Page History

...

• Named security contacts per project (at least two)

• Security issue reporting process defined in SECURITY.md with reference to Hyperledger reporting process

• Security issue disclosure process - see Disclosure task force

• Leverage automated scans

  • linters

  • Software Composition Analysis dependency scans, e.g. Dependabot, Govulncheck (depends on language) 

  • Static Application Security Testing (SAST) aka static analysis scans, e.g. CodeQL, Snyk
    

• Keep dependencies up to date (e.g. Dependabot)

• Security audits for Graduated project major releases

• Review OpenSSF secure developer guide

• Review and obtain OpenSSF Best Practices Badge - criteria

• Security Artifact Signing - proposed task force - https://github.com/hyperledger/toc/issues/49

Documentation - see also Documentation task force and Onboarding task forces

...

• GitHub Actions recommended

• Pull request checks

  • DCO

  • Unit tests

  • Integration tests

  • Scans - see Security section, more comprehensive scans can be run nightly instead

• Test coverage reporting

• See proposed Automated Pipelines task force - https://github.com/hyperledger/toc/issues/44

GitHub suggestions

• Use .github/settings.yml so that repository settings can be managed and tracked via pull requests

• Recommended initial repository settings, e.g. Repository options, Branch protection rules

• Rebase merging is preferred over Merge commits and Squash merging to keep commit history clean (assuming contributors squash/amend their own pull requests)

• Although there are often multiple paths to achieve an outcome in git and GitHub, there is value in defining a suggested path, both for the benefit of new GitHub users, and for the sake of project consistency.

  • Examples - amending commits versus squashing commits, Mergifyio to simplify cherry picks and backports.

  • Example guidance - https://hyperledger-fabric.readthedocs.io/en/latest/github/github.html