Merge pull request #987 from equinor/repo-info

Update repo information

CONTRIBUTING.md

@@ -0,0 +1,37 @@
+# How to contribute to this repo
+
+We love your input! We want to make contributing to this project as easy and transparent as possible, whether it's:
+
+- Reporting a bug
+- Proposing new features
+- Discussing the current state of the code
+- Submitting a fix
+
+This is how you should do it:
+
+Use our [issue list](../../issues) to report a **bug** or **propose a new feature**, including
+
+### For **bug report**  
+- A quick summary and/or background
+- Steps to reproduce
+   - Be specific!
+   - Give sample code if you can
+- What you expected would happen
+- What actually happens
+
+The team love thorough bug reports - no it's not a joke!
+
+### For **feature request**  
+- Brief description of the feature
+- What problem/issue will this solve
+- A sort of Definition of Done - "How should it look when finsihed"
+
+### When submitting a fix using a Pull Request (PR)  
+
+- Fork this repository from GitHub  
+- Once, you have a local copy (after forking) you can make edits to the code, make formatting changes, reorganise the code, add documentation etc …  
+- After you have made the changes, you have to create a pull request  
+
+We will review the pull request and if it appropriate and there are no clashes or vulnerabilities, it will be merged to the main code  
+
+Voila! you have contributed to a piece of software and the cycle repeats.

README.md

@@ -1,3 +1,4 @@
+[![Build Status](https://github.com/equinor/radix-operator/workflows/radix-operator-build/badge.svg)](https://github.com/equinor/radix-operator/actions?query=workflow%3Aradix-operator-build)
 # radix-operator
 
 The radix-operator is the central piece of the [Radix platform](https://github.com/equinor/radix-platform) which fully manages the Radix platform natively on [Kubernetes](https://kubernetes.io/). It manages seven [custom resource definitions](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/):
@@ -14,8 +15,6 @@ The `radix-operator` and `radix-pipeline` are built using Github actions, then t
 
 There are [secrets](https://github.com/equinor/radix-operator/settings/secrets) defined for the actions to be able to push to radixdev and radixprod. These are the corresponding credentials for radix-cr-cicd-dev and radix-cr-cicd-prod service accounts.
 
-[![Build Status](https://github.com/equinor/radix-operator/workflows/radix-operator-build/badge.svg)](https://github.com/equinor/radix-operator/actions?query=workflow%3Aradix-operator-build)
-
 ## Developer information
 
 ### Development Process
@@ -30,6 +29,8 @@ The `radix-pipeline` never gets deployed to cluster, but rather is invoked by th
 - `master` branch should be used for creating the image used in the `qa` environment of any cluster. When a pull request is approved and merged to `master`, Github actions build will create a will create a `radix-pipeline:master-latest` image available in ACR of the subscription
 - `release` branch should be used for image used in the `prod` environment of any cluster. When a pull request is approved and merged to `master`, and tested ok in `qa` environment of any cluster, we should immediately merge `master` into `release` and build image used in the `prod` environment of any cluster, unless there are breaking changes which needs to be coordinated with release of our other components. When the `master` branch is merged to the `release` branch, Github actions build will create a `radix-pipeline:release-latest` image available in ACR of the subscription.
 
+Want to contribute? Read our [contributing guidelines](./CONTRIBUTING.md)
+
 ### Dependencies management
 
 As of 2019-10-28, radix-operator uses go modules. See [Using go modules](https://blog.golang.org/using-go-modules) for more information and guidelines.

SECURITY.md

@@ -0,0 +1,18 @@
+# Security
+
+If you discover a security vulnerability in this project, please follow these steps to responsibly disclose it:
+
+1. **Do not** create a public GitHub issue for the vulnerability.
+2. Follow our guideline for Responsible Disclosure Policy at [https://www.equinor.com/about-us/csirt](https://www.equinor.com/about-us/csirt) to report the issue
+
+The following information will help us triage your report more quickly:
+
+- Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
+- Full paths of source file(s) related to the manifestation of the issue
+- The location of the affected source code (tag/branch/commit or direct URL)
+- Any special configuration required to reproduce the issue
+- Step-by-step instructions to reproduce the issue
+- Proof-of-concept or exploit code (if possible)
+- Impact of the issue, including how an attacker might exploit the issue
+
+We prefer all communications to be in English.