Skip to content

Commit 3b5859f

Browse files
UlisesGasconUlisesGascon
authored
Merge branch 'main' into css-linting
2 parents d877f87 + 06e8c1f commit 3b5859f

13 files changed

Lines changed: 685 additions & 861 deletions

File tree

‎.github/workflows/linter.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Lint website and markdown files
2+
3+
on: [push, pull_request]
4+
5+
jobs:
6+
lint:
7+
runs-on: ubuntu-latest
8+
defaults:
9+
run:
10+
working-directory: scorecards-site
11+
12+
steps:
13+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5
14+
- uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 #v5
15+
with:
16+
node-version: 22
17+
- run: yarn install --frozen-lockfile
18+
- run: yarn lint

‎README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,8 @@ The site is deployed on Netlify and the deployment configuration is in
1313
[netlify.toml](./netlify.toml). Any changes committed to
1414
[netlify.toml](./netlify.toml) and [scorecards-site/](./scorecards-site) on
1515
`main` branch gets automatically deployed to production. So please make sure to
16-
review deploy previews when making changes to the site.
16+
review deploy previews when making changes to the site. The documentation for
17+
local development can be found [here](/scorecards-site/README.md)
1718

1819
The API uses [OpenAPI](https://www.openapis.org/) spec and
1920
[go-swagger](https://goswagger.io/) to auto-generate server and client code. Any

‎scorecards-site/README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22

33
## Pre-requisites
44

5-
* [NVM](https://github.com/nvm-sh/nvm)
6-
* NPM
7-
* [Yarn](https://classic.yarnpkg.com/lang/en/docs/install/)
5+
- [NVM](https://github.com/nvm-sh/nvm)
6+
- NPM
7+
- [Yarn](https://classic.yarnpkg.com/lang/en/docs/install/)
88

99
## Build Setup
1010

‎scorecards-site/components/CommitData.vue‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,10 @@
1111
export default {
1212
name: 'Test',
1313
props: {
14-
latestCommit: null,
14+
latestCommit: {
15+
type: String,
16+
default: '',
17+
},
1518
},
1619
data() {
1720
return {}

‎scorecards-site/components/RepoButton.vue‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,14 @@ export default {
1616
GithubRepoIcon,
1717
},
1818
props: {
19-
commits: null,
20-
stars: null,
19+
commits: {
20+
type: Number,
21+
default: 0,
22+
},
23+
stars: {
24+
type: Number,
25+
default: 0,
26+
},
2127
},
2228
data() {
2329
return {

‎scorecards-site/components/global/CodeGroup.vue‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,6 @@ export default {
4747
},
4848
methods: {
4949
changeCodeTab(index) {
50-
console.log(index)
5150
this.activeCodeTabIndex = index
5251
},
5352
loadTabs() {
@@ -74,7 +73,11 @@ export default {
7473
tab.elm.classList.remove('theme-code-block__active')
7574
}
7675
})
77-
if (this.codeTabs[index] && this.codeTabs[index].elm && this.codeTabs[index].elm.classList) {
76+
if (
77+
this.codeTabs[index] &&
78+
this.codeTabs[index].elm &&
79+
this.codeTabs[index].elm.classList
80+
) {
7881
this.codeTabs[index].elm.classList.add('theme-code-block__active')
7982
}
8083
},

‎scorecards-site/content/home.md‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ Scorecard also has standalone binaries and other platforms troubleshooting and c
131131

132132
<h2 class="h1" id="learn-more">Learn more</h2>
133133

134-
> We rely on Security Scorecards *[i.e., OpenSSF Scorecard]* to ensure we follow secure development best practices.
134+
> We rely on Security Scorecards _[i.e., OpenSSF Scorecard]_ to ensure we follow secure development best practices.
135135
136136
<div class="text-right"><cite>Appu Goundan, <a href="https://github.com/GoogleContainerTools/distroless">Distroless</a></cite></div>
137137

@@ -141,7 +141,7 @@ By some estimates\* 84% of all codebases have at least one vulnerability, with a
141141

142142
Even in large tech companies, the tedious process of reviewing code for vulnerabilities falls down the priority list, and there is little insight into known vulnerabilities and solutions that companies can draw on.
143143

144-
That’s where Security Scorecards *[i.e., OpenSSF Scorecard]* is helping. Its focus is to understand the security posture of a project and assess the risks that dependencies introduce.
144+
That’s where Security Scorecards _[i.e., OpenSSF Scorecard]_ is helping. Its focus is to understand the security posture of a project and assess the risks that dependencies introduce.
145145

146146
\*[Open Source Security and Risk Analysis Report](https://www.synopsys.com/software-integrity/resources/analyst-reports/open-source-security-risk-analysis.html?intcmp=sig-blog-ossra1) (Synopsys, 2021)
147147

@@ -231,45 +231,45 @@ You can learn more about the scoring criteria, risks, and remediation suggestion
231231
#### Holistic security practises
232232

233233
| Code vulnerabilities | Description | Risk |
234-
|-----------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------|------|
234+
| --------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- | ---- |
235235
| [Vulnerabilities](https://github.com/ossf/scorecard/blob/main/docs/checks.md#vulnerabilities) | Does the project have unfixed vulnerabilities? Uses the [OSV service](https://osv.dev/). | High |
236236

237237
| Maintenance | Description | Risk |
238-
|-------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------|
238+
| ----------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ |
239239
| [Dependency Update Tool](https://github.com/ossf/scorecard/blob/main/docs/checks.md#dependency-update-tool) | Does the project use tools to help update its dependencies e.g. [Dependabot](https://docs.github.com/en/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-dependabot-security-updates), [RenovateBot](https://github.com/renovatebot/renovate)? | High |
240240
| [Maintained](https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained) | Is the project maintained? | High |
241241
| [Security Policy](https://github.com/ossf/scorecard/blob/main/docs/checks.md#security-policy) | Does the project contain a [security policy](https://docs.github.com/en/free-pro-team@latest/github/managing-security-vulnerabilities/adding-a-security-policy-to-your-repository)? | Medium |
242242
| [Licence](https://github.com/ossf/scorecard/blob/main/docs/checks.md#license) | Does the project declare a licence? | Low |
243243
| [CII Best Practices](https://github.com/ossf/scorecard/blob/main/docs/checks.md#cii-best-practices) | Does the project have a [CII Best Practices Badge](https://bestpractices.coreinfrastructure.org/en)? | Low |
244244

245245
| Continuous testing | Description | Risk |
246-
|---------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------|
246+
| ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------ |
247247
| [CI Tests](https://github.com/ossf/scorecard/blob/main/docs/checks.md#ci-tests) | Does the project run tests in CI, e.g. [GitHub Actions](https://docs.github.com/en/free-pro-team@latest/actions), [Prow](https://github.com/kubernetes/test-infra/tree/master/prow)? | Low |
248248
| [Fuzzing](https://github.com/ossf/scorecard/blob/main/docs/checks.md#fuzzing) | Does the project use fuzzing tools, e.g. [OSS-Fuzz](https://github.com/google/oss-fuzz)? | Medium |
249249
| [SAST](https://github.com/ossf/scorecard/blob/main/docs/checks.md#sast) | Does the project use static code analysis tools, e.g. [CodeQL](https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository#enabling-code-scanning-using-actions), [LGTM](https://lgtm.com/), [SonarCloud](https://sonarcloud.io/)? | Medium |
250250

251251
#### Source risk assessment
252252

253253
| Name | Description | Risk |
254-
|-----------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------|----------|
254+
| --------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
255255
| [Binary Artifacts](https://github.com/ossf/scorecard/blob/main/docs/checks.md#binary-artifacts) | Is the project free of checked-in binaries? | High |
256256
| [Branch Protection](https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection) | Does the project use [Branch Protection](https://docs.github.com/en/free-pro-team@latest/github/administering-a-repository/about-protected-branches)? | High |
257257
| [Dangerous Workflow](https://github.com/ossf/scorecard/blob/main/docs/checks.md#dangerous-workflow) | Does the project avoid dangerous coding patterns in GitHub Actions? | Critical |
258258
| [Code Review](https://github.com/ossf/scorecard/blob/main/docs/checks.md#code-review) | Does the project require code review before code is merged? | High |
259-
| [Contributors](https://github.com/ossf/scorecard/blob/main/docs/checks.md#contributors) | Does the project have contributors from multiple organizations? | Low |
259+
| [Contributors](https://github.com/ossf/scorecard/blob/main/docs/checks.md#contributors) | Does the project have contributors from multiple organizations? | Low |
260260

261261
#### Build risk assessment
262262

263263
| Name | Description | Risk |
264-
|-------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------|
264+
| ----------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ |
265265
| [Pinned Dependencies](https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies) | Does the project declare and pin [dependencies](https://docs.github.com/en/free-pro-team@latest/github/visualizing-repository-data-with-graphs/about-the-dependency-graph#supported-package-ecosystems)? | Medium |
266266
| [Token Permissions](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions) | Does the project declare GitHub workflow tokens as [read only](https://docs.github.com/en/actions/reference/authentication-in-a-workflow)? | High |
267267
| [Packaging](https://github.com/ossf/scorecard/blob/main/docs/checks.md#packaging) | Does the project build and publish official packages from CI/CD, e.g. [GitHub Publishing](https://docs.github.com/en/free-pro-team@latest/actions/guides/about-packaging-with-github-actions#workflows-for-publishing-packages)? | Medium |
268268
| [Signed Releases](https://github.com/ossf/scorecard/blob/main/docs/checks.md#signed-releases) | Does the project [cryptographically sign releases](https://wiki.debian.org/Creating%20signed%20GitHub%20releases)? | High |
269269

270270
<br/>
271271

272-
> Machine checkable properties are an essential part of a sound security process. That’s why we have incorporated Security Scorecards *[i.e., OpenSSF Scorecard]* into our dependency acceptance criteria.
272+
> Machine checkable properties are an essential part of a sound security process. That’s why we have incorporated Security Scorecards _[i.e., OpenSSF Scorecard]_ into our dependency acceptance criteria.
273273
274274
<div class="text-right mb-60"><cite>Harvey Tuch, <a href="https://www.envoyproxy.io/">Envoy</a></cite></div>
275275

‎scorecards-site/modules/Footer/Footer.vue‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,8 @@
1414
<div class="text-14 mb-12">
1515
Copyright © OpenSSF Scorecard a Series of LF Projects, LLC
1616
<br />
17-
For website terms of use, trademark policy, and other project policies, please see <a href="https://lfprojects.org">https://lfprojects.org</a>.
17+
For website terms of use, trademark policy, and other project policies,
18+
please see <a href="https://lfprojects.org">https://lfprojects.org</a>.
1819
</div>
1920
<div class="text-14">
2021
<strong>Privacy statement: </strong> We use

‎scorecards-site/modules/Header/Header.js‎

Lines changed: 29 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -54,12 +54,35 @@ export default {
5454
hour12: false,
5555
timeZone: Intl.DateTimeFormat().resolvedOptions().timeZone,
5656
}
57-
const response = await fetch(this.apiURL)
58-
const data = await response.json()
59-
const d = data[0].commit.committer.date
60-
this.latestCommit = new Intl.DateTimeFormat('en-US', options).format(
61-
new Date(d)
62-
)
57+
try {
58+
const response = await fetch(this.apiURL)
59+
const data = await response.json()
60+
61+
// Guard against empty responses or unexpected shapes
62+
if (!data || !Array.isArray(data) || data.length === 0) {
63+
this.latestCommit = null
64+
return
65+
}
66+
67+
const first = data[0]
68+
if (
69+
!first ||
70+
!first.commit ||
71+
!first.commit.committer ||
72+
!first.commit.committer.date
73+
) {
74+
this.latestCommit = null
75+
return
76+
}
77+
78+
const d = first.commit.committer.date
79+
this.latestCommit = new Intl.DateTimeFormat('en-US', options).format(
80+
new Date(d)
81+
)
82+
} catch (e) {
83+
// Network issues or rate limits can cause generate to fail; fail gracefully
84+
this.latestCommit = null
85+
}
6386
},
6487
async getTotalCommits(owner, repo) {
6588
// TODO: store this is state/cache so we do not have to load every time

‎scorecards-site/package.json‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
"lint:js": "eslint --ext \".js,.vue\" --ignore-path .gitignore .",
1111
"lint:prettier": "prettier --check .",
1212
"lint": "yarn lint:js && yarn lint:prettier",
13-
"lintfix": "prettier --write --list-different . && yarn lint:js --fix"
13+
"lint:fix": "prettier --write --list-different . && yarn lint:js --fix"
1414
},
1515
"lint-staged": {
1616
"*.{js,vue}": "eslint --cache",
@@ -32,17 +32,14 @@
3232
"nuxt": "^2.15.8",
3333
"prismjs": "^1.30.0",
3434
"rehype-add-classes": "^1.0.0",
35-
"retext-emoji": "^8.1.0",
3635
"sass-loader": "10",
37-
"shiki": "^3.12.2",
3836
"swiper": "6.x",
3937
"vue": "^2.6.14",
4038
"vue-awesome-swiper": "^4.1.1",
4139
"vue-intersect": "^1.1.6",
4240
"vue-intersect-directive": "^1.1.1",
4341
"vue-server-renderer": "^2.6.14",
44-
"vue-template-compiler": "^2.6.14",
45-
"webpack": "^4.46.0"
42+
"vue-template-compiler": "^2.6.14"
4643
},
4744
"devDependencies": {
4845
"@babel/eslint-parser": "^7.16.3",

0 commit comments

Comments
 (0)