Skip to content

Add contributing guide and proposed OpenSSF Best Practices answers - #1165

Merged
cdalar merged 1 commit into
mainfrom
bestpractices-badge
Oct 4, 2026
Merged

cdalar merged 1 commit into
mainfrom
bestpractices-badge

Conversation

@cdalar

@cdalar cdalar commented Oct 4, 2026

Copy link
Copy Markdown
Owner

The Best Practices badge entry is at 18% for the passing level: 53 criteria have been unanswered since February 2025. The form itself can only be saved by the project owner, so this PR prepares everything the repo can provide.

Changes

  • CONTRIBUTING.md β€” bug reporting process, how to submit a change, and the requirements for acceptable contributions, including the policy that new functionality and fixes come with tests. This backs the contribution_requirements, report_process, test_policy and tests_documented_added criteria. The README's Contributing section links to it.
  • .bestpractices.json β€” proposed status and justification for 49 passing-level criteria. bestpractices.dev reads this file and shows the values as proposals when the entry is edited; nothing is saved until the owner accepts them.

After merging

Open https://www.bestpractices.dev/projects/10052/passing/edit, click Save (and continue) πŸ€– to pull in the proposals, review them, and save. Also change the home page URL there from http://docs.onctl.io (now a 404) to https://onctl.sh.

Deliberately not proposed

These need the maintainer's own answer or a fix first:

  • know_secure_design, know_common_errors β€” a statement about the primary developer's own knowledge.
  • release_notes β€” releases carry GoReleaser's commit list; the criterion asks for a human-readable summary rather than a raw log.
  • static_analysis_fixed β€” CodeQL has one open high-severity alert (go/insecure-hostkeycallback).
  • vulnerabilities_fixed_60_days, vulnerabilities_critical_fixed β€” three Dependabot alerts on the docs site's npm lockfile are older than 60 days.

test_most is proposed as Unmet (coverage is about 37%); it is a SHOULD criterion, so it does not block the passing level.

πŸ€– Generated with Claude Code

https://claude.ai/code/session_01FM1Tvz8jDNmhot3etAateY

CONTRIBUTING.md documents the bug reporting process, contribution
requirements and test policy the passing badge asks for.
.bestpractices.json carries proposed answers and justifications that
bestpractices.dev picks up when the project entry is edited.

Claude-Session: https://claude.ai/code/session_01FM1Tvz8jDNmhot3etAateY
@cdalar
cdalar enabled auto-merge (squash) October 4, 2026 16:50
@codecov

codecov Bot commented Oct 4, 2026

Copy link
Copy Markdown

Codecov Report

βœ… All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@1529f8c). Learn more about missing BASE report.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #1165   +/-   ##
=======================================
  Coverage        ?   36.93%           
=======================================
  Files           ?       51           
  Lines           ?     5656           
  Branches        ?        0           
=======================================
  Hits            ?     2089           
  Misses          ?     3567           
  Partials        ?        0           

β˜” View full report in Codecov by Harness.
πŸ“’ Have feedback on the report? Share it here.

πŸš€ New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@cdalar
cdalar merged commit c04c1be into main Oct 4, 2026
14 checks passed
@cdalar
cdalar deleted the bestpractices-badge branch October 4, 2026 19:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

⌂ 捒网址