Skip to content

Commit a068b82

Browse files
masc2023masc2023
authored
Merge pull request #2543 from alekseyborisyukvalidas/albor_github_evaluation
Added github evaluation
2 parents b670fe6 + 7cdaedc commit a068b82

File tree

3 files changed

+235
-2
lines changed

3 files changed

+235
-2
lines changed

‎docs/score_tools/score_tools_evaluation_list.rst‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -607,10 +607,10 @@ release, as part of the Tool Verification Report.
607607
* - 6-2
608608
- GitHub
609609
- Code hosting and collaboration platform
610-
- T.B.D. (see [1]_)
610+
- cloud
611611
- YES
612612
- :need:`rl__infrastructure_tooling_community`
613-
- N/A
613+
- :need:`doc_tool__github`
614614
- YES
615615
* - 6-3
616616
- GitHub Actions

‎docs/score_tools/tools_vc_cicd/github.rst‎

Lines changed: 231 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,231 @@
1+
..
2+
# *******************************************************************************
3+
# Copyright (c) 2025 Contributors to the Eclipse Foundation
4+
#
5+
# See the NOTICE file(s) distributed with this work for additional
6+
# information regarding copyright ownership.
7+
#
8+
# This program and the accompanying materials are made available under the
9+
# terms of the Apache License Version 2.0 which is available at
10+
# https://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# SPDX-License-Identifier: Apache-2.0
13+
# *******************************************************************************
14+
15+
.. doc_tool:: github
16+
:id: doc_tool__github
17+
:status: draft
18+
:version: cloud
19+
:tcl: HIGH
20+
:safety_affected: YES
21+
:security_affected: YES
22+
:realizes: wp__tool_verification_report
23+
:tags: tool_management, tools_vc_cicd
24+
25+
GitHub Verification Report
26+
==========================
27+
28+
Introduction
29+
------------
30+
Scope and purpose
31+
~~~~~~~~~~~~~~~~~
32+
GitHub.com is a cloud-based platform for source code management, project management, and automation.
33+
It is used for hosting git repositories, managing issues and projects, code review,
34+
release planning, and running CI/CD workflows via GitHub Actions.
35+
36+
Inputs and outputs
37+
~~~~~~~~~~~~~~~~~~
38+
Inputs:
39+
| - Source code (git repositories)
40+
| - Issues, project boards, milestones
41+
| - Workflow definitions (YAML)
42+
| - Pull requests, reviews
43+
44+
Outputs:
45+
| - Repository state (commits, branches, tags)
46+
| - Issue/project status
47+
| - CI/CD run results
48+
| - Release artifacts
49+
50+
51+
Available information
52+
~~~~~~~~~~~~~~~~~~~~~
53+
- Platform: GitHub.com (cloud)
54+
- Official documentation: https://docs.github.com/
55+
- API reference: https://docs.github.com/en/rest
56+
- S-CORE GitHub organization: https://github.com/eclipse-score
57+
58+
59+
Usage constraints:
60+
| - Requires internet access and GitHub account
61+
| - Actions runners may have resource/time limits
62+
| - Some features may require paid plans (e.g., private repositories, larger runner capacity)
63+
64+
Installation and integration
65+
----------------------------
66+
Installation
67+
~~~~~~~~~~~~
68+
No installation required for cloud use. Access via web, git client, or API. For CI/CD, configure workflows in `.github/workflows/` and connect via Bazel rules.
69+
70+
Integration
71+
~~~~~~~~~~~
72+
- Source code hosted on GitHub.com
73+
- Issues, projects, and milestones managed via web or API
74+
- CI/CD workflows triggered by git events, managed via GitHub Actions
75+
- Bazel rules used to interact with GitHub for automation
76+
77+
Environment
78+
~~~~~~~~~~~
79+
- Web browser
80+
- Git client
81+
- Bazel build environment
82+
83+
Safety evaluation
84+
-----------------
85+
This section outlines the safety evaluation of GitHub for its use within the S-CORE project.
86+
87+
.. list-table:: Safety evaluation
88+
:header-rows: 1
89+
:widths: 1 2 8 2 6 4 2 2
90+
91+
* - Malfunction identification
92+
- Use case description
93+
- Malfunctions
94+
- Impact on safety?
95+
- Impact safety measures available?
96+
- Impact safety detection sufficient?
97+
- Further additional safety measure required?
98+
- Confidence (automatic calculation)
99+
* - 1
100+
- Issue/Project management
101+
- | Issues, projects, or milestones are not updated or synced.
102+
| Project status is out of date, leading to miscommunication.
103+
- no
104+
- | Manual status checks during regular meetings.
105+
| All teams have regular sync points to verify project status. Sync happens on ticket basis.
106+
| So when ticket is lost, it will be detected during these regular meetings.
107+
- yes
108+
- no
109+
- high
110+
* - 2
111+
- Issue/Project management
112+
- | Issue or project data is lost or corrupted.
113+
| Loss of planning or tracking data, may impact traceability.
114+
- yes
115+
- | Manual status checks during regular meetings.
116+
| All teams have regular sync points to verify project status. Sync happens on ticket basis.
117+
| So when ticket is lost, it will be detected during these regular meetings.
118+
- yes
119+
- no
120+
- high
121+
* - 3
122+
- Repository access
123+
- | GitHub is unavailable.
124+
| Source code, issues, or workflows cannot be accessed or updated.
125+
- no
126+
- no
127+
- yes
128+
- no
129+
- high
130+
* - 4
131+
- Repository access
132+
- | Data corruption or loss.
133+
| Commits, issues, or workflow data is lost or corrupted.
134+
- yes
135+
- | PR reviews.
136+
| Code reviews and approvals help catch data issues before merging.
137+
- yes
138+
- no
139+
- high
140+
* - 5
141+
- Repository access
142+
- | Wrong repository/branch/tag checked out.
143+
| Build/test runs on incorrect code version due to misconfiguration or user error.
144+
- yes
145+
- | PR reviews.
146+
| Code reviews and approvals help catch data issues before merging.
147+
- yes
148+
- no
149+
- high
150+
* - 6
151+
- Workflows (CI/CD)
152+
- | Actions workflow fails to run (misconfiguration, runner unavailable).
153+
| CI/CD jobs do not execute as expected, blocking releases or tests.
154+
- no
155+
- no
156+
- yes
157+
- no
158+
- high
159+
* - 7
160+
- Workflows (CI/CD)
161+
- | Wrong workflow triggered (wrong event, branch, or path).
162+
| CI/CD jobs run on unintended code or skip required checks.
163+
- yes
164+
- | PR reviews
165+
| Code reviews and approvals help catch data issues before merging.
166+
- yes
167+
- no
168+
- high
169+
* - 8
170+
- Workflows (CI/CD)
171+
- | Workflow passes with undetected errors (false positive).
172+
| CI/CD reports success but actual build/test failed or was skipped.
173+
- yes
174+
- | Log analysis.
175+
| Ensure that underlying build/test tools correctly return error code and have proper logging.
176+
- yes
177+
- no
178+
- high
179+
* - 9
180+
- Workflows (CI/CD)
181+
- | Workflow fails due to external service outage (e.g., Actions runner, artifact storage).
182+
| Build/test is blocked or incomplete due to third-party service unavailability.
183+
- no
184+
- no
185+
- yes
186+
- no
187+
- high
188+
* - 10
189+
- Artifact storage
190+
- | Release artifacts not published or corrupted.
191+
| Release process is blocked or produces incomplete/corrupted results.
192+
- no
193+
- no
194+
- yes
195+
- no
196+
- high
197+
* - 11
198+
- Artifact storage
199+
- | Artifacts published to wrong location or with wrong version/tag.
200+
| Downstream consumers use incorrect or outdated artifacts.
201+
- yes
202+
- | Manual review of release process and artifacts.
203+
| Release process includes manual checks to verify artifact correctness.
204+
- yes
205+
- no
206+
- high
207+
208+
Security evaluation
209+
-------------------
210+
This section outlines the security evaluation of GitHub for its use within the S-CORE project.
211+
212+
.. list-table:: Security evaluation
213+
:header-rows: 1
214+
215+
* - Threat identification
216+
- Use case description
217+
- Threats
218+
- Impact on security?
219+
- Impact security measures available?
220+
- Impact security detection sufficient?
221+
* - 1
222+
- TBD
223+
- TBD
224+
- TBD
225+
- TBD
226+
- TBD
227+
228+
Result
229+
------
230+
GitHub does not require qualification for use in safety-related software development according to ISO 26262.
231+
Suggested safety and security measures should be applied to mitigate identified risks.

‎docs/score_tools/tools_vc_cicd/index.rst‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,5 @@ Version Control & CI/CD Tools Overview
2828
.. toctree::
2929
:hidden:
3030
:maxdepth: 2
31+
32+
github

0 commit comments

Comments
 (0)