OWASP / OWASP/Nest

Automated Metadata Population for OWASP Entities PoC

Open
#2,123 2 comments 0 reactions 1 assignee Claimed by @arkid15r View on GitHub
enhancement question
Dominant language
Python
Stars
451
Forks
707
Avg merge
22h 59m
Merged PRs (30d)
91

Description

**Describe the solution you'd like**

Implement a proof-of-concept (PoC) system that automatically creates Pull Requests (PRs) in OWASP repositories (www-project-* prefixed, later chapters and committees) to introduce a CI/CD workflow for validating OWASP entities metadata (projects, chapters, committees, etc.) against the central OWASP Schema.

This PoC is the first step toward consistent and automated metadata population across all OWASP entities:

* **PR Creation:**

* Automatically open PRs in selected `www-project-*` repositories.
* PRs must include a GitHub Actions CI/CD workflow that validates metadata files (e.g., `owasp-project-metadata.yml`) against the schema.

* **Extensibility:**

* Design the workflow and automation so that it can be extended to OWASP **chapters** and **committees** repositories.

* **Reviewers:**

* Attempt to set `reviewers` for the PRs as the **current project leaders** (if retrievable via GitHub API).
* If not possible due to GitHub API/permissions limitations, document the constraints.

#### Deliverables

1. A PoC implementation (via GitHub App) that:

* Creates PRs with metadata validation workflow files.
* Runs schema validation on project metadata as part of CI/CD.
* Optionally sets reviewers.

2. Documentation outlining:

* The technical approach.
* How to extend the approach to chapters and committees.
* Any limitations discovered (e.g., setting reviewers automatically).

#### Success Criteria

* At least one successful PR raised in a `www-project-*` repository.
* Metadata validation workflow included in the PR.
* Confirmation whether reviewer assignment is possible.
* Clear documentation for scaling metadata population to all OWASP entities.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.