Skip to content

Commit c418492

Browse files
authored
Merge pull request #1427 from fl4via/UNDERTOW-2023_README
[UNDERTOW-2023] Update README file, extracting contributing and security
2 parents ce3ca99 + 21f0b14 commit c418492

4 files changed

Lines changed: 234 additions & 41 deletions

File tree

‎CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
@undertow-io/codeowners

‎CONTRIBUTING.md‎

Lines changed: 224 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,224 @@
1+
Contributing Guide
2+
==================
3+
4+
Bug fixes and documentation improvements are welcome! If you want to contribute, I suggest you have a look at our [Jira project](https://issues.redhat.com/projects/UNDERTOW "Undertow Jira") and get in touch with us via [Zulip chat](https://wildfly.zulipchat.com/#narrow/stream/174183-undertow "#undertow").
5+
6+
7+
PRs must be submitted to master branch (soon to be [renamed to main](https://issues.redhat.com/browse/UNDERTOW-2043)) and they should:
8+
- state clearly what they do (see more [here](https://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html))
9+
- point to associated Jira (see more on [link par aa sesscao do Jira])
10+
- contain a test case, unless existing tests already verify the code added by the PR
11+
- have a license header in all new files, with current year’s number
12+
- pass CI (except for known failures, we are working on fixing those, tracked by [UNDERTOW-1523](https://issues.redhat.com/browse/UNDERTOW-1523))
13+
14+
If your PR is incomplete, the reviewer might request you add the missing bits or add them for you if that is simple enough (for
15+
that to be possible, though, you need to check the [Allow edits from maintainers](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork) box)
16+
17+
We expect all contributors and users to follow our [Code of Conduct](CODE_OF_CONDUCT.md) when communicating through project channels. These include, but are not limited to: chat, issues, code.
18+
19+
# Issues
20+
21+
Undertow uses JIRA to manage issues. All issues can be found [here](https://issues.redhat.com/projects/Undertow/issues).
22+
23+
To create a new issue, comment on an existing issue, or assign an issue to yourself, you'll need to first [create a JIRA account](https://issues.redhat.com/).
24+
25+
## Good First Issues
26+
27+
Want to contribute to Undertow but aren't quite sure where to start? Check out our issues with the `good-first-issue` label. These are a triaged set of issues that are great for getting started on our project. These can be found [here](https://issues.redhat.com/issues/?jql=project%20%3D%20Undertow%20%20and%20labels%20in%20(%22good-first-issue%22)).
28+
29+
Once you have selected an issue you would like to work on, make sure it's not already assigned to someone else. To assign an issue to yourself, simply click on "Start Progress". This will automatically assign the issue to you.
30+
31+
## Discussing your Planned Changes
32+
33+
If you want feedback, you can discuss your planned changes in any of the following ways:
34+
* add comments to the issue ticket at [Undertow Jira](https://issues.jboss.org/browse/UNDERTOW)
35+
* Undertow Dev Google Group
36+
* Undertow [Zulip chat](https://wildfly.zulipchat.com/#narrow/stream/174183-undertow "#undertow").
37+
* or simply create a draft PR and poing in the PR description that you would like feedback on the proposal before getting to the
38+
final solution
39+
40+
41+
PR Review Process
42+
--------------------------------------------
43+
44+
PR reviewers will take into account the following aspects when reviewing your PR:
45+
- correctness: the code must be correct
46+
- performance impact: if there are negative performance impacts in the code, careful consideration must be taken whereas the impact could be eliminated and, in case it cannot, if the new code should be accepted
47+
- code style: keep your code style consistent with the classes you are editing, such as variable names, ordering of methods, etc
48+
- scope of the fix: this is a very important factor. Sometimes, the fix should be applied to a broader range of classes, such as a bug that repeats itself in other parts of the code. Other times, the PR solves a bug only partially, because the bug has a broader impact than initially evaluated.
49+
- is the proposed fix the best approach for the Jira at hand?
50+
- backwards compatibility: we must prevent any PR that breaks compatibility with previous versions. If the PR| does so, it could still be okay, but this should be clearly documented it will probably be discussed by the project maintainers before being merged
51+
- security impact: it is critical to evaluate if the PR has any sort of security impact, preventing the addition of exploitable flaws.
52+
53+
Your PR will be classified by the reviewer with one or more of the following labels: **bug fix**, **enhancement**, **new feature/API change**, and **dependency upgrade**.
54+
55+
Besides the classifications labels, a series of labels are going to be added to your PR while it is under review. This is the full list of labels and what they mean:
56+
- **waiting CI check** PR is ready to be merged, but we are waiting for CI results. The use of this label is optional.
57+
- **waiting PR update** reviewer has requested changes to the PR
58+
- **failed CI** a new failure was introduced to CI
59+
- **question** reviewer has asked one or more questions to the contributor, so the PR can be better assessed
60+
- **under verification** reviewer will perform some extra verifications before giving their feedback (usually this means running reproducers, reviewing specs, and the like)
61+
- **waiting peer review** PR has been reviewed but is waiting on a second review before being merged (as the changes affects core classes or adds a new feature)
62+
- **next release** PR is in the payload of the next release based on master branch
63+
- **maintenance branch** this tag is used for PRs submitted to maintenance branches only, and is included here just for completeness. Maintainers will take care of backporting
64+
submittted fixes to the maintenance branches when needed
65+
66+
#GitHub Quickstart
67+
68+
If this is your first time contributing to a GitHub project, you can follow the next steps to get up to speed when contributing to
69+
Undertow. Regardless of your level of experience, though, we kindly ask you that PRs are always rebased before being submitted or
70+
updated.
71+
72+
## One time setup
73+
74+
### Create a GitHub account
75+
76+
If you don't have one already, head to https://github.com/
77+
78+
### Fork Undertow
79+
80+
Fork https://github.com/undertow-io/undertow into your GitHub account.
81+
82+
### Clone your newly forked repository onto your local machine
83+
84+
```bash
85+
git clone git@github.com:[your username]/undertow.git
86+
cd console
87+
```
88+
89+
### Add a remote reference to upstream
90+
91+
This makes it easy to pull down changes in the project over time
92+
93+
```bash
94+
git remote add upstream git://github.com/undertow-io/undertow.git
95+
```
96+
97+
## Development Process
98+
99+
This is the typical process you would follow to submit any changes to Undertow.
100+
101+
### Pulling updates from upstream
102+
103+
```bash
104+
git pull --rebase upstream main
105+
```
106+
107+
> Note that --rebase will automatically move your local commits, if you have
108+
> any, on top of the latest branch you pull from.
109+
> If you don't have any commits it is safe to leave off, but for safety it
110+
> doesn't hurt to use it each time just in case you have a commit you've
111+
> forgotten about!
112+
113+
### Create a simple topic branch to isolate your work (recommended)
114+
115+
```bash
116+
git checkout -b my_cool_feature
117+
```
118+
119+
If you have a Jira number for the fix, having the Jira name in the branch is very useful to keep track of your changes:
120+
121+
```bash
122+
git checkout -b UNDERTOW-XXXX
123+
```
124+
or
125+
```bash
126+
git checkout -b UNDERTOW-XXXX-my_cool_feature
127+
```
128+
129+
130+
### Make the changes
131+
132+
Make whatever code changes, including new tests to verify your change, and make sure the project builds without errors:
133+
134+
```bash
135+
mvn clean verify
136+
```
137+
138+
> If you're making non code changes, the above step is not required.
139+
140+
### Commit changes
141+
142+
Add whichever files were changed into 'staging' before performing a commit:
143+
144+
```bash
145+
git commit -v
146+
```
147+
The `-v` parameter is advisable if you want to check when writing the commit message all the changes that are included in your
148+
commit.
149+
150+
### Rebase changes against master
151+
152+
Once all your commits for the issue have been made against your local topic branch, we need to rebase it against branch master in upstream to ensure that your commits are added on top of the current state of master. This will make it easier to incorporate your changes into the master branch, especially if there has been any significant time passed since you rebased at the beginning.
153+
154+
```bash
155+
git pull --rebase upstream master
156+
```
157+
158+
### Push to your repo
159+
160+
Now that you've sync'd your topic branch with upstream, it's time to push it to your GitHub repo.
161+
162+
```bash
163+
git push origin UNDERTOW-XXXX-my_cool_feature
164+
```
165+
166+
### Getting your changes merged into upstream, a pull request
167+
168+
Now your updates are in your GitHub repo, you will need to notify the project that you have code/docs for inclusion.
169+
170+
* Send a pull request, by clicking the pull request link while in your repository fork
171+
* After review a maintainer will merge your pull request, update/resolve associated issues, and reply when complete
172+
* Lastly, switch back to branch master from your topic branch and pull the updates
173+
174+
```bash
175+
git checkout master
176+
git pull upstream master
177+
```
178+
179+
* You may also choose to update your origin on GitHub as well
180+
181+
```bash
182+
git push origin
183+
```
184+
185+
#### Updating a PR
186+
187+
After you get feedback from reviewers and the community, you might need to update your PR before it is merged.
188+
If the original commit is too big, you can do an incremental, new commit, to facilitate review of the changes in the PR.
189+
190+
However, if you want to edit your previous commit, you can easily do so by amending it:
191+
192+
193+
```bash
194+
git commit --amend -v
195+
```
196+
197+
Don't forget to add the changes you want incorporated to your commit before amending it.
198+
199+
If your PR contains more than one commit and you need to edit a commit that is not the latest, it cannot be amended as above,
200+
but you can use the interactive magic rebase. The command below allows you to amend, merge, delete or simply reword the latest
201+
X commits in the current branch (replace X by the correct number for your case):
202+
203+
```bash
204+
git rebase -i HEAD~X
205+
```
206+
207+
Then just follow the instructions to indicate the changes you need to do.
208+
209+
It is a good practice to create a backup of your original branch in case you end up doing a mistake. That way, you can just
210+
reload your original fix (the GitHub remote origin account containing the PR can serve this purpose, as long as you don't
211+
overwrite it with a broken branch).
212+
213+
Once you are satisfied if your commits, run the tests again with `mvn clean verify`. Finally, check the changes your are going
214+
to push to origin are really okay with:
215+
216+
```bash
217+
git log -p
218+
```
219+
220+
Only then, you can push it to origin. If you edited a commit that was already in the PR, you will need to force the push with `-f`:
221+
222+
```bash
223+
git push origin --foce UNDERTOW-XXXX-my_cool_feature
224+
```

‎README.md‎

Lines changed: 1 addition & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Undertow
33
Undertow is a Java web server based on non-blocking IO. It consists of a few different parts:
44

55
- A core HTTP server that supports both blocking and non-blocking IO
6-
- A Servlet 4.0/5.0 implementation
6+
- A Servlet 4.0/5.0/6.0 implementation
77
- A JSR-356/Jakarta 2.0 compliant Web Socket implementation
88

99
Website: http://undertow.io
@@ -17,40 +17,6 @@ Undertow Dev Group: https://groups.google.com/g/undertow-dev/
1717

1818
Zulip Chat: https://wildfly.zulipchat.com stream [#undertow](https://wildfly.zulipchat.com/#narrow/stream/174183-undertow)
1919

20-
Contributing to Undertow - PR Review Process
21-
--------------------------------------------
22-
23-
Bug fixes and documentation improvements are welcome! If you want to contribute and are not sure where to start, I suggest you have a look at our [Jira project](https://issues.redhat.com/projects/UNDERTOW "Undertow Jira") and get in touch with us via [Zulip chat](https://wildfly.zulipchat.com/#narrow/stream/174183-undertow "#undertow").
24-
25-
PRs must be submitted to master branch (soon to be [renamed to main](https://issues.redhat.com/browse/UNDERTOW-2043)) and they should:
26-
- state clearly what they do
27-
- point to associated Jira
28-
- contain a test case, unless existing tests already verify the code added by the PR
29-
- have a license header in all new files, with current year’s number
30-
- pass CI (except for known failures, we are working on fixing those, tracked by [UNDERTOW-1523](https://issues.redhat.com/browse/UNDERTOW-1523))
31-
32-
If your PR is incomplete, the reviewer might request you add the missing bits or add them for you if that is simple enough.
33-
34-
PR reviewers will take into account the following aspects when reviewing your PR:
35-
- correctness: the code must be correct
36-
- performance impact: if there are negative performance impacts in the code, careful consideration must be taken whereas the impact could be eliminated and, in case it cannot, if the new code should be accepted
37-
- code style: keep your code style consistent with the classes you are editing, such as variable names, ordering of methods, etc
38-
- scope of the fix: this is a very important factor. Sometimes, the fix should be applied to a broader range of classes, such as a bug that repeats itself in other parts of the code. Other times, the PR solves a bug only partially, because the bug has a broader impact than initially evaluated.
39-
- is the proposed fix the best approach for the Jira at hand?
40-
- backwards compatibility: we must prevent any PR that breaks compatibility with previous versions
41-
- security impact: it is critical to evaluate if the PR has any sort of security impact, preventing the addition of exploitable flaws.
42-
43-
Your PR will be classified by the reviewer with one or more of the following labels: **bug fix**, **enhancement**, **new feature/API change**, and **dependency upgrade**.
44-
45-
Besides the classifications labels, a series of labels are going to be added to your PR while it is under review. This is the full list of labels and what they mean:
46-
- **waiting CI check** PR is ready to be merged, but we are waiting for CI results. The use of this label is optional.
47-
- **waiting PR update** reviewer has requested changes to the PR
48-
- **failed CI** a new failure was introduced to CI
49-
- **question** reviewer has asked one or more questions to the contributor, so the PR can be better assessed
50-
- **under verification** reviewer will perform some extra verifications before giving their feedback (usually this means running reproducers, reviewing specs, and the like)
51-
- **waiting peer review** PR has been reviewed but is waiting on a second review before being merged (as the changes affects core classes or adds a new feature)
52-
- **next release** PR is in the payload of the next release
53-
5420
Notifying Security Relevant Bugs
5521
--------------------------------
5622

‎SECURITY.md‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,14 @@
55
The following versions of Undertow are supported with security updates:
66

77
| Version | Supported |
8-
| ------- | ------------------ |
9-
| < 2.0 | :x: |
10-
| 2.0.x | :white_check_mark: |
11-
| 2.1.x | :x: |
12-
| > 2.2.x | :white_check_mark: |
8+
|---------|--------------------|
9+
| < 2.2.x | :x: |
10+
| 2.2.x | :white_check_mark: |
11+
| 2.3.x | :white_check_mark: |
12+
1313

1414
## Reporting a Vulnerability
1515

16-
If you find a vulnerability, send an email to secalert@redhat.com. To expedite things, you can copy Flavia Rainone (frainone@redhat.com).
16+
If you find a vulnerability, please send an email to secalert@redhat.com. To expedite things, you can copy Flavia Rainone (frainone@redhat.com).
17+
This will ensure the bug is properly handled without causing unnecessary negative impacts for the Undertow's user base.
18+
You can find more information about the security procedures at [this page](https://access.redhat.com/security/team/contact "Security Contacts and Procedures").

0 commit comments

Comments
 (0)