Update baseline.yaml - NEW - OSPS-DO-15 #118
Conversation
added new criteria proposal OSPS-DO-15 - around dependency selection process for projects Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>
| The project documentation MUST include a | ||
| descriptive statement about how the project | ||
| selects, obtains, and tracks its dependencies. |
There was a problem hiding this comment.
Can we pivot this from "project documentation describes" to something with more teeth? e.g.
- id: OSPS-QA-08
category: Quality
criteria: |
The project has implemented automated review of
changes to enforce a project-selected dependency
policy.It's not clear from this criteria whether something that says "if you add a package, remember to update package.json, we don't check in package-lock.json" could meet the maturity_level: 2 standard. (I'd hope not, but it is a descriptive statement about how the projects obtains and tracks its dependencies...)
There was a problem hiding this comment.
These might be two separate things. You can't check against a policy that you don't have, so maybe having any policy is level 1 and your suggestion is level 2?
|
Additionally, having a dependency-quality-check as automation would tie in well with OSPS-QA-04 around requiring status checks to pass. |
SecurityCRob
added
documentation
fixed indent? Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>
added new criteria proposal OSPS-DO-15 - around dependency selection process for projects