Consider Removing Signing from new SDL Pipeline
- Dominant language
- C#
- Stars
- 3.2k
- Forks
- 1.3k
- PR merge metrics
- PR metrics pending
Description
In https://github.com/dotnet/sdk/pull/55779 we migrated logic for SDL checks into an SDL pipeline verbatim, but https://github.com/dotnet/sdk/pull/55779#discussion_r3853967731 this PR feedback had a good point that the signing checks might not be needed anymore in the pipeline. If signing is only done in the VMR going forward, we could remove those checks to reduce workload on the CI runners.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading pull request 55779 and its discussion, then trace the new SDL pipeline and determine whether signing is performed only in the VMR. Done means deciding whether the signing checks can be removed without weakening the remaining SDL checks or adding unnecessary CI runner work.
Written by the indexing model from the issue text.
Assessment
- Domain
- ci-cd, security
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100