Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add contributor guidance (OSPS-DO-02) #124

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+26 −0
Open

Add contributor guidance (OSPS-DO-02) #124

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
# Contributing to the Security Baseline

## Contributing to the Criteria:

Currently, all the baseline criteria are in `baseline.yaml`; follow the structure
[in the README](./README.md#baseline-structure) when proposing new entries.

## Contributing to the Tooling:

The baseline is published to https://baseline.openssf.org/ (via GitHub Pages) via
Jekyll (a static site generator) using scripts from `./cmd` and formatting from
`./docs`, using GitHub Actions.

## PR guidelines

All changes to the repository should be made via PR
([OSPS-AC-03](https://baseline.openssf.org/#osps-ac-03)). In addition to a clear
Comment on lines +16 to +17
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
All changes to the repository should be made via PR
([OSPS-AC-03](https://baseline.openssf.org/#osps-ac-03)). In addition to a clear
All changes to the repository should be made via a pull request (PR)
(this enables us to meet our own requirement [OSPS-AC-03](https://baseline.openssf.org/#osps-ac-03)).
In addition to a clear

title and descriptive commit message, PRs MUST meet the following criteria:

* DCO signoff (via `git commit -s` -- [OSPS-LE-01](https://baseline.openssf.org/#osps-le-01))
* All checks must pass ([OSPS-QA-04](https://baseline.openssf.org/#osps-qa-04))
Comment on lines +16 to +21
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We might want to leave the links out of this, since #113 will break them anyway. I think we're fine without the citations, but if you feel strongly about leaving them in, we should decide if we want to have them be hyperlinks or just bare text references.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As "customer zero", we should figure out what the best practices are here. Linking to the criteria seems helpful in providing background information, but only if the URLs are stable enough that they don't just turn into dead links.

(And, I think that's something worth thinking about as we proceed...)


## Maintainer Status

See [./governance/GOVERNANCE.md](./governance/GOVERNANCE.md#maintainer-status) for
the process of achieving maintainer status on the project.
Loading