Skip to content

Commit c528b14

Browse files
maxrakemaxrake
authored
feat: convert to a Docker container action (#15)
This change moves away from a lengthy composite action with many external action references towards a simple Docker container action. The inputs have been simplified. The permissions are well defined. The logic is completely self-contained within the `phylumio/phylum-ci` Docker image now. The action name, description, and branding icon were updated. These updates are meant to make the action more clear for users when browsing and selecting from the options in the GitHub Actions Marketplace (once it gets added there). Other changes made include removing unused testing files and adding community standard documentation to bring the repository up to current standards. A License (MIT), Code of Conduct, Security policy, and Contributing guidelines, issue, and PR templates were added. These files were adapted from the `phylum-dev/phylum-ci` repository. BREAKING CHANGE: The inputs are different now. Tokens for GitHub and Phylum are still required, but now all the other options are encapsulated by the single `cmd` input, which is the `phylum-ci` command line to pass to the Docker container's entrypoint. Closes #14
1 parent 0862f79 commit c528b14

19 files changed

+727
-2824
lines changed

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
name: Bug report
3+
about: Create a report to help us improve
4+
title: ''
5+
labels: bug, needs triage
6+
assignees: ''
7+
8+
---
9+
10+
## Describe the bug
11+
12+
A clear and concise description of what the bug is.
13+
14+
## To Reproduce
15+
16+
Steps to reproduce the behavior:
17+
18+
1. Go to '...'
19+
2. Click on '....'
20+
3. Scroll down to '....'
21+
4. See error
22+
23+
## Expected behavior
24+
25+
A clear and concise description of what you expected to happen.
26+
27+
## Screenshots
28+
29+
If applicable, add screenshots to help explain your problem.
30+
31+
## Additional context
32+
33+
Add any other context about the problem here.

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
name: Feature request
3+
about: Suggest an idea for this project
4+
title: ''
5+
labels: enhancement, needs triage
6+
assignees: ''
7+
8+
---
9+
10+
## Overview
11+
12+
**Is your feature request related to a problem? Please describe.**
13+
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
14+
15+
**Describe the solution you'd like**
16+
A clear and concise description of what you want to happen.
17+
18+
**Describe alternatives you've considered**
19+
A clear and concise description of any alternative solutions or features you've considered.
20+
21+
## Additional context
22+
23+
Add any other context or screenshots about the feature request here.
24+
25+
## Acceptance criteria
26+
27+
- [ ] Outputs XYZ when ...
28+
- [ ] Allow ABC to happen when ...

‎.github/ISSUE_TEMPLATE/task_or_chore.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
name: Task or chore
3+
about: Describe a task/chore that is needed
4+
title: ''
5+
labels: task, needs triage
6+
assignees: ''
7+
8+
---
9+
10+
## Description
11+
12+
Provide a description of the task/chore that is needed. This is for items that aren't bugs or feature enhancements.
13+
14+
## Additional Details
15+
16+
Provide any additional details or context here.
17+
18+
## Acceptance Criteria
19+
20+
- [ ] ABC is updated to ...
21+
- [ ] Documentation is updated

‎.github/pull_request_template.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
## Checklist
2+
3+
- [ ] Does this PR have an associated issue (i.e., `closes #<issueNum>` in description above)?
4+
- [ ] Have you ensured that you have met the expected acceptance criteria?
5+
- [ ] Have you created sufficient tests?
6+
- [ ] Have you updated all affected documentation?

‎CODE_OF_CONDUCT.md‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
# Contributor Covenant Code of Conduct
2+
3+
## Our Pledge
4+
5+
We as members, contributors, and leaders pledge to make participation in our
6+
community a harassment-free experience for everyone, regardless of age, body
7+
size, visible or invisible disability, ethnicity, sex characteristics, gender
8+
identity and expression, level of experience, education, socio-economic status,
9+
nationality, personal appearance, race, caste, color, religion, or sexual
10+
identity and orientation.
11+
12+
We pledge to act and interact in ways that contribute to an open, welcoming,
13+
diverse, inclusive, and healthy community.
14+
15+
## Our Standards
16+
17+
Examples of behavior that contributes to a positive environment for our
18+
community include:
19+
20+
* Demonstrating empathy and kindness toward other people
21+
* Being respectful of differing opinions, viewpoints, and experiences
22+
* Giving and gracefully accepting constructive feedback
23+
* Accepting responsibility and apologizing to those affected by our mistakes,
24+
and learning from the experience
25+
* Focusing on what is best not just for us as individuals, but for the overall
26+
community
27+
28+
Examples of unacceptable behavior include:
29+
30+
* The use of sexualized language or imagery, and sexual attention or advances of
31+
any kind
32+
* Trolling, insulting or derogatory comments, and personal or political attacks
33+
* Public or private harassment
34+
* Publishing others' private information, such as a physical or email address,
35+
without their explicit permission
36+
* Other conduct which could reasonably be considered inappropriate in a
37+
professional setting
38+
39+
## Enforcement Responsibilities
40+
41+
Community leaders are responsible for clarifying and enforcing our standards of
42+
acceptable behavior and will take appropriate and fair corrective action in
43+
response to any behavior that they deem inappropriate, threatening, offensive,
44+
or harmful.
45+
46+
Community leaders have the right and responsibility to remove, edit, or reject
47+
comments, commits, code, wiki edits, issues, and other contributions that are
48+
not aligned to this Code of Conduct, and will communicate reasons for moderation
49+
decisions when appropriate.
50+
51+
## Scope
52+
53+
This Code of Conduct applies within all community spaces, and also applies when
54+
an individual is officially representing the community in public spaces.
55+
Examples of representing our community include using an official e-mail address,
56+
posting via an official social media account, or acting as an appointed
57+
representative at an online or offline event.
58+
59+
## Enforcement
60+
61+
Instances of abusive, harassing, or otherwise unacceptable behavior may be
62+
reported to the community leaders responsible for enforcement at
63+
[[email protected]](mailto:[email protected]).
64+
All complaints will be reviewed and investigated promptly and fairly.
65+
66+
All community leaders are obligated to respect the privacy and security of the
67+
reporter of any incident.
68+
69+
## Enforcement Guidelines
70+
71+
Community leaders will follow these Community Impact Guidelines in determining
72+
the consequences for any action they deem in violation of this Code of Conduct:
73+
74+
### 1. Correction
75+
76+
**Community Impact**: Use of inappropriate language or other behavior deemed
77+
unprofessional or unwelcome in the community.
78+
79+
**Consequence**: A private, written warning from community leaders, providing
80+
clarity around the nature of the violation and an explanation of why the
81+
behavior was inappropriate. A public apology may be requested.
82+
83+
### 2. Warning
84+
85+
**Community Impact**: A violation through a single incident or series of
86+
actions.
87+
88+
**Consequence**: A warning with consequences for continued behavior. No
89+
interaction with the people involved, including unsolicited interaction with
90+
those enforcing the Code of Conduct, for a specified period of time. This
91+
includes avoiding interactions in community spaces as well as external channels
92+
like social media. Violating these terms may lead to a temporary or permanent
93+
ban.
94+
95+
### 3. Temporary Ban
96+
97+
**Community Impact**: A serious violation of community standards, including
98+
sustained inappropriate behavior.
99+
100+
**Consequence**: A temporary ban from any sort of interaction or public
101+
communication with the community for a specified period of time. No public or
102+
private interaction with the people involved, including unsolicited interaction
103+
with those enforcing the Code of Conduct, is allowed during this period.
104+
Violating these terms may lead to a permanent ban.
105+
106+
### 4. Permanent Ban
107+
108+
**Community Impact**: Demonstrating a pattern of violation of community
109+
standards, including sustained inappropriate behavior, harassment of an
110+
individual, or aggression toward or disparagement of classes of individuals.
111+
112+
**Consequence**: A permanent ban from any sort of public interaction within the
113+
community.
114+
115+
## Attribution
116+
117+
This Code of Conduct is adapted from the [Contributor Covenant][homepage],
118+
version 2.1, available at
119+
[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
120+
121+
Community Impact Guidelines were inspired by
122+
[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
123+
124+
For answers to common questions about this code of conduct, see the FAQ at
125+
[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
126+
[https://www.contributor-covenant.org/translations][translations].
127+
128+
[homepage]: https://www.contributor-covenant.org
129+
[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
130+
[Mozilla CoC]: https://github.com/mozilla/diversity
131+
[FAQ]: https://www.contributor-covenant.org/faq
132+
[translations]: https://www.contributor-covenant.org/translations

‎CONTRIBUTING.md‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
# Contributing
2+
3+
Contributions are welcome and appreciated!
4+
5+
Phylum is the future of software supply chain security and is eager to provide useful GitHub integrations.
6+
If there is an unsupported use case for managing the security of your dependencies, we want to know about it.
7+
If there is a way Phylum can be used to make your life as a developer easier, we want to be there for you and do it!
8+
9+
_You_ can contribute in many ways:
10+
11+
## Types of Contributions
12+
13+
### Report Bugs
14+
15+
Report bugs at <https://github.com/phylum-dev/phylum-analyze-pr-action/issues>.
16+
If the bug is related to the underlying Docker image instead of the action itself, report bugs at
17+
<https://github.com/phylum-dev/phylum-ci/issues> instead.
18+
19+
Please use the bug report template which should remind you to include:
20+
21+
* A clear and consise description of the bug
22+
* Detailed steps to reproduce the bug
23+
* Expected behavior
24+
* Screenshots, where appropriate
25+
* Additional context
26+
* The operating system name and version
27+
* Any details about the setup that might be helpful in troubleshooting
28+
29+
### Fix Bugs
30+
31+
Look through the GitHub issues for bugs to work on, which will be labeled with `bug`.
32+
33+
### Implement Features
34+
35+
Look through the GitHub issues for features to work on, which will be labeled with `enhancement`.
36+
37+
### Write Documentation
38+
39+
The action could always use more documentation, whether as part of the official phylum docs, in help/description
40+
messages, or even on the web in blog posts, articles, and such.
41+
42+
### Increase Test Coverage
43+
44+
There can always be more and better tests to improve the overall test coverage.
45+
Test contributions will help make the project more robust, less prone to regressions, and easier for everyone to
46+
contribute as it will be more likely that changes are made in a way that don't break other parts of the project.
47+
Even if there is already 100% test coverage, there may still be room for contributions.
48+
For instance, it may be the case that certain functionality or use cases are not covered in the existing set of tests.
49+
50+
### Submit Feedback
51+
52+
The best way to send feedback is to file an issue at <https://github.com/phylum-dev/phylum-analyze-pr-action/issues>.
53+
54+
If you are proposing a feature, please use the feature request template which should remind you to:
55+
56+
* Explain in detail how it would work
57+
* Keep the scope as narrow as possible, to make it easier to implement
58+
* Provide additional context
59+
* Add acceptance criteria
60+
61+
## Security Disclosures
62+
63+
Found a security issue in this repository? See the [security policy](./SECURITY.md)
64+
for details on coordinated disclosure.
65+
66+
## Code of Conduct
67+
68+
Everyone participating in the `phylum-analyze-pr-action` project, and in particular in the issue tracker and pull
69+
requests, is expected to treat other people with respect and more generally to follow the guidelines articulated in the
70+
[Code of Conduct](./CODE_OF_CONDUCT.md).
71+
72+
## Local Development
73+
74+
Ready to contribute with code submissions and pull requests (PRs)?
75+
Here's how to set up `phylum-analyze-pr-action` for local development.
76+
77+
1. Clone the `phylum-analyze-pr-action` repo locally
78+
79+
```sh
80+
git clone [email protected]:phylum-dev/phylum-analyze-pr-action.git
81+
```
82+
83+
2. Create a branch for local development:
84+
85+
```sh
86+
git checkout -b <name-of-your-branch>
87+
```
88+
89+
Now you can make your changes locally.
90+
91+
3. If the changes are to the underlying Docker image, also check out the `phylum-ci` repo locally
92+
93+
```sh
94+
git clone [email protected]:phylum-dev/phylum-ci.git
95+
git checkout -b <name-of-your-branch>
96+
```
97+
98+
Reference the contribution guidelines for [the `phylum-ci` repository](https://github.com/phylum-dev/phylum-ci)
99+
for more detail. Updates made to the underlying image can be built and placed somewhere accessible for testing:
100+
101+
```yaml
102+
# Change this entry in the `action.yml` file to point to your image. Reference:
103+
# https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions#runsimage
104+
image: docker://phylumio/phylum-ci:latest
105+
```
106+
107+
4. Commit your changes and push your branch to GitHub:
108+
109+
```sh
110+
git add .
111+
git commit -m "Description of the changes goes here"
112+
git push --set-upstream origin <name-of-your-branch>
113+
```
114+
115+
5. Submit a pull request (PR) through the GitHub website
116+
117+
## Pull Request Guidelines
118+
119+
Before you submit a pull request, check that it meets these guidelines:
120+
121+
* Does this PR have an associated issue (i.e., `closes #<issueNum>` in the PR description)?
122+
* Have you ensured that you have met the expected acceptance criteria?
123+
* Have you created sufficient tests?
124+
* Have you updated all affected documentation?
125+
126+
The pull request should work for all tests defined in the status checks.

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2022 Phylum, Inc.
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

0 commit comments

Comments
 (0)