Publish the eng-pipes repo

[chadwhitacre]

The eng-pipes repo is one of two that OSPO engineers spend the most time in (the other is self-hosted). It's private only by historical accident, it really should be public. I want this especially because it will make hiring easier, we can link people to the repo and the best candidates can engage with us there as part of their application.

• Switch to Apache license (no reason for it to be BSL, it's not a core component of Sentry-the-product)
  • Switch to Apache license eng-pipes#414
• Go through security review🔒.
• Resolve critical and high dependabot vulns.
• Flip the bit.

Security Review

• Repo has a suitable license.
• Dependabot is configured, if applicable.
  • Review current dependabot alerts and resolve all critical or high severity findings.
• Code scanning (CodeQL) is enabled, if applicable.
  • CodeQL is typically not available (for free) to private repos, so enabling this may not be possible until the repo is public. Be prepared to submit a PR as soon as the repo is made public.
• Secret scanning is enabled. (requires public repo or GHAS on private repos)
• Review for any leaked secrets.
  • Run gitleaks and ensure there are no detected secrets.
  • Review any screenshots for potential captures of API tokens, session cookies, etc.
  • git log -p if the repo is small and manually scan for anything sensitive.
• Review repo settings and environment variables.
  • Do all secrets exist under “Secrets” ?
• Review any Github Actions.
  • Ensure there is no accidental printing of a secret value.
  • Ensure there is no basic encoding of a secret value that is printed (e.g. base64).
• Review configured webhooks.
  • Are all URLs expected destinations?
  • Are they documented somewhere, either in Notion or the repo, and their purpose understood?
  • Do they use sufficiently strong secrets for signing.
• Does the main branch have a protection rule in place requiring an approved PR to merge?
• Review collaborators on the repo.
  • Are access levels properly scoped (e.g. least privilege)?
  • Are all collaborators Sentry employees?

[BYK]

UNLEASH THE KRAKEN! 🎉 🐙

[chadwhitacre]

Security review submitted for Security review. ;)🤞

[mdtro]

Security review. ✅

[chadwhitacre]

Done! Announced internally and externally.