Aman-Mittal opened a new issue, #377: URL: https://github.com/apache/fineract-backoffice-ui/issues/377
Tracking issue for the **first official release** of the Fineract Backoffice UI, following the pattern other ASF projects use for a major release meta-issue (Airflow's `Release Airflow 3.0` / `Release Airflow 2.0` issues are the model). > **This issue tracks the work. It does not replace the vote.** Per ASF release policy the binding vote happens on `[email protected]` and needs **three binding +1s from PMC members**. Nothing here is authoritative until that thread passes. ## Business Value A release turns this repository into something an institution can adopt. Today there is no version anyone can name, no artifact anyone can download, and no published statement of what was tested — so a deployer evaluating it has to read the source and take the rest on trust. A released 1.0.0 gives them a fixed point: a version number, a signed source artifact with LICENSE and NOTICE, an SBOM, a dependency-licence report, and an honest list of what does and does not work against which Fineract version. It matters to the project too. The UI already enforces route-level authorization, keeps navigation and route permissions from drifting apart in CI, and proves in its own tests that *Fineract itself* refuses what the UI refuses. None of that is visible to anyone who has not read the repository. A release is how that work becomes usable — and how the community gets a version to file bugs against instead of "main as of last Tuesday". --- ## Status: READY FOR 1.0.0-RC.1 ONLY A full release-readiness audit was run against **`0846def1e7ce08cab809752f1808c2aa16b56f62`**. Every check below was executed on that commit and observed; none is inferred from a green CI badge. The software is in good shape. **The release engineering is what is missing**, and every blocker is hours of work rather than weeks. ### Verified green | | | |---|---| | Unit tests | **1093/1093** + 2/2 (MFE project) | | E2E | 325 passed; 8 failures **all attributed to host contention**, green when re-run the way CI runs them (12/12 and 3/3) | | E2E — two-factor, real backend | **3 passed** on a dedicated stack | | GA gates | **8/9, 0 blocking** — the single advisory failure is an internal refactor counter that only has to fall | | Build, lint, format, i18n, icons, internal endpoints, route permissions, e2e typecheck, licence headers | all pass | | Apache RAT 0.17 | **706 approved, 0 unapproved** — and the gate was *proved* to exit 1 on a real violation rather than taken on trust | | Production dependency licences | **26/26 ASF Category A** (22 MIT, 2 Apache-2.0, 1 BSD-2-Clause, 1 0BSD) | | Production vulnerabilities | **0** (`npm audit --omit=dev`) | | Permission codes | **223 declared, 223 real** — validated against the platform's own 699-code catalogue. None invented. | | API contract currency | committed spec is **operation-for-operation identical to Fineract head**: 594 paths, 958 operations, 0 added, 0 removed | | Supply chain | all 13 GitHub Actions SHA-pinned, least-privilege permissions, no `pull_request_target`, checksum-verified RAT download, dependabot + CodeQL + zizmor + a signed-commit gate | | Coverage | 73.7% statements excluding the generated OpenAPI client; every security-critical file ≥90%, guards and navigation config at 100% | | Functional inventory | 27 areas, 333 routes, 302 components, **0 TODO/FIXME/HACK**, no dead routes, no placeholder screens | ### Blockers for a 1.0.0 tag - [ ] **V1 — the project has no version.** `package.json` is `0.0.0`, and it is not cosmetic: it reaches `dist/…/remoteEntry.json` as `"version": "0.0.0"` for every shared federation dependency, and the SBOM's `metadata.component.version`. - [ ] **D1 — no release documentation.** No `RELEASING.md`, no changelog, no KEYS reference, no description of how a candidate is built, signed, staged or verified. For a *first* release, where the PMC votes on the process as much as on the payload, this is the largest single gap. - [ ] **L1 — one Category X licence needs a PMC/Legal ruling.** `[email protected]` is **LGPL-3.0-only**. It is a direct devDependency wired into `eslint.config.js`, used only to lint, and absent from both the production dependency tree and `dist/` — but it is named in `package.json`, which travels in a source tarball. - [ ] **E1 — the container cannot reach a backend, in either documented configuration.** Verified by building and running the image: `GET /api/v1/authentication` returns **200 `text/html`, 7546 bytes — the SPA's own shell** — because `deploy/nginx.conf` has no API proxy. The cross-origin alternative is blocked by the CSP that same file serves (`connect-src 'self'`). The README's own `/api/ → proxy to Fineract` example is not implemented in `nginx.conf`. - [ ] **E2 — `deploy/docker-compose.yml` defaults to a third-party public demo host.** An ASF deployment artifact should not default to sending an operator's credentials to a server the project does not control. - [ ] **E3 — the image build ignores the lockfile.** `deploy/Dockerfile` runs `npm install`, not `npm ci` — exactly what CI's "Dependency Integrity" job exists to forbid. A published image would not be reproducible from the lockfile the SBOM describes. **E1–E3 bind only if the release ships a container.** For a source-only release they drop to P2 and the remaining blockers are V1, D1 and L1. ### Decisions only the PMC can make - [ ] **Artifact scope** — source tarball only, or source plus a convenience container? Attribution, E1–E3 and the Docker Hub question all follow from this, and nothing else can be finalised without it. - [ ] **The LGPL-3.0 lint dependency** — acceptable as build-only tooling in a source release, or replace before an RC? - [ ] **Version number, and when the "not release-ready" notice in `security.md` comes out.** That notice stays until the PMC says otherwise; the audit did not remove it. - [ ] **Target Fineract version.** Everything today — the committed OpenAPI contract, the generated client, and the real-backend E2E suite — is validated against **head** (`1.16.0-SNAPSHOT`, git describe `1.15.0-303-gf4f927e`). If the release should be retrospective to **1.15**, that compatibility is currently *unevidenced*, and a compatibility job is needed before the vote. - [ ] **Approve a release manager.** ### Release checklist - [ ] Set the version; add a CI assertion that the tag and `package.json` agree - [ ] `RELEASING.md` + `CHANGELOG.md` - [ ] RM signing key published and added to KEYS - [ ] Resolve or defer E1–E3 per the artifact-scope decision - [ ] Correct the copyright year in `NOTICE` and `README.md` (both read 2025) - [ ] Fix `security.md`'s configuration table — it places `rbacEnabled` in `environment.ts` as a build flag; it is a runtime `config.json` key - [ ] Remove the broken `GEMINI.md` link from `README.md` - [ ] Tag `1.0.0-RC.1`, build the source tarball, sign (`.asc`), checksum (`.sha512`) - [ ] **Run RAT over the tarball, not the working tree** — a RAT run over a git checkout is not evidence about the artifact - [ ] Stage in `dist.apache.org/repos/dist/dev/fineract/` - [ ] `[VOTE]` on `[email protected]`, ≥72 hours, 3 binding +1 - [ ] `svn mv` to `release/`, wait for mirrors, `[ANNOUNCE]` ### Known limitations for the release notes Three features are **blocked by verified Fineract defects on PostgreSQL**, not by UI gaps — see #376: | Item | What the platform does | |---|---| | GLIM | creation fails: `null value in column "principal_amount" of relation "glim_accounts" violates not-null constraint` | | GSIM | accepts the request, answers `gsimId: 0`, forms no parent record | | Centre collection sheet | `command=generateCollectionSheet` → 500, `operator does not exist: boolean = integer` | Also for the notes: - **Migration-affecting change.** Previously an authenticated user could reach many screens by typing the URL. Protected routes now require the corresponding permission, so a user whose role lacks a code loses access to screens they could previously open. This is intended, and it matches what the backend was already refusing. `rbacEnabled: false` in `config.json` restores the previous behaviour for a deployment that needs to stage the change. - **Hindi and Korean are 20.9% translated** — 459 keys each against 2200 in `en.json`. Untranslated strings fall back to English rather than rendering as raw keys (verified), but the application offers three languages and delivers one. - **One WCAG 2.1 AA contrast failure.** `--ion-color-primary: #3498db` with white text is **3.15:1** against the 4.5:1 requirement for normal-size text. That is arithmetic on the committed theme, not a flaky test. **No WCAG compliance is claimed anywhere in the documentation**, and that should stay true. ### Evidence The full audit report and its raw evidence are in `audit/release-1.0.0/`: the report itself, both CycloneDX 1.6 SBOMs (23 production / 932 full components), the licence reports, `npm audit` output, the RAT report, the platform permission catalogue as fetched, and every E2E and container-build log. > **On attachments:** GitHub's API cannot upload files to an issue — attachments require a browser upload. The SBOM and logs therefore need to be either dragged into a comment by hand, committed under `audit/`, or published as release assets. Flagging that rather than leaving it implied. Demo videos are not yet recorded; `npm run demo:record` produces them under `demo-recordings/`. --- Self-serve, and deliberately unassigned. Comment here to pick up any checklist item. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
