mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 03:38:23 +00:00
kevinveenbirkenbachandClaude Opus 5.5
b2c2fe7703
The contributor docs described repository settings that are not in place. security.md marked "Require status checks", "Require branch to be up to date" and "Require signed commits" as enforced, but the active ruleset `Main` has no required_status_checks and no required_signatures rule, and the separate `Signed` ruleset is disabled. repository.md listed Dependabot alerts, security and version updates, secret scanning and push protection as disabled although all of them are on, and its summary repeated the two rules that are not enforced. branch.md claimed branch protection enforces the branch naming rules, while only the PR validation run checks the prefix. Three pages still described a hadolint SARIF job in call-lint.yml that no longer exists, which hid that nothing uploads the Hadolint results the ruleset asks for. The pages now state what the ruleset and the repository settings enforce today, name the policy pages for rules that are policy only, and record that no workflow uploads Hadolint results. Scorecard alerts 472, 504 and 505 depend on repository settings and process and stay open; 507 and 539 are no longer reported on main. Refs #853 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
74 lines
1.5 KiB
Markdown
74 lines
1.5 KiB
Markdown
# Repository Settings 🔧
|
|
|
|
See also [branch.md](branch/security.md) for branch protection rules.
|
|
|
|
## Dependency Management 📦
|
|
|
|
### Dependency Graph ✅
|
|
|
|
👉 Dependency insights are available under Insights → Dependency graph
|
|
|
|
### Dependabot Alerts ✅
|
|
|
|
👉 Known vulnerabilities in dependencies are reported as Dependabot alerts
|
|
|
|
### Dependabot Security Updates ✅
|
|
|
|
👉 Dependabot opens PRs that bump vulnerable dependencies to a fixed release
|
|
|
|
### Dependabot Version Updates ✅
|
|
|
|
👉 Dependabot opens upgrade PRs for the ecosystems listed in [dependabot.yml](../../../../.github/dependabot.yml)
|
|
|
|
---
|
|
|
|
## Code Scanning (Global) 🔬
|
|
|
|
### CodeQL ✅
|
|
|
|
👉 Security issues may be detected automatically
|
|
|
|
### Copilot Autofix ✅
|
|
|
|
👉 Suggested fixes may appear
|
|
|
|
---
|
|
|
|
## Secret Protection 🔐
|
|
|
|
For GHCR authentication configuration see [authentication.md](../ghcr/authentication.md).
|
|
|
|
### Secret Scanning ✅
|
|
|
|
👉 Committed secrets are detected and reported as secret scanning alerts
|
|
|
|
### Push Protection ✅
|
|
|
|
👉 Pushes that contain a detected secret are blocked
|
|
|
|
---
|
|
|
|
## Summary for Contributors 📋
|
|
|
|
You MUST:
|
|
|
|
- Create a PR (no direct push)
|
|
- Get 2 approvals
|
|
- Get CODEOWNER approval (if applicable)
|
|
- Resolve all comments
|
|
- Re-approve after changes
|
|
- Pass code scanning & quality checks
|
|
|
|
You MUST NOT:
|
|
|
|
- Push directly to main
|
|
- Force push
|
|
- Merge without approvals
|
|
|
|
You MAY:
|
|
|
|
- Create branches freely
|
|
- Use merge commits
|
|
|
|
All rules above are **currently enforced** on `main`.
|