Skip to content

setup.md

Latest commit

 

History

History
61 lines (41 loc) · 3.07 KB

setup.md

File metadata and controls

61 lines (41 loc) · 3.07 KB
Raw

Repository setup

Settings for this repository (or a fork of it).

Repository settings

Settings → General:

Field Value
Description Reusable GitHub Actions workflows and composite actions for the sogeor DevSecOps platform: pinned, least-privilege CI building blocks.
Website empty until the documentation site exists
Topics github-actions, reusable-workflows, composite-actions, ci-cd, devsecops, supply-chain-security, security-hardening, openssf-scorecard, renovate, mkdocs, platform-engineering

Include in the home page: Releases — on after the first release; Deployments — off; Packages — off.

Settings → General → Pull Requests: only Allow squash merging; enable Automatically delete head branches.

Access for callers

Settings → Actions → General → Access: the repository is public, so public callers can use it without changes. For private repositories of the same organization select Accessible from repositories in the 'sogeor' organization.

Ruleset

Settings → Rules → Rulesets → New branch ruleset:

  1. Name master, Enforcement status Active, target branch Default.
  2. Enable Restrict deletions, Require signed commits, Require a pull request before merging (0 approvals), Block force pushes.
  3. Require status checks to pass, Require branches to be up to date; add linters, docs / docs, security-lite / gitleaks, security-lite / trivy, security-lite / semgrep, security-lite / checkov, scorecard / Scorecard analysis.
  4. Bypass list: Repository admin, mode For pull requests only.

Advanced Security

Settings → Advanced Security: Private vulnerability reporting — on; Dependency graph — on; Dependabot alerts — on; Dependabot security and version updates — off (Renovate is used); Secret Protection and Push protection — on; CodeQL analysis — Default setup with language actions.

Environments for callers

Infrastructure workflows read credentials from an Environment of the caller repository.

  1. Settings → Environments → New environment, name as passed in environment (for example images).
  2. Deployment branches and tags → Selected branches and tags → Add deployment branch or tag rule: master. A read-only plan Environment (for example mgmt-plan) may allow all branches.
  3. Environment secrets → Add environment secret and Environment variables → Add environment variable for every name in Configuration. Values without leading or trailing whitespace.

Renovate

Install the Renovate GitHub App for this repository (Only select repositories). The configuration is in renovate.json.

Scorecard

  1. Create a fine-grained personal access token: resource owner sogeor, repository workflows, permission Administration: Read-only, expiration 1 year.
  2. Settings → Secrets and variables → Actions → New repository secret: name SCORECARD_TOKEN, value — the token.