3 ms·
AllStar: Continuous Security Policy Enforcement for GitHub Projects
- jacques_chester 5y agoThe OpenSSF post linked to has a more detailed description: https://openssf.org/blog/2021/08/11/introducing-the-allstar-github-app/ https://openssf.org/blog/2021/08/11/introducing-the-allstar-... tl;dr it's automation to apply rules defined in its sister project, Scorecards.
- RyJones 5y agothis is pretty cool - can't wait to roll it out for my GitHub orgs. disclaimer: I work for LF.
- z77dj3kl 5y agoSeems pretty silly? It has opened a bunch of issues and is harassing devs on github repos complaining about missing SECURITY.md files? https://github.com/search?q=%22Issue+created+by+Allstar.+https%3A%2F%2Fgithub.com%2Fossf%2Fallstar%22&type=issues https://github.com/search?q=%22Issue+created+by+Allstar.+htt... No judgement, but I guess this is just not the kind of hole-plugging security I'm used to.
- dlor 5y agoThese GitHub orgs have explicitly opted in and configured the checks, so harassing the developers in those organizations is exactly what the org owners wanted :)
- SkyPuncher 5y agoYep. We're looking into this because Githubs org wide security controls are less than ideal. This lets us enforce a default and track exceptions.