feat: add OpenSSF badge to current footer #6030
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
github-actions
bot
removed
the
github_actions:pull-request
Unit Test Coverage Report
Unit Test Report
|
|
Why is it distasteful? |
Alternatives considered:
FWIW, I've never seen a badge NOT on a repository's README, but that decision has already been made. I'm happy to adjust however we see fit but suspect there is not concensus or one singular perfect solution. If we don't value removing this roadblock for nodejs/security-wg#956 we can close. #6031 is the permanent solution |
|
I know that it serves a purpose of passing the gold level openssf, but other than passing to the gold level,"openssf best practices: passing" doesn't provide a useful insight to a random website visitor.
Because:
Is there a specific reason for adding this to all pages of nodejs.org compared to a single page? It seems this is a badge that should be included in security page, since it is a security related badge. The best practices requirements state that: As far as I can see, it doesn't state that we need to put this to every single page. |
|
I stand with Yagiz here. This badge has absolute no meaning or value for your average visitor and even Node.js end-user. Maybe even collaborator. It feels right to be either at the README or at the Security page, now that there's a PR open to add a security page. |
|
I agree with all that, which is why it belongs on the repo readme, but the security page is fine too. It'd just be nice to not have to wait for the redesign. |
|
Right. But afaik if we only add on the readme we don't get certification. To be frank, I find these requirements from OpenSSF quite nonsensical. I hate when other organisations impose a badge on us to gain X, or at lest they should allow us to decide where to put it. Anyhow, sorry for my ramble. If we can wait for the other PR I mentioned to get merged, then we can move this badge to the security page of the website. Even tho that badge completely does not match anything on the website and feels misplaced. |
|
@ovflowd that's incorrect; "only the readme" is completely sufficient for gold status, and is the preferred location. |
I was told that it needed to be the nodejs/node readme and the node.js website readme wasn't allowed. There was a whole debacle about that. I might be wrong, my memory fails me daily 🫠 |
|
oh, well yeah when i say "readme" i mean "in the project repo it's describing", websites don't have a readme in a colloquial sense :-) putting it in the website repo's readme wouldn't make sense for a project that's not "the website". |
Well, I am not the one who decides what goes to the nodejs readme. Yet often websites readme's are also a touchpoint to the project. What I meant is that displaying a badge is ridiculous as a requirement. At least for me, an ignorant one (as I have little to no knowledge about anything OpenSSF). How could a badge grant "golden" security status? 😅 |
|
(Sorry for going offtopic btw) |
|
Fair question, but I'm assuming it's about providing transparency so that users can validate security practices if they want. |
If that's the goal, the badge should imo be accompanied with a text paragraph. As Yagiz mentioned, most of people visiting the website wouldnt know what OpenSSF stands for (or even is), even if they are curious about our security standards. Now, if we accompany the badge with a paragraph mentioning if one's want to get to know about some of our practices to then click the badge, that makes way much more sense for me. |
No there is no requirement, but there also is no security page. This is a stop-gap for the next couple months.
? Mock up of the footer with a paragraph explainer before the badge. Text borrowed from https://www.bestpractices.dev/en 
The footer seems like the perfect place to me. Casual users won't look at any of its content. If folks have other ideas, I can close this PR or hear direct suggestions. My goal was always to do something quick and unblocking, knowing that a new solution is coming. Perhaps my urgency is misplaced. |
|
closing - i see #6028 now that will have a security page |
Description
Adds the OpenSSF best practices badge to the current site's footer. This is a stop-gap measure while the new site is being designed - but furthers efforts from the @nodejs/security working group started within nodejs/security-wg#859
Validation
https://nodejs-xhjbbt8kf-openjs.vercel.app/en
Related Issues
closes #5432
Check List
npx turbo lintto ensure the code follows the style guide. And runnpx turbo lint:fixto fix the style errors if necessary.npx turbo formatto ensure the code follows the style guide.npx turbo testto check if all tests are passing.