While the application requires users to choose a project they created and for which they committed the code, the focus of the application isn’t the project, but the users who apply, will get a new Drupal role necessary to be able to opt into security coverage for projects they are owner or maintainer in.<\/p>\n
Preparation<\/h3>\n\nBefore opening an application, please check the issues reported by\u00a0phpcs --<\/span>standard=<\/span>Drupal,<\/span>DrupalPractice<\/code> the project that will be used for the application and fix everything that needs to be fixed. That alone fixes most of what reviewers will report. Although it does not resolve every issue, the application approval is faster.<\/p>\n<\/div>\nBefore\u00a0entering the project application process, the following conditions must be met.<\/p>\n
\n- There isn’t another, still open, application from the same user. This includes postponed applications.<\/li>\n
- The user who applies cannot yet opt for projects into security advisory coverage<\/a>.<\/li>\n
- The user who applies has committed code in the project used for the application (not an issue fork created to fix an issue in an existing project). Those commits must be (preferably) the only ones done in the branch used for the application, or be most of the commits for that branch.<\/li>\n
- The account used to create the application (and to commit code in the project) isn’t a shared account. Shared accounts aren’t allowed to commit code on Drupal.org repositories.<\/li>\n
- There is sufficient PHP code to see what the user who created the application understands of Drupal coding standards, Drupal APIs, and Drupal best practices; a project that only implements a hook or two to, for example, add a library (CSS or JavaScript) to most or all the Drupal pages doesn’t contain sufficient PHP code for these applications.<\/li>\n<\/ul>\n
Application process<\/h3>\n\n- Obtain basic Git access<\/a>\u00a0and\u00a0create a project<\/a>\u00a0for your code.<\/li>\n
- Get your project into a state you feel is release-ready;\u00a0ideally, you would commit the project early and have a track record of several weeks\/months of commits so that application reviewers can get an idea of your development and maintenance style.<\/li>\n
- Have a look at the\u00a0security advisory coverage applications checklist<\/a>\u00a0and try to resolve the common issues.<\/li>\n
- Once ready,\u00a0create a new issue<\/a>\u00a0in the\u00a0Drupal.org security advisory coverage applications<\/em> queue. Fill out the issue form.
\n![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2023\/03\/1-1-300x217.png\")
<\/p>\n\n- Title:<\/strong> The branch name and the project name (For example, for the 2.0.x branch of the project Email Octopus<\/em>, then the title would be [2.0.x] Email Octopus.)<\/li>\n
- Category:<\/strong>\u00a0Task<\/em><\/li>\n
- Status:<\/strong>\u00a0Needs review\u00a0<\/em>or, if you want reviewers to wait before reviewing the project,\u00a0Active<\/em><\/li>\n
- Component:<\/strong>\u00a0Select the option that better describes the type of project used for the application<\/li>\n
- Description<\/strong>\n
\n- Write a detailed description of what your project does, including how it is different from other, similar, projects (if applicable)<\/li>\n
- For themes, a screenshot is also helpful<\/li>\n
- Add the link to the project page<\/li>\n
- Add the list of links to reviews of other project applications that you did
![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2023\/03\/2-296x300.png\")
\u00a0<\/span><\/li>\n<\/ol>\n<\/li>\n<\/ul>\n<\/li>\n- Reviewers will then examine the project files and provide feedback over the coming days\/weeks (again see Review process for security advisory coverage: What to expect<\/a>). You can always ask what to do, if you don’t understand it in first time.<\/li>\n
- As the application process is fully volunteer-driven, many of our most active reviewers may use the review bonus program<\/a> to prioritize which applications they review. This program gives priority to those who are also helping to review other applications. Participation is not mandatory, but it does provide a significant fast track through the application process. Due to limited resources, it could otherwise take a number of weeks between reviews of your own application. To participate in the Review Bonus<\/em>\u00a0program, review three other\u00a0applications<\/a> and reference them in your own application.
![\"\"](\"\/blog\/wp-ttn-blog\/uploads\/2023\/03\/3-300x261.png\")
<\/li>\n- Once given the sign-off, you will be able to opt all your projects into security advisory coverage. Once this comes into place, there is no need to submit another application for review, since (at this stage) you are considered a trusted contributor.
\n<\/em><\/strong><\/li>\n<\/ol>\nWhat next steps are?<\/h3>\n
Once the application is fixed, and you have the role that allows you to opt projects into security advisory coverage, you can edit the project to change the value assigned to the Security advisory coverage<\/em>\u00a0field.<\/p>\nYou will be able to opt into security advisory coverage for every project you create, including the ones created in the past.<\/p>\n
Keeping in mind these pointers.<\/strong><\/p>\n\n- Once the project opts for security advisory, it can’t be undone, so please be careful while doing that, but you can always mark your releases as recommended(provides green shield) or not.<\/li>\n
- Use correct branch naming and tags versioning.<\/li>\n
- Before providing any stable release, clear the project issue queue, so your release may not have already reported bugs.<\/li>\n
- Providing green shield stable release builds more trust for the end user in terms of security and code. So make sure you first have dev, beta, and alpha releases. Then provide the stable release.<\/li>\n<\/ol>\n
Once you are clear with all the processes and best practices, you can also start reviewing the other project applications and suggest feedback and can get credit for that issue.<\/em><\/strong><\/p><\/blockquote>\nThanks, Hope this helps.<\/p>\n
<\/div>","protected":false},"excerpt":{"rendered":"Aim The aim of this is to obtain a new Drupal role (vetted) after verifying what the user who applies understands about writing secure code\u00a0that follows the\u00a0Drupal coding standards\u00a0and correctly uses the\u00a0Drupal APIs, following the Drupal best practices. While the application requires users to choose a project they created and for which they committed the […]<\/p>\n","protected":false},"author":1343,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":2},"categories":[3602],"tags":[4862],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/56986"}],"collection":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/users\/1343"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/comments?post=56986"}],"version-history":[{"count":4,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/56986\/revisions"}],"predecessor-version":[{"id":57046,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/56986\/revisions\/57046"}],"wp:attachment":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/media?parent=56986"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/categories?post=56986"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/tags?post=56986"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Before opening an application, please check the issues reported by\u00a0 Before\u00a0entering the project application process, the following conditions must be met.<\/p>\n Once the application is fixed, and you have the role that allows you to opt projects into security advisory coverage, you can edit the project to change the value assigned to the Security advisory coverage<\/em>\u00a0field.<\/p>\n You will be able to opt into security advisory coverage for every project you create, including the ones created in the past.<\/p>\n Keeping in mind these pointers.<\/strong><\/p>\n Once you are clear with all the processes and best practices, you can also start reviewing the other project applications and suggest feedback and can get credit for that issue.<\/em><\/strong><\/p><\/blockquote>\n Thanks, Hope this helps.<\/p>\n Aim The aim of this is to obtain a new Drupal role (vetted) after verifying what the user who applies understands about writing secure code\u00a0that follows the\u00a0Drupal coding standards\u00a0and correctly uses the\u00a0Drupal APIs, following the Drupal best practices. While the application requires users to choose a project they created and for which they committed the […]<\/p>\n","protected":false},"author":1343,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":2},"categories":[3602],"tags":[4862],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/56986"}],"collection":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/users\/1343"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/comments?post=56986"}],"version-history":[{"count":4,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/56986\/revisions"}],"predecessor-version":[{"id":57046,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/56986\/revisions\/57046"}],"wp:attachment":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/media?parent=56986"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/categories?post=56986"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/tags?post=56986"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}phpcs --<\/span>standard=<\/span>Drupal,<\/span>DrupalPractice<\/code> the project that will be used for the application and fix everything that needs to be fixed. That alone fixes most of what reviewers will report. Although it does not resolve every issue, the application approval is faster.<\/p>\n<\/div>\n\n
Application process<\/h3>\n
\n
\n<\/p>\n\n
\n
\u00a0<\/span><\/li>\n<\/ol>\n<\/li>\n<\/ul>\n<\/li>\n<\/li>\n
\n<\/em><\/strong><\/li>\n<\/ol>\nWhat next steps are?<\/h3>\n
\n