Skip to content

Commit 1ba7417

Browse files
shenxianpengshenxianpeng
committed
feat: update spec
1 parent bc6e8af commit 1ba7417

2 files changed

Lines changed: 53 additions & 35 deletions

File tree

‎content/_index.md‎

Lines changed: 42 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -19,41 +19,27 @@ DevOps Maturity Specification is a set of guidelines for DevOps best practices,
1919
* 🟢 MUST have (weight 1)
2020
* 🟡 NICE have (weight 0.5)
2121

22-
| **Category** |**Code**| **Criteria** | **Req.**|
23-
|--------------------|--------|--------------------------------------------|---------|
24-
| Basics | D101 | Build a specific branch | 🟢 |
25-
| | D102 | Build upon pull request | 🟢 |
26-
| | D103 | Build from clean environment | 🟡 |
27-
| Quality | D201 | Automated Testing: Functional testing | 🟢 |
28-
| | D202 | Automated Testing: Performance testing | 🟡 |
29-
| | D203 | Code Coverage | 🟡 |
30-
| | D204 | Accessibility Testing | 🟡 |
31-
| Security | D301 | Security scan[^1] | 🟢 |
32-
| | D302 | License scan | 🟡 |
33-
| Supply Chain Security| D401 | Documented Build Chain | 🟢 |
34-
| | D402 | CI/CD as coded | 🟢 |
35-
| | D403 | Artifacts are signed | 🟡 |
36-
| | D404 | Artifactory download for Package Managers | 🟡 |
37-
| Analysis | D501 | Static code analysis | 🟡 |
38-
| | D502 | Dynamic code analysis | 🟡 |
39-
| | D503 | Quality Gate | 🟡 |
40-
| | D504 | Code Lint | 🟡 |
41-
| Reporting | D601 | Email/Slack reporting functionality | 🟢 |
42-
| | D602 | Attached Reports | 🟢 |
43-
44-
[^1]: Security scan includes vulnerability scanning, dependency scanning, and secret scanning.
45-
46-
### Code Groupings
47-
48-
|**Code**|**Description**|
49-
|--------|---------------|
50-
| D1xx | Basics |
51-
| D2xx | Quality |
52-
| D3xx | Security |
53-
| D4xx | Supply Chain Security|
54-
| D5xx | Analysis |
55-
| D6xx | Reporting |
56-
22+
| **Category** |**Code**| **Criteria** | **Req.**|
23+
|--------------------|--------|----------------------------------|---------|
24+
| Basics | D101 | Branch Builds[^1] | 🟢 |
25+
| | D102 | Pull Request Builds[^2] | 🟢 |
26+
| | D103 | Clean Build Environments[^3] | 🟡 |
27+
| Quality | D201 | Unit Testing[^4] | 🟢 |
28+
| | D202 | Functional Testing[^5] | 🟢 |
29+
| | D203 | Performance Testing[^6] | 🟡 |
30+
| | D204 | Code Coverage[^7] | 🟡 |
31+
| | D205 | Accessibility Testing[^8] | 🟡 |
32+
| Security | D301 | Security Scanning[^9] | 🟢 |
33+
| | D302 | License Scanning[^10] | 🟡 |
34+
| Supply Chain Security| D401 | Documented Build Process[^11] | 🟢 |
35+
| | D402 | CI/CD as Code[^12] | 🟢 |
36+
| | D403 | Artifact Signing[^13] | 🟡 |
37+
| | D404 | Dependency Pinning[^14] | 🟡 |
38+
| Analysis | D501 | Static Code Analysis[^15] | 🟡 |
39+
| | D502 | Dynamic Code Analysis[^16] | 🟡 |
40+
| | D504 | Code Linting[^17] | 🟡 |
41+
| Reporting | D601 | Notifications & Alerts[^18] | 🟢 |
42+
| | D602 | Attached Reports[^19] | 🟢 |
5743

5844
## Badge Levels
5945

@@ -78,3 +64,24 @@ You can used [devops-maturity](https://github.com/devops-maturity/devops-maturit
7864
### What is the difference between OpenSSF Best Practices and DevOps Maturity?
7965

8066
[OpenSSF Best Practices](https://www.bestpractices.dev/) targets open source projects across the entire software development lifecycle, while DevOps Maturity focuses specifically on DevOps practices applicable to both open source and internal enterprise projects. DevOps Maturity provides both a web UI and a CLI for automatic maturity scoring. In contrast, OpenSSF Best Practices only offers a web-based SaaS and does not support internal deployment.
67+
68+
[^1]: Supports builds from any specific branch, not just the `main` branch.
69+
[^2]: Supports building pull requests (PRs), not limited to direct pushes to branches.
70+
[^3]: Supports building in clean environments, such as containers or virtual machines (VMs).
71+
[^4]: Supports unit testing, including unit or component-level tests.
72+
[^5]: Supports functional testing, such as integration or end-to-end (E2E) tests.
73+
[^6]: Supports performance testing, including load, stress, or throughput testing.
74+
[^7]: Supports measuring code coverage, including line, branch, or function coverage.
75+
[^8]: Supports accessibility testing for standards compliance, such as WCAG.
76+
[^9]: Supports security scanning, including SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing).
77+
[^10]: Supports license scanning using tools like SPDX, FOSSology, or license-checkers.
78+
[^11]: Provides a documented build process, including build steps, manifests, or reproducibility details.
79+
[^12]: Supports CI/CD workflows defined as code, such as pipeline-as-code or infrastructure-as-code.
80+
[^13]: Supports artifact signing (e.g., with PGP or GPG) to ensure authenticity and integrity.
81+
[^14]: Supports dependency pinning or version locking to ensure reproducible builds.
82+
[^15]: Supports static code analysis tools such as SonarQube, Polaris, or similar.
83+
[^16]: Supports dynamic analysis, including runtime behavior analysis or fuzz testing.
84+
[^17]: Supports code linting using tools like ESLint, Prettier, or pre-commit hooks.
85+
[^18]: Supports notification systems such as email or Slack alerts.
86+
[^19]: Supports attaching detailed reports to builds, such as test results or coverage metrics.
87+

‎content/about/index.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,14 @@ The DevOps Maturity specification was inspired by [Conventional Branch](https://
2222
[![DevOps Maturity](https://img.shields.io/badge/DevOps%20Maturity%20Specification-1.0.0-yellow)](https://github.com/devops-maturity/devops-maturity)
2323

2424
_Want your project on this list?_ [send a pull request](https://github.com/devops-maturity/spec/pulls).
25+
26+
## Maturity Code Map
27+
28+
|**Code**|**Description**|
29+
|--------|---------------|
30+
| D1xx | Basics |
31+
| D2xx | Quality |
32+
| D3xx | Security |
33+
| D4xx | Supply Chain Security|
34+
| D5xx | Analysis |
35+
| D6xx | Reporting |

0 commit comments

Comments
 (0)