django-commons / django-commons/controls

Investigate and define Codeowners file recommendation for projects

Open
#84 4 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

question security
Dominant language
No language data
Stars
1
Forks
0
Avg merge
18m
Merged PRs (30d)
1

Description

Seth Larson, PSF security developer in residence, recommended that we use the codeowners file to lock down specific areas of projects. This can make it easier for everyone to have write permissions in other areas of the project, then limit the sensitive parts to specific people.

I'm not 100% sure how far we want to take this, or in what regard. Projects can use this file to be very permissive with the commit permission. Or we can use this for projects to need Django Common's admins permissions. Perhaps this is something we utilize when we have a new person adopt an abandoned project so that the admins are a bit involved until the person has proven they can be trusted?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the GitHub CODEOWNERS documentation linked in the issue, then compare its permission model with the organization’s stated scenarios. Define whether CODEOWNERS should protect sensitive project areas, require Django Commons admin involvement, or support adoption of abandoned projects; document the selected policy and its scope as done criteria.

Written by the indexing model from the issue text.

Assessment

Tech stack
github
Domain
authorization, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.