Skip to content

Commit f578fe7

Browse files
markuslfmarkuslf
committed
chore: add SECURITY.md, FUNDING.yml, issue templates, dependabot, codeql, scorecard, dependency-review
1 parent 126bb48 commit f578fe7

8 files changed

Lines changed: 305 additions & 2 deletions

File tree

‎.github/FUNDING.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1 @@
1-
# These are supported funding model platforms
2-
31
github: 'linuxfabrik'

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: 'Bug report'
2+
description: 'Submit a bug report for LFOps'
3+
labels:
4+
- 'bug'
5+
body:
6+
- type: 'checkboxes'
7+
id: 'before-posting'
8+
attributes:
9+
label: 'Before submitting:'
10+
options:
11+
- label: 'I have searched existing issues to make sure this is not a duplicate.'
12+
required: true
13+
- label: 'I am using the latest release.'
14+
required: true
15+
- label: 'I agree to follow the [Code of Conduct](https://github.com/Linuxfabrik/lfops/blob/main/CODE_OF_CONDUCT.md).'
16+
required: true
17+
18+
- type: 'textarea'
19+
id: 'bug-description'
20+
attributes:
21+
label: 'Bug description'
22+
description: 'Provide a clear and concise description of the bug.'
23+
validations:
24+
required: true
25+
26+
- type: 'textarea'
27+
id: 'steps'
28+
attributes:
29+
label: 'Steps to reproduce'
30+
description: 'List the steps needed to reproduce the issue.'
31+
validations:
32+
required: true
33+
34+
- type: 'textarea'
35+
id: 'expected'
36+
attributes:
37+
label: 'Expected behavior'
38+
description: 'What did you expect to happen?'
39+
40+
- type: 'textarea'
41+
id: 'environment'
42+
attributes:
43+
label: 'Environment'
44+
description: 'Operating system, software version, and any other relevant details.'
45+
validations:
46+
required: true
47+
48+
- type: 'textarea'
49+
id: 'additional'
50+
attributes:
51+
label: 'Additional context'
52+
description: 'Any other information, logs, or screenshots.'

‎.github/ISSUE_TEMPLATE/feature_request.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: 'Feature request'
2+
description: 'Suggest a new feature or improvement for LFOps'
3+
labels:
4+
- 'enhancement'
5+
body:
6+
- type: 'textarea'
7+
id: 'solution'
8+
attributes:
9+
label: 'Describe the solution you would like'
10+
description: 'A clear and concise description of what you want to happen.'
11+
validations:
12+
required: true
13+
14+
- type: 'textarea'
15+
id: 'alternatives'
16+
attributes:
17+
label: 'Alternatives considered'
18+
description: 'Have you considered any alternative solutions or workarounds?'
19+
20+
- type: 'textarea'
21+
id: 'context'
22+
attributes:
23+
label: 'Additional context'
24+
description: 'Any other context or screenshots about the feature request.'

‎.github/dependabot.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: 'github-actions'
4+
directory: '/'
5+
schedule:
6+
interval: 'daily'

‎.github/workflows/codeql.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: 'CodeQL'
2+
3+
on:
4+
push:
5+
branches:
6+
- 'main'
7+
pull_request:
8+
branches:
9+
- 'main'
10+
schedule:
11+
- cron: '0 0 * * 1'
12+
13+
permissions:
14+
contents: 'read'
15+
16+
jobs:
17+
analyze:
18+
name: 'Analyze'
19+
runs-on: 'ubuntu-latest'
20+
permissions:
21+
actions: 'read'
22+
contents: 'read'
23+
security-events: 'write'
24+
25+
strategy:
26+
fail-fast: false
27+
matrix:
28+
language:
29+
- 'python'
30+
31+
steps:
32+
- name: 'Harden Runner'
33+
uses: 'step-security/harden-runner@v2'
34+
with:
35+
egress-policy: 'audit'
36+
37+
- name: 'Checkout repository'
38+
uses: 'actions/checkout@v4'
39+
40+
- name: 'Initialize CodeQL'
41+
uses: 'github/codeql-action/init@v3'
42+
with:
43+
languages: '${{ matrix.language }}'
44+
45+
- name: 'Autobuild'
46+
uses: 'github/codeql-action/autobuild@v3'
47+
48+
- name: 'Perform CodeQL Analysis'
49+
uses: 'github/codeql-action/analyze@v3'
50+
with:
51+
category: '/language:${{ matrix.language }}'

‎.github/workflows/dependency-review.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: 'Dependency Review'
2+
3+
on:
4+
pull_request: {}
5+
6+
permissions:
7+
contents: 'read'
8+
9+
jobs:
10+
dependency-review:
11+
runs-on: 'ubuntu-latest'
12+
steps:
13+
- name: 'Harden Runner'
14+
uses: 'step-security/harden-runner@v2'
15+
with:
16+
egress-policy: 'audit'
17+
18+
- name: 'Checkout repository'
19+
uses: 'actions/checkout@v4'
20+
21+
- name: 'Dependency Review'
22+
uses: 'actions/dependency-review-action@v4'

‎.github/workflows/scorecard.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: 'Scorecard supply-chain security'
2+
3+
on:
4+
branch_protection_rule: {}
5+
schedule:
6+
- cron: '22 14 * * 4'
7+
push:
8+
branches:
9+
- 'main'
10+
11+
permissions: 'read-all'
12+
13+
jobs:
14+
analysis:
15+
name: 'Scorecard analysis'
16+
runs-on: 'ubuntu-latest'
17+
permissions:
18+
security-events: 'write'
19+
id-token: 'write'
20+
21+
steps:
22+
- name: 'Harden Runner'
23+
uses: 'step-security/harden-runner@v2'
24+
with:
25+
egress-policy: 'audit'
26+
27+
- name: 'Checkout code'
28+
uses: 'actions/checkout@v4'
29+
with:
30+
persist-credentials: false
31+
32+
- name: 'Run analysis'
33+
uses: 'ossf/scorecard-action@v2'
34+
with:
35+
results_file: 'results.sarif'
36+
results_format: 'sarif'
37+
publish_results: true
38+
39+
- name: 'Upload artifact'
40+
uses: 'actions/upload-artifact@v4'
41+
with:
42+
name: 'SARIF file'
43+
path: 'results.sarif'
44+
retention-days: 5
45+
46+
- name: 'Upload to code-scanning'
47+
uses: 'github/codeql-action/upload-sarif@v3'
48+
with:
49+
sarif_file: 'results.sarif'

‎SECURITY.md‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
The latest version is currently supported and receives security updates.
6+
7+
8+
## Reporting a Vulnerability
9+
10+
We're extremely grateful for security researchers and users that report
11+
vulnerabilities to us. All reports are thoroughly investigated by our team.
12+
13+
Vulnerabilities are reported privately via GitHub's
14+
[Security Advisories](https://docs.github.com/en/code-security/security-advisories)
15+
feature. Please use the following link to submit your vulnerability:
16+
[Report a vulnerability](https://github.com/Linuxfabrik/lfops/security/advisories/new)
17+
18+
Please see
19+
[Privately reporting a security vulnerability](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability)
20+
for more information on how to submit a vulnerability using GitHub's interface.
21+
22+
23+
### When Should I Report a Vulnerability?
24+
25+
* You think you discovered a potential security vulnerability
26+
* You are unsure how a vulnerability affects your system
27+
* You think you discovered a vulnerability in another project that this project depends on
28+
- For projects with their own vulnerability reporting and disclosure process, please report it directly there
29+
30+
### When Should I NOT Report a Vulnerability?
31+
32+
* You need help tuning your System for security
33+
* You need help applying security related updates
34+
* Your issue is not security related
35+
36+
37+
### Vulnerability Response
38+
39+
Each report is acknowledged and analyzed within 30 days.
40+
41+
Any vulnerability information stays within this project and will not be disseminated to other projects
42+
unless it is necessary to get the issue fixed.
43+
44+
As the security issue moves from triage, to identified fix, to release planning
45+
we will keep the reporter updated.
46+
47+
48+
## Security Release & Disclosure Process
49+
50+
Security vulnerabilities should be handled quickly and sometimes privately. The
51+
primary goal of this process is to reduce the total time users are vulnerable
52+
to publicly known exploits.
53+
54+
55+
### Private Disclosure
56+
57+
We ask that all suspected vulnerabilities be privately and responsibly
58+
disclosed via the [private disclosure process](#reporting-a-vulnerability)
59+
outlined above.
60+
61+
Fixes may be developed and tested by our team in a
62+
[temporary private fork](https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/collaborating-in-a-temporary-private-fork-to-resolve-a-repository-security-vulnerability)
63+
that are private from the general public if deemed necessary.
64+
65+
66+
### Public Disclosure
67+
68+
Vulnerabilities are disclosed publicly as GitHub [Security
69+
Advisories](https://github.com/Linuxfabrik/lfops/security/advisories).
70+
71+
A public disclosure date is negotiated by our team
72+
and the bug submitter. We prefer to fully disclose the bug as soon as possible
73+
once a user mitigation is available. It is reasonable to delay disclosure when
74+
the bug or the fix is not yet fully understood, the solution is not
75+
well-tested, or for vendor coordination. The timeframe for disclosure is from
76+
immediate (especially if it's already publicly known) to several weeks. For a
77+
vulnerability with a straightforward mitigation, we expect report date to
78+
disclosure date to be on the order of 30 days.
79+
80+
If you know of a publicly disclosed security vulnerability please IMMEDIATELY
81+
[report the vulnerability](#reporting-a-vulnerability) to inform the team about the vulnerability so they may start the
82+
patch, release, and communication process.
83+
84+
If possible the team will ask the person making the public report if
85+
the issue can be handled via a private disclosure process. If the reporter
86+
denies the request, the team will move swiftly with the fix and
87+
release process. In extreme cases you can ask GitHub to delete the issue but
88+
this generally isn't necessary and is unlikely to make a public disclosure less
89+
damaging.
90+
91+
### Security Releases
92+
93+
Once a fix is available it will be released and announced via the project on
94+
GitHub.
95+
Security releases will announced and clearly marked as a security release and
96+
include information on which vulnerabilities were fixed. As much as possible
97+
this announcement should be actionable, and include any mitigating steps users
98+
can take prior to upgrading to a fixed version.
99+
100+
Fixes will be applied in new releases and all fixed vulnerabilities will be noted in
101+
the [CHANGELOG](./CHANGELOG.md).

0 commit comments

Comments
 (0)