3 ms·
I think that what works for companies like Uber/Google/Facebook is not applicable to the rest of fortune 500 or all of the rest of the companies. disclaimer: I
by shimont 7y ago
I think that what works for companies like Uber/Google/Facebook is not applicable to the rest of fortune 500 or all of the rest of the companies.
disclaimer: I am one of Datree.io founders. We provide a visibility and governance solution to R&D organizations on top of GitHub.
Here are some rules and enforcement around Security and Compliance which most of our companies use for multi-repo GitHub orgs.
1. Prevent users from adding outside collaborators to GitHub repos.
2. Enforce branch protection on all current repos and future created ones - prevent master branch deletion and force push.
3. Enforce pull request flow on default branch for all repos (including future created) - prevent direct commits to master without pull-request and checks.
4. Enforce Jira ticket integration - mention ticket number in pull request name / commit message.
5. Enforce proper Git user configuration.
6. Detect and prevent merging of secrets.