From 0b3f69beedbd8c2e9bd524b8e25d6598d0794e8c Mon Sep 17 00:00:00 2001 From: usingtechnology <39388115+usingtechnology@users.noreply.github.com> Date: Thu, 11 Jun 2026 11:49:44 -0700 Subject: [PATCH 1/2] feat: CCP-4873 Github templates get some standards for developer contribution --- .github/ISSUE_TEMPLATE/bug.md | 35 +++++++ .github/ISSUE_TEMPLATE/custom.md | 8 ++ .github/ISSUE_TEMPLATE/decision.md | 18 ++++ .github/ISSUE_TEMPLATE/documentation.md | 26 +++++ .github/ISSUE_TEMPLATE/epic.md | 20 ++++ .github/ISSUE_TEMPLATE/feature.md | 26 +++++ .github/ISSUE_TEMPLATE/question.md | 17 +++ .github/ISSUE_TEMPLATE/task.md | 20 ++++ .github/ISSUE_TEMPLATE/ux.md | 22 ++++ .github/codeowners | 15 +++ .github/pull_request_template.md | 71 +++++++++++++ .github/workflows/pr_validate.yaml | 48 +++++++++ .vscode/launch.json | 4 +- CODE_OF_CONDUCT.md | 128 ++++++++++++++++++++++ COMPLIANCE.yaml | 11 ++ CONTRIBUTING.md | 16 +++ DEVELOPER.md | 134 +++++++++++++++--------- SECURITY.md | 46 ++++++++ 18 files changed, 611 insertions(+), 54 deletions(-) create mode 100644 .github/ISSUE_TEMPLATE/bug.md create mode 100644 .github/ISSUE_TEMPLATE/custom.md create mode 100644 .github/ISSUE_TEMPLATE/decision.md create mode 100644 .github/ISSUE_TEMPLATE/documentation.md create mode 100644 .github/ISSUE_TEMPLATE/epic.md create mode 100644 .github/ISSUE_TEMPLATE/feature.md create mode 100644 .github/ISSUE_TEMPLATE/question.md create mode 100644 .github/ISSUE_TEMPLATE/task.md create mode 100644 .github/ISSUE_TEMPLATE/ux.md create mode 100644 .github/codeowners create mode 100644 .github/pull_request_template.md create mode 100644 .github/workflows/pr_validate.yaml create mode 100644 CODE_OF_CONDUCT.md create mode 100644 COMPLIANCE.yaml create mode 100644 CONTRIBUTING.md create mode 100644 SECURITY.md diff --git a/.github/ISSUE_TEMPLATE/bug.md b/.github/ISSUE_TEMPLATE/bug.md new file mode 100644 index 0000000..3841d1e --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug.md @@ -0,0 +1,35 @@ +--- +name: Bug +about: Create a report to help us improve +title: '' +labels: bug +assignees: '' + +--- + +**Describe the Bug** +A clear and concise description of what the bug is. + +**Expected Behaviour** +A clear and concise description of what you expected to happen. + +**Actual Behaviour** +A clear and concise description of what actually happened. + +**Steps To Reproduce** +Steps to reproduce the behaviour: +1. Go to '...' +2. Click on '....' +3. Scroll down to '....' +4. See error + +**Screenshots** +If applicable, add screenshots to help explain your problem. + +**Desktop (please complete the following information):** + - OS: [e.g. iOS] + - Browser [e.g. chrome, safari] + - Version [e.g. 22] + +**Additional context** +Add any other context about the problem here. diff --git a/.github/ISSUE_TEMPLATE/custom.md b/.github/ISSUE_TEMPLATE/custom.md new file mode 100644 index 0000000..b1069d8 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/custom.md @@ -0,0 +1,8 @@ +--- +name: Custom issue template +about: Describe this issue template's purpose here +title: '' +labels: '' +assignees: '' + +--- diff --git a/.github/ISSUE_TEMPLATE/decision.md b/.github/ISSUE_TEMPLATE/decision.md new file mode 100644 index 0000000..12bedda --- /dev/null +++ b/.github/ISSUE_TEMPLATE/decision.md @@ -0,0 +1,18 @@ +--- +name: Decision +about: A significant decision that has been made or raised to the Product Owner +title: '' +labels: decision +assignees: '' + +--- + +**Decision** +A clear and concise description of the decision to be made or that was made. + +**Context** +- why is this decision needed? +- what options were considered? + +**Outcome** +- the decision reached, and who made it diff --git a/.github/ISSUE_TEMPLATE/documentation.md b/.github/ISSUE_TEMPLATE/documentation.md new file mode 100644 index 0000000..917aa24 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/documentation.md @@ -0,0 +1,26 @@ +--- +name: Documentation +about: Documentation for a specific area or need +title: '' +labels: documentation +assignees: '' + +--- + +**As a** *(User Type/Persona)* **I want** *(Feature/enhancement)* **So That** *(Value, why is this wanted, what is the user trying to accomplish)* + +**Additional Context** +- enter text here +- enter text here + +**Acceptance Criteria** +- [ ] Given (Context), When (action carried out), Then (expected outcome) +- [ ] Given (Context), When (action carried out), Then (expected outcome) + +**Definition of Done** +- [ ] Ready to Demo in Sprint Review +- [ ] Does what I have made have appropriate test coverage? +- [ ] Documentation exists and can be found +- [ ] Peer Reviewed by the team +- [ ] Manual testing of all PRs in Dev and Prod +- [ ] Merged diff --git a/.github/ISSUE_TEMPLATE/epic.md b/.github/ISSUE_TEMPLATE/epic.md new file mode 100644 index 0000000..6b6b4e5 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/epic.md @@ -0,0 +1,20 @@ +--- +name: Epic +about: A User Story large enough that it cannot be completed in a single sprint, the desired end state of a feature +title: '' +labels: epic +assignees: '' + +--- + +**As a** *(User Type/Persona)* **I want** *(Feature/enhancement)* **So That** *(Value, why is this wanted, what is the user trying to accomplish)* + +**Additional Context** + +- enter text here +- enter text here + +**Acceptance Criteria** + +- [ ] Given (Context), When (action carried out), Then (expected outcome) +- [ ] Given (Context), When (action carried out), Then (expected outcome) diff --git a/.github/ISSUE_TEMPLATE/feature.md b/.github/ISSUE_TEMPLATE/feature.md new file mode 100644 index 0000000..df8804f --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature.md @@ -0,0 +1,26 @@ +--- +name: Feature request / user story +about: Suggest an idea from the perspective of a user +title: '' +labels: enhancement +assignees: '' + +--- + +**As a** *(User Type/Persona)* **I want** *(Feature/enhancement)* **So That** *(Value, why is this wanted, what is the user trying to accomplish)* + +**Additional Context** +- enter text here +- enter text here + +**Acceptance Criteria** +- [ ] Given (Context), When (action carried out), Then (expected outcome) +- [ ] Given (Context), When (action carried out), Then (expected outcome) + +**Definition of Done** +- [ ] Ready to Demo in Sprint Review +- [ ] Does what I have made have appropriate test coverage? +- [ ] Documentation exists and can be found +- [ ] Peer Reviewed by the team +- [ ] Manual testing of all PRs in Dev and Prod +- [ ] Merged diff --git a/.github/ISSUE_TEMPLATE/question.md b/.github/ISSUE_TEMPLATE/question.md new file mode 100644 index 0000000..c2e8a26 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/question.md @@ -0,0 +1,17 @@ +--- +name: Question +about: Ask us a question! +title: '' +labels: question +assignees: '' + +--- + +**Your question** +A clear and concise statement of what you would like to know. + +**Context** +- any background or details that help us answer the question + +**Additional context** +- any additional details that could not be captured above diff --git a/.github/ISSUE_TEMPLATE/task.md b/.github/ISSUE_TEMPLATE/task.md new file mode 100644 index 0000000..f9b5f1f --- /dev/null +++ b/.github/ISSUE_TEMPLATE/task.md @@ -0,0 +1,20 @@ +--- +name: Task +about: Work for the team that cannot be written as a user story +title: '' +labels: task +assignees: '' + +--- + +**Describe the task** +A clear and concise description of what the task is. + +**Acceptance Criteria** +- [ ] first +- [ ] second +- [ ] third + +**Additional context** +- Add any other context about the task here. +- Or here diff --git a/.github/ISSUE_TEMPLATE/ux.md b/.github/ISSUE_TEMPLATE/ux.md new file mode 100644 index 0000000..e6b0d32 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/ux.md @@ -0,0 +1,22 @@ +--- +name: UX Task +about: This is a Task for UX Research, Design or Testing +title: '' +labels: ux +assignees: '' + +--- + +**Describe the task** +Basic description of the task. Is it focused on research with users or the business area? Is it design focused on either co-design or wireframing? Is it user testing or compiling results? + +**Acceptance Criteria** +- [ ] what is required for this task to be complete? +- what is the finishing point or end state of this task? +- [ ] what is the output of this task? + +**SME/User Contact** +(may want to use a persona to fill this in) + +**Additional context** +- any additional details that could not be captured above diff --git a/.github/codeowners b/.github/codeowners new file mode 100644 index 0000000..4e48e51 --- /dev/null +++ b/.github/codeowners @@ -0,0 +1,15 @@ +# Code owners for the SOBA repository. +# +# Owners listed here are automatically requested for review when someone opens +# a pull request that modifies matching files. Uncomment and fill in the GitHub +# handles for your team before relying on this. +# +# See https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners + +# Matched against repo root (asterisk) +# * @owner1 @owner2 + +# Matched against directories +# /.github/workflows/ @owner1 @owner2 +# /backend/ @owner1 @owner2 +# /frontend/ @owner1 @owner2 diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 0000000..86d056f --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,71 @@ + + +**References ticket:** CCP-NNNN + + + +# Description + +Please provide a summary of the change and the issue fixed. Please include relevant context. List dependency changes. + +## Type of change + + + +- [ ] Bug fix (non-breaking change which fixes an issue) +- [ ] New feature (non-breaking change which adds functionality) +- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) +- [ ] This change requires a documentation update +- [ ] Documentation update + +# How Has This Been Tested? + + + + + +- [ ] New unit tests +- [ ] New integration tests +- [ ] New end-to-end tests (Playwright) +- [ ] No new tests are required +- [ ] Manual tests (description below) +- [ ] Updated existing tests + +## How to verify + + + +1. ... +2. ... +3. Expected result: ... + +## Checklist + + + + +- [ ] I have read the [CONTRIBUTING](../CONTRIBUTING.md) doc +- [ ] I have performed a self-review of my own code +- [ ] I have commented my code, particularly in hard-to-understand areas +- [ ] I have made corresponding changes to the documentation +- [ ] I have run lint on the affected backend and/or frontend workspace +- [ ] My changes generate no new warnings +- [ ] I have added tests that prove my fix is effective or that my feature works +- [ ] New and existing unit tests pass locally with my changes +- [ ] Any dependent changes have already been accepted and merged + +## Further comments + + diff --git a/.github/workflows/pr_validate.yaml b/.github/workflows/pr_validate.yaml new file mode 100644 index 0000000..ae71554 --- /dev/null +++ b/.github/workflows/pr_validate.yaml @@ -0,0 +1,48 @@ +# Validates the pull request title (conventional commits) and rejects forks. +# Only the PR title is checked — individual commits are not inspected — because +# merges use the PR title as the squash commit message. +name: PR Validate +run-name: PR-${{ github.event.number }} validate + +on: + pull_request: + types: [opened, edited, reopened, synchronize, ready_for_review] + +permissions: + pull-requests: read + +concurrency: + group: ${{ github.workflow }}-${{ github.event.number }} + cancel-in-progress: true + +jobs: + validate: + name: Validate PR + runs-on: ubuntu-latest + if: ${{ !github.event.pull_request.draft }} + steps: + - name: Reject forks + if: github.event.pull_request.head.repo.full_name != github.repository + run: | + echo "::error::Pull requests from forks are not accepted. Please create a branch in this repository and open your PR from there." + exit 1 + + - name: Validate PR title + uses: amannn/action-semantic-pull-request@v6 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + # Allowed conventional-commit types. The Jira id (e.g. CCP-1234) + # belongs in the subject: "feat: CCP-1234 add submission export". + types: | + feat + fix + build + ci + docs + perf + refactor + revert + style + test + chore diff --git a/.vscode/launch.json b/.vscode/launch.json index 79efd0a..5eb30f7 100644 --- a/.vscode/launch.json +++ b/.vscode/launch.json @@ -52,8 +52,8 @@ "name": "SOBA Frontend (Chrome)", "type": "chrome", "request": "launch", - "url": "http://localhost:5173", - "webRoot": "${workspaceFolder}/frontend/src" + "url": "http://localhost:3000", + "webRoot": "${workspaceFolder}/frontend" } ] } diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..c97423d --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,128 @@ +# Contributor Covenant Code of Conduct + +## Our Pledge + +We as members, contributors, and leaders pledge to make participation in our +community a harassment-free experience for everyone, regardless of age, body +size, visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, religion, or sexual identity +and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. + +## Our Standards + +Examples of behavior that contributes to a positive environment for our +community include: + +* Demonstrating empathy and kindness toward other people +* Being respectful of differing opinions, viewpoints, and experiences +* Giving and gracefully accepting constructive feedback +* Accepting responsibility and apologizing to those affected by our mistakes, + and learning from the experience +* Focusing on what is best not just for us as individuals, but for the + overall community + +Examples of unacceptable behavior include: + +* The use of sexualized language or imagery, and sexual attention or + advances of any kind +* Trolling, insulting or derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or email + address, without their explicit permission +* Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Enforcement Responsibilities + +Community leaders are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any behavior that they deem inappropriate, threatening, offensive, +or harmful. + +Community leaders have the right and responsibility to remove, edit, or reject +comments, commits, code, wiki edits, issues, and other contributions that are +not aligned to this Code of Conduct, and will communicate reasons for moderation +decisions when appropriate. + +## Scope + +This Code of Conduct applies within all community spaces, and also applies when +an individual is officially representing the community in public spaces. +Examples of representing our community include using an official e-mail address, +posting via an official social media account, or acting as an appointed +representative at an online or offline event. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the community leaders responsible for enforcement at +. All complaints will be reviewed and investigated +promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the +reporter of any incident. + +## Enforcement Guidelines + +Community leaders will follow these Community Impact Guidelines in determining +the consequences for any action they deem in violation of this Code of Conduct: + +### 1. Correction + +**Community Impact**: Use of inappropriate language or other behavior deemed +unprofessional or unwelcome in the community. + +**Consequence**: A private, written warning from community leaders, providing +clarity around the nature of the violation and an explanation of why the +behavior was inappropriate. A public apology may be requested. + +### 2. Warning + +**Community Impact**: A violation through a single incident or series +of actions. + +**Consequence**: A warning with consequences for continued behavior. No +interaction with the people involved, including unsolicited interaction with +those enforcing the Code of Conduct, for a specified period of time. This +includes avoiding interactions in community spaces as well as external channels +like social media. Violating these terms may lead to a temporary or +permanent ban. + +### 3. Temporary Ban + +**Community Impact**: A serious violation of community standards, including +sustained inappropriate behavior. + +**Consequence**: A temporary ban from any sort of interaction or public +communication with the community for a specified period of time. No public or +private interaction with the people involved, including unsolicited interaction +with those enforcing the Code of Conduct, is allowed during this period. +Violating these terms may lead to a permanent ban. + +### 4. Permanent Ban + +**Community Impact**: Demonstrating a pattern of violation of community +standards, including sustained inappropriate behavior, harassment of an +individual, or aggression toward or disparagement of classes of individuals. + +**Consequence**: A permanent ban from any sort of public interaction within +the community. + +## Attribution + +This Code of Conduct is adapted from the [Contributor Covenant][homepage], +version 2.0, available at +https://www.contributor-covenant.org/version/2/0/code_of_conduct.html. + +Community Impact Guidelines were inspired by [Mozilla's code of conduct +enforcement ladder](https://github.com/mozilla/diversity). + +[homepage]: https://www.contributor-covenant.org + +For answers to common questions about this code of conduct, see the FAQ at +https://www.contributor-covenant.org/faq. Translations are available at +https://www.contributor-covenant.org/translations. diff --git a/COMPLIANCE.yaml b/COMPLIANCE.yaml new file mode 100644 index 0000000..6495c8a --- /dev/null +++ b/COMPLIANCE.yaml @@ -0,0 +1,11 @@ +name: compliance +description: | + This document is used to track a projects PIA and STRA + compliance. +spec: + - name: PIA + status: not-required + last-updated: '2026-06-11T00:00:00.000Z' + - name: STRA + status: not-required + last-updated: '2026-06-11T00:00:00.000Z' diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..e5750b4 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,16 @@ +# How to contribute + +Government employees, public and members of the private sector are encouraged to contribute to the repository by **creating a branch and submitting a pull request**. Pull requests from forks are not accepted — please open your branch within this repository. + +(If you are new to GitHub, you might start with a [basic tutorial](https://help.github.com/articles/set-up-git) and check out a more detailed guide to [pull requests](https://help.github.com/articles/using-pull-requests/).) + +## Before you begin + +- Please bring your change ideas to the team before starting work. +- Contributors must follow the [Code of Conduct](./CODE_OF_CONDUCT.md). +- Changes should include test coverage, documentation, and comments where appropriate. +- Pull request titles should follow the format `type: CCP-1234 short description` (for example, `feat: CCP-1234 add submission export`). + +Pull requests will be evaluated by the repository guardians on a schedule and if deemed beneficial will be committed to the main branch. + +All contributors retain the original copyright to their stuff, but by contributing to this project, you grant a world-wide, royalty-free, perpetual, irrevocable, non-exclusive, transferable license to all users **under the terms of the [license](./LICENSE) under which this project is distributed**. diff --git a/DEVELOPER.md b/DEVELOPER.md index 7075f8a..67705fb 100644 --- a/DEVELOPER.md +++ b/DEVELOPER.md @@ -55,12 +55,14 @@ docker compose -f .devcontainer/docker-compose.yml up -d This starts: - **MongoDB** (port 27017) — used by Form.io -- **[PostgreSQL](https://www.postgresql.org) 17** (port 5432) — app DB +- **[PostgreSQL](https://www.postgresql.org) 17** (port 5432) — app DB (default DB `postgres`; migrate creates `soba`) - **Form.io** (port 3001) — form runtime +- **Temporal** (gRPC port 7233) — workflow engine +- **Temporal UI** (port 8088) — workflow dashboard -**Inside the devcontainer** use `host.docker.internal` to reach these services (e.g. `mongodb://host.docker.internal:27017`, `postgresql://postgres:postgres@host.docker.internal:5432/postgres`, `http://host.docker.internal:3001`). The devcontainer is started with `--add-host=host.docker.internal:host-gateway` so that this hostname works on Linux as well as on Docker Desktop (Mac/Windows). On the host machine use `localhost` and the same ports. **Using the app from a browser on the host** (e.g. http://localhost:3000): the frontend example uses `NEXT_PUBLIC_SOBA_API_BASE_URL=http://localhost:4000/api/v1` so client-side API calls go to the forwarded backend; no change needed. Form.io login: `formio@localhost.com` / `formio`. +**Inside the devcontainer** use `host.docker.internal` to reach sidecars from backend processes (e.g. `mongodb://host.docker.internal:27017`, `postgresql://postgres:postgres@host.docker.internal:5432/postgres`, `http://host.docker.internal:3001`). The devcontainer is started with `--add-host=host.docker.internal:host-gateway` so that this hostname works on Linux as well as on Docker Desktop (Mac/Windows). **Committed `.env.example` files use `localhost`** for DB, Form.io, and API URLs — that works when the browser and forwarded ports are on the host (e.g. http://localhost:3000 with `NEXT_PUBLIC_SOBA_API_BASE_URL=http://localhost:4000/api/v1`). Use `host.docker.internal` in backend env when the API server runs inside the container and must reach compose services. Form.io login: `formio@localhost.com` / `formio`. -**Database (migrate + seed):** After the sidecars are up, from the repo root run `pnpm db:init` to run pending migrations and seed data. See [Drizzle](#drizzle) for individual `db:migrate` / `db:seed` commands. +**Database (migrate + seed):** After the sidecars are up, from the repo root run `pnpm db:init` (or `pnpm dev:db:up` to start services and init in one step). See [Drizzle](#drizzle) for individual `db:migrate` / `db:seed` commands. --- @@ -88,10 +90,14 @@ The repo is a **[pnpm](https://pnpm.io) workspace** (faster installs, shared sto | `pnpm lint:fix:frontend` / `pnpm lint:fix:backend` | Lint fix one app | | `pnpm check` | Type/style checks for both apps | | `pnpm check:frontend` / `pnpm check:backend` | Check one app | +| `pnpm qa` | `check` then `test` (PR readiness shortcut) | +| `pnpm qa:build` | `qa` then `build` | +| `pnpm dev:services:up` | Start sidecars via docker compose (`up -d --wait`) | +| `pnpm dev:db:up` | `dev:services:up` then `db:init` | | `pnpm clean:workspace` | Remove deps, build outputs, and test artifacts (keeps `.env`) | | `pnpm clean:workspace:full` | Same as above, plus remove gitignored env files | -Package manager is pinned in `package.json` (`packageManager`: `pnpm@10.28.2`). The `integration` app lives outside the workspace and has its own `pnpm-lock.yaml`; use `pnpm -C integration/playwright