|
1 | 1 | # Secure Dashboard for the OpenJS Foundation
|
2 | 2 |
|
3 |
| -This is an evolution of [this proof of concept (POC)](https://github.com/UlisesGascon/poc-openjs-security-program-standards-dashboard). |
| 3 | +This project aims to provide a secure and user-friendly dashboard for managing and monitoring projects under the OpenJS Foundation. It evolves from [this proof of concept (POC)](https://github.com/UlisesGascon/poc-openjs-security-program-standards-dashboard) and currently we are developing an MVP version ([milestone roadmap](https://github.com/secure-dashboards/openjs-foundation-dashboard/issues/30)). |
4 | 4 |
|
5 |
| -## Prerequisites |
| 5 | +## Table of Contents |
6 | 6 |
|
7 |
| -- Node.js 22 and npm |
8 |
| -- Docker and Docker Compose |
9 |
| -- Github token with repo:read level access. |
| 7 | +1. [Motivation](#motivation) |
| 8 | + - [More context](#more-context) |
| 9 | + - [Engage now](#engage-now) |
| 10 | +2. [Getting Started](#getting-started) |
| 11 | + - [Prerequisites](#prerequisites) |
| 12 | + - [Infrastructure Setup](#infrastructure-setup) |
| 13 | + - [Configuration](#configuration) |
| 14 | +3. [Usage](#usage) |
| 15 | + - [Projects](#projects) |
| 16 | + - [Workflows](#workflows) |
| 17 | + - [Checks](#checks) |
| 18 | +4. [Database Management](#database-management) |
| 19 | + - [Migrations](#migrations) |
| 20 | + - [Seeding](#seeding) |
| 21 | + - [Schema Management](#schema-management) |
| 22 | +5. [Development](#development) |
| 23 | + - [Debugging](#debugging) |
| 24 | + - [Linting](#linting) |
| 25 | + - [Testing](#testing) |
| 26 | +6. [Community Guidelines](#community-guidelines) |
| 27 | +7. [License](#license) |
10 | 28 |
|
11 |
| -## Infrastructure |
| 29 | +--- |
12 | 30 |
|
13 |
| -This project requires a PostgreSQL database. You can run this project using a local database with Docker. Additionally, this project provides an instance of [Adminer](https://www.adminer.org/) accessible at `http://localhost:8080`. |
| 31 | +## Motivation |
14 | 32 |
|
| 33 | +The goal of this project is to streamline the secure management of OpenJS Foundation projects by providing an intuitive dashboard with robust infrastructure support. It emphasizes security, simplicity, and extensibility ✨ |
15 | 34 |
|
16 |
| -### Starting the Infrastructure |
| 35 | +### More Context |
17 | 36 |
|
18 |
| -To start the infrastructure, run the following command: |
| 37 | +A few months ago, we started a discussion about [the OpenJS Security Collab space initiative](https://github.com/openjs-foundation/security-collab-space) ("[Security Program Standards](https://github.com/openjs-foundation/security-collab-space/issues/211)") to build a dashboard for monitoring security parameters in our projects (Node.js, Electron, jQuery, Express, etc.). After carefully planning and securing resources, we are now at an exciting point as we’ve recently launched a pilot program with some projects. 🚀 |
19 | 38 |
|
20 |
| -```bash |
21 |
| -npm run infra:start |
22 |
| -``` |
| 39 | +So far, we’ve developed this website: [https://openjs-security-program-standards.netlify.app/](https://openjs-security-program-standards.netlify.app/), which is based on the checklist ([Google Sheet](https://docs.google.com/spreadsheets/d/1GwIsAudAn89xv9DAbr1HUaY4KEVBsYfg--_1cW0uIB0/edit#gid=0)) and the introductory document ([Google Doc](https://docs.google.com/document/d/1bWk3U5XpsKswqlPbZZHGxy3xRPuUx_gVzWa03OiMyQs/edit)) that we compiled during our original research. 😄 |
23 | 40 |
|
24 |
| -### Stopping the Infrastructure |
| 41 | +You can watch this [YouTube video](https://www.youtube.com/watch?v=B1kd8k5SvBI) for a proper introduction to the Dashboard and website (both Proof of Concept versions) built based on feedback from [the Express Security WG](https://github.com/expressjs/security-wg) and others. |
25 | 42 |
|
26 |
| -To stop the infrastructure, run the following command: |
| 43 | +In essence, this tool collects information from multiple sources, evaluates it, transforms it into actionable insights, and uses it to build dashboards, tasks, and alerts at both the foundation and project levels. If you prefer a non-video format, here are [the slides](https://slides.ulisesgascon.com/openjs-security-program-standards/) and [the code repository](https://github.com/UlisesGascon/poc-openjs-security-program-standards-dashboard/blob/main/README.md). |
27 | 44 |
|
28 |
| -```bash |
29 |
| -npm run infra:stop |
30 |
| -``` |
| 45 | +Currently, we are focused on building a solid MVP and onboarding new contributors, aiming to create a great product by the end of this process. 😎 |
31 | 46 |
|
32 |
| -## Configuration |
| 47 | +### Engage Now |
33 | 48 |
|
34 |
| -### Environment Variables |
| 49 | +Yes, we are looking for HELP in many ways! 😇 Let’s collaborate and have fun together. You can find more information in [the contributing guide](CONTRIBUTING.md). 🌟 |
35 | 50 |
|
36 |
| -This project requires a GitHub token to access the GitHub API. You need to set the `GITHUB_TOKEN` environment variable. |
| 51 | +Another great way to get involved is by participating in [the OpenJS Security Collab Space](https://github.com/openjs-foundation/security-collab-space). We hold regular meetings to discuss this initiative and many other exciting topics. |
37 | 52 |
|
38 |
| -#### Optional: use .env file |
| 53 | +--- |
39 | 54 |
|
40 |
| -Create a `.env` file and add your GitHub token: |
| 55 | +## Getting Started |
41 | 56 |
|
42 |
| -```sh |
43 |
| -GITHUB_TOKEN=your_github_token_here |
44 |
| -``` |
45 |
| - |
46 |
| -then use `--env-file` flag to load it, like `node --env-file=.env index.js workflow run --name populate-repos-list` |
| 57 | +### Prerequisites |
47 | 58 |
|
| 59 | +- Node.js 22 and npm |
| 60 | +- Docker and Docker Compose |
| 61 | +- GitHub token with `repo:read` access level (not needed for development) |
48 | 62 |
|
49 |
| -## Database Management |
| 63 | +### Infrastructure Setup |
50 | 64 |
|
51 |
| -### Running Migrations |
| 65 | +This project requires a PostgreSQL database and includes an instance of [Adminer](https://www.adminer.org/) accessible at `http://localhost:8080`. |
52 | 66 |
|
53 |
| -To run the latest database migrations, use the following command: |
| 67 | +#### Start Infrastructure |
54 | 68 |
|
55 | 69 | ```bash
|
56 |
| -npm run db:migrate |
| 70 | +npm run infra:start |
57 | 71 | ```
|
58 | 72 |
|
59 |
| -### Rolling Back Migrations |
60 |
| - |
61 |
| -To rollback the last batch of migrations, use the following command: |
| 73 | +#### Stop Infrastructure |
62 | 74 |
|
63 | 75 | ```bash
|
64 |
| -npm run db:rollback |
| 76 | +npm run infra:stop |
65 | 77 | ```
|
66 | 78 |
|
67 |
| -### Seeding the Database |
| 79 | +### Configuration |
68 | 80 |
|
69 |
| -To seed the database with initial data, use the following command: |
70 | 81 |
|
71 |
| -```bash |
72 |
| -npm run db:seed |
73 |
| -``` |
| 82 | +#### Environment Variables |
74 | 83 |
|
75 |
| -### Examine the database schema |
| 84 | +Set the `GITHUB_TOKEN` environment variable to authenticate with the GitHub API. |
76 | 85 |
|
77 |
| -You can find an updated version of the schemas in [/src/database/schema/schema.sql](src/database/schema/schema.sql) so you don't have to start the infra and run the migrations if you just want to know about the database structure. |
78 |
| - |
79 |
| -### Update the database schema |
| 86 | +Optionally, use a `.env` file: |
| 87 | +``` |
| 88 | +GITHUB_TOKEN=your_github_token_here |
| 89 | +``` |
80 | 90 |
|
81 |
| -To update the schema, use the following command: |
| 91 | +Then load it using: |
82 | 92 |
|
83 | 93 | ```bash
|
84 |
| -npm run db:generate-schema |
| 94 | +node --env-file=.env index.js workflow run --name populate-repos-list |
85 | 95 | ```
|
86 | 96 |
|
87 | 97 | ## Usage
|
88 | 98 |
|
89 | 99 | ### Projects
|
90 | 100 |
|
91 |
| -To add a new project, use the following command: |
| 101 | +Add a new project: |
92 | 102 |
|
93 | 103 | ```bash
|
94 | 104 | node index.js project add [--name <name>] [--github-urls <urls...>] [--category <category>]
|
95 | 105 | ```
|
96 | 106 |
|
97 |
| -For example, to add a project named "express" with GitHub URLs: |
| 107 | +Example: |
98 | 108 |
|
99 | 109 | ```bash
|
100 | 110 | node index.js project add --name express --github-urls https://github.com/expressjs https://github.com/pillarjs https://github.com/jshttp --category impact
|
101 | 111 | ```
|
102 | 112 |
|
103 | 113 | ### Workflows
|
104 | 114 |
|
105 |
| -To run a workflow, use the following command: |
| 115 | +Run a workflow: |
106 | 116 |
|
107 | 117 | ```bash
|
108 | 118 | node index.js workflow run [--name <name>]
|
109 | 119 | ```
|
110 | 120 |
|
111 |
| -To list all available workflows, use the following command: |
| 121 | +List workflows: |
112 | 122 |
|
113 | 123 | ```bash
|
114 | 124 | node index.js workflow list
|
115 | 125 | ```
|
116 | 126 |
|
117 | 127 | ### Checks
|
118 | 128 |
|
119 |
| -You can list all the implemented checks, use the following command: |
| 129 | +List all checks: |
120 | 130 |
|
121 | 131 | ```bash
|
122 | 132 | node index.js check list
|
123 | 133 | ```
|
124 |
| - |
125 |
| -You can any implemented check at any time by running the following command: |
| 134 | +Run a specific check: |
126 | 135 |
|
127 | 136 | ```bash
|
128 | 137 | node index.js check run [--name <name>]
|
129 | 138 | ```
|
130 | 139 |
|
| 140 | +There is an specific workflow that runs all the checks sequentially: |
131 | 141 |
|
132 |
| -## Debug mode |
| 142 | +```bash |
| 143 | +node index.js workflow run run-all-checks |
| 144 | +``` |
133 | 145 |
|
134 |
| -This project uses the [debug library](https://www.npmjs.com/package/debug), so you can always use the environmental variable `DEBUG=*` to print more detailed information of the execution. |
| 146 | +## Database Management |
135 | 147 |
|
| 148 | +### Migrations |
136 | 149 |
|
137 |
| -## Linting |
| 150 | +Run latest migrations: |
138 | 151 |
|
139 |
| -To lint the files, use the following command: |
| 152 | +```bash |
| 153 | +npm run db:migrate |
| 154 | +``` |
| 155 | + |
| 156 | +Rollback migrations: |
| 157 | + |
| 158 | +```bash |
| 159 | +npm run db:rollback |
| 160 | +``` |
| 161 | + |
| 162 | +### Seeding |
| 163 | + |
| 164 | +Seed the database: |
| 165 | + |
| 166 | +```bash |
| 167 | +npm run db:seed |
| 168 | +``` |
| 169 | + |
| 170 | +### Schema Management |
| 171 | + |
| 172 | +Check the schema: |
| 173 | + |
| 174 | +Refer to the latest schema file at [/src/database/schema/schema.sql](src/database/schema/schema.sql). |
| 175 | + |
| 176 | +Update the schema: |
| 177 | + |
| 178 | +```bash |
| 179 | +npm run db:generate-schema |
| 180 | +``` |
| 181 | + |
| 182 | +## Development |
| 183 | + |
| 184 | +### Debugging |
| 185 | + |
| 186 | +Enable debug logs using the `DEBUG` environment variable: |
| 187 | + |
| 188 | +```bash |
| 189 | +DEBUG=* node index.js |
| 190 | +``` |
| 191 | + |
| 192 | +### Linting |
| 193 | + |
| 194 | +Run lint checks: |
140 | 195 |
|
141 | 196 | ```bash
|
142 | 197 | npm run lint
|
143 | 198 | ```
|
144 | 199 |
|
145 |
| -To automatically fix linting issues, use the following command: |
| 200 | +Fix lint issues: |
146 | 201 |
|
147 | 202 | ```bash
|
148 | 203 | npm run lint:fix
|
149 | 204 | ```
|
150 | 205 |
|
151 |
| -## Running Tests |
| 206 | +### Testing |
152 | 207 |
|
153 |
| -To run the tests, use the following command: |
| 208 | +Run tests: |
154 | 209 |
|
155 | 210 | ```bash
|
156 | 211 | npm test
|
157 | 212 | ```
|
158 | 213 |
|
159 |
| -To run the tests with coverage, use the following command: |
| 214 | +Run tests with coverage: |
160 | 215 |
|
161 | 216 | ```bash
|
162 | 217 | npm run test:coverage
|
163 | 218 | ```
|
164 | 219 |
|
| 220 | +Update the snapshots when needed: |
| 221 | +```bash |
| 222 | +npm run test -- -u |
| 223 | +``` |
| 224 | + |
| 225 | +## Community Guidelines |
| 226 | + |
| 227 | +We encourage contributors to adhere to our [Code of Conduct](CODE_OF_CONDUCT.md) and [Contributing Guidelines](CONTRIBUTING.md). Security-related concerns should follow our [Security Policy](SECURITY.md). |
| 228 | + |
| 229 | + |
165 | 230 | ## License
|
166 | 231 |
|
167 |
| -This project is licensed under the MIT License. See the [LICENSE](/LICENSE) file for details. |
| 232 | +This project is licensed under the MIT License. See the [LICENSE](LICENSE) file for details. |
0 commit comments