Skip to content

README_DEV.adoc

Latest commit

 

History

History
152 lines (105 loc) · 3.48 KB

README_DEV.adoc

File metadata and controls

152 lines (105 loc) · 3.48 KB
Raw

Developper’s Guide

[terminal] Developing VulnScout

Requirements

NVM 22 is required to develop on VulnScout without any issues. Installation guide for NVM : nvm

nvm install 22
nvm use 22

Modify the frontend

By default, the /frontend directory is not mounted in a volume with the container. To visualise frontend modifications, you will need to run VulnScout in development mode. To do so, you can run the following command:

./vulnscout.sh \
--name example \
--spdx .vulnscout/example/spdx2/example.rootfs.spdx.tar.zst \
--dev

[check] Testing the project

We use CQFD to run testing tools in a container.

Quick Setup with CQFD

Step 1: Setup CQFD and Docker

Make sure Docker runs without requiring sudo. To do so, add your user to the docker group:

sudo groupadd docker
sudo usermod -aG docker $USER

Log out and log back in to apply the changes.

  • Install CQFD:

git clone https://github.com/savoirfairelinux/cqfd.git
cd cqfd
sudo make install

For more information, visit the CQFD GitHub repository: https://github.com/savoirfairelinux/cqfd

Step 2: Initialise CQFD for this project

Once installed, initialise the container image:

cqfd init
Note
 This only needs to be done once, unless the container definition (.cqfd/docker/Dockerfile) is modified.

Step 3: Run all the tests with CQFD

To run all tests using CQFD, execute the following command:

cqfd

Also, you can run the tests separately:

cqfd -b test_backend
cqfd -b test_frontend

Testing the Docker image

You can test the Docker image using the provided tests Makefile. To build and test the Docker image, run:

export BUILD_TAG="$(pwgen -n 12 -1)"
make -C tests docker_build docker_test docker_clean

[code] Code quality and linting

Python backend (Flask)

  • Linter: flake8

  • Type checking (from tests/ folder): mypy --config-file tox.ini

  • Unit tests: pytest

  • Coverage (terminal): pytest --cov=src

  • Coverage (HTML): pytest --cov-report html --cov=src

Frontend (React + TypeScript)

  • Dev server: npm run dev

  • Build: npm run build

  • Unit tests: npm run test (uses Jest + Testing Library)

  • Linter: npm run lint (ESLint)

  • Coverage report: npm run coverage

Note
 Running make -C tests test will execute all linters and tests. If pre-commit is installed, flake8 will also run on every commit. With CQFD, use cqfd -b test to run the full suite.

Pre-commit hook

We use pre-commit to automatically run flake8 before every commit.

To enable it:

pip install pre-commit
pre-commit install

This helps enforce code quality and consistency across all contributions.

[rocket] Release Process

VulnScout follows a semantic versioning strategy with development versions between releases.

Version Numbering Strategy

The versioning workflow follows these steps:

  1. Current stable version: v0.9.1 (example - keep for now)

  2. Before creating a release tag: Bump version to v0.10

  3. First PR after release: Bump version to v0.10-dev

  4. Feature PRs: Continue development with -dev suffix

  5. Repeat the cycle