Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[security] audit repository tooling #208

Open
3 of 8 tasks
Tracked by #12
arademm opened this issue Oct 21, 2023 · 1 comment
Open
3 of 8 tasks
Tracked by #12

[security] audit repository tooling #208

arademm opened this issue Oct 21, 2023 · 1 comment

Comments

@arademm
Copy link

arademm commented Oct 21, 2023

The security SIG is looking to ensure that security tooling is setup consistently across the organization. As a result, we're asking maintainers to ensure the following tools are enabled in each repository:

  • CodeQL enabled via GitHub Actions
  • Static code analysis tool (the collector uses govulncheck [https://pkg.go.dev/golang.org/x/vuln] on every build)
  • Repository security settings
    • Security Policy ✅
    • Security advisories ✅
    • Private vulnerability reporting ✅
    • Dependabot alerts ✅
    • Code scanning alerts ✅

Parent issue: open-telemetry/sig-security#12

@tigrannajaryan
Copy link
Member

We use Renovatebot instead of Dependabot, I think it ticks the box.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants