Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Proposal of Static Code Analysis Subgroup for new Acceptance Criteria #73

Open
wants to merge 9 commits into
base: master
Choose a base branch
from
Open

Proposal of Static Code Analysis Subgroup for new Acceptance Criteria #73

Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
c114946
Update Static Code Requirements
inkuss Aug 8, 2024
11a8865
Update MODULE_ACCEPTANCE_CRITERIA.MD
inkuss Aug 8, 2024
24a18bb
Update MODULE_ACCEPTANCE_CRITERIA.MD
inkuss Aug 8, 2024
d676751
Update MODULE_ACCEPTANCE_CRITERIA.MD
inkuss Aug 8, 2024
fa94c5b
Don't mention FE unit tests twice (only in Shared/Common)
inkuss Aug 9, 2024
9a6e28f
Update MODULE_ACCEPTANCE_CRITERIA.MD
inkuss Aug 13, 2024
c3ebd8b
Update MODULE_ACCEPTANCE_CRITERIA.MD
inkuss Aug 13, 2024
368740b
Update MODULE_ACCEPTANCE_CRITERIA.MD: Formulation of code smells seve…
inkuss Aug 20, 2024
4f922aa
Update MODULE_ACCEPTANCE_CRITERIA.MD
inkuss Sep 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion MODULE_ACCEPTANCE_CRITERIA.MD
View file
Open in desktop
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reminder that after the changes to this file are agreed to, the same should be made to the TEMPLATE file.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reminder to bump "version 2.0 (ratified 2022-06-10)".

Original file line number Diff line number Diff line change
Expand Up @@ -58,8 +58,13 @@ Please see [Before Development](MODULE_EVALUATION_TEMPLATE#before-development) f
* _This is not applicable to libraries_
* Must not depend on a FOLIO library that has not been approved through the TCR process
* Gracefully handles the absence of third party systems or related configuration. (3, 5, 12)
* Sonarqube hasn't identified any security issues, major code smells or excessive (>3%) duplication (6); and any disabled or intentionally ignored rules/recommendations are reasonably justified.
* An automated code scannner hasn't identified any security issues, major code smells or excessive duplication (6); and any disabled or intentionally ignored rules/recommendations are reasonably justified.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

excessive duplication (6)

Unless 6% duplication is intended to be a tool ignorant policy, this statement still includes policy specific to Sonar

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(6) referts to the value "6. Module is secure".

* See [Rule Customization](https://dev.folio.org/guides/code-analysis/#rule-customization) details.
* The code scanner may be Sonar (via Jenkins), github Actions or other. The results of the code scanning need to be reproducible by the Community.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My understanding is that GitHub actions are a build tool rather than a static code analyser

If that is the case, then it is similar to Jenkins rather than Sonar

At the moment, this sentence suggests to me that GitHub actions are an alternative to Sonar rather than an alternative to Jenkins

* Examples for Code Duplication Detection metrics (i.e. characterstic numbers) can be found [here](https://folio-org.atlassian.net/wiki/spaces/TC/pages/386891824/Examples+of+Code+Duplication+Metrics+and+Code+Smells+Severity) .
* For code smells _major_ means the highest severity level:
* _High_ for Sonarqube.
* _Critical_ for CodeNarc.
* Uses [officially supported](https://wiki.folio.org/display/TC/Officially+Supported+Technologies) build tools (3, 5, 13)
* Unit tests have 80% coverage or greater, and are based on [officially supported technologies](https://wiki.folio.org/display/TC/Officially+Supported+Technologies)[^1] (3, 4)

Expand Down