From 0c8c33eefcd63c5ac5fbfa60dbdcf450c6114604 Mon Sep 17 00:00:00 2001 From: cruddasj Date: Wed, 27 Aug 2025 15:06:46 +0100 Subject: [PATCH 1/3] Merge up latest updates to main (#24) * IA-473 Documentation - contributors (#13) IA-473 - Documentation - contributors * chore(deps): bump the python-packages group across 1 directory with 4 updates (#14) * IA-509: Formalise Docs (#15) * IA-509: Formalise Docs * update changelog * Update CONTRIBUTING.md * commiit * Update MAINTAINERS.md * Update CHANGELOG.md --------- Co-authored-by: Conaill4 Co-authored-by: Conaill O Neill <85241039+Conaill4@users.noreply.github.com> * IA-524: Add markdown templates for bug report reports, feature requests and pull requests (#16) Co-authored-by: peter.rooke * feature(OSPO): add inner-source licensing materials (#23) --------- Co-authored-by: athomas-kainos Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Harrison Duffield <46687573+HarrisonDuffield@users.noreply.github.com> Co-authored-by: Conaill4 Co-authored-by: Conaill O Neill <85241039+Conaill4@users.noreply.github.com> Co-authored-by: Peter Rooke Co-authored-by: peter.rooke --- .github/ISSUE_TEMPLATE/bug_report.md | 32 ++ .github/ISSUE_TEMPLATE/feature_request.md | 21 ++ .github/pull_request_template.md | 32 ++ .github/workflows/oss-checker.yml | 124 ++++++++ .github/workflows/publish-github-release.yml | 117 ++++++++ ACKNOWLEDGEMENTS.md | 30 ++ CHANGELOG.md | 89 +++--- CODE_OF_CONDUCT.md | 81 +++++ CONTRIBUTING.md | 123 ++++++++ LICENSE.md | 297 ++++++------------- MAINTAINERS.md | 66 ++--- NOTICE | 4 - README.md | 60 +++- SECURITY.md | 73 +++++ pyproject.toml | 8 +- 15 files changed, 860 insertions(+), 297 deletions(-) create mode 100644 .github/ISSUE_TEMPLATE/bug_report.md create mode 100644 .github/ISSUE_TEMPLATE/feature_request.md create mode 100644 .github/pull_request_template.md create mode 100644 .github/workflows/oss-checker.yml create mode 100644 .github/workflows/publish-github-release.yml create mode 100644 ACKNOWLEDGEMENTS.md create mode 100644 CODE_OF_CONDUCT.md create mode 100644 CONTRIBUTING.md delete mode 100644 NOTICE create mode 100644 SECURITY.md diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 0000000..e0a7150 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -0,0 +1,32 @@ +--- + +name: Bug report +about: Create a report to help us improve +title: '' +labels: '' +assignees: '' + +--- + +**Describe the bug** +A clear and concise description of what the bug is. + +**To Reproduce** +Steps to reproduce the behavior: +1. Run '...' +2. Observe on '....' +3. See error/exception (etc) + +**Expected behavior** +A clear and concise description of what you expected to happen. + +**Screenshots** +If applicable, add screenshots to help explain your problem. + +**System (please complete the following information):** +- Container [e.g. docker image] +- OS: [e.g. Ubuntu] +- Version [e.g. 20.04.3] + +**Additional context** +Add any other context about the problem here. diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md new file mode 100644 index 0000000..549a887 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -0,0 +1,21 @@ +--- + +name: Feature request +about: Suggest an idea for this project +title: '' +labels: '' +assignees: '' + +--- + +**Is your feature request related to a problem? Please describe.** +A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] + +**Describe the solution you'd like** +A clear and concise description of what you want to happen. + +**Describe alternatives you've considered** +A clear and concise description of any alternative solutions or features you've considered. + +**Additional context** +Add any other context or screenshots about the feature request here. diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 0000000..68ec382 --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,32 @@ +## Sensitive Credential Checks + +- [ ] As the author of these changes, I have checked for any sensitive credentials prior to this review being requested. +- [ ] As a reviewer of these changes, I have checked for any sensitive credentials prior to approving this merge. + + + +## Motivation and Context + + + + +## Description + +- Describe your changes in detail + +## How Has This Been Tested? + + + + + +## Screenshots (if appropriate): + +## Checklist: + + + +- [ ] It contains only changes required by issue (does not contain other PR) +- [ ] Includes link to an issue (if apply) +- [ ] I have added tests to cover my changes. + diff --git a/.github/workflows/oss-checker.yml b/.github/workflows/oss-checker.yml new file mode 100644 index 0000000..2bf4025 --- /dev/null +++ b/.github/workflows/oss-checker.yml @@ -0,0 +1,124 @@ +# SPDX-License-Identifier: Apache-2.0 +# © Crown Copyright 2025. This work has been developed by the National Digital Twin Programme and is legally attributed to the Department for Business and Trade (UK) as the governing entity. + +name: Run OSS check helper + +on: + workflow_dispatch: + +jobs: + oss-checks: + runs-on: ubuntu-latest + + steps: + - name: Fetch GitHub App token for target repo + id: target_token + uses: actions/create-github-app-token@v2 + with: + app-id: ${{ secrets.OSPO_WORKFLOW_APP_ID }} + private-key: ${{ secrets.OSPO_WORKFLOW_PRIVATE_KEY }} + permission-contents: read + + - name: Fetch GitHub App token for OSPO source repo (read-only) + id: ospo_token + uses: actions/create-github-app-token@v2 + with: + app-id: ${{ secrets.OSPO_WORKFLOW_APP_ID }} + private-key: ${{ secrets.OSPO_WORKFLOW_PRIVATE_KEY }} + owner: National-Digital-Twin + repositories: ospo-resources + permission-contents: read + + - name: Checkout target repository + uses: actions/checkout@v4 + with: + token: ${{ steps.target_token.outputs.token }} + + - name: Checkout OSPO source repository + uses: actions/checkout@v4 + with: + repository: National-Digital-Twin/ospo-resources + path: ospo-resources + token: ${{ steps.ospo_token.outputs.token }} + + - name: Checkout archetypes source repository + uses: actions/checkout@v4 + with: + repository: National-Digital-Twin/archetypes + path: archetypes + + - name: Test for presence of OSS files and variation from templated content + run: | + missing_files=() + unchanged_files=() + + while IFS= read -r file || [ -n "$file" ]; do + # Skip comments and empty lines + if [[ -z "$file" || "$file" == \#* ]]; then + continue + fi + + target_path="$file" + archetypes_path="archetypes/$file" + + if [ ! -f "$target_path" ]; then + echo "Missing OSS file in target repository: $target_path" + missing_files+=("$file") + elif cmp -s "$target_path" "$archetypes_path"; then + echo "OSS file unchanged from archetypes template: $target_path" + unchanged_files+=("$file") + else + echo "OSS file present and different from the archetypes template: $target_path" + fi + done < ospo-resources/oss-checklist-files.txt + + echo "" + if [ ${#missing_files[@]} -ne 0 ]; then + echo "The following OSS required files are missing:" + printf '%s\n' "${missing_files[@]}" + fi + + if [ ${#unchanged_files[@]} -ne 0 ]; then + echo "The following OSS required files are unchanged from the archetypes template:" + printf '%s\n' "${unchanged_files[@]}" + fi + + if [ ${#missing_files[@]} -ne 0 ] || [ ${#unchanged_files[@]} -ne 0 ]; then + echo "OSS required file check failed." + exit 1 + else + echo "All OSS files are present and have been updated from their original templated content." + fi + + - name: Check GitHub template files are present + run: | + echo "Checking for pull request and issue template files" + + missing_templates=() + + files_to_check=( + ".github/PULL_REQUEST_TEMPLATE.md" + ".github/ISSUE_TEMPLATE/bug_report.md" + ".github/ISSUE_TEMPLATE/feature_request.md" + ) + + for file in "${files_to_check[@]}"; do + if [ ! -f "$file" ]; then + missing_templates+=("$file") + fi + done + + if [ ${#missing_templates[@]} -ne 0 ]; then + echo "" + echo "Required GitHub template files not found:" + printf ' - %s\n' "${missing_templates[@]}" + echo "" + echo "These files help improve project collaboration and are considered best practice." + echo "These need to be included in repository contents to improve the developer and repository consumer experience." + + # Fail the job + echo "Missing required GitHub template files." + exit 1 + else + echo "Required pull request and issue template files present." + fi diff --git a/.github/workflows/publish-github-release.yml b/.github/workflows/publish-github-release.yml new file mode 100644 index 0000000..23a5669 --- /dev/null +++ b/.github/workflows/publish-github-release.yml @@ -0,0 +1,117 @@ +# SPDX-License-Identifier: Apache-2.0 +# © Crown Copyright 2025. This work has been developed by the National Digital Twin Programme and is legally attributed to the Department for Business and Trade (UK) as the governing entity. + +# This workflow is triggered when a pull request is merged into the main branch +# from a release/* branch. It extracts the release version from the source branch, +# generates a Software Bill of Materials (SBOM) using the GitHub API, +# creates a Git tag with the version, and publishes a GitHub release including the SBOM file. + +name: Generate SBOM, Tag and Publish GitHub Release + +on: + pull_request: + types: + - closed + branches: + - main + +permissions: + contents: write + +jobs: + versioning: + if: github.event.pull_request.merged == true && startsWith(github.head_ref, 'release/') + name: Extract Release Version + runs-on: ubuntu-latest + outputs: + version: ${{ steps.extract_version.outputs.VERSION }} + steps: + - name: Extract Version from Source Branch Name + id: extract_version + run: | + SOURCE_BRANCH="${{ github.head_ref }}" + VERSION=$(echo "$SOURCE_BRANCH" | grep -o '[0-9]\+\.[0-9]\+\.[0-9]\+') + + if [ -z "$VERSION" ]; then + echo "Error: No semantic release version found in source branch: $SOURCE_BRANCH" + exit 1 + fi + + echo "VERSION=$VERSION" >> $GITHUB_ENV + echo "VERSION=$VERSION" >> $GITHUB_OUTPUT + + - name: Validate Version Format (Semantic Versioning) + run: | + if [[ ! "${{ env.VERSION }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + echo "Error: Invalid version format found. Expected semantic version in release branch name (e.g., release/0.9.0)" + exit 1 + fi + + - name: Print Tag Version + run: | + echo "Identified release semantic version: ${{ steps.extract_version.outputs.version }}" + + generate-sbom: + name: Generate SPDX SBOM + runs-on: ubuntu-latest + needs: [versioning] + steps: + - name: Checkout Code + uses: actions/checkout@v4 + + - name: Generate SPDX SBOM + run: | + # Call GitHub API to generate SBOM + api_response=$(curl -sSL \ + -H "Accept: application/vnd.github+json" \ + -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \ + -H "X-GitHub-Api-Version: 2022-11-28" \ + "$GITHUB_API_URL/repos/${{ github.repository }}/dependency-graph/sbom") + + # Extract nested "sbom" object into a valid SPDX file + echo "$api_response" | jq '.sbom' > sbom.spdx.json + + - name: Upload SBOM Artifact + uses: actions/upload-artifact@v4 + with: + name: sbom + path: sbom.spdx.json + + create-git-tag: + name: Create Git Tag + needs: [versioning, generate-sbom] + runs-on: ubuntu-latest + steps: + - name: Checkout Repository + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Create Git Tag + uses: rickstaa/action-create-tag@v1 + with: + tag: "v${{ needs.versioning.outputs.version }}" + message: "Release v${{ needs.versioning.outputs.version }}" + force_push_tag: true + + create-git-release: + name: Create GitHub Release + needs: [versioning, generate-sbom, create-git-tag] + runs-on: ubuntu-latest + steps: + - name: Download SBOM Artifact + uses: actions/download-artifact@v4 + with: + name: sbom + + - name: Create GitHub Release + uses: softprops/action-gh-release@v2 + with: + tag_name: "v${{ needs.versioning.outputs.version }}" + name: "Release v${{ needs.versioning.outputs.version }}" + body: "Automated release for version ${{ needs.versioning.outputs.version }}. For details of fixes, new features and changes in this release, please see [CHANGELOG.md](${{ github.server_url }}/${{ github.repository }}/blob/main/CHANGELOG.md)." + draft: false + prerelease: false + files: | + sbom.spdx.json + diff --git a/ACKNOWLEDGEMENTS.md b/ACKNOWLEDGEMENTS.md new file mode 100644 index 0000000..d2ef94a --- /dev/null +++ b/ACKNOWLEDGEMENTS.md @@ -0,0 +1,30 @@ +# Acknowledgements + +**Repository:** `label-builder` +**Description:** `Recognises suppliers, partner organisations, and other contributors to the repository's development.` + +The National Digital Twin Programme (NDTP) would like to acknowledge the contributions of various organisations and individuals who have supported the development of this repository. + +## Organisational contributions + +Over time, the following organisations have provided technical expertise, development support, and domain knowledge that have contributed to the evolution of this project: + +- [Kainos](https://www.kainos.com/) +- [Telicent](https://telicent.io/) + +We are grateful for the collaboration that has helped shape this repository. + +## Individual contributions + +For a list of individual contributors who have made direct commits to this repository, see GitHub’s auto-generated contributor insights: [Contributors](../../graphs/contributors). + +--- + +**Note:** This acknowledgment does not confer any legal rights, ownership, or imply ongoing involvement by any of the named organisations or individuals. All contributions are made in accordance with the repository’s licensing terms. + +© Crown Copyright 2025. This work has been developed by the National Digital Twin Programme and is legally attributed to the Department for Business and Trade (UK) as the governing entity. + +Licensed under the NDTP InnerSource Licence – Version 1.0. + +For full licensing terms, see [LICENSE.md](LICENSE.md). + diff --git a/CHANGELOG.md b/CHANGELOG.md index 664cef0..cc629c1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,69 +1,70 @@ -# Changelog -## Unreleased -### Changed -- Updated MAINTAINERS.md with updated supplier information. +# Changelog -## [0.1.7](https://github.com/telicent-oss/label-builder/compare/v0.1.6...v0.1.7) (2024-11-13) +**Repository:** `label-builder` +**Description:** `Tracks all notable changes, version history, and roadmap toward 1.0.0 following Semantic Versioning.` +All notable changes to this repository will be documented in this file. -### Miscellaneous +This project follows **Semantic Versioning (SemVer)** ([semver.org](https://semver.org/)), using the format: -* cosmetic change to trigger release-please ([#21](https://github.com/telicent-oss/label-builder/issues/21)) ([b9e9d7e](https://github.com/telicent-oss/label-builder/commit/b9e9d7e1cee74d27e22a6f018f5b6e06d58dc196)) -## 0.1.6 (2024-10-01) +`[MAJOR].[MINOR].[PATCH]` +- **MAJOR** (`X.0.0`) – Incompatible API/feature changes that break backward compatibility. +- **MINOR** (`0.X.0`) – Backward-compatible new features, enhancements, or functionality changes. +- **PATCH** (`0.0.X`) – Backward-compatible bug fixes, security updates, or minor corrections. +- **Pre-release versions** – Use suffixes such as `-alpha`, `-beta`, `-rc.1` (e.g., `2.1.0-beta.1`). +- **Build metadata** – If needed, use `+build` (e.g., `2.1.0+20250314`). +--- -### Features +## [Unreleased] -* add initial view of the idh model mixin for label creation ([#18](https://github.com/telicent-oss/label-builder/issues/18)) ([7868e76](https://github.com/telicent-oss/label-builder/commit/7868e764da8c65d333e8c409b5fe6067d2d8945c)) +### Added +- Placeholder for upcoming features and enhancements. -## [0.1.5](https://github.com/telicent-oss/label-builder/compare/v0.1.4...v0.1.5) (2024-08-21) +### Fixed +- Placeholder for bug fixes and security updates. +### Changed +- Placeholder for changes to existing functionality. -### Miscellaneous +--- -* update min version for label-builder-service ([#14](https://github.com/telicent-oss/label-builder/issues/14)) ([8db639e](https://github.com/telicent-oss/label-builder/commit/8db639ec53ae666299965db610a168408e573842)) +## Future Roadmap to `1.0.0` -## [0.1.4](https://github.com/telicent-oss/label-builder/compare/v0.1.3...v0.1.4) (2024-08-20) +The `0.90.x` series is part of NDTP’s **pre-stable development cycle**, meaning: +- **Minor versions (`0.91.0`, `0.92.0`...) introduce features and improvements** leading to a stable `1.0.0`. +- **Patch versions (`0.90.1`, `0.90.2`...) contain only bug fixes and security updates**. +- **Backward compatibility is NOT guaranteed until `1.0.0`**, though NDTP aims to minimise breaking changes. +Once `1.0.0` is reached, future versions will follow **strict SemVer rules**. -### Bug Fixes +--- -* pin minimum version of label-builder-service to prevent issues ([#12](https://github.com/telicent-oss/label-builder/issues/12)) ([0bbcdcb](https://github.com/telicent-oss/label-builder/commit/0bbcdcb802d26176ed88c0995da87ece268be60b)) +## Versioning Policy -## [0.1.3](https://github.com/telicent-oss/label-builder/compare/v0.1.2...v0.1.3) (2024-08-14) +1. **MAJOR updates (`X.0.0`)** – Typically introduce breaking changes that require users to modify their code or configurations. +- **Breaking changes (default rule)**: Any backward-incompatible modifications require a major version bump. +- **Non-breaking major updates (exceptional cases)**: A major version may also be incremented if the update represents a significant milestone, such as a shift in governance, a long-term stability commitment, or substantial new functionality that redefines the project’s scope. +2. **MINOR updates (`0.X.0`)** – New functionality that is backward-compatible. +3. **PATCH updates (`0.0.X`)** – Bug fixes, performance improvements, or security patches. +4. **Dependency updates** – A **major dependency upgrade** that introduces breaking changes should trigger a **MAJOR** version bump (once at `1.0.0`). +--- -### Miscellaneous +## How to Update This Changelog -* update dependency ([#10](https://github.com/telicent-oss/label-builder/issues/10)) ([beaf53e](https://github.com/telicent-oss/label-builder/commit/beaf53ed34042f7ff70ffd0161e34536f43d9162)) +1. When making changes, update this file under the **Unreleased** section. +2. Before a new release, move changes from **Unreleased** to a new dated section with a version number. +3. Follow **Semantic Versioning** rules to categorise changes correctly. +4. If pre-release versions are used, clearly mark them as `-alpha`, `-beta`, or `-rc.X`. -## [0.1.2](https://github.com/telicent-oss/label-builder/compare/v0.1.1...v0.1.2) (2024-08-09) +--- +**Maintained by the National Digital Twin Programme (NDTP).** -### Miscellaneous +© Crown Copyright 2025. This work has been developed by the National Digital Twin Programme and is legally attributed to the Department for Business and Trade (UK) as the governing entity. -* meta class for telicent mixin expose api functionality docs ([#6](https://github.com/telicent-oss/label-builder/issues/6)) ([9e6eada](https://github.com/telicent-oss/label-builder/commit/9e6eadaae178b14b45b0da9143b84e52a0584aa1)) -* update release pr to reusable workflow ([#7](https://github.com/telicent-oss/label-builder/issues/7)) ([b5db659](https://github.com/telicent-oss/label-builder/commit/b5db659b1663c9cfe96084a2a4f577e34ada5fda)) +Licensed under the NDTP InnerSource Licence – Version 1.0. -## [0.1.1](https://github.com/telicent-oss/label-builder/compare/v0.1.0...v0.1.1) (2024-06-27) - - -### Documentation - -* update documentation to reflect recent changes to telicent-lib ([8482299](https://github.com/telicent-oss/label-builder/commit/84822998a0445c672cb9f17742bfc963794948da)) -* update documentation to reflect recent changes to telicent-lib ([#4](https://github.com/telicent-oss/label-builder/issues/4)) ([8482299](https://github.com/telicent-oss/label-builder/commit/84822998a0445c672cb9f17742bfc963794948da)) - -## 0.1.0 (2024-05-10) - - -### Features - -* initial release of telicent label builder ([59ffe1b](https://github.com/telicent-oss/label-builder/commit/59ffe1bd54aae57ab62175e8065e0fc9e86bc4b2)) - -## 0.1.0 (2024-05-07) - - -### Features - -* Initial release of label builder ([255903f](https://github.com/telicent-oss/label-builder/commit/255903f327573e7caf1f0f3b91cbf86aadf9e595)) +For full licensing terms, see [LICENSE.md](LICENSE.md). diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..fc272a0 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,81 @@ +# Code of Conduct + +**Repository:** `label-builder` +**Description:** `Defines expected behaviors, rules, and the enforcement process to ensure professional engagement.` + +## Introduction + +The National Digital Twin Programme (NDTP) is committed to fostering an open, inclusive, and professional environment in all its repositories. +This Code of Conduct outlines the expectations for behaviour when engaging with NDTP repositories, including issue reporting, documentation feedback, +and discussions with repository maintainers. + +By participating in this repository, you agree to follow this Code of Conduct. + +--- + +## Expected Behaviour + +All contributors, maintainers, and public users are expected to: + +- **Be respectful and professional** – Treat others with courtesy and professionalism. +- **Communicate constructively** – Offer feedback that is clear, helpful, and focused on improving the repository. +- **Engage in a welcoming manner** – Encourage participation and provide a positive experience for all users. +- **Provide relevant and clear information** – When submitting issues or feedback, be specific and include details that help maintainers understand the request. + +--- + +## Unacceptable Behaviour + +The following behaviour will not be tolerated: + +- **Harassment, discrimination, or personal attacks** – Any form of offensive behaviour towards individuals or groups. +- **Trolling, disruptive comments, or inflammatory language** – Intentionally provoking arguments or making non-constructive comments. +- **Excessive demands or unrealistic expectations of maintainers** – This includes repeated requests for prioritisation outside of programme priorities. +- **Spamming or promotional content** – Off-topic discussions unrelated to the repository's purpose. +- **Disclosing sensitive information** – Sharing security vulnerabilities or confidential details outside of the responsible disclosure process. + +--- + +## Reporting Concerns + +If you believe someone is violating this Code of Conduct, please report it by following these steps: + +1. **For general issues** – Raise a concern with the repository maintainers by emailing ndtp@businessandtrade.gov.uk. +2. **For security-related concerns** – Follow the responsible disclosure process outlined in [SECURITY.md](./SECURITY.md). +3. **For incidents requiring escalation** – NDTP reserves the right to take appropriate action, including restricting access to contributors who violate this policy. + +All reports will be reviewed confidentially, and NDTP will take appropriate action to address the issue. + +--- + +## Enforcement + +Violations of this Code of Conduct may result in: + +- A formal warning +- Temporary suspension from participation +- Permanent exclusion from engaging with NDTP repositories + +Decisions on enforcement are made at NDTP’s discretion. + +--- + +## Scope + +This Code of Conduct applies to all interactions in NDTP repositories, including but not limited to: + +- Issue tracking and reporting +- Documentation suggestions and feedback +- Discussions with maintainers +- Any other interactions in public NDTP projects + +--- + +**Maintained by the National Digital Twin Programme (NDTP).** + +© Crown Copyright 2025. This work has been developed by the National Digital Twin Programme and is legally attributed to the Department for Business and Trade (UK) as the governing entity. + +Licensed under the NDTP InnerSource Licence – Version 1.0. + +For full licensing terms, see [LICENSE.md](LICENSE.md). + diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..7f8ba9f --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,123 @@ +# Contribution Guidelines + +**Repository:** `label-builder` +**Description:** `Guidelines for issue reporting, documentation suggestions, and NDTP’s controlled contribution model.` + +Thank you for your interest in this repository. + +The National Digital Twin Programme (NDTP) develops and maintains this repository in collaboration with suppliers and partner organisations, including other parts of government and their suppliers. + +NDTP follows a **Cathedral open-source governance model** where code may be made **publicly available** under open-source licences, and collaboration is invited from **approved partners**. Contributions from the general public are not currently accepted, but **feedback, issue reporting, and documentation suggestions are encouraged**. + +If you want to see which suppliers and organisations have contributed to this repository in the past, refer to [ACKNOWLEDGEMENTS.md](./ACKNOWLEDGEMENTS.md) and the GitHub contributor insights page at [Contributors](../../graphs/contributors). + +--- + +## How You Can Contribute + +Public users and NDTP partners are encouraged to engage in the following ways: + +- **Reporting bugs and issues** – If you find a problem, please open a GitHub issue. +- **Suggesting documentation improvements** – Propose clarifications or additions to the existing documentation. +- **Providing structured feedback** – If you have suggestions for improvements, let us know via GitHub Issues. + +While we review all input, NDTP prioritises development based on programme goals, supplier development cycles, and strategic objectives. + +NDTP does not currently accept **public pull requests (PRs) or direct code contributions** to this repository. Contributions are limited to **approved suppliers and partner organisations** under formal agreements. + +For details on repository maintainers and how to contact them, refer to [MAINTAINERS.md](./MAINTAINERS.md). + +--- + +## Reporting Issues + +If you encounter a bug, error, or inconsistency, please follow these steps: + +1. Check for an existing issue under [Issues](../../issues). +2. Open a new issue if no one has reported it yet. Use one of the provided issue templates. +3. Provide a clear, detailed description of the issue, including steps to reproduce it if applicable. +4. Label the issue appropriately (bug, documentation, enhancement, etc.). + +For security-related issues, do not submit a public issue. Instead, follow our [Responsible Disclosure process](./SECURITY.md). + +--- + +## Documentation Feedback + +If you find an error in the documentation, need more clarity, or have suggestions for additional documentation, you can: + +1. Open a GitHub issue under the `documentation` label. +2. Describe the improvement you are suggesting, including references to existing documentation where applicable. +3. Submit structured feedback – specific examples help us make updates faster. + +We prioritise documentation updates based on user impact and alignment with programme goals. + +--- + +## NDTP's Approach to Open-Source Development + +- **Development is led by approved suppliers and partners** who have been engaged through a formal process. +- **We welcome feedback and ideas**, but implementation is subject to programme priorities. + +To see what we’re working on, check out our [Project Roadmap](../../projects). If no roadmap is currently available, please note that it is being actively developed and will be published in due course. + +--- + +## Branching Strategy + +This repository follows a **GitFlow-based branching model** to manage development efficiently. Key conventions include: + +- **Main Branch (`main`)**: The stable, production-ready branch. Only tested and approved changes are merged here. +- **Develop Branch (`develop`)**: The integration branch where features and fixes are merged before reaching `main`. +- **Feature Branches (`feature/*`)**: Used for new developments. Named based on functionality, e.g., `feature/new-auth-method`. +- **Bugfix Branches (`bugfix/*`)**: Address minor issues in `develop` before release. +- **Release Branches (`release/*`)**: Used to prepare a new stable release, ensuring final testing and versioning updates. +- **Hotfix Branches (`hotfix/*`)**: Critical fixes applied directly to `main` and merged back into `develop`. + +For more details, refer to [GitFlow Workflow](https://www.atlassian.com/git/tutorials/comparing-workflows/gitflow-workflow). + +--- + +## Pull Request Policy + +To maintain high-quality contributions, NDTP enforces the following **minimum pull request (PR) requirements** for approved contributors: + +- **All PRs must be reviewed by at least one maintainer** before merging. +- **PRs should reference a corresponding issue** where applicable. +- **Code changes must include relevant tests** to ensure stability. +- **Commit messages should follow best practices**, including referencing issue numbers when relevant. +- **Documentation updates should accompany PRs that impact functionality.** +- **PRs should use "squash and merge" as the preferred merge strategy**, ensuring a clean history. +- **Feature and bugfix branches should be deleted after merge** to keep the repository tidy. +- **Force pushing to the `main` branch is strictly prohibited** to protect repository integrity. +- **CI builds must pass before merging** to enforce basic validation checks. + +--- + +## Contribution Licensing + +By submitting feedback, documentation suggestions, or issue reports, you acknowledge that any resulting changes will be licensed under the same open-source terms as this repository: + +- Code contributions (if ever accepted) will be licensed under Apache 2.0. +- Documentation updates will be licensed under OGL v3.0. + +For supplier-contracted development, NDTP ensures that all contributions align with Crown Copyright and public sector open-source standards. + +--- + +## Repository Maintainers + +For details on who maintains this repository and how to contact them, refer to [MAINTAINERS.md](./MAINTAINERS.md). + +NDTP repository maintainers review reported issues, evaluate documentation suggestions, and oversee ongoing development. + +--- + +**Maintained by the National Digital Twin Programme (NDTP).** + +© Crown Copyright 2025. This work has been developed by the National Digital Twin Programme and is legally attributed to the Department for Business and Trade (UK) as the governing entity. + +Licensed under the NDTP InnerSource Licence – Version 1.0. + +For full licensing terms, see [LICENSE.md](LICENSE.md). + diff --git a/LICENSE.md b/LICENSE.md index 6b1eaa3..7afaec9 100644 --- a/LICENSE.md +++ b/LICENSE.md @@ -1,201 +1,96 @@ - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS - - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright 2024 TELICENT LTD - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. +# NDTP InnerSource License + +**Repository:** `label-builder` +**Description:** `Defines the licensing terms for the source code in this repository.` + +--- + +## Version + +**NDTP InnerSource License – Version 1.0** +**Issued by:** National Digital Twin Programme (NDTP) +**Effective Date:** 9 July 2025 + +--- + +## Copyright + +© Crown Copyright 2025. +This work has been developed by the **National Digital Twin Programme (NDTP)** and is legally attributed to the **Department for Business and Trade (UK)** as the governing entity. + +This repository is **not open source**. +Its contents are licensed under the terms of this **NDTP InnerSource License**, unless and until it is formally published under an approved open source licence by the NDTP Management Team. + +--- + +## 1. Purpose + +This repository supports InnerSource development practices within the NDTP. It enables collaborative development by internal teams and authorised suppliers, in a controlled and non-public environment. + +--- + +## 2. Licensing Status + +This work is **not licensed under an open source licence**. +It must not be published, distributed, sublicensed, or shared externally without the **explicit, written approval** of the NDTP Management Team. + +> The NDTP InnerSource Licence permits internal collaboration only. No part of this repository may be used or disclosed beyond the authorised delivery context. + +--- + +## 3. Intellectual Property + +All rights, including intellectual property rights in this code and associated materials, are owned by the NDTP. + +Where contributions are made by suppliers or delivery partners, those contributions are accepted on the basis that **full intellectual property rights** belong to the Crown under the terms of their contract. + +--- + +## 4. Permitted Use + +You may: + +- View, use, and modify the code as required to fulfil your responsibilities under the NDTP. +- Collaborate within authorised NDTP teams and with approved suppliers under existing contracts. + +You may not: + +- Share, publish, or release this repository publicly. +- Fork, clone, or redistribute this code outside approved NDTP channels. +- Apply any license other than the NDTP InnerSource License to this repository or its contents, unless instructed by the NDTP Management Team. + +--- + +## 5. Future Publication + +At the discretion of the NDTP Management Team, this repository may later be designated for release under an approved open source licence. + +Any such designation must follow NDTP's internal governance processes. + +> Until such designation is explicitly made and executed, this repository remains **confidential and proprietary**. + +--- + +## 6. Enforcement + +Any unauthorised disclosure, publication, or redistribution of this repository or its contents may: + +- Constitute a breach of contract +- Trigger formal investigation +- Result in legal, disciplinary, or commercial action, including revocation of access rights + +All actions will be escalated to the NDTP Management Team for appropriate handling. + +--- + +## Contact + +For all enquiries regarding licensing, publication status, or contributor rights, please contact: + +**NDTP Management Team** +Department for Business and Trade (UK) +NDTP@BUSINESSANDTRADE.GOV.UK + +--- + +**End of NDTP InnerSource Licence – Version 1.0** diff --git a/MAINTAINERS.md b/MAINTAINERS.md index 13470f9..51ad959 100644 --- a/MAINTAINERS.md +++ b/MAINTAINERS.md @@ -2,65 +2,45 @@ **Repository:** `label-builder` **Description:** `Lists maintainers responsible for reviewing issues, security, and documentation updates.` -**SPDX-License-Identifier:** OGL-UK-3.0 -## Introduction +Current Status: Under NDTP Oversight -This repository is maintained by the **National Digital Twin Programme (NDTP)** in collaboration with contracted suppliers and partner -organisations. +At present, **there is no actively assigned supplier maintaining this repository**. NDTP is currently in the process of engaging new suppliers through its procurement cycle. -Maintainers are responsible for reviewing issues, evaluating documentation suggestions, and overseeing supplier-led development. +In the meantime: +- **Bug reports and documentation feedback** will still be reviewed by NDTP. +- **Security vulnerabilities** should be reported via the [responsible disclosure process](./SECURITY.md). +- **For any queries, please contact:** **ndtp@businessandtrade.gov.uk** -If you need to report a problem, suggest improvements, or seek guidance on using this repository, please refer to the contacts listed below. +Once a new supplier is engaged, this file will be updated with their details. ---- - -## Responsibilities of Maintainers - -Maintainers are responsible for: - -- Reviewing and responding to **GitHub Issues**. -- Assessing **documentation updates and corrections**. -- Overseeing **code updates** developed by NDTP-approved suppliers. -- Ensuring compliance with **NDTP’s licensing and security policies**. - -NDTP does not accept public code contributions, but we welcome **bug reports and documentation feedback**. - ---- - -## Current Maintainers - -| Name | Organisation | Role | Contact | -|------|-------------|------|---------| -| Alex Atudosie | NDTP | Lead Maintainer | ospo@ndtp.co.uk | -| Alex Atudosie | NDTP | Security Contact | ospo@ndtp.co.uk | -| Alex Atudosie | NDTP | Documentation Lead | ospo@ndtp.co.uk | - -For general issues, please **open a GitHub issue** rather than contacting maintainers directly. - ---- +## Last Active Maintainers -## Escalation Contacts +The following organisations were responsible for previous development efforts on this repository: -If you need to escalate an issue that has not been addressed within a reasonable time: +| Name | Organisation | Role | Contact | +|----------------------------|-----------------|--------------------|--------------------------------| +| Martin Willits | Kainos | Lead Maintainer | ndtp@businessandtrade.gov.uk | +| Joshua Hughes | Kainos | Documentation Lead | ndtp@businessandtrade.gov.uk | -1. **Security vulnerabilities** – Follow the responsible disclosure process in [SECURITY.md](SECURITY.md). -2. **Governance and policy queries** – Contact NDTP at **ospo@ndtp.co.uk**. -3. **Urgent operational issues** – If an issue affects critical systems, contact the **Lead Maintainer** listed above. +*For ongoing inquiries, please use the NDTP contact email above.* --- -## Updating this File +## How This Repository is Managed -Maintainer details may change over time. If you are an NDTP-approved maintainer and need to update this file, please submit a request -through the designated NDTP repository administrator. +NDTP repositories remain available even when transitioning between suppliers. +During these times, NDTP ensures: +- Critical issues are **triaged internally**. +- No new **public contributions** are accepted unless approved. +- The repository remains available under **open-source governance**. --- **Maintained by the National Digital Twin Programme (NDTP).** -© Crown Copyright 2025. This work has been developed by the National Digital Twin Programme and is legally attributed to the Department for Business and Trade (UK) as the governing entity. +© Crown Copyright 2025. This work has been developed by the National Digital Twin Programme and is legally attributed to the Department for Business and Trade (UK) as the governing entity. -Licensed under the Open Government Licence v3.0. +Licensed under the NDTP InnerSource Licence – Version 1.0. -For full licensing terms, see [OGL_LICENSE.md](OGL_LICENSE.md). +For full licensing terms, see [LICENSE.md](LICENSE.md). \ No newline at end of file diff --git a/NOTICE b/NOTICE deleted file mode 100644 index 259d6ed..0000000 --- a/NOTICE +++ /dev/null @@ -1,4 +0,0 @@ -telicent-label-builder -============ - -Copyright (c) 2024 Telicent Ltd. \ No newline at end of file diff --git a/README.md b/README.md index 758cf14..74ba9a5 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,22 @@ -# ianode-label-builder +# README +**Repository:** `label-builder` +**Description:** `IANode label builder provides useful helper classes to build and create security labels.` +**Repository Status:** `Private – NDTP InnerSource` + +--- + +## Overview + +This repository is part of the **National Digital Twin Programme (NDTP)**. It supports the development of secure, modular, and standards-based components for internal use across NDTP projects. + +> **This repository is private and governed by the NDTP InnerSource Licence – Version 1.0.** +> It is intended solely for collaboration among NDTP teams and authorised suppliers. +> It is **not open source** and must not be disclosed, redistributed, or published externally. + +--- + +## ianode-label-builder IANode label builder provides useful helper classes to build and create security labels. @@ -17,3 +34,44 @@ pip install ianode-label-builder ## Usage For documentation on how to use ianode-label-builder, please see the [documentation index](docs/index.md). + +## Contributors +The development of these works has been made possible with thanks to our [contributors](https://github.com/National-Digital-Twin/label-builder/graphs/contributors). + +## Public Funding Acknowledgment +This repository has been developed with public funding as part of the National Digital Twin Programme (NDTP), a UK Government initiative. NDTP, alongside its partners, has invested in this work to advance open, secure, and reusable digital twin technologies for any organisation, whether from the public or private sector, irrespective of size. + +## Licensing + +This repository, including all source code, documentation, configuration files, and related materials, is licensed under the: + +**NDTP InnerSource Licence – Version 1.0** +See [LICENSE.md](LICENSE.md) for the full licence text. + +> ⚠️ This repository is **not open source**. +> Redistribution, disclosure, or publication of any part of this repository is prohibited without the **explicit, written approval** of the NDTP Management Team. + +All intellectual property rights are held by the **Department for Business and Trade (UK)** as the governing entity for the National Digital Twin Programme (NDTP). + +## Security and Responsible Disclosure +We take security seriously. If you believe you have found a security vulnerability in this repository, please follow our responsible disclosure process outlined in `SECURITY.md`. + +## Software Bill of Materials (SBOM) + +This project provides a Software Bill of Materials (SBOM) to help users and integrators understand its dependencies. + +### Current SBOM +Download the [latest SBOM for this codebase](../../dependency-graph/sbom) to view the current list of components used in this repository. + +## Contributing +We welcome contributions that align with the Programme’s objectives. Please read our `CONTRIBUTING.md` guidelines before submitting pull requests. + +## Acknowledgements +This repository has benefited from collaboration with various organisations. For a list of acknowledgments, see `ACKNOWLEDGEMENTS.md`. + +## Support and Contact +For questions or support, check our Issues or contact the NDTP team by emailing ndtp@businessandtrade.gov.uk. + +**Maintained by the National Digital Twin Programme (NDTP).** + +© Crown Copyright 2025. This work has been developed by the National Digital Twin Programme and is legally attributed to the Department for Business and Trade (UK) as the governing entity. \ No newline at end of file diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..9fb0c5f --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,73 @@ +# Security Policy + +**Repository:** `label-builder` +**Description:** `Details the responsible disclosure process for security vulnerabilities.` + +## Responsible Disclosure + +The National Digital Twin Programme (NDTP) follows a **Coordinated Vulnerability Disclosure (CVD)** process to ensure security risks are addressed responsibly. + +By reporting security vulnerabilities through the responsible channels, you agree to: +- Not disclose details of the vulnerability publicly until NDTP has had a reasonable opportunity to fix it. +- Provide NDTP with adequate time to assess and mitigate the risk. +- Act in good faith and follow ethical security research principles. + +NDTP reserves the right to take necessary action against unauthorised or harmful security testing activities. + +--- + +## Reporting Security Issues + +NDTP takes security seriously and encourages responsible reporting of vulnerabilities. + +If you believe you have found a security vulnerability in this repository, **please do not report it publicly**. Instead, follow the steps below to disclose the issue responsibly. + +### **How to Report a Security Issue** + +1. **Do not open a public issue on GitHub.** Instead, report security concerns via email to **ndtp@businessandtrade.gov.uk**. +2. **Provide detailed information about the vulnerability**, including: + - A clear description of the issue. + - Steps to reproduce the vulnerability. + - Potential impact or risk level. + - Any suggested mitigation strategies. +3. **Allow time for assessment and response.** NDTP will review the report and respond within **10 working days** to acknowledge receipt. +4. **Cooperate with NDTP to validate and address the issue.** + +Once a resolution has been identified, NDTP may choose to: + - **Release a patch** as part of the next scheduled update. + - **Issue a security advisory** if the issue is critical. + - **Provide acknowledgments** where appropriate (subject to NDTP’s disclosure policy). + +--- + +## Scope + +This security policy applies to: +- All NDTP repositories released as open source. +- Code, configuration files, and infrastructure deployed as part of NDTP’s **Integration Architecture (IA)**. +- **Third-party dependencies** included within NDTP repositories. If you identify a vulnerability in a third-party component that NDTP relies on (e.g., outdated libraries or known security flaws in dependencies), we encourage you to report it. + +Out of scope: +- Issues related to third-party services or software **not used within NDTP repositories**. +- Vulnerabilities in user environments that are unrelated to this repository. +- Unsolicited security testing or penetration testing without NDTP’s explicit permission. + +--- + +## Security Best Practices + +To help maintain security across NDTP repositories, we follow these principles: +- Dependencies are **scanned and updated regularly** (e.g., using automated tools like Dependabot). +- Sensitive credentials **must not be included** in public repositories. +- Security patches are applied in a timely manner, with priority given to critical vulnerabilities. + +--- + +**Maintained by the National Digital Twin Programme (NDTP).** + +© Crown Copyright 2025. This work has been developed by the National Digital Twin Programme and is legally attributed to the Department for Business and Trade (UK) as the governing entity. + +Licensed under the NDTP InnerSource Licence – Version 1.0. + +For full licensing terms, see [LICENSE.md](LICENSE.md). + diff --git a/pyproject.toml b/pyproject.toml index d7119fd..20e101a 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,5 +1,5 @@ [build-system] -requires = ["setuptools>=61.2.0", "wheel==0.41.3", "pip-tools==7.3.0"] +requires = ["setuptools>=61.2.0", "wheel==0.45.1", "pip-tools==7.3.0"] build-backend = "setuptools.build_meta" [project] @@ -30,9 +30,9 @@ classifiers = [ [project.optional-dependencies] dev = [ - "pre-commit==3.7.0", - "ruff==0.4.2", - "mypy==1.10.0" + "pre-commit==4.2.0", + "ruff==0.11.2", + "mypy==1.15.0" ] [tool.setuptools.dynamic] From e7e3ff0b17c759a8e1edca64392e6acbe6903717 Mon Sep 17 00:00:00 2001 From: Rotimi Joseph Date: Tue, 25 Aug 2026 10:51:27 +0100 Subject: [PATCH 2/3] fix: update change log --- CHANGELOG.md | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index cc629c1..9f7d9ee 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,16 +17,12 @@ This project follows **Semantic Versioning (SemVer)** ([semver.org](https://semv --- -## [Unreleased] +## [0.90.0] 2026-08-25 -### Added -- Placeholder for upcoming features and enhancements. +### Initial Features -### Fixed -- Placeholder for bug fixes and security updates. - -### Changed -- Placeholder for changes to existing functionality. +- Key functionality (in Python) for providing useful helper classes to build and create security labels. +- Added SPDX headers. --- From cf04a672e9651404da85030f5592a2f184283754 Mon Sep 17 00:00:00 2001 From: Rotimi Joseph Date: Tue, 25 Aug 2026 10:52:03 +0100 Subject: [PATCH 3/3] fix: add SPDX headers and remove license variables --- ianode_labels/__init__.py | 39 +++++++++++++---------- ianode_labels/ianode_model.py | 38 +++++++++++++--------- ianode_labels/ianodev1.py | 35 ++++++++++++-------- ianode_labels/ianodev2.py | 36 +++++++++++++-------- ianode_labels/idh_model.py | 38 +++++++++++++--------- ianode_labels/security_labels.py | 36 ++++++++++++--------- test/__init__.py | 21 ++++++++++++ test/test_idh_model.py | 23 +++++++++++++ test/test_security_labels.py | 23 +++++++++++++ test/test_security_labels_ianode_model.py | 23 +++++++++++++ 10 files changed, 223 insertions(+), 89 deletions(-) diff --git a/ianode_labels/__init__.py b/ianode_labels/__init__.py index d10581e..3d34d0a 100644 --- a/ianode_labels/__init__.py +++ b/ianode_labels/__init__.py @@ -1,25 +1,32 @@ +# SPDX-License-Identifier: Apache-2.0 +# Originally developed by Telicent Ltd.; subsequently adapted, enhanced, and maintained by the National Digital Twin Programme. + + +# Copyright (c) Telicent Ltd. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Modifications made by the National Digital Twin Programme (NDTP) +# © Crown Copyright 2026. This work has been developed by the National Digital Twin Programme +# and is legally attributed to the UK's Department for Business, Innovation, Science and Trade (BIST) as the governing entity. + + from ianode_labels.idh_model import IDHModel from ianode_labels.security_labels import Label, MultiValueLabel, SecurityLabelBuilder, SingleValueLabel from ianode_labels.ianode_model import IANodeModel from ianode_labels.ianodev1 import IANodeLabelsV1 from ianode_labels.ianodev2 import IANodeSecurityLabelsV2 -__license__ = """ -Copyright (c) Telicent Ltd. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -""" - __all__ = [ "SecurityLabelBuilder", diff --git a/ianode_labels/ianode_model.py b/ianode_labels/ianode_model.py index 64eadd4..b528e5e 100644 --- a/ianode_labels/ianode_model.py +++ b/ianode_labels/ianode_model.py @@ -1,3 +1,26 @@ +# SPDX-License-Identifier: Apache-2.0 +# Originally developed by Telicent Ltd.; subsequently adapted, enhanced, and maintained by the National Digital Twin Programme. + + +# Copyright (c) Telicent Ltd. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Modifications made by the National Digital Twin Programme (NDTP) +# © Crown Copyright 2026. This work has been developed by the National Digital Twin Programme +# and is legally attributed to the UK's Department for Business, Innovation, Science and Trade (BIST) as the governing entity. + + import logging from abc import ABC, abstractmethod from datetime import datetime, timezone @@ -8,21 +31,6 @@ from ianode_labels.security_labels import SecurityLabelBuilder from ianode_labels.ianodev2 import IANodeSecurityLabelsV2 -__license__ = """ -Copyright (c) Telicent Ltd. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -""" log = logging.getLogger(__name__) diff --git a/ianode_labels/ianodev1.py b/ianode_labels/ianodev1.py index c2d3a87..7f86802 100644 --- a/ianode_labels/ianodev1.py +++ b/ianode_labels/ianodev1.py @@ -1,22 +1,29 @@ -from enum import Enum +# SPDX-License-Identifier: Apache-2.0 +# Originally developed by Telicent Ltd.; subsequently adapted, enhanced, and maintained by the National Digital Twin Programme. -from ianode_labels import security_labels as security -__license__ = """ -Copyright (c) Telicent Ltd. +# Copyright (c) Telicent Ltd. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at +# Modifications made by the National Digital Twin Programme (NDTP) +# © Crown Copyright 2026. This work has been developed by the National Digital Twin Programme +# and is legally attributed to the UK's Department for Business, Innovation, Science and Trade (BIST) as the governing entity. - http://www.apache.org/licenses/LICENSE-2.0 -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -""" +from enum import Enum + +from ianode_labels import security_labels as security class IANodeLabelsV1(Enum): diff --git a/ianode_labels/ianodev2.py b/ianode_labels/ianodev2.py index b9acd9f..1ffcde7 100644 --- a/ianode_labels/ianodev2.py +++ b/ianode_labels/ianodev2.py @@ -1,22 +1,30 @@ -from enum import Enum +# SPDX-License-Identifier: Apache-2.0 +# Originally developed by Telicent Ltd.; subsequently adapted, enhanced, and maintained by the National Digital Twin Programme. -from ianode_labels.security_labels import MultiValueLabel, SingleValueLabel -__license__ = """ -Copyright (c) Telicent Ltd. +# Copyright (c) Telicent Ltd. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Modifications made by the National Digital Twin Programme (NDTP) +# © Crown Copyright 2026. This work has been developed by the National Digital Twin Programme +# and is legally attributed to the UK's Department for Business, Innovation, Science and Trade (BIST) as the governing entity. -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - http://www.apache.org/licenses/LICENSE-2.0 +from enum import Enum + +from ianode_labels.security_labels import MultiValueLabel, SingleValueLabel -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -""" class AndGroups(MultiValueLabel): diff --git a/ianode_labels/idh_model.py b/ianode_labels/idh_model.py index 27ad6e1..50a3b64 100644 --- a/ianode_labels/idh_model.py +++ b/ianode_labels/idh_model.py @@ -1,3 +1,26 @@ +# SPDX-License-Identifier: Apache-2.0 +# Originally developed by Telicent Ltd.; subsequently adapted, enhanced, and maintained by the National Digital Twin Programme. + + +# Copyright (c) Telicent Ltd. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Modifications made by the National Digital Twin Programme (NDTP) +# © Crown Copyright 2026. This work has been developed by the National Digital Twin Programme +# and is legally attributed to the UK's Department for Business, Innovation, Science and Trade (BIST) as the governing entity. + + import logging from datetime import datetime, timezone from typing import Annotated @@ -7,21 +30,6 @@ from ianode_labels.security_labels import SecurityLabelBuilder from ianode_labels.ianodev2 import IANodeSecurityLabelsV2 -__license__ = """ -Copyright (c) Telicent Ltd. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -""" log = logging.getLogger(__name__) diff --git a/ianode_labels/security_labels.py b/ianode_labels/security_labels.py index 4af3e10..cb49c7e 100644 --- a/ianode_labels/security_labels.py +++ b/ianode_labels/security_labels.py @@ -1,18 +1,24 @@ -__license__ = """ -Copyright (c) Telicent Ltd. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -""" +# SPDX-License-Identifier: Apache-2.0 +# Originally developed by Telicent Ltd.; subsequently adapted, enhanced, and maintained by the National Digital Twin Programme. + + +# Copyright (c) Telicent Ltd. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Modifications made by the National Digital Twin Programme (NDTP) +# © Crown Copyright 2026. This work has been developed by the National Digital Twin Programme +# and is legally attributed to the UK's Department for Business, Innovation, Science and Trade (BIST) as the governing entity. class Label: diff --git a/test/__init__.py b/test/__init__.py index e69de29..a8a7ebe 100644 --- a/test/__init__.py +++ b/test/__init__.py @@ -0,0 +1,21 @@ +# SPDX-License-Identifier: Apache-2.0 +# Originally developed by Telicent Ltd.; subsequently adapted, enhanced, and maintained by the National Digital Twin Programme. + + +# Copyright (c) Telicent Ltd. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Modifications made by the National Digital Twin Programme (NDTP) +# © Crown Copyright 2026. This work has been developed by the National Digital Twin Programme +# and is legally attributed to the UK's Department for Business, Innovation, Science and Trade (BIST) as the governing entity. \ No newline at end of file diff --git a/test/test_idh_model.py b/test/test_idh_model.py index 66efb86..88bed6e 100644 --- a/test/test_idh_model.py +++ b/test/test_idh_model.py @@ -1,3 +1,26 @@ +# SPDX-License-Identifier: Apache-2.0 +# Originally developed by Telicent Ltd.; subsequently adapted, enhanced, and maintained by the National Digital Twin Programme. + + +# Copyright (c) Telicent Ltd. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Modifications made by the National Digital Twin Programme (NDTP) +# © Crown Copyright 2026. This work has been developed by the National Digital Twin Programme +# and is legally attributed to the UK's Department for Business, Innovation, Science and Trade (BIST) as the governing entity. + + import unittest from ianode_labels import IDHModel diff --git a/test/test_security_labels.py b/test/test_security_labels.py index 944b110..3a6aa9d 100644 --- a/test/test_security_labels.py +++ b/test/test_security_labels.py @@ -1,3 +1,26 @@ +# SPDX-License-Identifier: Apache-2.0 +# Originally developed by Telicent Ltd.; subsequently adapted, enhanced, and maintained by the National Digital Twin Programme. + + +# Copyright (c) Telicent Ltd. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Modifications made by the National Digital Twin Programme (NDTP) +# © Crown Copyright 2026. This work has been developed by the National Digital Twin Programme +# and is legally attributed to the UK's Department for Business, Innovation, Science and Trade (BIST) as the governing entity. + + import unittest from ianode_labels import SecurityLabelBuilder, IANodeSecurityLabelsV2 diff --git a/test/test_security_labels_ianode_model.py b/test/test_security_labels_ianode_model.py index cfa506e..6269e5e 100644 --- a/test/test_security_labels_ianode_model.py +++ b/test/test_security_labels_ianode_model.py @@ -1,3 +1,26 @@ +# SPDX-License-Identifier: Apache-2.0 +# Originally developed by Telicent Ltd.; subsequently adapted, enhanced, and maintained by the National Digital Twin Programme. + + +# Copyright (c) Telicent Ltd. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Modifications made by the National Digital Twin Programme (NDTP) +# © Crown Copyright 2026. This work has been developed by the National Digital Twin Programme +# and is legally attributed to the UK's Department for Business, Innovation, Science and Trade (BIST) as the governing entity. + + import unittest from ianode_labels import SecurityLabelBuilder, IANodeLabelsV1