Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: Updated the README and CONTRIBUTING docs #716

Merged
merged 3 commits into from
May 30, 2024
Merged

docs: Updated the README and CONTRIBUTING docs #716

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4a52ce3
5/28/24 - ritz303 : Updated the README and CONTRIBUTING docs
agunn303 May 28, 2024
5fd41ef
5/29/24 - ritz303 : Edits from SME review
agunn303 May 29, 2024
c1eed3e
5/29/24 - ritz303 : Updated the important note
agunn303 May 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 6 additions & 30 deletions CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,33 +1,9 @@
# How to contribute
# How to give feedback and contribute

Contributions are essential for keeping this extension great.
We try to keep it as easy as possible to contribute changes and we are
open to suggestions for making it even easier.
There are only a few guidelines that we need contributors to follow.
## Feedback
<br >Your feedback is essential for keeping this extension great.

## First Time Setup
1. Install prerequisites:
* latest [Visual Studio Code](https://code.visualstudio.com/)
* [Node.js](https://nodejs.org/) v4.0.0 or higher
2. Fork and clone the repository
3. `cd fabric8-analytics-vscode-extension`
4. Install the dependencies:
If you have any questions or run into any problems, open an [issue](https://github.com/fabric8-analytics/fabric8-analytics-vscode-extension/issues), and we will be happy to help however we can.

```bash
$ npm install
```
5. Open the folder in VS Code

## Run the extension locally

1. Install `vsce` - A command line tool you'll use to publish extensions to the Extension Marketplace.
```bash
$ npm install -g [email protected]
```
2. From root folder, run the below command.
```bash
$ vsce package
```
3. `fabric8-analytics-<version>.vsix` file is created. Install it by following the instructions [here](https://code.visualstudio.com/docs/editor/extension-gallery#_install-from-a-vsix).

> If you have any questions or run into any problems, please post an issue - we'll be very happy to help.
## Contributing
<br >At this time, we are not opening up this project to external contributions.
122 changes: 78 additions & 44 deletions README.md
View file
Open in desktop
ritz303 marked this conversation as resolved.
Show resolved Hide resolved
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ The Red Hat Dependency Analytics extension uses vulnerability data sources for t
Red Hat Dependency Analytics only accesses your manifest files to analyze your application dependencies before displaying the vulnerability report.

**IMPORTANT:**
<br >Currently, Red Hat Dependency Analytics only supports projects that use Maven (`mvn`), Node (`npm`), Golang (`go mod`) and Python (`pip`) ecosystems.
<br >Currently, Red Hat Dependency Analytics only supports projects that use Maven (`mvn`), Node (`npm`), Golang (`go mod`), Python (`pip`), and Gradle (`gradle`) ecosystems.
In future releases, Red Hat plans to support other programming languages.

##### Table of Contents
Expand Down Expand Up @@ -134,55 +134,89 @@ The default path is `/tmp/redhatDependencyAnalyticsReport.html`.

- **Excluding dependencies with `exhortignore`**
<br >You can exclude a package from analysis by marking the package for exclusion.
If you want to ignore vulnerabilities for a dependency in a `pom.xml` file, you must add `exhortignore` as a comment against the dependency, group id, artifact id, or version scopes of that particular dependency in the manifest file.
For example:
How you exclude a package varies based on the your project's language:

```xml
<dependency> <!--exhortignore-->
<groupId>...</groupId>
<artifactId>...</artifactId>
<version>...</version>
</dependency>
```
- **Maven**
<br >If you want to ignore vulnerabilities for a dependency in a `pom.xml` file, you must add `<!--exhortignore-->` to the end of the line as a comment against the dependency, group id, artifact id, or version scopes of that particular dependency in the manifest file.
For example:

```xml
<dependency> <!--exhortignore-->
<groupId>...</groupId>
<artifactId>...</artifactId>
<version>...</version>
</dependency>
```

- **Node**
<br >If you wish to ignore vulnerabilities for a dependency in a `package.json` file, you must add `exhortignore` as a attribute-value pair.
The value for `exhortignore` is a list of comma-separated vulnerability IDs.
This list of vulnerabilities are ignored during analysis.
For example:

If you wish to ignore vulnerabilities for a dependency in a `package.json` file, you must add `exhortignore` as a attribute-value pair.
If `exhortignore` is followed by a list of comma-separated vulnerability IDs, only the listed vulnerabilities are ignored during analysis.
```json
{
"name": "sample",
"version": "1.0.0",
"description": "",
"main": "index.js",
"keywords": [],
"author": "",
"license": "ISC",
"dependencies": {
"dotenv": "^8.2.0",
"express": "^4.17.1",
"jsonwebtoken": "^8.5.1",
"mongoose": "^5.9.18"
},
"exhortignore": [
"jsonwebtoken"
]
}
```

- **Go**
<br >If you want to ignore vulnerabilities for a dependency in a `go.mod` file, you must add `// exhortignore` to the end of the line as a comment against the dependency in the manifest file.
For example:

```json
{
"name": "sample",
"version": "1.0.0",
"description": "",
"main": "index.js",
"keywords": [],
"author": "",
"license": "ISC",
"dependencies": {
"dotenv": "^8.2.0",
"express": "^4.17.1",
"jsonwebtoken": "^8.5.1",
"mongoose": "^5.9.18"
},
"exhortignore": [
"jsonwebtoken"
]
}
```
```go
require (
golang.org/x/sys v1.6.7 // exhortignore
)
```

If you want to ignore vulnerabilities for a dependency in a `go.mod` file, you must add `exhortignore` as a comment against the dependency in the manifest file.
- **Python**
<br >If you want to ignore vulnerabilities for a dependency in a `requirements.txt` file, you must add `# exhortignore` to the end of the line as a comment against the dependency in the manifest file.
For example:
```
require (
golang.org/x/sys v1.6.7 // exhortignore
)
```

If you want to ignore vulnerabilities for a dependency in a `requirements.txt` file, you must add `exhortignore` as a comment against the dependency in the manifest file.
```python
requests==2.28.1 # exhortignore
```

- **Gradle**
<br >If you want to ignore vulnerabilities for a dependency in a `build.gradle` file, you must add `// exhortignore` to the end of the line as a comment against the dependency in the manifest file.
For example:
```
requests==2.28.1 # exhortignore
```

```gradle
plugins {
id 'java'
}

group = 'groupName'
version = 'version'

repositories {
mavenCentral()
}

dependencies {
implementation "groupId:artifactId:version" // exhortignore
}

test {
useJUnitPlatform()
}
```

- **Excluding developmental or test dependencies**
<br >Red Hat Dependency Analytics does not analyze dependencies marked as `dev` or `test`, these dependencies are ignored.
Expand Down Expand Up @@ -221,9 +255,9 @@ The default path is `/tmp/redhatDependencyAnalyticsReport.html`.
}
```

For example, setting `exclude` attributte in the `go.mod` file:
For example, setting the `exclude` attribute in the `go.mod` file:

```
```go
exclude golang.org/x/sys v1.6.7

exclude (
Expand Down