Document policy to address SCA violations prior to release
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 271
- Forks
- 129
- Avg merge
- 3h 46m
- Merged PRs (30d)
- 4
Description
Address OSPS-VM-05.02 baseline requirement.
Requirement: While active, the project documentation MUST include a policy to address SCA violations prior to any release.
Recommendation: Document a policy in the project to address applicable Software Composition Analysis results before any release, and add status checks that verify compliance with that policy prior to release.
Control applies to: Maturity Level 3
https://baseline.openssf.org/versions/2025-10-10#osps-vm-0502
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Begin with the OSPS-VM-05.02 requirement and inspect the repository's existing documentation and release checks. Document how applicable SCA violations are addressed before releases, and add status checks that verify compliance. Done means the policy is documented and release compliance is automatically checked.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation, release, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100