[feedback] How can projects express they meet a given OSPS level?

tl;dr

Projects need a mechanism, today, that allows them to express how they meet a given OSPS level or set of OSPS criteria. We've been point at security-insights.yml but it isnt ready yet.

Details

We've rolled out the baselines, defined the criteria, and how projects can implement the criteria, but not yet provided them a mechanism by which they can capture the how. We currently are currently surfing some momentum given OSPS awareness, but this can quickly die if we fail to provide the means for projects to do this. Many individuals I've presented the OSPS baselines to cite this makes sense, they're already doing a lot of them, now how do they show it?

UX

For now, i've recommended to project to create a project page or file in their repo that grabs the criteria and just write out how they do it. This means they'll have double effort first in writing it out and then in converting to the security-insights.yml spec when it is ready. We need to narrow the window for projects jumping on this in the time between our announcement and the tooling/spec to allow expression to happen so we don't inadvertently introduce more effort or stale information that projects then need to go back and convert.

Desired Outcome

• Propose starter template for projects to address https://github.com/ossf/security-baseline/issues/20
  • https://github.com/ossf/project-template/pull/6/files
• Propose changes to the security-insights.yml to define OSPS baseline expression by projects. alternatively reconfirm this is the path forward we want to take.
• Campaign/advocate on the concurred changes to security-insights.yml (or other agreed mechanism) to inform projects this is the expression location of OSPS baseline criteria implementation.