contains all components
• [x] TRG 5.09 Helm Test running properly
• [x] TRG 5.10 Products need to support 3 versions at a time
• [x] TRG 5.11 Upgradeability

TRG 6 Released Helm Chart

• [x] TRG 6.01 Released Helm Chart

TRG 7 Open Source Governance

• [x] TRG 7.01 Legal Documentation
• [x] TRG 7.02 License and copyright header
• [x] TRG 7.03 IP checks for project content
• [x] TRG 7.04 IP checks for 3rd party content
• [x] #388
• [x] TRG 7.06 Legal information for end user content
• [x] TRG 7.07 Legal notice for documentation
• [x] TRG 7.08 Legal notice for KIT documentation

TRG 8 Security

• [x] TRG 8.01 Mitigate high and above findings in CodeQL
• [x] TRG 8.02 Mitigate high and above findings in KICS
• [x] TRG 8.03 Mitigate high and above findings in GitGuardian
• [x] TRG 8.04 Mitigate high and above findings in Trivy

Hints

Information Sharing

[tom-rm-meyer-ISST]

@evegufy please start with the review :)

[tom-rm-meyer-ISST]

@RoKrish14 could you please check the Security issues?

[evegufy]

Hi @tom-rm-meyer-ISST as discussed, I created issues for the changes which should be still implemented for the release, with the exception of TRG 7.06 Legal information for end user content, which is still WIP.

In the following some general recommadations: Futher recommandation

• Readme --> Remove Catena-X
• Changelog --> remove dead links https://github.com/eclipse-tractusx/puris/blob/2.0.0/CHANGELOG.md https://github.com/eclipse-tractusx/puris/releases/tag/v2.0.0
• Only create secret if not .Values.existingSecret https://github.com/eclipse-tractusx/puris/blob/2.0.0/charts/puris/templates/backend-secrets.yaml https://github.com/eclipse-tractusx/puris/blob/2.0.0/charts/puris/values.yaml#L362 Example: https://github.com/eclipse-tractusx/ssi-credential-issuer/blob/v1.0.0-rc.4/charts/ssi-credential-issuer/templates/secret.yaml https://github.com/eclipse-tractusx/ssi-credential-issuer/blob/v1.0.0-rc.4/charts/ssi-credential-issuer/values.yaml#L161
• Build images for arm64 https://hub.docker.com/r/tractusx/app-puris-frontend/tags https://hub.docker.com/r/tractusx/app-puris-backend/tags See: https://github.com/eclipse-tractusx/eclipse-tractusx.github.io/pull/755/files Why: local sandbox
• Add contribution details (information about how to fork, etc) https://github.com/eclipse-tractusx/puris/blob/2.0.0/CONTRIBUTING.md

[tom-rm-meyer-ISST]

Hey @evegufy with #405 we finally fixed the legal stuff in 7.05. Could you please confirm the successfull release checks?

[evegufy]

TRG review completed