Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs(mojaloop/#3455): update readme #76

Merged
merged 3 commits into from
Aug 29, 2023
Merged

docs(mojaloop/#3455): update readme #76

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
dcbfd24
docs(mojaloop/#3455): update audit section readme. ci: remove sonarcube
oderayi Aug 25, 2023
1e9c5d6
chore: update deps
oderayi Aug 28, 2023
47e028a
chore: update deps
oderayi Aug 29, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 0 additions & 10 deletions .circleci/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -237,16 +237,6 @@ jobs:
destination: test
- store_test_results:
path: coverage
- run:
name: Copy code coverage to SonarQube
command: |
if [ "${CIRCLE_BRANCH}" == "master" ];
then
echo "Sending lcov.info to SonarQube..."
aws s3 cp coverage/lcov.info $AWS_S3_DIR_SONARQUBE/${CIRCLE_PROJECT_REPONAME}/lcov.info
else
echo "Not a release (env CIRCLE_BRANCH != 'master'), skipping sending lcov.info to SonarQube."
fi

vulnerability-check:
executor: default-docker
Expand Down
6 changes: 3 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,12 +84,12 @@ Examples of usage of the SDK can be found in the `src/examples` directory of thi

## Auditing Dependencies

We use `npm-audit-resolver` along with `npm audit` to check dependencies for vulnerabilities, and keep track of resolved dependencies with an `audit-resolv.json` file.
We use `audit-ci` along with `npm audit` to check dependencies for node vulnerabilities, and keep track of resolved dependencies with an `audit-ci.jsonc` file.

To start a new resolution process, run:

```bash
npm run audit:resolve
npm run audit:fix
```

You can then check to see if the CI will pass based on the current dependencies with:
Expand All @@ -98,7 +98,7 @@ You can then check to see if the CI will pass based on the current dependencies
npm run audit:check
```

And commit the changed `audit-resolv.json` to ensure that CircleCI will build correctly.
The [audit-ci.jsonc](./audit-ci.jsonc) contains any audit-exceptions that cannot be fixed to ensure that CircleCI will build correctly.

## Automated Releases

Expand Down
Loading