ossf / ossf/allstar

Administrator requirement for repo default setting

Open
#110 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement Stale
Dominant language
Go
Stars
1.5k
Forks
152
Avg merge
1d 2h
Merged PRs (30d)
6

Description

Forking from: https://github.com/ossf/allstar/issues/103#issuecomment-1018622012

My thoughts:

it is also a goal for me to have Allstar's default settings represent the highest level of security best practices that we (OpenSSF) can recommend. ...
That said, I also acknowledge that my point of view is from a large-org perspective, and while the org admins do have transient permissions on all repos, they can't be expected to be responsible for all repos, and a direct admin should be required. I see how this would not be the case for a small org. I'd like to bring this up at the next "Best Practices" WG meeting to discuss further.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No files, tests, or entry points are named. Start by reading the linked discussion in issue 103 and the quoted context, then clarify the Best Practices WG decision about requiring a direct administrator. The issue is ready only once the expected default-setting behavior and acceptance criteria are defined.

Written by the indexing model from the issue text.

Assessment

Tech stack
github
Domain
authorization, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.