Comments (8)
- Kevin mentioned branch protection in the last meeting.
from abi-stable-node.
node-addon-api (scorecard)
- Branch-Protection
- Add branch protection on
main
(For GitHub, check out the steps here.) - Delete unused branches
v2.x-staging
,v1.x-staging
- Add branch protection on
- Code-Review
- Make "code reviews" mandatory in your repository configuration. (Instructions for GitHub.)
- Enforce the rule for administrators / code owners as well. (Instructions for GitHub.)
- Add fuzzing...? (scorecard criteria, nodejs example)
node-addon-examples (scorecard)
- Add branch protection on
main
- Add LICENSE file
- Make code reviews mandatory (as well as for administrators)
- Make GitHub Actions CI workflow tokens read-only
- Add CodeQL scanning similar to
node-addon-api
...? - Add fuzzing...?
from abi-stable-node.
Add branch protection for both node-addon-api and node-addon-examples.
from abi-stable-node.
PR to add boilerplate files to node-addon-examples - nodejs/node-addon-examples#213
from abi-stable-node.
@KevinEady can you expand a bit on Make GitHub Actions CI workflow tokens read-only
from abi-stable-node.
PR to add best practices to node-addon-api - nodejs/node-addon-examples#214
from abi-stable-node.
Hi @mhdawson,
... can you expand a bit on
Make GitHub Actions CI workflow tokens read-only
From Assigning permissions to jobs - GitHub Docs:
You can use
permissions
to modify the default permissions granted to the GITHUB_TOKEN, adding or removing access as required, so that you only allow the minimum required access.
This is for the principle of least privilege, as discussed in the Token-Permissions Check documentation.
This was mostly addressed by the SecurityBot PR nodejs/node-addon-examples#214 , eg: nodejs/node-addon-examples@a05f82c#diff-e98936aa52a6dd7416e4296e9628456227d834f7245967383fd9ff80fd985dadR9-R11 but it skipped a workflow that I added to the PR in this commit.
So once this PR is merged, we can say that the Token-Permissions issue has been addressed and we will receive full points.
from abi-stable-node.
@KevinEady I think I merged the PR you mentioned, so we should be able to close this now?
from abi-stable-node.
Related Issues (20)
- Blog post about transition to Node-API HOT 4
- Discuss https://github.com/nodejs/node-addon-api/pull/902 HOT 1
- Thread safety of napi_threadsafe_function
- Ask for review of node-serialport Node-API port - https://github.com/serialport/node-serialport/pull/2305/files HOT 2
- Drive towards full coverage HOT 5
- Discuss Node-API addition https://github.com/nodejs/node/pull/41329#issuecomment-1015667899 HOT 1
- Regular hang in Running test 'typed_threadsafe_function/typed_threadsafe_function_sum' HOT 1
- Node-API v9 HOT 7
- Better coverage of node-api in Youtube HOT 13
- Node-API add-on build HOT 4
- Add list of non C language bindings to Node.js doc HOT 10
- Document how to check for memory leaks in addon/default leak. HOT 4
- Electron 21 breaks api compatability with some modules HOT 9
- Get contacts for each of the runtimes supporting Node-API HOT 8
- What's new in the Node-API and node-addon-api world? - 2023 version HOT 20
- Can references be shared between different modules/envs? HOT 3
- Consider changing the license for examples to MIT HOT 2
- Tracking issues for V8 changes needed HOT 1
- Help with node-sqlite3 performance HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from abi-stable-node.