ictu/github-policy

How ICTU uses GitHub

github-policy's Issues

Optional: fine grained access tokens

They're still in beta, but it is possible to switch to fine grained access tokens. It is also possible to disallow classic access tokens.

Change name github-policy --> git-policy

Is it an option to change the name in git-policy and perhaps with configuration parameters - where necessary - create applicable variants for:

• github
• gitlab
• bitbucket

Consider Semantic Versioning as part of the policy.

Is it worth considering using semanting versioning as the standard when adopting the policy.

Standard for Public Code compliancy

The Standard for Public Code gives public organizations a model for building their own open source solutions to enable successful future reuse by similar public organizations in other places. It includes guidance for policy makers, city administrators, developers and vendors.
All codebases in stewardship with the Foundation for Public Code have chosen to apply the Standard to their own work (source).

Criteria

• Code in the open
• Bundle policy and source code
• Create reusable and portable code
• Welcome contributors
• Make contributing easy
• Maintain version control
• Require review of contributions
• Document codebase objectives
• Document the code
• Use plain English
• Use open standards
• Use continuous integration
• Publish with an open license
• Use a coherent style
• Document codebase maturity

Of a more technical nature is the corresponding publiccode.yml Standard

A metadata description standard for public software that is easy to use both for developers and people with less technical background in order to make the software developed by Public Administrations and Public Organisations easily discoverable.

• publiccode.yml is up to date

Extend policy to cover Docker Hub

Various ICTU GitHub repos also publish directly to Docker Hub, but we don't have any guidelines for this platform.
Docker Hub offers security insights much like GitHub, both through static analysis and continuous analysis (Docker Scout).
It is also possible to add OCI artifacts such as SBOMs - https://docs.docker.com/docker-hub/oci-artifacts/