-
-
Notifications
You must be signed in to change notification settings - Fork 3.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Adopt open source security foundation best practices #16012
base: main
Are you sure you want to change the base?
Adopt open source security foundation best practices #16012
Conversation
Thanks for making a pull request to jupyterlab! |
@fcollonval also opened an issue in the Security Subproject repository. This is a duplicate of my comment there so it gets seen a bit more broadly. In addition to the badge, the OpenSSF Best Practices Working Group maintains a set of guides, including the Concise Guide for Developing More Secure Software. One of the simplest things we could do is to adopt the practices in the Concise Guide that apply to Project Jupyter Subprojects. We wouldn't be able to do that right away, but it would give us a direction and a way to track our progress. Also, OpenSSF is part of the Linux Foundation, so this has adoption by a wider open source community and may help if Project Jupyter does transition to the LF. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It looks good but there are two relevant CI failures before we can merge it:
- the docs job failure due to warning that the new file is not included in ToC
- the pre-commit complaining about whitespaces or newlines
References
Fixes #16010
Code changes
None
It adds a new workflow to automatically analyze our practices performance against the OpenSSF best practices. The goal is to proactively monitor and improve our practices.
-> The OpenSSF best practices form for our project is https://www.bestpractices.dev/en/projects/8675.
User-facing changes
We are improving our practices 😉
Backwards-incompatible changes
None