Skip to content

Commit 972042e

Browse files
evilaliv3evilaliv3
committed
[doc] Add documentation section about quality assurance
1 parent c46f87c commit 972042e

File tree

4 files changed

+98
-2
lines changed

4 files changed

+98
-2
lines changed

‎README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,11 @@ The software is recognized by the [Digital Public Good Alliance](https://digital
2222
## Project Best Practices and Scores
2323
| Metric | Score
2424
| :---- | :---- |
25-
| [OpenSSF Scorecard](https://scorecard.dev/) | [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/globaleaks/globaleaks-whistleblowing-software/badge)](https://scorecard.dev/viewer/?uri=github.com/globaleaks/globaleaks-whistleblowing-software)
26-
| [OpenSSF Best Practices](https://bestpractices.coreinfrastructure.org/) | [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/3816/badge)](https://bestpractices.coreinfrastructure.org/projects/3816)
2725
| [MDN HTTP Observatory](https://developer.mozilla.org/en-US/observatory/analyze?host=try.globaleaks.org) | ![Status](https://img.shields.io/badge/observatory-A%2B-brightgreen)
2826
| [Security Headers](https://securityheaders.com/?q=https%3A%2F%2Ftry.globaleaks.org%2F) | ![Status](https://img.shields.io/badge/security%20headers-A%2B-brightgreen)
2927
| [SSLLabs](https://www.ssllabs.com/ssltest/analyze.html?d=try.globaleaks.org) | [![Status](https://img.shields.io/static/v1?label=SSLLabs&message=A%2B&color=%3CCOLOR%3E)](https://www.ssllabs.com/ssltest/analyze.html?d=try.globaleaks.org&latest)
28+
| [OpenSSF Scorecard](https://scorecard.dev/) | [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/globaleaks/globaleaks-whistleblowing-software/badge)](https://scorecard.dev/viewer/?uri=github.com/globaleaks/globaleaks-whistleblowing-software)
29+
| [OpenSSF Best Practices](https://bestpractices.coreinfrastructure.org/) | [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/3816/badge)](https://bestpractices.coreinfrastructure.org/projects/3816)
3030

3131
Project statistics on OpenHub: [www.openhub.net/p/globaleaks](https://www.openhub.net/p/globaleaks)
3232

‎documentation/index.rst

+1
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,4 @@ Documentation
1010
user/index.rst
1111
developer/index.rst
1212
roadmap/index.rst
13+
qualityassurance/index.rst

‎documentation/qualityassurance/badges.rst

+55
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
.. only:: html
2+
3+
+---------------------------+-------------------------------------------------------------+
4+
| **Metric** | **Score** |
5+
+---------------------------+-------------------------------------------------------------+
6+
| Build Status | |build-stable| |
7+
+---------------------------+-------------------------------------------------------------+
8+
| Tests Status | |tests-stable| |
9+
+---------------------------+-------------------------------------------------------------+
10+
| Tests Coverage | |coverage-stable| |
11+
+---------------------------+-------------------------------------------------------------+
12+
| Code Quality | |quality-stable| |
13+
+---------------------------+-------------------------------------------------------------+
14+
| Documentation | |docs-stable| |
15+
+---------------------------+-------------------------------------------------------------+
16+
| MDN HTTP Observatory | |mdn-http-observatory| |
17+
+---------------------------+-------------------------------------------------------------+
18+
| Security Headers | |security-headers| |
19+
+---------------------------+-------------------------------------------------------------+
20+
| SSLLabs | |ssllabs-status| |
21+
+---------------------------+-------------------------------------------------------------+
22+
| OpenSSF Scorecard | |ossf-scorecard| |
23+
+---------------------------+-------------------------------------------------------------+
24+
| OpenSSF Best Practices | |ossf-best-practices| |
25+
+---------------------------+-------------------------------------------------------------+
26+
27+
.. |build-stable| image:: https://github.com/globaleaks/globaleaks-whistleblowing-software/actions/workflows/build.yml/badge.svg?branch=stable
28+
:target: https://github.com/globaleaks/globaleaks-whistleblowing-software/actions/workflows/build.yml?query=branch%3Astable
29+
30+
.. |tests-stable| image:: https://github.com/globaleaks/globaleaks-whistleblowing-software/actions/workflows/tests.yml/badge.svg?branch=stable
31+
:target: https://github.com/globaleaks/globaleaks-whistleblowing-software/actions/workflows/tests.yml?query=branch%3Astable
32+
33+
.. |coverage-stable| image:: https://app.codacy.com/project/badge/Coverage/c09f1ec9607f4546924d19798a98dd7d?branch=stable
34+
:target: https://app.codacy.com/gh/globaleaks/globaleaks-whistleblowing-software/dashboard
35+
36+
.. |quality-stable| image:: https://app.codacy.com/project/badge/Grade/c09f1ec9607f4546924d19798a98dd7d?branch=stable
37+
:target: https://app.codacy.com/gh/globaleaks/globaleaks-whistleblowing-software/dashboard
38+
39+
.. |docs-stable| image:: https://readthedocs.org/projects/globaleaks/badge/?version=stable&style=flat
40+
:target: https://docs.globaleaks.org/en/stable/
41+
42+
.. |mdn-http-observatory| image:: https://img.shields.io/badge/observatory-A%2B-brightgreen
43+
:target: https://developer.mozilla.org/en-US/observatory/analyze?host=demo.globaleaks.org
44+
45+
.. |security-headers| image:: https://img.shields.io/badge/security%20headers-A%2B-brightgreen
46+
:target: https://securityheaders.com/?q=https%3A%2F%2Fdemo.globaleaks.org%2F
47+
48+
.. |ssllabs-status| image:: https://img.shields.io/static/v1?label=SSLLabs&message=A%2B&color=%3CCOLOR%3E
49+
:target: https://www.ssllabs.com/ssltest/analyze.html?d=demo.globaleaks.org&latest
50+
51+
.. |ossf-scorecard| image:: https://api.scorecard.dev/projects/github.com/globaleaks/globaleaks-whistleblowing-software/badge
52+
:target: https://scorecard.dev/viewer/?uri=github.com/globaleaks/globaleaks-whistleblowing-software
53+
54+
.. |ossf-best-practices| image:: https://bestpractices.coreinfrastructure.org/projects/3816/badge
55+
:target: https://bestpractices.coreinfrastructure.org/projects/3816

‎documentation/qualityassurance/index.rst

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
Quality Assurance
2+
=================
3+
The development of GlobaLeaks maintains rigorous software quality standards through a comprehensive Quality Assurance (QA) process, ensuring the platform remains robust, secure, and of the highest quality.
4+
5+
.. include:: badges.rst
6+
7+
**Code Review Process**
8+
To ensure high code quality and maintain the integrity of the project, GlobaLeaks enforces mandatory code reviews for all its contributions. Code reviews play a key role in maintaining consistency, identifying potential issues early, and promoting best practices. Every submitted pull request undergoes peer review by the GlobaLeaks maintainers and community where the code is scrutinized for clarity, adherence to project guidelines, potential security vulnerabilities, and performance optimizations. Reviewers provide feedback and suggestions, and the author of the PR is responsible for addressing any concerns raised. Once feedback is incorporated, the code is re-reviewed by the maintainers, and upon approval, the PR is merged into the main codebase. This collaborative process helps catch issues before they are deployed, ensuring that only high-quality, well-tested code is integrated into the project.
9+
10+
For more details on this matter, you could check the `CONTRIBUTINGhttps://github.com/globaleaks/globaleaks-whistleblowing-software/blob/stable/CONTRIBUTING.md`_ guidelines.
11+
12+
**Automated Testing and Code Coverage**
13+
14+
The development methodology includes an extensive suite of automated tests, covering unit tests, integration tests, and end-to-end tests to ensure correctness and prevent regressions. The code coverage consistently exceeds 90%, ensuring that the majority of the codebase is tested. Test execution is automated through Continuous Integration (CI), which ensures that any untested or faulty code is quickly identified, preventing it from being merged into the main codebase.
15+
16+
For more details on test coverage, you can view the `Test Coverage on Codacy <https://app.codacy.com/gh/globaleaks/globaleaks-whistleblowing-software/dashboard>`_ and `Test Status on GitHub <https://github.com/globaleaks/globaleaks-whistleblowing-software/actions/workflows/tests.yml?query=branch%3Astable>`_.
17+
18+
**Code Quality Assurance**
19+
20+
Code quality is maintained through a combination of static code analysis, automated linters, and mandatory code reviews. Static analysis tools identify potential vulnerabilities, performance bottlenecks, and violations of best practices, while linters ensure code consistency and readability. Code reviews are required for all pull requests, helping maintain high standards and reducing the chance of introducing errors.
21+
22+
For more details on code quality, refer to the `Code Quality Dashboard on Codacy <https://app.codacy.com/gh/globaleaks/globaleaks-whistleblowing-software/dashboard>`_.
23+
24+
**Continuous Integration and Deployment**
25+
26+
Every commit and pull request is automatically tested using CI/CD pipelines, ensuring that faulty or untested code is not merged. Security scans and dependency checks are also automated as part of the CI process, helping identify potential security vulnerabilities or issues with third-party libraries. Before deployment, releases undergo pre-production testing to ensure stability.
27+
28+
You can view the `Build Status on GitHub <https://github.com/globaleaks/globaleaks-whistleblowing-software/actions/workflows/build.yml?query=branch%3Astable>`_.
29+
30+
**Performance and Security Testing**
31+
32+
The project undergoes load and stress testing to simulate real-world usage scenarios and ensure it can handle high traffic. Security best practices are enforced through regular security audits and penetration testing, identifying vulnerabilities before they can be exploited. This ensures the system is both performant and secure.
33+
34+
For further information, check the evaluations by `Probely Security Header <https://securityheaders.com/?q=https%3A%2F%2Fdemo.globaleaks.org%2F>`_, `MDN HTTP Observatory <https://developer.mozilla.org/en-US/observatory/analyze?host=demo.globaleaks.org>`_ and `Qualys SSL Labs <https://www.ssllabs.com/ssltest/analyze.html?d=demo.globaleaks.org>`_.
35+
36+
**Project Best Practices**
37+
38+
The project adheres to OpenSSF best practices, which focus on improving the security of both the development and deployment processes. The OpenSSF Scorecard evaluates various security practices such as vulnerability management, dependency updates, and code quality, ensuring the project meets industry standards. Additionally, the project complies with the Core Infrastructure Initiative (CII) Best Practices, which further enhances its security and overall software quality by addressing areas like code review, testing, and documentation.
39+
40+
You can view the `OpenSSF Scorecard <https://scorecard.dev/viewer/?uri=github.com/globaleaks/globaleaks-whistleblowing-software>`_ and `CII Best Practices <https://bestpractices.coreinfrastructure.org/projects/3816>`_.

0 commit comments

Comments
 (0)