Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[security] audit repository tooling #4453

Closed
3 of 8 tasks
arademm opened this issue Oct 21, 2023 · 2 comments
Closed
3 of 8 tasks

[security] audit repository tooling #4453

arademm opened this issue Oct 21, 2023 · 2 comments
Milestone

Comments

@arademm
Copy link

arademm commented Oct 21, 2023

The security SIG is looking to ensure that security tooling is setup consistently across the organization. As a result, we're asking maintainers to ensure the following tools are enabled in each repository:

  • CodeQL enabled via GitHub Actions
  • Static code analysis tool (the collector uses govulncheck [https://pkg.go.dev/golang.org/x/vuln] on every build)
  • Repository security settings
    • Security Policy ✅
    • Security advisories ✅
    • Private vulnerability reporting ✅
    • Dependabot alerts ✅
    • Code scanning alerts ✅

Parent issue: open-telemetry/sig-security#12

@codeboten
Copy link
Contributor

This was already done here: #4413, the issue can be closed

@arademm
Copy link
Author

arademm commented Oct 25, 2023

Noted

@arademm arademm closed this as completed Oct 25, 2023
@pellared pellared added this to the untracked milestone Nov 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants