diff --git a/patterns/docs/Source Code Repositories/GitHub Repository Best Practices/GitHub Repository Best Practices.md b/patterns/docs/Source Code Repositories/GitHub Repository Best Practices/GitHub Repository Best Practices.md new file mode 100644 index 0000000..5208849 --- /dev/null +++ b/patterns/docs/Source Code Repositories/GitHub Repository Best Practices/GitHub Repository Best Practices.md @@ -0,0 +1,77 @@ +--- +sidebar_position: 1 +--- +
Status

Document

StakeholdersNRIDS Architecture, Development & Digital Services, NRM Product Teams
DescriptionThe purpose of this page is to outline practices when using GitHub as your source code repository
OutcomeConsistent point of reference for onboarding new product teams into the NRM's.
OwnerNRIDS (DDS, Architecture)
+ +Repository Setup +---------------- + +The below options are found under settings + +### **Branch Protection** + +Create at least 1 branch protection rule for your "main" branch that; + +* Forces an approval before merging to your "main" branch + * An approver should be someone able to understand the code changes and has the authority to approve code changes and pipeline activities associated with a PR Merge (Eg. Data Custodian and Test/Prod deployments) + +Note: Admins can bypass this + +* Enforces status checks to be passed before merging, this should include; + * SonarCloud (vulnerability, code coverage) + * Code scanning (Trivy, Snyk, CodeQL) + * Builds + * Deployments + * Route verification (up/down, penetration testing) +* Note: checks need to have been run once to populate the drop-down + +(Ensure you select your options below when enabling the rule) + +* Ensures branches are up to date before merging + +### **Manage Your Administrators** + +* Have at least 1 backup administrator +* Have as few admins as possible, most developers will not need to be an admin + +### **Manage Your Team** + +* Create a Team in GitHub and Manage the permission in the team. ([https://github.com/orgs/bcgov/teams](https://github.com/orgs/bcgov/teams)) +* This way if the single team is working on multiple products, authorization will be easier to manage and tracking will be easier. + +### **Setup Your Pull Request Repository Settings (Very Useful to Help Ensure Guidelines are Followed)** + +* Use squash merging to keep histories clean + * We recommend using pull request titles +* Suggest updating pull requests + * Being up to date is required (see above) + * Selecting this will add an easy update button to PRs +* Automatically delete head branches, which are merged feature branches + * Excessive numbers of branches can degrade performance and increase clone times + * Long lived-branches are strongly discouraged + +For additional PR, Pipeline, and Deployment practices: See + +### **Create Repository Documentation** + +* Create a meaningful Readme.md, see [https://github.com/bcgov/BC-Policy-Framework-For-GitHub/blob/master/BC-Gov-Org-HowTo/SAMPLE-README.md](https://github.com/bcgov/BC-Policy-Framework-For-GitHub/blob/master/BC-Gov-Org-HowTo/SAMPLE-README.md) +* Add a license and other required documentation, see [https://docs.developer.gov.bc.ca/required-pages-for-github-repository/](https://docs.developer.gov.bc.ca/required-pages-for-github-repository/) +* Make use of the GitHub Wiki + * The GitHub Wiki provides version controlled documentation that multiple people can edit and does not require technical expertise + * If you're going to use the Wiki make sure you add a reference to it in your Readme.md +* Create a reference in confluence to your repository and documentation + +### **GitHub Wiki - Suggestions of What to Add** + +* Points of Contact +* How-To's: + * Running Locally + * Developer Practices + * Coding Practices + * Ticket management + * Backup and restore  +* Application process flows + +### **Handle Your Secrets and Environment Variables** + +See \ No newline at end of file diff --git a/patterns/docs/Source Code Repositories/GitHub Repository Best Practices/data.json b/patterns/docs/Source Code Repositories/GitHub Repository Best Practices/data.json new file mode 100644 index 0000000..0999fd7 --- /dev/null +++ b/patterns/docs/Source Code Repositories/GitHub Repository Best Practices/data.json @@ -0,0 +1 @@ +{"id":"163422029","type":"page","status":"current","title":"GitHub Repository Best Practices","body":{"storage":{"value":"
Status

Document

StakeholdersNRIDS Architecture, Development & Digital Services, NRM Product Teams
DescriptionThe purpose of this page is to outline practices when using GitHub as your source code repository
OutcomeConsistent point of reference for onboarding new product teams into the NRM's.
OwnerNRIDS (DDS, Architecture)

Repository Setup

The below options are found under settings

Branch Protection

Create at least 1 branch protection rule for your "main" branch that;

Note: Admins can bypass this

(Ensure you select your options below when enabling the rule)

Manage Your Administrators

Manage Your Team

Setup Your Pull Request Repository Settings (Very Useful to Help Ensure Guidelines are Followed)

For additional PR, Pipeline, and Deployment practices: See

Create Repository Documentation

GitHub Wiki - Suggestions of What to Add

Handle Your Secrets and Environment Variables

See





","representation":"storage","_expandable":{"content":"/rest/api/content/163422029"}},"_expandable":{"editor":"","view":"","export_view":"","styled_view":"","anonymous_export_view":""}},"extensions":{"position":"none"},"_links":{"webui":"/display/AR/GitHub+Repository+Best+Practices","edit":"/pages/resumedraft.action?draftId=163422029","tinyui":"/x/TZ_9CQ","self":"https://apps.nrs.gov.bc.ca/int/confluence/rest/api/content/163422029"},"_expandable":{"container":"/rest/api/space/AR","metadata":"","operations":"","children":"/rest/api/content/163422029/child","restrictions":"/rest/api/content/163422029/restriction/byOperation","history":"/rest/api/content/163422029/history","ancestors":"","version":"","descendants":"/rest/api/content/163422029/descendant","space":"/rest/api/space/AR"}} \ No newline at end of file diff --git a/patterns/docs/Source Code Repositories/Migrating Existing Source Code Repositories/Migrating Existing Source Code Repositories.md b/patterns/docs/Source Code Repositories/Migrating Existing Source Code Repositories/Migrating Existing Source Code Repositories.md new file mode 100644 index 0000000..cadba6e --- /dev/null +++ b/patterns/docs/Source Code Repositories/Migrating Existing Source Code Repositories/Migrating Existing Source Code Repositories.md @@ -0,0 +1,33 @@ +--- +sidebar_position: 1 +--- +
Status

GreenDocument

Stakeholders

   

DescriptionChecklist to guide teams in the process of migrating SVN repos to Github
Outcome
OwnerNRIDS Architecture
+ +### Advantages to having code in the open: + +* Lower cost +* Community visibility and collaboration +* Encourages good development practices +* Github has a suite of extra tools (such as GitHub actions) +* Aligns with the [Digital Code of Practice](https://digital.gov.bc.ca/policies-standards/dcop/) +* Aligns with the [BCGov Digital Principles](https://github.com/bcgov/digital-principles) - Working in the Open, Take an Ecosystem Approach +* An extensive number of tests and tools are only free for open source projects + +### General Principles: + +* Code (like data) should take an "Open by Default" position and closed by exception +* The de-facto standard public code repository platform is Github +* On exception, the private code repository platform is Github Enterprise + +### Under what circumstances should a code repository be Private? + +* There are algorithms in the code that would bring harm to individuals, industry or the Province +* Information is hidden with intent, like state data from ArgoCD deployments +* The presense of secrets, passwords, personal information or other sensitive data + * Please be aware that we provide resources and assistance in preventing this situation + +
What do I need to do?How do I do that?What tools can help?
Obtain consent from the application/product owner to bring the code in the open; share this content to help inform the conversationIdentify the business owner of the codebase, obtain and document consenthttps://a100.gov.bc.ca/int/irs/viewAllApps.do
Ensure there is no application data in the code repository (aside from test data)
Scan the code for secrets, passwords or sensitive data

Trivy can perform secret scanning before and after a repo is provided publicly 

GitHub has built-in tools to detect accidentally adding this information

Enable built in features of Github such as Dependabot to scan code and recommend remediationExplore the "Security" tab in Github

Dependabot https://docs.github.com/en/code-security/dependabot

Renovate https://docs.renovatebot.com/ ie - https://github.com/bcgov/nr-forests-access-management/blob/main/renovate.json

Sonarcloud - ie https://sonarcloud.io/project/overview?id=forest-client-frontend

Ensure the underlying codebase, dependent libraries and software versions contain no significant and exploitable vulnerabilitiesContact the security team about using FETT to scan the existing code repository
Ensure that the Province of BC owns the codehttps://github.com/bcgov/BC-Policy-Framework-For-GitHub/blob/master/BC-Open-Source-Development-Employee-Guide/COI-Priv-IP.md
Apply an open source licensehttps://github.com/bcgov/BC-Policy-Framework-For-GitHub/blob/master/BC-Open-Source-Development-Employee-Guide/Licenses.md
Choose an appropriate name for your repositoryprefix each repository with "nr-"
  • e.g. nr-<app-name>
  • e.g. nr-fom-api
Identify at least two owners for the repositoryIdentify a product owner and a technical specialist
+ +### References: + +[https://github.com/bcgov/BC-Policy-Framework-For-GitHub/blob/master/BC-Open-Source-Development-Employee-Guide/Content-Approval-Checklist.md](https://github.com/bcgov/BC-Policy-Framework-For-GitHub/blob/master/BC-Open-Source-Development-Employee-Guide/Content-Approval-Checklist.md) \ No newline at end of file diff --git a/patterns/docs/Source Code Repositories/Migrating Existing Source Code Repositories/data.json b/patterns/docs/Source Code Repositories/Migrating Existing Source Code Repositories/data.json new file mode 100644 index 0000000..133a896 --- /dev/null +++ b/patterns/docs/Source Code Repositories/Migrating Existing Source Code Repositories/data.json @@ -0,0 +1 @@ +{"id":"171777483","type":"page","status":"current","title":"Migrating Existing Source Code Repositories","body":{"storage":{"value":"
Status

GreenDocument

Stakeholders

   

DescriptionChecklist to guide teams in the process of migrating SVN repos to Github
Outcome
OwnerNRIDS Architecture

Advantages to having code in the open:

General Principles:

Under what circumstances should a code repository be Private?


What do I need to do?How do I do that?What tools can help?
Obtain consent from the application/product owner to bring the code in the open; share this content to help inform the conversationIdentify the business owner of the codebase, obtain and document consenthttps://a100.gov.bc.ca/int/irs/viewAllApps.do
Ensure there is no application data in the code repository (aside from test data)

Scan the code for secrets, passwords or sensitive data

Trivy can perform secret scanning before and after a repo is provided publicly 

GitHub has built-in tools to detect accidentally adding this information

Enable built in features of Github such as Dependabot to scan code and recommend remediationExplore the "Security" tab in Github

Dependabot https://docs.github.com/en/code-security/dependabot

Renovate https://docs.renovatebot.com/ ie - https://github.com/bcgov/nr-forests-access-management/blob/main/renovate.json

Sonarcloud - ie https://sonarcloud.io/project/overview?id=forest-client-frontend

Ensure the underlying codebase, dependent libraries and software versions contain no significant and exploitable vulnerabilitiesContact the security team about using FETT to scan the existing code repository
Ensure that the Province of BC owns the code
https://github.com/bcgov/BC-Policy-Framework-For-GitHub/blob/master/BC-Open-Source-Development-Employee-Guide/COI-Priv-IP.md
Apply an open source license
https://github.com/bcgov/BC-Policy-Framework-For-GitHub/blob/master/BC-Open-Source-Development-Employee-Guide/Licenses.md
Choose an appropriate name for your repositoryprefix each repository with "nr-"
  • e.g. nr-<app-name>
  • e.g. nr-fom-api

Identify at least two owners for the repositoryIdentify a product owner and a technical specialist



References:

https://github.com/bcgov/BC-Policy-Framework-For-GitHub/blob/master/BC-Open-Source-Development-Employee-Guide/Content-Approval-Checklist.md


","representation":"storage","_expandable":{"content":"/rest/api/content/171777483"}},"_expandable":{"editor":"","view":"","export_view":"","styled_view":"","anonymous_export_view":""}},"extensions":{"position":"none"},"_links":{"webui":"/display/AR/Migrating+Existing+Source+Code+Repositories","edit":"/pages/resumedraft.action?draftId=171777483","tinyui":"/x/yx09Cg","self":"https://apps.nrs.gov.bc.ca/int/confluence/rest/api/content/171777483"},"_expandable":{"container":"/rest/api/space/AR","metadata":"","operations":"","children":"/rest/api/content/171777483/child","restrictions":"/rest/api/content/171777483/restriction/byOperation","history":"/rest/api/content/171777483/history","ancestors":"","version":"","descendants":"/rest/api/content/171777483/descendant","space":"/rest/api/space/AR"}} \ No newline at end of file