Code_Improvement Project

Overview

Purpose to improve code quality and security for the Mojaloop project. Includes analysis and introduction of new open sources tools, process improvments, gates checks (w/in pull requests and builds) along with documentation.

Scope: project is focused on quality and security but can lead to other areas such as test automation and DevOps automation and tools.

OutPut (phase one by end of January):

• Implementation and analysis of new OSS tools

• Update Release Scripts: Security aspects need to be embedded in release/devops (CI/CD)

• Update rules for Pull Requests: Security aspects embedded in pull requests (before check-ins)

• Update documentations: Standards and contribution guides Slack Channel:#code_security

Discussions:

Implement changes at the Dockerfile and CI/CD build process to help bolster our container security

• Create a non-root user within the Dockerfile

• Enable docker-content-trust on the docker host (this will be inside CircleCI)

• Run builds with --no-cache during CircleCI step to ensure that we are pulling in any new security patches each time (I don’t think this is a major issue since we don’t have CircleCI docker image caching on anyway

Move from Javascript to Typescript

• Transition to typescript (mix and match js and ts) for more security/quality

• Typescript is preferred but not required: https://github.com/mojaloop/template-typescript-public