compliance-viewer

A small application to access scan results stored in S3. The data is generated by the Concourse CI Compliance Testing project.

Setup

Local

Requires Ruby 2.3+.

1. User Provided Services expose values via CloudFoundry's VCAP_SERVICES environment variable, in JSON. In development we mimic this. Run

   cp env/example.json env/development.json

2. Fill out the required fields. This JSON will be parsed the same way VCAP_SERVICES are parsed in production.

3. Run the application with

   npm install
   bundle
   rackup

cloud.gov

ENV

We provide environment variables via User Provided Services. You can set them all interactively.

cf cups compliance-viewer-env -p "results_folder, new_relic_license_key"

The cf env command can be used to verify that ENV vars have been set. Use cf uups to update existing values.

Org

The 18F instance of Compliance Viewer is deployed to cloud.gov in the cloud-gov-compliance-toolkit organization. If you are an 18F staff member and don't have access, ask someone in #cloud-gov-support to run:

cf set-org-role <your email> cloud-gov-compliance-toolkit OrgManager

S3

Compliance Viewer uses an S3 bucket provided by cloud.gov. First, create the S3 bucket:

cf target -o cloud-gov-compliance-toolkit -s prod
cf create-service s3 basic reports

Compliance Viewer relies on S3 bucket versioning. It can be enabled via the AWS CLI using:

aws s3api put-bucket-versioning --bucket BUCKET_NAME --versioning-configuration Status=Enabled

or checked via:

aws s3api get-bucket-versioning --bucket BUCKET_NAME

Deploy

Finally, cf push to launch the application.

Public domain

This project is in the worldwide public domain. As stated in CONTRIBUTING:

This project is in the public domain within the United States, and copyright and related rights in the work worldwide are waived through the CC0 1.0 Universal public domain dedication.

All contributions to this project will be released under the CC0 dedication. By submitting a pull request, you are agreeing to comply with this waiver of copyright interest.