Repository navigation
Expand file tree
/
Copy pathexample-full.yml
More file actions
156 lines (154 loc) · 5.57 KB
/
Copy pathexample-full.yml
File metadata and controls
156 lines (154 loc) · 5.57 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
header:
schema-version: 2.2.0
last-updated: '2025-03-01'
last-reviewed: '2025-04-01'
url: https://example.com/foo/bar/raw/branch/main/security-insights.yml
comment: |
This file contains all possible information for both project and repository,
though it is not required to include all of this information every time.
Nor is it required to include both a project and repository section if the project
section is intended to be inherited by repositories via header.project-si-source
project:
name: FooBar
homepage: https://example.com
funding: https://example.com/FUNDING.yml
roadmap: https://example.com/roadmap.html
steward:
uri: https://example.com
comment: |
Some description of the relationship between this project and its steward.
administrators:
- name: Joe Dohn
affiliation: Foo
email: joe.bob@email.com
social: https://social.example.com/joebob
primary: true
documentation:
quickstart-guide: https://example.com/quickstart
detailed-guide: https://example.com/user-guide
code-of-conduct: https://example.com/code-of-conduct.html
release-process: https://example.com/release-process
support-policy: https://example.com/support-policy
signature-verification: https://example.com/signature-verification
repositories:
- name: Foo
url: https://example.com/foobar/foo
comment: |
Foo is the core repo for FooBar.
- name: Bar
url: https://example.com/foobar/bar
comment: |
Bar is a subproject repo.
vulnerability-reporting:
reports-accepted: true
bug-bounty-available: true
bug-bounty-program: https://example.com/bugs.html
contact:
name: The security team at FooBar Enterprise provides security support for this project.
email: security@something.com
primary: true
policy: https://example.com/reporting.html
in-scope:
- broken access control
- other
out-of-scope:
- other
pgp-key: |
your-key-here
comment: |
Lorum ipsum...
repository:
url: https://example.com/foobar/foo
status: active
bug-fixes-only: false
accepts-change-request: true
accepts-automated-change-request: true
no-third-party-packages: false
core-team:
- name: Alice White
affiliation: Foo Bar
email: alicewhite@example.com
social: https://social.example.com/alicewhite
primary: true
documentation:
contributing-guide: https://example.com/contributing-guide
review-policy: https://example.com/review-policy
security-policy: https://example.com/security-policy.html
governance: https://example.com/governance
dependency-management-policy: https://example.com/dependency-management-policy
license:
url: https://example.com/LICENSE
expression: MIT
release:
changelog: https://example.com/release/{version}#changelog
automated-pipeline: true
attestations:
- name: Release VEX
predicate-uri: https://intoto.VEX
location: https://example.com/release/{version}#vex
comment: Replace {version} with the actual version number for the release you want VEX data for.
- name: Release SBOM
predicate-uri: https://intoto.SPDX
location: https://example.com/release/{version}#spdx
comment: Replace {version} with the actual version number for the release you want an SBOM for.
- name: Maintainer Identity VSA
location: https://example.com/maintainer-identity
predicate-uri: https://slsa.dev/verification_summary/v1
comment: |
This is a VSA that details how trust identities were established for maintainers of the project.
- name: SCA Scan Results
location: https://example.com/test-results#{version}
predicate-uri: https://slsa.dev/test_results/{version}
comment: Results from SCA scan for a specific version
distribution-points:
- uri: https://example.com/foo
comment: GitHub Release Page
- uri: pkg:npm/foobar
comment: NPM Package
license:
url: https://example.com/release/{version}#license
expression: MIT AND Apache-2.0
security:
assessments:
self:
evidence: https://example.com/assessment.html
date: '2021-09-01'
comment: |
foo bar
third-party:
- evidence: https://example.com/artifact.html
date: '2021-09-01'
comment: |
foo bar
champions:
- name: Joe Bob
email: joe.bob@example.com
primary: true
tools:
- name: Dependabot
type: SCA
version: 1.2.3
rulesets:
- default
results:
adhoc:
name: Scheduled SCA Scan Results
predicate-uri: https://intoto.SCA
location: https://example.com/release/{version}#SCA
comment: Replace {version} with the actual version number for the release you want VEX data for.
ci:
name: PR SCA Scan Results
predicate-uri: https://intoto.SCA
location: https://example.com/release/{version}#SCA
comment: Replace {version} with the actual version number for the release you want VEX data for.
release:
name: Build & Release SCA Scan Results
predicate-uri: https://intoto.SCA
location: https://example.com/release/{version}#SCA
comment: Replace {version} with the actual version number for the release you want VEX data for.
integration:
adhoc: true
ci: true
release: true
comment: |
foo bar