Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Profile for private / internal repositories

Aperta
  • Qualcosa non va?
#458 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
32/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
python
Ambito
devtools, security

Direzione di ricerca

Start by reading the audit_openssf_baseline checks and the reported results for the private repository, focusing on the listed controls that are inapplicable or produce false positives. The issue proposes both a private profile and changes to several checks, so clarify the intended scope before starting. Done should mean the agreed profile handles private-repository controls appropriately and the identified false positives are addressed.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

module-baseline

Ran the OpenSSF Baseline audit (audit_openssf_baseline, level 3, OSPS v2026.02.19) against a private GitHub repository - a governance-first monorepo where every push carries signed evidence, main is behind a ruleset requiring PR + two status checks, actions are SHA-pinned, dependencies are exactly pinned and allowlisted, CODEOWNERS is in place. Result: 26 pass / 21 fail / 17 warn / 2 error. Most of the fails are the baseline being shaped for public open-source projects, which makes the score misleading for the growing class of private, agent-heavy repos that arguably need this tooling most.

Fails that don't apply to a private repo, or can't

  • OSPS-LE-01/03 LICENSE, GV-03 CONTRIBUTING, DO-03/04/05 SUPPORT / EOL / release verification, QA-02.02 SBOM in releases, DO-02 bug-report template - all release/community surface a private repo may legitimately not have (yet).
  • OSPS-VM-03.01 "enable private vulnerability reporting" - the GitHub feature is unavailable on private repos (/private-vulnerability-reporting returns 404). The check can't pass; it should be N/A or accept a SECURITY.md contact instead.

False positives worth fixing regardless of profile

  • OSPS-QA-05.01/05.02 "generated executables / binaries in repository" flagged 1,281 and 64,997 files - all under gitignored target/ and __pycache__/. The check scans the working tree; it should scan tracked files (git ls-files) or honour .gitignore.
  • OSPS-SA-01.01 "no architecture documentation" - the repo has design/*.md (component maps + an SDLC overview). The pattern seems to want ARCHITECTURE.md specifically.
  • OSPS-DO-06.01 "dependency management process not documented" - the repo has a reviewed dependency-allowlist.yaml with a per-dependency why: and a CI check that fails on any unlisted dependency. The pattern seems to want a prose DEPENDENCIES.md.

What a private profile could emphasise instead

The controls that actually distinguish a well-run private repo, several of which the baseline already has and which did pass here: branch protection with required checks (AC-*, BR-*), SHA-pinned actions, pinned + reviewed dependencies (BR-05/06), CODEOWNERS (GV-01/04), workflow linting (BR-01 via zizmor - which is also currently an ERROR: Command not found when zizmor isn't installed, rather than a skip with guidance), secret scanning, signed commits or signed evidence on push, and - increasingly relevant - distinct identities for automated/agent contributors, so "who authored this" is answerable.

Happy to provide the full JSON report or test a candidate profile against this repo.

Lingua principale
Python
Stelle
22
Fork
27
Merge medio
1g 19h
PR unite (30g)
39

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di darnitdevorg/darnit

Tutte le issue di darnitdevorg/darnit

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.