From 5ae99a5d216bc39a6a27a838c7859129a59aabdf Mon Sep 17 00:00:00 2001 From: Isaac Milarsky Date: Thu, 30 Jan 2025 16:34:16 -0600 Subject: [PATCH] changes based on repolinter output --- CODEOWNERS.md | 50 ++---- CODE_OF_CONDUCT.md | 27 ++- COMMUNITY_GUIDELINES.md | 34 ++-- CONTRIBUTING.md | 262 ++++++++++++----------------- GOVERNANCE.md | 8 +- LICENSE | 123 +------------- MAINTAINERS.md | 67 ++------ README.md | 360 ++++++++++------------------------------ SECURITY.md | 21 +-- 9 files changed, 268 insertions(+), 684 deletions(-) diff --git a/CODEOWNERS.md b/CODEOWNERS.md index 04f0761f..eb41b0bb 100644 --- a/CODEOWNERS.md +++ b/CODEOWNERS.md @@ -1,33 +1,17 @@ -# Code Owners - -[@decause-gov](https://github.com/decause-gov) -[@natalialuzuriaga](https://github.com/natalialuzuriaga) -[@IsaacMilarky](https://github.com/IsaacMilarky) -[@sachin-panayil](https://github.com/sachin-panayil) -[@DinneK](https://github.com/DinneK) - -## Repository Domains - -- Repository Templates in `/tier*/` [@natalialuzuriaga](https://github.com/natalialuzuriaga) [@sachin-panayil](https://github.com/sachin-panayil) [@IsaacMilarky](https://github.com/IsaacMilarky) -- Outbound Checklists in `/tier*/checklist.md` [@natalialuzuriaga](https://github.com/natalialuzuriaga) -- GitHub Actions in `/.github` [@sachin-panayil](https://github.com/sachin-panayil) [@IsaacMilarky](https://github.com/IsaacMilarky) [@natalialuzuriaga](https://github.com/natalialuzuriaga) - -## Shoutouts - -[@usdigitalresponse](https://github.com/usdigitalresponse) - -- [@aprilselby88](https://github.com/aprilselby88) -- [@vantuyls](https://github.com/vantuyls) -- [@sgarciahelguera](https://github.com/sgarciahelguera) - -Thank you [US Digital Response](https://www.usdigitalresponse.org/) Team for your support creating this repository! - -[Coding It Forward Fellows](https://codingitforward.com/fellowship) - -- [@Firebird1029](https://github.com/Firebird1029) -- [@CreativeNick](https://github.com/CreativeNick) -- [@RicardoZamora01](https://github.com/RicardoZamora01) - -# Questions? - -Email opensource@cms.hhs.gov +#Code Owners + + + ## Repository Domains + diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md index 7c7373b5..724395c7 100644 --- a/CODE_OF_CONDUCT.md +++ b/CODE_OF_CONDUCT.md @@ -1,17 +1,10 @@ -## Contributor Code of Conduct - -As contributors and maintainers of this project, we pledge to respect all people who contribute through reporting issues, posting feature requests, updating documentation, submitting pull requests or patches, and other activities. - -We are committed to making participation in this project a harassment-free experience for everyone, regardless of the level of experience, gender, gender identity, expression, sexual orientation, disability, personal appearance, body size, race, ethnicity, age, or religion. - -Examples of unacceptable behavior by participants include the use of sexual language or imagery, derogatory comments or personal attacks, trolling, public or private harassment, insults, or other unprofessional conduct. - -Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned with this Code of Conduct. - -Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by opening an issue or contacting one or more of the project maintainers at opensource@cms.hhs.gov. - -This Code of Conduct is adapted from the [Contributor Covenant](http://contributor-covenant.org), version 1.0.0, available at [http://contributor-covenant.org/version/1/0/0/](http://contributor-covenant.org/version/1/0/0/) - -## Acknowledgements - -This CODE_OF_CONDUCT.md was originally forked from the [United States Digital Service](https://usds.gov) [Justice40](https://thejustice40.com) open source [repository](https://github.com/usds/justice40-tool), and we would like to acknowledge and thank the community for their contributions. +## Contributor Code of Conduct +As contributors and maintainers of this project, we pledge to respect all people who contribute through reporting issues, posting feature requests, updating documentation, submitting pull requests or patches, and other activities. + We are committed to making participation in this project a harassment-free experience for everyone, regardless of the level of experience, gender, gender identity, expression, sexual orientation, disability, personal appearance, body size, race, ethnicity, age, or religion. + Examples of unacceptable behavior by participants include the use of sexual language or imagery, derogatory comments or personal attacks, trolling, public or private harassment, insults, or other unprofessional conduct. + Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned with this Code of Conduct. + Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by opening an issue or contacting one or more of the project maintainers at opensource@cms.hhs.gov. + This Code of Conduct is adapted from the [Contributor Covenant](http://contributor-covenant.org), version 1.0.0, available at [http://contributor-covenant.org/version/1/0/0/](http://contributor-covenant.org/version/1/0/0/) + + ## Acknowledgements +This CODE_OF_CONDUCT.md was originally forked from the [United States Digital Service](https://usds.gov) [Justice40](https://thejustice40.com) open source [repository](https://github.com/usds/justice40-tool), and we would like to acknowledge and thank the community for their contributions. diff --git a/COMMUNITY_GUIDELINES.md b/COMMUNITY_GUIDELINES.md index 8f7172f4..b5afbcce 100644 --- a/COMMUNITY_GUIDELINES.md +++ b/COMMUNITY_GUIDELINES.md @@ -1,37 +1,29 @@ -# repo-scaffolder Open Source Community Guidelines - -This document contains principles and guidelines for participating in the repo-scaffolder open source community. - -## Principles - +# {name_of_project_here} Open Source Community Guidelines +This document contains principles and guidelines for participating in the {name_of_project_here} open source community. + + ## Principles These principles guide our data, product, and process decisions, architecture, and approach. - - Open means transparent and participatory. - We take a modular and modern approach to software development. - We build open-source software and open-source process. - We value ease of implementation. - Fostering community includes building capacity and making our software and processes accessible to participants with diverse backgrounds and skillsets. - Data (and data science) is as important as software and process. We build open data sets where possible. -- We strive for transparency for algorithms and places we might be introducing bias. - -## Community Guidelines - +- We strive for transparency for algorithms and places we might be introducing bias. + + ## Community Guidelines All community members are expected to adhere to our [Code of Conduct](CODE_OF_CONDUCT.md). - Information on contributing to this repository is available in our [Contributing file](CONTRIBUTING.md). - -When participating in the repo-scaffolder open source community conversations and spaces, we ask individuals to follow the following guidelines: - +When participating in {{ cookiecutter.project_name }} open source community conversations and spaces, we ask individuals to follow the following guidelines: - When joining a conversation for the first time, please introduce yourself by providing a brief intro that includes: - - your related organization (if applicable) - - your pronouns - - your superpower, and how you hope to use it for {{ cookiecutter.project_name }} + - your related organization (if applicable) + - your pronouns + - your superpower, and how you hope to use it for {{ cookiecutter.project_name }} - Embrace a culture of learning, and educate each other. We are all entering this conversation from different starting points and with different backgrounds. There are no dumb questions. - Take space and give space. We strive to create an equitable environment in which all are welcome and able to participate. We hope individuals feel comfortable voicing their opinions and providing contributions and will do our best to recognize and make space for individuals who may be struggling to find space here. Likewise, we expect individuals to recognize when they are taking up significant space and take a step back to allow room for others. - Be respectful. - Default to positive. Assume others' contributions are legitimate and valuable and that they are made with good intention. - -## Acknowledgements - + + ## Acknowledgements This COMMUNITY_GUIDELINES.md was originally forked from the [United States Digital Service](https://usds.gov) [Justice40](https://thejustice40.com) open source [repository](https://github.com/usds/justice40-tool), and we would like to acknowledge and thank the community for their contributions. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index e9010cc3..410a717a 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,157 +1,107 @@ -# How to Contribute - -We're so thankful you're considering contributing to an [open source project of -the U.S. government](https://code.gov/)! If you're unsure about anything, just -ask -- or submit the issue or pull request anyway. The worst that can happen is -you'll be politely asked to change something. We appreciate all friendly -contributions. - -We encourage you to read this project's CONTRIBUTING policy (you are here), its -[LICENSE](LICENSE.md), and its [README](README.md). - -## Getting Started - -First, install the required dependencies. - -To create a new repository using repo-scaffolder, run the production version of repo-scaffolder. Subsitute `X` with the tier number you'd like to create in the directory flag. - -``` -cookiecutter https://github.com/DSACMS/repo-scaffolder --directory=tierX -``` - -More commands on using repo-scaffolder for repository creation and maintenance can be found here: https://github.com/DSACMS/repo-scaffolder/blob/main/README.md#Using-repo-scaffolder - -### Team Specific Guidelines - -- Please try to keep pull requests to a reasonable size; try to split large contributions to multiple PRs -- Please create pull requests into dev unless the contribution is some kind of bugfix or urgent hotfix. -- Document and explain the contribution clearly according to provided standards when possible. -- Feel free to reach out to us if there is any confusion. A list of the project maintainers is found here: [MAINTAINERS.md](./MAINTAINERS.md) - -### Building dependencies - -1. Clone the repo - - `git clone https://github.com/DSACMS/metrics.git` - -2. Install the required packages in requirements.txt - - `pip install -r requirements.txt` - -### Building the Project - -N/A - -### Workflow and Branching - +# Contributing Guidelines + + + We're so thankful you're considering contributing to an [open source project of the U.S. government](https://code.gov/)! If you're unsure about anything, just ask -- or submit the issue or pull request anyway. The worst that can happen is you'll be politely asked to change something. We appreciate all friendly contributions. + + We encourage you to read this project's CONTRIBUTING policy (you are here), its [LICENSE](LICENSE.md), and its [README](README.md). + + ## Getting Started + + + ### Team Specific Guidelines + + + ### Building Dependencies + + + ### Building the Project + + + ### Workflow and Branching + - -### Coding Style and Linters - - - -Each application has its own linting and testing guidelines. Lint and code tests are run on each commit, so linters and tests should be run locally before commiting. - -### Writing Issues - -When creating an issue please try to adhere to the following format: - - module-name: One line summary of the issue (less than 72 characters) - - ### Expected behavior - - As concisely as possible, describe the expected behavior. - - ### Actual behavior - - As concisely as possible, describe the observed behavior. - - ### Steps to reproduce the behavior - - List all relevant steps to reproduce the observed behavior. - - see our .github/ISSUE_TEMPLATE.md for more examples. - -### Writing Pull Requests - -Comments should be formatted to a width no greater than 80 columns. - -Files should be exempt of trailing spaces. - -We adhere to a specific format for commit messages. Please write your commit -messages along these guidelines. Please keep the line width no greater than 80 -columns (You can use `fmt -n -p -w 80` to accomplish this). - - module-name: One line description of your change (less than 72 characters) - - Problem - - Explain the context and why you're making that change. What is the problem - you're trying to solve? In some cases there is not a problem and this can be - thought of being the motivation for your change. - - Solution - - Describe the modifications you've done. - - Result - - What will change as a result of your pull request? Note that sometimes this - section is unnecessary because it is self-explanatory based on the solution. - - Some important notes regarding the summary line: - - * Describe what was done; not the result - * Use the active voice - * Use the present tense - * Capitalize properly - * Do not end in a period — this is a title/subject - * Prefix the subject with its scope - -## Reviewing Pull Requests - -When you submit a pull request on GitHub, it will be reviewed by the project -community, and once the changes are approved, your commits will be brought into -a development branch for additional testing. Once the changes are merged, they will -be pushed back to the main branch. - -If the issue the pull request is addressing is particularly urgent, the pull request -will be merged directly into the main branch. - -## Documentation - -We also welcome improvements to the project documentation or to the existing -docs. Please file an [issue](https://github.com/DSACMS/repo-scaffolder/issues). - -## Policies - -### Open Source Policy - -We adhere to the [CMS Open Source -Policy](https://github.com/CMSGov/cms-open-source-policy). If you have any -questions, just [shoot us an email](mailto:opensource@cms.hhs.gov). - -### Security and Responsible Disclosure Policy - -_Submit a vulnerability:_ Vulnerability reports can be submitted through [Bugcrowd](https://bugcrowd.com/cms-vdp). Reports may be submitted anonymously. If you share contact information, we will acknowledge receipt of your report within 3 business days. - -For more information about our Security, Vulnerability, and Responsible Disclosure Policies, see [SECURITY.md](SECURITY.md). - -## Public domain - -This project is in the public domain within the United States, and copyright and related rights in the work worldwide are waived through the [CC0 1.0 Universal public domain dedication](https://creativecommons.org/publicdomain/zero/1.0/). - -All contributions to this project will be released under the CC0 dedication. By submitting a pull request or issue, you are agreeing to comply with this waiver of copyright interest. +1. Fork the project +2. Check out the `main` branch +3. Create a feature branch +4. Write code and tests for your change +5. From your branch, make a pull request against `{{ cookiecutter.project_org }}/{{ cookiecutter.project_repo_name }}/main` +6. Work with repo maintainers to get your change reviewed +7. Wait for your change to be pulled into `{{ cookiecutter.project_org }}/{{ cookiecutter.project_repo_name }}/main` +8. Delete your feature branch +--> + + ### Testing Conventions + + + ### Coding Style and Linters + + + ### Writing Issues + + + ### Writing Pull Requests + + + ### Reviewing Pull Requests + + + ## Shipping Releases + + + ## Documentation + + + ## Policies + + ### Open Source Policy +We adhere to the [CMS Open Source Policy](https://github.com/CMSGov/cms-open-source-policy). If you have any questions, just [shoot us an email](mailto:opensource@cms.hhs.gov). + + ### Security and Responsible Disclosure Policy +*Submit a vulnerability:* Vulnerability reports can be submitted through [Bugcrowd](https://bugcrowd.com/cms-vdp). Reports may be submitted anonymously. If you share contact information, we will acknowledge receipt of your report within 3 business days. + For more information about our Security, Vulnerability, and Responsible Disclosure Policies, see [SECURITY.md](SECURITY.md). + + ## Public Domain +This project is in the public domain within the United States, and copyright and related rights in the work worldwide are waived through the [CC0 1.0 Universal public domain dedication](https://creativecommons.org/publicdomain/zero/1.0/) as indicated in [LICENSE](LICENSE). + All contributions to this project will be released under the CC0 dedication. By submitting a pull request or issue, you are agreeing to comply with this waiver of copyright interest. diff --git a/GOVERNANCE.md b/GOVERNANCE.md index 11783859..59d2bad9 100644 --- a/GOVERNANCE.md +++ b/GOVERNANCE.md @@ -1,5 +1,3 @@ -# Governance - - - -This project is governed by our [Community Guidelines](COMMUNITY_GUIDELINES.md) and [Code of Conduct](CODE_OF_CONDUCT.md). +# Governance + + This project is governed by our [Community Guidelines](COMMUNITY_GUIDELINES.md) and [Code of Conduct](CODE_OF_CONDUCT.md). diff --git a/LICENSE b/LICENSE index 0e259d42..ef71215b 100644 --- a/LICENSE +++ b/LICENSE @@ -1,121 +1,2 @@ -Creative Commons Legal Code - -CC0 1.0 Universal - - CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE - LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN - ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS - INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES - REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS - PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM - THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED - HEREUNDER. - -Statement of Purpose - -The laws of most jurisdictions throughout the world automatically confer -exclusive Copyright and Related Rights (defined below) upon the creator -and subsequent owner(s) (each and all, an "owner") of an original work of -authorship and/or a database (each, a "Work"). - -Certain owners wish to permanently relinquish those rights to a Work for -the purpose of contributing to a commons of creative, cultural and -scientific works ("Commons") that the public can reliably and without fear -of later claims of infringement build upon, modify, incorporate in other -works, reuse and redistribute as freely as possible in any form whatsoever -and for any purposes, including without limitation commercial purposes. -These owners may contribute to the Commons to promote the ideal of a free -culture and the further production of creative, cultural and scientific -works, or to gain reputation or greater distribution for their Work in -part through the use and efforts of others. - -For these and/or other purposes and motivations, and without any -expectation of additional consideration or compensation, the person -associating CC0 with a Work (the "Affirmer"), to the extent that he or she -is an owner of Copyright and Related Rights in the Work, voluntarily -elects to apply CC0 to the Work and publicly distribute the Work under its -terms, with knowledge of his or her Copyright and Related Rights in the -Work and the meaning and intended legal effect of CC0 on those rights. - -1. Copyright and Related Rights. A Work made available under CC0 may be -protected by copyright and related or neighboring rights ("Copyright and -Related Rights"). Copyright and Related Rights include, but are not -limited to, the following: - - i. the right to reproduce, adapt, distribute, perform, display, - communicate, and translate a Work; - ii. moral rights retained by the original author(s) and/or performer(s); -iii. publicity and privacy rights pertaining to a person's image or - likeness depicted in a Work; - iv. rights protecting against unfair competition in regards to a Work, - subject to the limitations in paragraph 4(a), below; - v. rights protecting the extraction, dissemination, use and reuse of data - in a Work; - vi. database rights (such as those arising under Directive 96/9/EC of the - European Parliament and of the Council of 11 March 1996 on the legal - protection of databases, and under any national implementation - thereof, including any amended or successor version of such - directive); and -vii. other similar, equivalent or corresponding rights throughout the - world based on applicable law or treaty, and any national - implementations thereof. - -2. Waiver. To the greatest extent permitted by, but not in contravention -of, applicable law, Affirmer hereby overtly, fully, permanently, -irrevocably and unconditionally waives, abandons, and surrenders all of -Affirmer's Copyright and Related Rights and associated claims and causes -of action, whether now known or unknown (including existing as well as -future claims and causes of action), in the Work (i) in all territories -worldwide, (ii) for the maximum duration provided by applicable law or -treaty (including future time extensions), (iii) in any current or future -medium and for any number of copies, and (iv) for any purpose whatsoever, -including without limitation commercial, advertising or promotional -purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each -member of the public at large and to the detriment of Affirmer's heirs and -successors, fully intending that such Waiver shall not be subject to -revocation, rescission, cancellation, termination, or any other legal or -equitable action to disrupt the quiet enjoyment of the Work by the public -as contemplated by Affirmer's express Statement of Purpose. - -3. Public License Fallback. Should any part of the Waiver for any reason -be judged legally invalid or ineffective under applicable law, then the -Waiver shall be preserved to the maximum extent permitted taking into -account Affirmer's express Statement of Purpose. In addition, to the -extent the Waiver is so judged Affirmer hereby grants to each affected -person a royalty-free, non transferable, non sublicensable, non exclusive, -irrevocable and unconditional license to exercise Affirmer's Copyright and -Related Rights in the Work (i) in all territories worldwide, (ii) for the -maximum duration provided by applicable law or treaty (including future -time extensions), (iii) in any current or future medium and for any number -of copies, and (iv) for any purpose whatsoever, including without -limitation commercial, advertising or promotional purposes (the -"License"). The License shall be deemed effective as of the date CC0 was -applied by Affirmer to the Work. Should any part of the License for any -reason be judged legally invalid or ineffective under applicable law, such -partial invalidity or ineffectiveness shall not invalidate the remainder -of the License, and in such case Affirmer hereby affirms that he or she -will not (i) exercise any of his or her remaining Copyright and Related -Rights in the Work or (ii) assert any associated claims and causes of -action with respect to the Work, in either case contrary to Affirmer's -express Statement of Purpose. - -4. Limitations and Disclaimers. - - a. No trademark or patent rights held by Affirmer are waived, abandoned, - surrendered, licensed or otherwise affected by this document. - b. Affirmer offers the Work as-is and makes no representations or - warranties of any kind concerning the Work, express, implied, - statutory or otherwise, including without limitation warranties of - title, merchantability, fitness for a particular purpose, non - infringement, or the absence of latent or other defects, accuracy, or - the present or absence of errors, whether or not discoverable, all to - the greatest extent permissible under applicable law. - c. Affirmer disclaims responsibility for clearing rights of other persons - that may apply to the Work or any use thereof, including without - limitation any person's Copyright and Related Rights in the Work. - Further, Affirmer disclaims responsibility for obtaining any necessary - consents, permissions or other rights required for any use of the - Work. - d. Affirmer understands and acknowledges that Creative Commons is not a - party to this document and has no duty or obligation with respect to - this CC0 or use of the Work. +# License +Remove this line and attach the license that is being used for this project. For helping choosing a license, visit this website: https://choosealicense.com/ diff --git a/MAINTAINERS.md b/MAINTAINERS.md index 7fb0e3b6..83ccc161 100644 --- a/MAINTAINERS.md +++ b/MAINTAINERS.md @@ -1,53 +1,20 @@ -## Maintainers - +## Maintainers - -This is a list of maintainers for this project. See [CODEOWNERS.md](./CODEOWNERS.md) for list of reviewers for different parts of the codebase. Team members include: - -- [@decause-gov](https://github.com/decause-gov) -- [@natalialuzuriaga](https://github.com/natalialuzuriaga) -- [@IsaacMilarky](https://github.com/IsaacMilarky) -- [@sachin-panayil](https://github.com/sachin-panayil) -- [@DinneK](https://github.com/DinneK) - + This is a list of maintainers for this project. See [CODEOWNERS.md](./CODEOWNERS.md) for list of reviewers for different parts of the codebase. Team members include: + ## Maintainers List: -Repository Templates -- [@natalialuzuriaga](https://github.com/natalialuzuriaga) -- [@sachin-panayil](https://github.com/sachin-panayil) -- [@IsaacMilarky](https://github.com/IsaacMilarky) - -Outbound Checklists -- [@natalialuzuriaga](https://github.com/natalialuzuriaga) - -GitHub Actions -- [@sachin-panayil](https://github.com/sachin-panayil) -- [@IsaacMilarky](https://github.com/IsaacMilarky) -- [@natalialuzuriaga](https://github.com/natalialuzuriaga) - -## Approvers: - -- [@decause-gov](https://github.com/decause-gov) - -## Reviewers: - -- [@natalialuzuriaga](https://github.com/natalialuzuriaga) -- [@IsaacMilarky](https://github.com/IsaacMilarky) -- [@sachin-panayil](https://github.com/sachin-panayil) -- [@DinneK](https://github.com/DinneK) - -| Roles | Responsibilities | Requirements | Defined by | -| -------- | :--------------------------------------------- | :-------------------------------------------------------------------------------- | :---------------------------------------------------------- | -| member | active contributor in the community | multiple contributions to the project. | PROJECT GitHub org Committer Team | -| reviewer | review contributions from other members | history of review and authorship in a sub-project | MAINTAINERS file reviewer entry, and GitHub Org Triage Team | -| approver | approve accepting contributions | highly experienced and active reviewer + contributor to a sub-project | MAINTAINERS file approver entry and GitHub Triage Team | -| lead | set direction and priorities for a sub-project | demonstrated responsibility and excellent technical judgement for the sub-project | MAINTAINERS file owner entry and GitHub Org Admin Team | - -## Contributors - - - -Total number of contributors: - - - + - + + ## Approvers: + - + + ## Reviewers: + - + +| Roles | Responsibilities | Requirements | Defined by | +| -------------|:-----------------------------------------|:-----------------------------------------------|:---------------------------------------| +| member | active contributor in the community | multiple contributions to the project. | PROJECT GitHub org Committer Team | +| reviewer | review contributions from other members | history of review and authorship in a sub-project | MAINTAINERS file reviewer entry, and GitHub Org Triage Team | +| approver | approve accepting contributions | highly experienced and active reviewer + contributor to a sub-project | MAINTAINERS file approver entry and GitHub Triage Team | +| lead | set direction and priorities for a sub-project | demonstrated responsibility and excellent technical judgement for the sub-project | MAINTAINERS file owner entry and GitHub Org Admin Team | diff --git a/README.md b/README.md index b5d3d0e9..debf28d2 100644 --- a/README.md +++ b/README.md @@ -1,276 +1,98 @@ -# repo-scaffolder - -Templates and commandline tools for creating repositories for US Federal open source projects - -## About the Project - -The CMS Open Source Program Office developed a [maturity model framework](https://github.com/DSACMS/repo-scaffolder/blob/main/maturity-model-tiers.md) to classify federal open source projects based on their maturity level. Each tier outlines specific files and content that are required or recommended to be included in the repository. - -repo-scaffolder assists project teams with creating repositories that adhere to repository hygiene standards. It provides file templates detailing project information, contributing guidance, maintainer roles, project metadata, community involvement, feedback mechanisms, governance, security policies, and more. Using [cookiecutter](https://github.com/cookiecutter/cookiecutter), repo-scaffolder helps teams identify what tier their project is classified as and fill in project information to be inputted into the file templates. In turn, this provides the project sufficient structure and foundation to promote a healthy open source ecosystem - -This repository also includes [outbound checklists](#Outbound-Checklists) for each tier outlining the review process for releasing repositories as open source. - -For existing repositories, repolinter via GitHub Actions is used to identify any files and information missing from the repository according to their maturity tier. - - - - - - - - - - - -## Core Team - -An up-to-date list of core team members can be found in [MAINTAINERS.md](MAINTAINERS.md). At this time, the project is still building the core team and defining roles and responsibilities. We are eagerly seeking individuals who would like to join the community and help us define and fill these roles. - -## Documentation Index - - - -##### Usage - -- [Using repo-scaffolder](#Using-repo-scaffolder) -- [Updating repositories using GitHub Actions](#Updating-projects-with-new-repo-scaffolder-upstream-file-changes) -- [Documentation](./docs) - -##### Maturity Models - -- [Maturity Model Framework](./maturity-model-tiers.md) -- [Tier 0](./tier0/README.md) -- [Tier 1](./tier1/README.md) -- [Tier 2](./tier2/README.md) -- [Tier 3](./tier3/README.md) -- [Tier 4](./tier4/README.md) - -##### Outbound Checklists - -- [Tier 1](./tier1/checklist.md) -- [Tier 2](./tier2/checklist.md) -- [Tier 3](./tier3/checklist.md) -- [Tier 4](./tier4/checklist.md) - -##### Files - -- [CONTRIBUTING.md](./CONTRIBUTING.md) -- [MAINTAINERS.md](./MAINTAINERS.md) -- [CODEOWNERS.md](./CODEOWNERS.md) -- [COMMUNITY_GUIDELINES.md](./COMMUNITY_GUIDELINES.md) -- [CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md) -- [SECURITY.md](./SECURITY.md) -- [LICENSE](./LICENSE) - -## Repository Structure - - - - -## Using repo-scaffolder - -### Create a new repository using repo-scaffolder - -The Open Source Program Office follows a maturity model framework to classify federal repositories according to their level of maturity: https://github.com/DSACMS/repo-scaffolder/blob/main/maturity-model-tiers.md. - -There are 4 tiers in the maturity model framework. The `/tier*` directory consists of templates, files, and scripts for each respective tier: - -- `{{cookiecutter.project_slug}}` is the directory containing templates and files to be generated upon repository creation. This serves as your repository starting point. -- `cookiecutter.json` defining the questions cookiecutter asks. -- `hooks`, a folder containing scripts to be run upon repository creation. -- `checklist.md` & `checklist.pdf` is the outbound review checklist with guidelines on releasing the repository as open source. -- `README.md` with more information about the maturity tier and file contents. - -#### Prerequisites - -- python -- github cli -- [cookiecutter](https://github.com/cookiecutter/cookiecutter) -- [repolinter](https://github.com/todogroup/repolinter) - -#### Need help picking a maturity tier? - -If you do not know what tier your project is, the cookiecutter will walk you through questions to figure out what tier you need. Run: - -``` -cookiecutter https://github.com/DSACMS/repo-scaffolder -``` - -#### Know what maturity tier you need? - -If you know what tier you need, you can run the cookiecutter for an individual tier. Use the below command with `X` substituted for the tier number. - -``` -cookiecutter https://github.com/DSACMS/repo-scaffolder --directory=tierX -``` - -### Update an existing repository using repo-scaffolder - -You can update existing projects with repo-scaffolder. Using the `-s` flag on cookiecutter will not overwrite existing files. Follow these steps: - -1. Create a new branch in your repo -2. cd into folder above -3. run: `cookiecutter -f -s https://github.com/DSACMS/repo-scaffolder --directory=tierX` -4. Make sure when answering the questions you use the existing folder/project name -5. Raise pr into main - -### Metadata collection using code.json - - - -#### Add code.json to your project - -Each repository should contain a code.json file with metadata about the project. - -To add code.json into your project, navigate to your project's `.github` directory and run the following cookiecutter command. You will be asked questions about the project (see cookiecutter.json) in order to collect and store this metadata in code.json. - -``` -cookiecutter . --directory=codejson -``` - -### Maintaining your repository using repo-scaffolder - -#### Updating projects with new repo-scaffolder upstream file changes - -When creating projects, if you want to receive updates then add `dsacms-tierX` as a github topic to the repo. The scaffolder repo includes github workflows that will find all repos with that tag and can raise a pull request with an updated string or adding a file. See [actions.md](https://github.com/DSACMS/repo-scaffolder/blob/main/.github/actions.md) for more information. - -### Identify missing files and information using repolinter - - - -Repolinter is a tool maintained by the [TODOGroup](https://todogroup.org/) for checking repositories for common open source issues, using pre-defined rulesets. This can be run stand-alone as a script, pre-commit in your IDE, or post-commit or within CI/CD systems! - -✔    =  Pass - -✖    =  Fail - -⚠  =  Warn - -Tiers of level 1 thru 4 have repolinter.json file in their projects. Tier1 has detailed configuration of all the rules. All the other tiers extends their previous tiers and has only the `rule` and the `level` configuration. - -Sample commands to run with the given repolinter.json path: - -``` -repolinter lint . - -repolinter lint tier4/\{\{cookiecutter.project_slug\}\} -``` - -#### Automated repolinter actions -A tool to automatically update repositories up to hygenic standards with the use of [Repolinter through GitHub Actions](https://github.com/DSACMS/repolinter-actions) is also available. This action sends a PR to your repository with templates of all the missing files and sections that are required using a predefined rulset. Visit the repository for more information on how to get this action up and running. - -# Development and Software Delivery Lifecycle - -The following guide is for members of the project team who have access to the repository as well as code contributors. The main difference between internal and external contributions is that external contributors will need to fork the project and will not be able to merge their own pull requests. For more information on contributing, see: [CONTRIBUTING.md](./CONTRIBUTING.md). - -## Local Development - -This project contains several different features. - -- `/tier*` contains file templates for repository creation and metadata collection using cookiecutter. Refer to the README.mds to learn more about the file contents. -- `/.github` contains GitHub actions to update repositories contents across the ecosystem. -- `checklist.md` & `checklist.pdf` is the outbound review checklist with guidelines on releasing the repository as open source. -- `maturity-model-tiers.md` & `maturity-model-tiers.pdf` contain information about our maturity model framework. - -### Editing/adding tiers and template contents in repo-scaffolder - -At a top level, each tier consists of a folder for `hooks`, a folder containing the files to be added (`{{cookiecutter.project_slug}}`), and a `cookiecutter.json` defining the questions cookiecutter asks. These naming conventions must be followed as that is what cookiecutter picks up. The `hooks` folder needs to be duplicated in each tier. The folder containing the files to be added can include slugged out variables such as `{{ cookiecutter.project_name }}` that can be filled in by the answers to `cookiecutter.json`. -For example, `{{ cookiecutter.project_name }}` will be filled in by this question - `"project_name": "My Project",`. - -See the [cookiecutter docs](https://cookiecutter.readthedocs.io/en/stable/) -for more information. - - - -## Coding Style and Linters - - - -Each application has its own linting and testing guidelines. Lint and code tests are run on each commit, so linters and tests should be run locally before commiting. - -## Branching Model - -This project follows [trunk-based development](https://trunkbaseddevelopment.com/), which means: - -- Make small changes in [short-lived feature branches](https://trunkbaseddevelopment.com/short-lived-feature-branches/) and merge to `dev` frequently. -- Be open to submitting multiple small pull requests for a single ticket (i.e. reference the same ticket across multiple pull requests). -- Treat each change you merge to `dev` as immediately deployable to production. Do not merge changes that depend on subsequent changes you plan to make, even if you plan to make those changes shortly. -- Ticket any unfinished or partially finished work. -- Tests should be written for changes introduced, and adhere to the text percentage threshold determined by the project. +# {name_of_project_here} + + + ## About the Project + + + ## Project Vision + + + ## Project Mission + + + ## Agency Mission + + + ## Team Mission + + + ## Core Team +An up-to-date list of core team members can be found in [MAINTAINERS.md](MAINTAINERS.md). At this time, the project is still building the core team and defining roles and responsibilities. We are eagerly seeking individuals who would like to join the community and help us define and fill these roles. + + ## Documentation Index + + **{list of .md at top directory and descriptions}** + + ## Repository Structure + + + **{list directories and descriptions}** + + ## Development and Software Delivery Lifecycle +The following guide is for members of the project team who have access to the repository as well as code contributors. The main difference between internal and external contributions is that external contributors will need to fork the project and will not be able to merge their own pull requests. For more information on contributing, see: [CONTRIBUTING.md](./CONTRIBUTING.md). + + ## Local Development + + + ## Coding Style and Linters + + Each application has its own linting and testing guidelines. Lint and code tests are run on each commit, so linters and tests should be run locally before commiting. + + ## Branching Model + + + ## Contributing +Thank you for considering contributing to an Open Source project of the US Government! For more information about our contribution guidelines, see [CONTRIBUTING.md](CONTRIBUTING.md). + + ## Codeowners +The contents of this repository are managed by **{responsible organization(s)}**. Those responsible for the code and documentation in this repository can be found in [CODEOWNERS.md](CODEOWNERS.md). + + ## Community +The {name_of_project_here} team is taking a community-first and open source approach to the product development of this tool. We believe government software should be made in the open and be built and licensed such that anyone can download the code, run it themselves without paying money to third parties or using proprietary software, and use it as they will. We know that we can learn from a wide variety of communities, including those who will use or will be impacted by the tool, who are experts in technology, or who have experience with similar technologies deployed in other spaces. We are dedicated to creating forums for continuous conversation and feedback to help shape the design and development of the tool. -We also recognize capacity building as a key part of involving a diverse open source community. We are doing our best to use accessible language, provide technical and process documents, and offer support to community members with a wide variety of backgrounds and skillsets. - -### Community Guidelines - -Principles and guidelines for participating in our open source community are can be found in [COMMUNITY_GUIDELINES.md](COMMUNITY_GUIDELINES.md). Please read them before joining or starting a conversation in this repo or one of the channels listed below. All community members and participants are expected to adhere to the community guidelines and code of conduct when participating in community spaces including: code repositories, communication channels and venues, and events. - -## Feedback - -If you have ideas for how we can improve or add to our capacity building efforts and methods for welcoming people into our community, please let us know at opensource@cms.hhs.gov. If you would like to comment on the tool itself, please let us know by filing an **issue on our GitHub repository.** - -## Acknowlegements - -This project was developed as a collaboration between the United States Digital -Service ([USDS.gov](https://usds.gov)), The Department of Health and Human -Services ([HHS.gov](https://hhs.gov)), The Digital Service at the Centers for -Medicare & Medicaid Services ([CMS.gov](https://cms.gov)) and The -[USDigitalResponse.org](https://usdigitalresponse.org). - -## Policies - -### Open Source Policy - -We adhere to the [CMS Open Source -Policy](https://github.com/CMSGov/cms-open-source-policy). If you have any -questions, just [shoot us an email](mailto:opensource@cms.hhs.gov). - -### Security and Responsible Disclosure Policy - -_Submit a vulnerability:_ Vulnerability reports can be submitted through [Bugcrowd](https://bugcrowd.com/cms-vdp). Reports may be submitted anonymously. If you share contact information, we will acknowledge receipt of your report within 3 business days. - -For more information about our Security, Vulnerability, and Responsible Disclosure Policies, see [SECURITY.md](SECURITY.md). - -### Software Bill of Materials (SBOM) - +We also recognize capacity building as a key part of involving a diverse open source community. We are doing our best to use accessible language, provide technical and process documents, and offer support to community members with a wide variety of backgrounds and skillsets. + + ## Community Guidelines +Principles and guidelines for participating in our open source community are can be found in [COMMUNITY_GUIDELINES.md](COMMUNITY_GUIDELINES.md). Please read them before joining or starting a conversation in this repo or one of the channels listed below. All community members and participants are expected to adhere to the community guidelines and code of conduct when participating in community spaces including: code repositories, communication channels and venues, and events. + + ## Governance + +Information about how the {{ cookiecutter.project_name }} community is governed may be found in [GOVERNANCE.md](GOVERNANCE.md). + + ## Feedback +If you have ideas for how we can improve or add to our capacity building efforts and methods for welcoming people into our community, please let us know at **{contact_email}**. If you would like to comment on the tool itself, please let us know by filing an **issue on our GitHub repository.** + + ## Glossary +Information about terminology and acronyms used in this documentation may be found in [GLOSSARY.md](GLOSSARY.md). + + ## Policies + + ### Open Source Policy +We adhere to the [CMS Open Source Policy](https://github.com/CMSGov/cms-open-source-policy). If you have any questions, just [shoot us an email](mailto:opensource@cms.hhs.gov). + + ### Security and Responsible Disclosure Policy +*Submit a vulnerability:* Vulnerability reports can be submitted through [Bugcrowd](https://bugcrowd.com/cms-vdp). Reports may be submitted anonymously. If you share contact information, we will acknowledge receipt of your report within 3 business days. +For more information about our Security, Vulnerability, and Responsible Disclosure Policies, see [SECURITY.md](SECURITY.md). + + ## Public Domain +This project is in the public domain within the United States, and copyright and related rights in the work worldwide are waived through the [CC0 1.0 Universal public domain dedication](https://creativecommons.org/publicdomain/zero/1.0/) as indicated in [LICENSE](LICENSE). +All contributions to this project will be released under the CC0 dedication. By submitting a pull request or issue, you are agreeing to comply with this waiver of copyright interest. + + ### Software Bill of Materials (SBOM) A Software Bill of Materials (SBOM) is a formal record containing the details and supply chain relationships of various components used in building software. - -In the spirit of [Executive Order 14028 - Improving the Nation’s Cyber Security](https://www.gsa.gov/technology/it-contract-vehicles-and-purchasing-programs/information-technology-category/it-security/executive-order-14028), a SBOM for this repository is provided here: https://github.com/DSACMS/repo-scaffolder/network/dependencies. - -For more information and resources about SBOMs, visit: https://www.cisa.gov/sbom. - -## Public domain - -This project is in the public domain within the United States, and copyright -and related rights in the work worldwide are waived through the [CC0 1.0 -Universal public domain -dedication](https://creativecommons.org/publicdomain/zero/1.0/) as indicated in [LICENSE](LICENSE). - -All contributions to this project will be released under the CC0 dedication. By -submitting a pull request or issue, you are agreeing to comply with this waiver -of copyright interest. +In the spirit of [Executive Order 14028 - Improving the Nation's Cyber Security](https://www.gsa.gov/technology/it-contract-vehicles-and-purchasing-programs/information-technology-category/it-security/executive-order-14028), a SBOM for this repository is provided here: https://github.com/{repo_org}/{repo_name}/network/dependencies. +For more information and resources about SBOMs, visit: https://www.cisa.gov/sbom. \ No newline at end of file diff --git a/SECURITY.md b/SECURITY.md index c33d9ea0..5612ae8e 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,12 +1,9 @@ -# Security and Responsible Disclosure Policy - -The Centers for Medicare & Medicaid Services is committed to ensuring the security of the American public by protecting their information from unwarranted disclosure. We want security researchers to feel comfortable reporting vulnerabilities they have discovered so we can fix them and keep our users safe. We developed our disclosure policy to reflect our values and uphold our sense of responsibility to security researchers who share their expertise with us in good faith. - -*Submit a vulnerability:* Vulnerability reports can be submitted through [Bugcrowd](https://bugcrowd.com/cms-vdp). Reports may be submitted anonymously. If you share contact information, we will acknowledge receipt of your report within 3 business days. - -Review the HHS Disclosure Policy and websites in scope: -[https://www.hhs.gov/vulnerability-disclosure-policy/index.html](https://www.hhs.gov/vulnerability-disclosure-policy/index.html). - -This policy describes *what systems and types of research* are covered under this -policy, *how to send* us vulnerability reports, and *how long* we ask security -researchers to wait before publicly disclosing vulnerabilities. +# Security and Responsible Disclosure Policy +The Centers for Medicare & Medicaid Services is committed to ensuring the security of the American public by protecting their information from unwarranted disclosure. We want security researchers to feel comfortable reporting vulnerabilities they have discovered so we can fix them and keep our users safe. We developed our disclosure policy to reflect our values and uphold our sense of responsibility to security researchers who share their expertise with us in good faith. + + *Submit a vulnerability:* Vulnerability reports can be submitted through [Bugcrowd](https://bugcrowd.com/cms-vdp). Reports may be submitted anonymously. If you share contact information, we will acknowledge receipt of your report within 3 business days. + + Review the HHS Disclosure Policy and websites in scope: + [https://www.hhs.gov/vulnerability-disclosure-policy/index.html](https://www.hhs.gov/vulnerability-disclosure-policy/index.html). + + This policy describes *what systems and types of research* are covered under this policy, *how to send* us vulnerability reports, and *how long* we ask security researchers to wait before publicly disclosing vulnerabilities.