Skip to content
This repository was archived by the owner on Jul 29, 2024. It is now read-only.

Commit 5e6d065

Browse files
Changes to increase www.bestpractices.dev score (#37)
2 parents 9e80aa5 + 6de3444 commit 5e6d065

File tree

6 files changed

+124
-27
lines changed

6 files changed

+124
-27
lines changed

.github/workflows/standard.yaml

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
# ----------------------------------------------------------------------
2424
action_contexts:
2525
name: "Display GitHub Action Contexts"
26-
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_display_action_contexts.yaml@CI-v0.15.6
26+
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_display_action_contexts.yaml@CI-v0.17.0
2727

2828
# ----------------------------------------------------------------------
2929
validate:
@@ -45,7 +45,7 @@ jobs:
4545

4646
name: Validate
4747

48-
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_validate_python.yaml@CI-v0.15.6
48+
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_validate_python.yaml@CI-v0.17.0
4949
with:
5050
operating_system: ${{ matrix.os }}
5151
python_version: ${{ matrix.python_version }}
@@ -56,7 +56,7 @@ jobs:
5656

5757
name: Postprocess Coverage Info
5858

59-
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_package_python_coverage.yaml@CI-v0.15.6
59+
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_package_python_coverage.yaml@CI-v0.17.0
6060
with:
6161
gist_id: 2f9d770d13e3a148424f374f74d41f4b
6262
gist_filename: PythonProjectBootstrapper_coverage.json
@@ -85,7 +85,7 @@ jobs:
8585

8686
name: Create Package
8787

88-
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_create_python_package.yaml@CI-v0.15.6
88+
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_create_python_package.yaml@CI-v0.17.0
8989
with:
9090
operating_system: ${{ matrix.os }}
9191
python_version: ${{ matrix.python_version }}
@@ -112,7 +112,7 @@ jobs:
112112

113113
name: Validate Package
114114

115-
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_validate_python_package.yaml@CI-v0.15.6
115+
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_validate_python_package.yaml@CI-v0.17.0
116116
with:
117117
operating_system: ${{ matrix.os }}
118118
python_version: ${{ matrix.python_version }}
@@ -136,7 +136,7 @@ jobs:
136136

137137
name: Create Binary
138138

139-
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_create_python_binary.yaml@CI-v0.15.6
139+
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_create_python_binary.yaml@CI-v0.17.0
140140
with:
141141
operating_system: ${{ matrix.os }}
142142
python_version: ${{ matrix.python_version }}
@@ -159,7 +159,7 @@ jobs:
159159

160160
name: Validate Binary
161161

162-
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_validate_python_binary.yaml@CI-v0.15.6
162+
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_validate_python_binary.yaml@CI-v0.17.0
163163
with:
164164
operating_system: ${{ matrix.os }}
165165
python_version: ${{ matrix.python_version }}
@@ -173,7 +173,7 @@ jobs:
173173

174174
name: Publish
175175

176-
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_publish_python.yaml@CI-v0.15.6
176+
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_publish_python.yaml@CI-v0.17.0
177177
with:
178178
release_sources_configuration_filename: .github/release_sources.yaml
179179
secrets:

src/PythonProjectBootstrapper/ProjectGenerationUtils.py

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -267,11 +267,16 @@ def CopyToOutputDir(
267267
merged_manifest[rel_filepath] = generated_hash
268268

269269
# create and save manifest
270-
yaml_comments = """#####################################################################################
271-
# This file is used to determine whether changes have been made to any files in the project.
272-
# These values are saved in case the project is regenerated so we can avoid overwriting any user changes.
273-
# Please do not change the contents :)
274-
#####################################################################################\n\n"""
270+
yaml_comments = textwrap.dedent(
271+
"""\
272+
#############################################################################################################
273+
# This file is used by PythonProjectBootstrapper (https://github.com/gt-sse-center/PythonProjectBootstrapper)
274+
# to determine whether changes have been made to any files in the project. These values are saved in case the
275+
# project is regenerated so we can avoid overwriting any user changes. Please do not change the contents :)
276+
#############################################################################################################
277+
278+
""",
279+
)
275280

276281
if potential_manifest.is_file():
277282
_ChangeManifestWritePermissions(manifest_filepath=potential_manifest, read_only=False)

src/PythonProjectBootstrapper/package/{{ cookiecutter.__empty_dir }}/.github/workflows/standard.yaml

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
# ----------------------------------------------------------------------
1919
action_contexts:
2020
name: "Display GitHub Action Contexts"
21-
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_display_action_contexts.yaml@CI-v0.15.6
21+
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_display_action_contexts.yaml@CI-v0.17.0
2222

2323
# ----------------------------------------------------------------------
2424
validate:
@@ -40,7 +40,7 @@ jobs:
4040

4141
name: Validate
4242

43-
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_validate_python.yaml@CI-v0.15.6
43+
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_validate_python.yaml@CI-v0.17.0
4444
with:
4545
operating_system: {% raw %}${{ matrix.os }}{% endraw %}
4646
python_version: {% raw %}${{ matrix.python_version }}{% endraw %}
@@ -51,7 +51,7 @@ jobs:
5151

5252
name: Postprocess Coverage Info
5353

54-
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_package_python_coverage.yaml@CI-v0.15.6
54+
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_package_python_coverage.yaml@CI-v0.17.0
5555
with:
5656
gist_id: {{ cookiecutter.gist_id }}
5757
gist_filename: {{ cookiecutter.github_project_name }}_coverage.json
@@ -80,7 +80,7 @@ jobs:
8080

8181
name: Create Package
8282

83-
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_create_python_package.yaml@CI-v0.15.6
83+
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_create_python_package.yaml@CI-v0.17.0
8484
with:
8585
operating_system: {% raw %}${{ matrix.os }}{% endraw %}
8686
python_version: {% raw %}${{ matrix.python_version }}{% endraw %}
@@ -107,7 +107,7 @@ jobs:
107107

108108
name: Validate Package
109109

110-
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_validate_python_package.yaml@CI-v0.15.6
110+
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_validate_python_package.yaml@CI-v0.17.0
111111
with:
112112
operating_system: {% raw %}${{ matrix.os }}{% endraw %}
113113
python_version: {% raw %}${{ matrix.python_version }}{% endraw %}
@@ -131,7 +131,7 @@ jobs:
131131

132132
name: Create Binary
133133

134-
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_create_python_binary.yaml@CI-v0.15.6
134+
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_create_python_binary.yaml@CI-v0.17.0
135135
with:
136136
operating_system: {% raw %}${{ matrix.os }}{% endraw %}
137137
python_version: {% raw %}${{ matrix.python_version }}{% endraw %}
@@ -154,7 +154,7 @@ jobs:
154154

155155
name: Validate Binary
156156

157-
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_validate_python_binary.yaml@CI-v0.15.6
157+
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_validate_python_binary.yaml@CI-v0.17.0
158158
with:
159159
operating_system: {% raw %}${{ matrix.os }}{% endraw %}
160160
python_version: {% raw %}${{ matrix.python_version }}{% endraw %}
@@ -178,7 +178,7 @@ jobs:
178178

179179
name: Create Docker Image
180180

181-
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_create_docker_image.yaml@CI-v0.15.6
181+
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_create_docker_image.yaml@CI-v0.17.0
182182
with:
183183
operating_system: ubuntu-latest
184184
python_version: {% raw %}${{ matrix.python_version }}{% endraw %}
@@ -200,7 +200,7 @@ jobs:
200200

201201
name: Publish
202202

203-
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_publish_python.yaml@CI-v0.15.6
203+
uses: davidbrownell/dbrownell_DevTools/.github/workflows/callable_publish_python.yaml@CI-v0.17.0
204204
with:
205205
release_sources_configuration_filename: .github/release_sources.yaml
206206
secrets:
Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# Contributing
2+
3+
Feedback and contributions are very welcome!
4+
5+
Here's help on how to make contributions, divided into the following sections:
6+
7+
- [general information](#general-information),
8+
- [vulnerability reporting](#vulnerability-reporting-security-issues),
9+
- [code changes](#code-changes),
10+
11+
## General information
12+
For specific proposals, please provide them as [pull requests](https://github.com/coreinfrastructure/best-practices-badge/pulls) or [issues](https://github.com/coreinfrastructure/best-practices-badge/issues) via our [GitHub site]({{ cookiecutter.github_url }}/{{ cookiecutter.github_username }}/{{ cookiecutter.github_project_name }}).
13+
14+
The [DEVELOPMENT.md]({{ cookiecutter.github_url }}/{{ cookiecutter.github_username }}/{{ cookiecutter.github_project_name }}/blob/main/DEVELOPMENT.md) file explains how to install the program locally (highly recommended if you're going to make code changes). It also provides a quick start guide.
15+
16+
### Pull requests and different branches recommended
17+
Pull requests are preferred, since they are specific. For more about how to create a pull request, see https://help.github.com/articles/using-pull-requests/.
18+
19+
We recommend creating different branches for different (logical) changes, and creating a pull request when you're done into the main branch. See the GitHub documentation on [creating branches](https://help.github.com/articles/creating-and-deleting-branches-within-your-repository/) and [using pull requests](https://help.github.com/articles/using-pull-requests/).
20+
21+
### How we handle proposals
22+
We use GitHub to track proposed changes via its [issue tracker](https://github.com/coreinfrastructure/best-practices-badge/issues) and [pull requests](https://github.com/coreinfrastructure/best-practices-badge/pulls). Specific changes are proposed using those mechanisms. Issues are assigned to an individual, who works and then marks it complete. If there are questions or objections, the conversation are of that issue or pull request is used to resolve it.
23+
24+
### We are proactive
25+
In general we try to be proactive to detect and eliminate mistakes and vulnerabilities as soon as possible, and to reduce their impact when they do happen. We use a defensive design and coding style to reduce the likelihood of mistakes, a variety of tools that try to detect mistakes early, and an automatic test suite with significant coverage. We also release the software as open source software so others can review it.
26+
27+
Since early detection and impact reduction can never be perfect, we also try to detect and repair problems during deployment as quickly as possible. This is especially true for security issues; see our [security information](#vulnerability-reporting-security-issues) for more.
28+
29+
## Vulnerability reporting (security issues)
30+
Please privately report vulnerabilities you find so we can fix them!
31+
32+
See [SECURITY.md]({{ cookiecutter.github_url }}/{{ cookiecutter.github_username }}/{{ cookiecutter.github_project_name }}/blob/main/SECURITY.md) for information on how to privately report vulnerabilities.
33+
34+
## Code changes
35+
To make changes to the "{{ cookiecutter.pypi_project_name }}" web application that implements the criteria, you may find [DEVELOPMENT.md]({{ cookiecutter.github_url }}/{{ cookiecutter.github_username }}/{{ cookiecutter.github_project_name }}/blob/main/DEVELOPMENT.md) helpful.
36+
37+
The code should strive to be DRY (don't repeat yourself), clear, and obviously correct. Some technical debt is inevitable, just don't bankrupt us with it. Improved refactorizations are welcome.
38+
39+
### Automated tests
40+
When adding or changing functionality, please include new tests for them as part of your contribution.
41+
42+
We require the code to have at a minimum statement coverage (that is measured and enforced during the [Continuous Integration](https://en.wikipedia.org/wiki/Continuous_integration) process); please ensure your contributions do not lower the coverage below that minimum.
43+
44+
We encourage tests to be created first, run to ensure they fail, and then add code to implement the test (aka test driven development). However, each git commit should have both the test and improvement in the same commit, because 'git bisect' will then work well.
45+
46+
### How to check proposed changes before submitting them
47+
See [DEVELOPMENT.md]({{ cookiecutter.github_url }}/{{ cookiecutter.github_username }}/{{ cookiecutter.github_project_name }}/blob/main/DEVELOPMENT.md) for information on how to run tests on your local machine before submitting them as a pull request.
48+
49+
### Git commit messages
50+
When writing git commit messages, try to follow the guidelines in [How to Write a Git Commit Message](https://chris.beams.io/posts/git-commit/):
51+
52+
1. Separate subject from body with a blank line
53+
2. Limit the subject line to 50 characters. (We're flexible on this, but do limit it to 72 characters or less.)
54+
3. Capitalize the subject line
55+
4. Do not end the subject line with a period
56+
5. Use the imperative mood in the subject line (command form)
57+
6. Wrap the body at 72 characters ("fmt -w 72")
58+
7. Use the body to explain what and why vs. how (git tracks how it was changed in detail, don't repeat that)

src/PythonProjectBootstrapper/package/{{ cookiecutter.__empty_dir }}/README.md

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,33 +12,58 @@
1212

1313
{{ cookiecutter.project_description }}
1414

15-
### Overview
15+
<!-- BEGIN: Exclude Package -->
16+
## Contents
17+
- [Overview](#overview)
18+
- [Installation](#installation)
19+
- [Contributing](#contributing)
20+
- [Local Development](#local-development)
21+
- [Vulnerability Reporting](#vulnerability-reporting-security-issues)
22+
- [License](#license)
23+
<!-- END: Exclude Package -->
24+
25+
## Overview
1626

1727
TODO: Complete this section
1828

1929
### How to use {{ cookiecutter.github_project_name }}
2030

2131
TODO: Complete this section
2232

23-
## Installation via Executable
33+
<!-- BEGIN: Exclude Package -->
34+
## Installation
35+
36+
{{ cookiecutter.github_project_name }} can be installed via one of these methods:
37+
38+
- [Installation via Executable](#installation-via-executable)
39+
- [Installation via pip](#installation-via-pip)
40+
41+
### Installation via Executable
2442

2543
Download an executable for Linux, MacOS, or Windows to use the functionality provided by this repository without a dependency on [Python](https://www.python.org).
2644

2745
1. Download the archive for the latest release [here]({{ cookiecutter.github_url }}/{{ cookiecutter.github_username }}/{{ cookiecutter.github_project_name }}/releases/latest); the files will begin with `exe.` and contain the name of your operating system.
2846
2. Decompress the archive
2947

30-
## Installation via pip
48+
### Installation via pip
3149

3250
Install the {{ cookiecutter.pypi_project_name }} package via [pip](https://pip.pypa.io/en/stable/) (Package Installer for Python) to use it with your python code.
3351

3452
`pip install {{ cookiecutter.pypi_project_name }}`
3553

36-
<!-- BEGIN: Exclude Package -->
54+
## Contributing
55+
See [CONTRIBUTING.md]({{ cookiecutter.github_url }}/{{ cookiecutter.github_username }}/{{ cookiecutter.github_project_name }}/blob/main/CONTRIBUTING.md) for information on contributing to {{ cookiecutter.github_project_name }}.
56+
3757
## Local Development
3858

39-
Visit [DEVELOPMENT.md]({{ cookiecutter.github_url }}/{{ cookiecutter.github_username }}/{{ cookiecutter.github_project_name }}/blob/main/DEVELOPMENT.md) for information on developing or testing {{ cookiecutter.github_project_name }} on your local Linux, MacOS, or Windows machine.
59+
See [DEVELOPMENT.md]({{ cookiecutter.github_url }}/{{ cookiecutter.github_username }}/{{ cookiecutter.github_project_name }}/blob/main/DEVELOPMENT.md) for information on developing or testing {{ cookiecutter.github_project_name }} on your local Linux, MacOS, or Windows machine.
4060
<!-- END: Exclude Package -->
4161

62+
## Vulnerability Reporting (Security Issues)
63+
Please privately report vulnerabilities you find so we can fix them!
64+
65+
See [SECURITY.md]({{ cookiecutter.github_url }}/{{ cookiecutter.github_username }}/{{ cookiecutter.github_project_name }}/blob/main/SECURITY.md) for information on how to privately report vulnerabilities.
66+
4267
## License
4368

4469
{{ cookiecutter.github_project_name }} is licensed under the <a href="
Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# Security
2+
3+
If you find a significant vulnerability, or evidence of one, please report it privately.
4+
5+
We prefer that you use the [GitHub mechanism for privately reporting a vulnerability](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability). Under the [main repository's security tab]({{ cookiecutter.github_url }}/{{ cookiecutter.github_username }}/{{ cookiecutter.github_project_name }}/security), in the left sidebar, under "Reporting", click Advisories, then click "Report a vulnerability" to open the advisory form.
6+
7+
We will gladly give credit to anyone who reports a vulnerability so that we can fix it. If you want to remain anonymous or pseudonymous instead, please let us know that; we will gladly respect your wishes.
8+
9+
We gladly welcome patches to fix such vulnerabilities! See [CONTRIBUTING.md]({{ cookiecutter.github_url }}/{{ cookiecutter.github_username }}/{{ cookiecutter.github_project_name }}/blob/main/CONTRIBUTING.md) for information about contributions.

0 commit comments

Comments
 (0)