...
Named security contacts per project (at least two)
Security issue reporting process defined in SECURITY.md with reference to Hyperledger reporting process
Security issue disclosure process - see Disclosure task force
Leverage automated scans
linters
Software Composition Analysis dependency scans, e.g. Dependabot, Govulncheck (depends on language)
Static Application Security Testing (SAST) aka static analysis scans, e.g. CodeQL, Snyk
Keep dependencies up to date (e.g. Dependabot)
Security audits for Graduated project major releases
Review and obtain OpenSSF Best Practices Badge - criteria
Security Artifact Signing - proposed task force - https://github.com/hyperledger/toc/issues/49
Documentation - see also Documentation task force and Onboarding task forces
...
GitHub Actions recommended
Pull request checks
DCO
Unit tests
Integration tests
- Scans - see Security section, more comprehensive scans can be run nightly instead
Test coverage reporting
See proposed Automated Pipelines task force - https://github.com/hyperledger/toc/issues/44
GitHub suggestions
Use .github/settings.yml so that repository settings can be managed and tracked via pull requests
Recommended initial repository settings, e.g. Repository options, Branch protection rules
Rebase merging is preferred over Merge commits and Squash merging to keep commit history clean (assuming contributors squash/amend their own pull requests)
Although there are often multiple paths to achieve an outcome in git and GitHub, there is value in defining a suggested path, both for the benefit of new GitHub users, and for the sake of project consistency.
Examples - amending commits versus squashing commits, Mergifyio to simplify cherry picks and backports.
Example guidance - https://hyperledger-fabric.readthedocs.io/en/latest/github/github.html