[R24.08] Quality Gate Checklist

[tom-rm-meyer-ISST]

QG checks

Please open and fill in this issue in your product repository to document the compliance with our Tractus-X Release Guideline (TRGs)

Show compliance with TRGs by referencing to a tagged link in the respective repository where possible, example: TRG 1.01 (see github.com/eclipse-tractusx/example-repo/tree/1.0.0/README.md)

Close this issue once the compliance with the TRGs has been documented

Committer(s): @tom-rm-meyer-ISST
Helm Chart Version: 2.7.0
App Version: 2.1.0

Release Management Reference Issue: eclipse-tractusx/sig-release#795

Check of Tractus-X Release Guidelines

• Currently implemented automatic checks can be found under your product on our Release Guidelines Checks Board
• This QG Check is depending on the mandatory information from our current Release Guidelines

TRG 1 Documentation

• TRG 1.01 appropriate README.md (see here)
• TRG 1.02 appropriate install instructions either INSTALL.md or in README.md (see INSTALL.md and Chart README.md)
• TRG 1.03 appropriate CHANGELOG.md (see here)
• TRG 1.04 editable static files (see here)
• TRG 1.05 architecture documentation (see here)
• TRG 1.06 administrator's guide (see here)
• TRG 1.07 user guide available (see README.md and userGuide)
• TRG 1.08 open api documentation available (see README.md)

TRG 2 Git

• TRG 2.01 default branch is named main (see here)
• TRG 2.03 repository structure (see quality gate action run)
• TRG 2.04 leading product repository (see here but only this repo)
• TRG 2.05 .tractusx metafile in a proper format (see here)
• TRG 2.06 Dependabot (see here)

TRG 3 Kubernetes

• TRG 3.02 persistent volume and persistent volume claim or database dependency (subchart) are in place when needed (see chart of dependency postgresql)

TRG 4 Container

• TRG 4.01 semantic versioning and tagging (see frontend, backend)
• TRG 4.02 base image is agreed (see frontend, backend)
• TRG 4.03 image has USER command and Non Root Container (see frontend, backend)
• TRG 4.05 released image must be placed in DockerHub, remove GHCR references (see frontend, backend)
• TRG 4.06 separate notice file for DockerHub has all necessary information (see frontend, backend)
• TRG 4.07 root file system is set to read access by default, but can be overwritten by the user (see frontend, backend)
• TRG 4.08 multi platform builds (see frontend, backend)

TRG 5 Helm

• TRG 5.01 Helm chart requirements (see here)
• TRG 5.02 Helm chart location in /charts directory and correct structure (see quality gate action run)
• TRG 5.03 proper version strategy (see here)
• TRG 5.04 CPU / MEM resource requests and limits and are properly set (see frontend, backend)
• TRG 5.06 Application must be configurable through the Helm chart (see here)
• TRG 5.07 Dependencies are present and properly configured in the Chart.yaml (see dependency, config)
• TRG 5.08 Product has a single deployable helm chart that contains all components (see here)
• TRG 5.09 Helm Test running properly (see here)
• TRG 5.10 Products need to support 3 versions at a time (see v1.28.9, v1.29.4, v1.30.0)
• TRG 5.11 Upgradeability (see here)

TRG 6 Released Helm Chart

• TRG 6.01 Released Helm Chart (see here)

TRG 7 Open Source Governance

• TRG 7.01 Legal Documentation (see here)
• TRG 7.02 License and copyright header (see updated)
• TRG 7.03 IP checks for project content (see here)
• TRG 7.04 IP checks for 3rd party content (see DEPENDENCIES_BACKEND, DEPENDENCIES_FRONTEND)
• TRG 7.05 Legal information for distributions (see frontend, backend)
• TRG 7.06 Legal information for end user content (see here)
• TRG 7.07 Legal notice for documentation (see here, here, all docs)
• TRG 7.08 Legal notice for KIT documentation (see as above / not a kit but non_code parts)

TRG 8 Security

• TRG 8.01 Mitigate high and above findings in CodeQL (see here)
• TRG 8.02 Mitigate high and above findings in KICS (see here)
• TRG 8.04 Mitigate high and above findings in Trivy (see here)
• TRG 8.03 No secret findings by GitGuardian or TruffleHog (see here)

TRG UX/UI Styleguide

• TRG 9.01 UX consistency / Styleguide for UI (see Changelog with Known Knowns)

Hints

Information Sharing

[tom-rm-meyer-ISST]

Done