...
- All gerrit code submissions to include at least 1 Jira issue. This is for tracking purposes. This creates a Link between gerrit submissions and Jira issues. git-review add the "Issue-ID: JIRA"
- License scans are not done until one or two weeks prior to a release. We require more time. LF does not scan SCP repos. That leaves those repos open. LF does have a tool called nexus iq. People have been using that to do license scans. Because of the language the security vulnerability may not be helpful for Java but for Go C++ is not as helpful. Requesting all the repos to add this nexus iq job. Action item for repo owners is to define a job. There are samples available for you to follow.Xiaohua Zhang check the sample and create the JJB to check the license. : O-RAN Developer's Guide to CI Resources and Processes at the LF#ConfigureProjectforNexusIQ(CLM)Analysis
- Adopting semantic versioning for the artifacts (libraries and docker images and use it for the artifacts). The action item is for the developers and contributors in the future please use major, minor, and patch versioning. We can write some best practices in the future but this is the format. Another action item is what will be the best way to verify a version.
...