diff --git a/README.md b/README.md index 614bbe91..76815941 100644 --- a/README.md +++ b/README.md @@ -29,34 +29,34 @@ To run the API and/or Admin servers run the following commands ### Both Admin + API ```bash -#NPM: +#NPM: npm start -#CLI: +#CLI: node src/index.js server ``` -### API +### API ```bash -#NPM: +#NPM: npm run start:api -#CLI: +#CLI: node src/index.js server --api ``` -### Admin +### Admin ```bash -#NPM: +#NPM: npm run start:admin -#CLI: +#CLI: node src/index.js server --admin ``` ## Tests -### Unit Testing +### Unit Testing Running unit tests ```bash @@ -144,8 +144,36 @@ For more information on anchore and anchore-cli, refer to: - [Anchore CLI](https://github.com/anchore/anchore-cli) - [Circle Orb Registry](https://circleci.com/orbs/registry/orb/anchore/anchore-engine) +## Automated Releases +As part of our CI/CD process, we use a combination of CircleCI, standard-version +npm package and github-release CircleCI orb to automatically trigger our releases +and image builds. This process essentially mimics a manual tag and release. -## Additional Notes: +On a merge to master, CircleCI is configured to use the mojaloopci github account +to push the latest generated CHANGELOG and package version number. -- For all put parties callbacks `FSPIOP-Destination` header is considered to be mandatory. +Once those changes are pushed, CircleCI will pull the updated master, tag and +push a release triggering another subsequent build that also publishes a docker image. + +### Potential problems + +* There is a case where the merge to master workflow will resolve successfully, triggering + a release. Then that tagged release workflow subsequently failing due to the image scan, + audit check, vulnerability check or other "live" checks. + + This will leave master without an associated published build. Fixes that require + a new merge will essentially cause a skip in version number or require a clean up + of the master branch to the commit before the CHANGELOG and bump. + + This may be resolved by relying solely on the previous checks of the + merge to master workflow to assume that our tagged release is of sound quality. + We are still mulling over this solution since catching bugs/vulnerabilities/etc earlier + is a boon. + +* It is unknown if a race condition might occur with multiple merges with master in + quick succession, but this is a suspected edge case. + +## Additional Notes: + +- For all put parties callbacks `FSPIOP-Destination` header is considered to be mandatory.