Skip to content

Commit cf64fd3

Browse files
haksungjanghaksungjang
committed
TRUSCA v0.20.0
0 parents  commit cf64fd3

1,801 files changed

Lines changed: 488099 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.editorconfig‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# EditorConfig — https://editorconfig.org
2+
# Top-most EditorConfig file for the TrustedOSS Portal monorepo.
3+
root = true
4+
5+
# Defaults for every file.
6+
[*]
7+
charset = utf-8
8+
end_of_line = lf
9+
insert_final_newline = true
10+
trim_trailing_whitespace = true
11+
indent_style = space
12+
indent_size = 2
13+
14+
# Python — 4-space indent (PEP 8).
15+
[*.py]
16+
indent_size = 4
17+
18+
# Makefiles require real tabs.
19+
[Makefile]
20+
indent_style = tab
21+
22+
# Go uses tabs by convention.
23+
[*.go]
24+
indent_style = tab
25+
26+
# Markdown — trailing whitespace can be a meaningful line break, so keep it.
27+
[*.md]
28+
trim_trailing_whitespace = false
29+
30+
# Avoid reformatting vendored or generated lockfiles.
31+
[{*.lock,package-lock.json,poetry.lock,uv.lock}]
32+
indent_style = unset
33+
indent_size = unset
34+
trim_trailing_whitespace = unset
35+
insert_final_newline = unset

‎.env.example‎

Lines changed: 776 additions & 0 deletions
Large diffs are not rendered by default.

‎.github/CODEOWNERS‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# CODEOWNERS — default reviewers per path.
2+
#
3+
# GitHub requests a review from the listed owners when a pull request touches a
4+
# matching path. Handles are placeholder GitHub teams; replace with real teams
5+
# as the maintainer roster is filled in (see MAINTAINERS.md and GOVERNANCE.md).
6+
#
7+
# Order matters: the last matching pattern wins.
8+
9+
# Default owner for everything not matched below.
10+
* @trustedoss/maintainers
11+
12+
# Backend — API, services, scan pipeline, integrations.
13+
/apps/backend/ @trustedoss/maintainers
14+
15+
# Frontend — React UI and in-app i18n.
16+
/apps/frontend/ @trustedoss/maintainers
17+
18+
# Documentation site (EN/KO).
19+
/docs-site/ @trustedoss/maintainers
20+
21+
# Helm chart.
22+
/charts/ @trustedoss/maintainers
23+
24+
# Infrastructure as code.
25+
/terraform/ @trustedoss/maintainers
26+
27+
# CI/CD, issue templates, and repo automation.
28+
/.github/ @trustedoss/maintainers
29+
30+
# Governance and project meta — change with extra care.
31+
/GOVERNANCE.md @trustedoss/maintainers
32+
/MAINTAINERS.md @trustedoss/maintainers
33+
/CODE_OF_CONDUCT.md @trustedoss/maintainers
34+
/SECURITY.md @trustedoss/maintainers
35+
/.github/CODEOWNERS @trustedoss/maintainers

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
name: Bug report
2+
description: Report something that does not work as documented
3+
title: "[Bug] "
4+
labels: ["bug", "triage"]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
Thanks for taking the time to file a bug report.
10+
11+
Before submitting, please:
12+
- Search [existing issues](https://github.com/trustedoss/trusca/issues?q=is%3Aissue) to avoid duplicates.
13+
- **Do not file security vulnerabilities here.** See [SECURITY.md](https://github.com/trustedoss/trusca/blob/main/SECURITY.md) for the responsible disclosure process.
14+
15+
- type: textarea
16+
id: summary
17+
attributes:
18+
label: Summary
19+
description: One or two sentences describing the bug.
20+
placeholder: e.g. Scan never completes when the project URL contains a fragment.
21+
validations:
22+
required: true
23+
24+
- type: textarea
25+
id: reproduction
26+
attributes:
27+
label: Steps to reproduce
28+
description: A minimal, deterministic recipe that reproduces the bug.
29+
placeholder: |
30+
1. Log in as a Developer.
31+
2. Go to Projects → New.
32+
3. Enter `https://github.com/example/repo#main`.
33+
4. Click Scan.
34+
5. Wait for status.
35+
value: |
36+
1.
37+
2.
38+
3.
39+
validations:
40+
required: true
41+
42+
- type: textarea
43+
id: expected
44+
attributes:
45+
label: Expected behavior
46+
description: What did you expect to happen?
47+
validations:
48+
required: true
49+
50+
- type: textarea
51+
id: actual
52+
attributes:
53+
label: Actual behavior
54+
description: What actually happened? Include error messages, stack traces, screenshots if relevant.
55+
validations:
56+
required: true
57+
58+
- type: input
59+
id: version
60+
attributes:
61+
label: TrustedOSS Portal version
62+
description: Output of the `/api/v1/version` endpoint, or the Git commit SHA if running from source.
63+
placeholder: v2.0.0 / 9c19b5a
64+
validations:
65+
required: true
66+
67+
- type: dropdown
68+
id: deployment
69+
attributes:
70+
label: Deployment mode
71+
options:
72+
- Docker Compose (development)
73+
- Docker Compose (production)
74+
- Helm chart (Kubernetes)
75+
- Demo SaaS (trustedoss.io)
76+
- Other (describe in environment)
77+
validations:
78+
required: true
79+
80+
- type: textarea
81+
id: environment
82+
attributes:
83+
label: Environment
84+
description: |
85+
Please share:
86+
- OS and architecture (e.g. Ubuntu 24.04 / x86_64)
87+
- Docker / Docker Compose V1 version (`docker --version`, `docker-compose --version`)
88+
- PostgreSQL version (if external)
89+
- Dependency-Track version and connection mode (bundled / external)
90+
- Browser and version (for UI bugs)
91+
render: text
92+
validations:
93+
required: true
94+
95+
- type: textarea
96+
id: logs
97+
attributes:
98+
label: Relevant logs
99+
description: |
100+
Please paste relevant log lines. Logs are JSON; include the surrounding context including `request_id` if available.
101+
Redact any sensitive values before pasting.
102+
render: shell
103+
104+
- type: dropdown
105+
id: severity
106+
attributes:
107+
label: Severity (your assessment)
108+
options:
109+
- Critical — data loss, security impact, all users blocked
110+
- High — feature broken, no workaround
111+
- Medium — feature degraded, workaround exists
112+
- Low — minor / cosmetic
113+
validations:
114+
required: true
115+
116+
- type: checkboxes
117+
id: checks
118+
attributes:
119+
label: Pre-flight checks
120+
options:
121+
- label: I searched existing issues and did not find a duplicate.
122+
required: true
123+
- label: I confirmed this is not a security vulnerability (those go to SECURITY.md).
124+
required: true
125+
- label: I redacted secrets, tokens, and PII from the logs and screenshots.
126+
required: true

‎.github/ISSUE_TEMPLATE/feature_request.yml‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
name: Feature request
2+
description: Suggest a new feature, enhancement, or workflow improvement
3+
title: "[Feature] "
4+
labels: ["enhancement", "triage"]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
Thanks for proposing a new feature.
10+
11+
Before submitting, please:
12+
- Search [existing issues](https://github.com/trustedoss/trusca/issues?q=is%3Aissue) and [discussions](https://github.com/trustedoss/trusca/discussions) to avoid duplicates.
13+
- Check the [v2 execution plan](https://github.com/trustedoss/trusca/blob/main/docs/v2-execution-plan.md) — your idea may already be on the roadmap.
14+
15+
- type: textarea
16+
id: problem
17+
attributes:
18+
label: Problem statement
19+
description: What user problem does this solve? Describe the situation, not the solution.
20+
placeholder: e.g. As a Team Admin, when a scan finishes I have to refresh the page to see new findings, which delays triage.
21+
validations:
22+
required: true
23+
24+
- type: textarea
25+
id: proposal
26+
attributes:
27+
label: Proposed solution
28+
description: How would you solve this? Be specific about UI / API / behavior.
29+
validations:
30+
required: true
31+
32+
- type: textarea
33+
id: alternatives
34+
attributes:
35+
label: Alternatives considered
36+
description: What other approaches did you consider, and why is the proposal preferred?
37+
38+
- type: dropdown
39+
id: area
40+
attributes:
41+
label: Affected area
42+
multiple: true
43+
options:
44+
- Auth & RBAC
45+
- Project / Components
46+
- Vulnerabilities
47+
- Licenses & Obligations
48+
- SBOM / Reports
49+
- Scan pipeline (cdxgen / ORT / Trivy)
50+
- Dependency-Track integration
51+
- Admin (users / teams / DT / disk / audit)
52+
- CI/CD (API key / webhook / build gate)
53+
- Notifications
54+
- i18n (EN / KO)
55+
- Documentation
56+
- DevOps (Docker / Helm / install scripts)
57+
- Other
58+
validations:
59+
required: true
60+
61+
- type: dropdown
62+
id: persona
63+
attributes:
64+
label: Primary user persona
65+
options:
66+
- Super Admin (system operator)
67+
- Team Admin
68+
- Developer
69+
- CI/CD pipeline (machine actor)
70+
- External / unauthenticated viewer
71+
validations:
72+
required: true
73+
74+
- type: textarea
75+
id: acceptance
76+
attributes:
77+
label: Acceptance criteria
78+
description: How will we know this is done? Bullet list of testable conditions.
79+
placeholder: |
80+
- [ ] Component count badge updates within 5s without page refresh.
81+
- [ ] EN and KO labels added.
82+
- [ ] WebSocket reconnect within 2s on transient disconnect.
83+
validations:
84+
required: true
85+
86+
- type: dropdown
87+
id: priority
88+
attributes:
89+
label: Priority (your assessment)
90+
options:
91+
- P0 — blocks GA / mission-critical
92+
- P1 — significant value, needed soon
93+
- P2 — nice to have
94+
- P3 — speculative / future
95+
validations:
96+
required: true
97+
98+
- type: textarea
99+
id: additional
100+
attributes:
101+
label: Additional context
102+
description: Mockups, links to related issues, prior-art screenshots from other tools, etc.
103+
104+
- type: checkboxes
105+
id: checks
106+
attributes:
107+
label: Pre-flight checks
108+
options:
109+
- label: I searched existing issues and discussions for duplicates.
110+
required: true
111+
- label: I checked the v2 execution plan and confirmed this is not already roadmapped (or noted where it diverges).
112+
required: true

‎.github/ISSUE_TEMPLATE/security.yml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
name: Security report (PUBLIC — please use private channel instead)
2+
description: Open ONLY for non-sensitive security topics. Vulnerabilities go to SECURITY.md.
3+
title: "[Security] "
4+
labels: ["security", "triage"]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
## ⚠️ Stop and read this first
10+
11+
**Do NOT file a public issue for an unpatched vulnerability.**
12+
13+
For confidential vulnerability reports, please use one of these private channels (see [SECURITY.md](https://github.com/trustedoss/trusca/blob/main/SECURITY.md) for details):
14+
15+
- **GitHub private vulnerability reporting** — [Report a vulnerability](https://github.com/trustedoss/trusca/security/advisories/new) (preferred)
16+
- **Encrypted email** — `[email protected]` (PGP key fingerprint in SECURITY.md)
17+
18+
Use this **public** template only for:
19+
- Questions about our security model or policies
20+
- Hardening suggestions for already-public surfaces
21+
- Public discussion of an *already-disclosed* CVE
22+
23+
If you submit an unpatched vulnerability through this form, we will close the issue without comment and ask you to refile through the private channel.
24+
25+
- type: dropdown
26+
id: kind
27+
attributes:
28+
label: What is this report about?
29+
options:
30+
- Question about our security policy / threat model
31+
- Hardening suggestion for a public surface
32+
- Discussion of an already-disclosed CVE / advisory
33+
- Other (NOT an unpatched vulnerability)
34+
validations:
35+
required: true
36+
37+
- type: textarea
38+
id: summary
39+
attributes:
40+
label: Summary
41+
description: One or two sentences.
42+
validations:
43+
required: true
44+
45+
- type: textarea
46+
id: details
47+
attributes:
48+
label: Details
49+
description: |
50+
Provide the relevant context. If this references a published CVE / advisory, include the identifier and link.
51+
**Do not paste exploit code, PoC steps, or unpatched-vulnerability details here.**
52+
validations:
53+
required: true
54+
55+
- type: input
56+
id: references
57+
attributes:
58+
label: References
59+
description: Public links (CVE, advisory, blog post, prior issue).
60+
placeholder: e.g. CVE-2025-12345, https://github.com/advisories/GHSA-xxxx
61+
62+
- type: checkboxes
63+
id: checks
64+
attributes:
65+
label: Pre-flight checks (required)
66+
options:
67+
- label: This report does NOT contain an unpatched vulnerability or its exploitation details.
68+
required: true
69+
- label: I have read SECURITY.md and confirmed the private channel is the correct path for any sensitive disclosure.
70+
required: true

0 commit comments

Comments
 (0)