Repository navigation
Initiative for CII-Best-Practices for Nodejs Projects #953
Description
As commented in #884 seems like there is an interest to explore this idea.
Context
I discovered that we already completed the process for Nodejs, last update at 2016-05-19.
I believe we can review the current status and check if we need to update some of the answers. Also it might be quite interesting to see if we can achieve Silver or Gold level.
More information in OpenSSF Best Practices Badge Program
Next steps
- @UlisesGascon will create separe PRs to include the current Questions/answers for each level so we can brainstorm changes easily and then ask to update the project in the registry
- Update the OpenSSF Best practices once the discussion is completed and the feedback is consolidated
Activity
UlisesGascon commentedon May 12, 2023
@rvagg can you add me to the https://bestpractices.coreinfrastructure.org/en/projects/29? We will need to make some changes soon in order to merge #954
rvagg commentedon Jun 22, 2023
Sorry @UlisesGascon, this one fell off my notification list in my general cull of incoming notifications, only an email from @mhdawson pointed me to it.
This is a lifetime ago, so it's something expunged from my memory, I clicked through to the page wondering why I was being pinged about it .. but my name's on it! Project #29 in CII Best Practices, I remember now when that thing started and thinking it was a good idea .. early adopters!
I actually can't find any place where I can "add" or even transfer the thing, it looks like it's just me. I guess we could email and ask them to transfer it to someone else? Or if you want to list items that you want to edit in this thread I could go and do them. Lots of stuff to fill out for Silver and Gold but if you want to tell me which ones to tick I could go and do that.
UlisesGascon commentedon Jun 23, 2023
Thanks @rvagg for the update, seems like we are early adopters 😃
I was not able to find it as well, so I guest this feature is not yet implement. Can you help us to update the records for the entry level form? In the PR #954 we discussed about what should be included. By comparing the first and the last commit https://github.com/nodejs/security-wg/compare/84945b0..1eeb152 it will be easier to visualize what has change from the current responses.
If you prefer me to do it, you can share your credentials with us (if you are using user/pass login) in the private repository 👍
We are working now in the Silver questionary in #955
rvagg commentedon Jun 23, 2023
GitHub login unfortunately!
Next problem is that their form doesn't work! I can edit "passing" and "gold" but not "silver", when I go to the edit link (https://bestpractices.coreinfrastructure.org/en/projects/29/edit?criteria_level=1) it redirects back to https://bestpractices.coreinfrastructure.org/en.
I'll email them and also see if I can convert the login to user/pass or add people to it, or something.
rvagg commentedon Jun 23, 2023
Opened ossf/best-practices-badge#1983 about the edit problem, emailed them about the login setup.
rvagg commentedon Jun 23, 2023
... and ossf/best-practices-badge#1984 about email problems
rvagg commentedon Jun 28, 2023
Passingcriteria all updated to match the diff now.Silverediting got fixed so I should be able to do that too when needed.mhdawson commentedon Jun 28, 2023
@rvagg thanks for opening those issues. Does it make sense to open an issue asking how we transfer ownership so that you don't need to be in the loop?
rvagg commentedon Jun 29, 2023
I asked via email, no response yet.
mhdawson commentedon Jun 29, 2023
k thanks.
UlisesGascon commentedon Aug 21, 2023
Hi @rvagg! Good news! The silver responses are ready in b93ef8e. Can you help us to add them in the website?
rvagg commentedon Aug 22, 2023
I've done the updates, but as I noted in the commit all of the entries require justification - text and/or a URL, I stopped commenting in the commit because there's so many without. Even the N/A ones want justification. But I found I could submit without filling those out, even though they said "Required", but now on the page you should see lots of
Warning: Requires lengthier justification.31 remaining items
github-actions commentedon Feb 4, 2025
This issue has been inactive for 90 days. It will be closed in 14 days unless there is further activity or the stale label is taken off.
github-actions commentedon May 6, 2025
This issue has been inactive for 90 days. It will be closed in 14 days unless there is further activity or the stale label is taken off.
github-actions commentedon Aug 5, 2025
This issue has been inactive for 90 days. It will be closed in 14 days unless there is further activity or the stale label is taken off.
david-a-wheeler commentedon Aug 5, 2025
You absolutely can create a nodejs-tsc account on https://www.bestpractices.dev/ and then have @rvagg transfer ownership over to that user. You can also add other users as editors.