Install Security Policy App: Allstar

Question

Install Security Policy App: Allstar

jeffmendoza opened this issue 3 years ago · comments

I'd like to install Allstar https://github.com/ossf/allstar https://github.com/apps/allstar-app on this repo as a trail for eventually enabling on all envoyproxy org repos.

Allstar checks repos for violations against configured security policies, and takes actions when out of compliance:

Policies:

Branch Protection settings
SECURITY.md present
No non-org Admins (outside collaborators)
No binary artifacts.

Actions:

Create a GitHub Issue
Fix the issue (being developed)

Which policies to enable and which action to take are configured via config files in either an org-level repo named .allstar or files in the individual repo. This lets org owners control the main repo to manage settings.

I'll work with the org-owners to get it installed and configured with settings appropriate for the Envoy community.
cc @lizan @htuch @mattklein123

asraa · Answer 1 · Fri Jul 23 2021 04:53:34 GMT+0800 (China Standard Time)

Thanks! Just to reiterate: as of right now these policies should be passing on envoy repos, so there shouldn't be any noise. It will alert on changes.

htuch · Answer 2 · Fri Jul 23 2021 10:40:57 GMT+0800 (China Standard Time)

This seems reasonable to me. @snowp?

asraa · Answer 3 · Thu Jul 29 2021 01:58:39 GMT+0800 (China Standard Time)

friendly ping @snowp?

Snow Pettersen · Answer 4 · Thu Jul 29 2021 02:01:59 GMT+0800 (China Standard Time)

Already talked to @htuch on Slack about this, I'm in favor of this

asraa · Answer 5 · Thu Jul 29 2021 02:03:28 GMT+0800 (China Standard Time)

Awesome, sorry about that! @jeffmendoza and I can make a PR for the configuration YAML

htuch · Answer 6 · Thu Jul 29 2021 11:23:36 GMT+0800 (China Standard Time)

I've installed the app, please update when it's functional at your end :)