Revised Tools

[pburls]

Resolves #27

Changed the following tools:

• Consul - From Trial to Hold - "Given Kubernetes is our strategic deployment platform of choice, Kubernetes' service discovery and configuration management features make the need for Consul redundant. While systems not yet on Kubernetes may require these features, we would recommend holding off creating more infrastructure with Consul and instead invest the effort moving to k8s."

Added the following to tools:

• CodeScene - Adopt - "CodeScene identifies patterns in the evolution of your code. This gives you the power to predict its future and find areas that are hard to evolve and prone to defects (i.e. areas of ""tech debt""). This tool has been successfully trialled by many teams over the last few years and it's recent v4 upgrade has made it even easier to use. For more information about onboarding, please read this wiki page."
• OpenAPI - Adopt - "OpenAPI is now the leading standard for creating specifications for RESTful API and describing JSON messages. Our department's CSC Interface Specifications initiative is making a big push to get all our interfaces properly documented using OpenAPI. For more information about how to use OpenAPI and the tooling supporting it, please visit the CSC Interface Specifications initiative wiki page."
• Blackduck - Trial - "Adding security scans to your CI/CD pipeline has never been easier with the Blackduck tooling. It checks for known vulnerabilities and license problems for each of your project's dependencies. The PMP team are already using it and all GOTT projects for Peacock are using it too. If your team is interested in using this tool, please let us know and we will organise help from the PMP team or Jake Straker from the OTT Security team."
• Veracode - Assess - "Another part of security is to scan our own code for potential vulnerabilities. Veracode is a code analysis tool that can also be introduced into your CI/CD pipeline. This is another tool promoted by the OTT Security team and we are looking for teams who would be interested assessing the viability of this tool." WIP
• Dependabot - Assess - "Another tool that goes hand in hand with Blackduck is Dependabot. This tool automatically updates your project's dependencies for you by creating PRs that your team can quickly accept if your tests still pass. If your team uses GitHub and would like to help assess it, please let us know. It's as easy as adding a configuration file to your GitHub repo."

Preview these changes in the Tech Radar visualiser here.

[jpjavafun]

Looks good.

We've been using BlackDuck for a while now, I think GZ are as well?

PMP could maybe showcase this to push it from trial to adopt?

[pburls]

Looks good.

We've been using BlackDuck for a while now, I think GZ are as well?

PMP could maybe showcase this to push it from trial to adopt?

Ok, I will put PMP and Jake Straker from the OTT Security Team as resources for help for getting started with Black Duck. Jake has also offered to do a session on it. So maybe we collect a list of teams that express interest first.

[pburls]

Jake isn't sure if the Veracode license applies to our department given it is paid on a per project basis. So I might remove it for now.