Skip to content

maintainer-setup.md

Latest commit

 

History

History
37 lines (24 loc) · 1.64 KB

maintainer-setup.md

File metadata and controls

37 lines (24 loc) · 1.64 KB
Raw

Maintainer setup

GitHub repository security features need a one-time configuration after the initial foundation is merged.

Security and analysis

In repository Settings, Security and analysis:

  1. Enable Dependency graph.
  2. Enable Dependabot alerts and security updates.
  3. Enable secret scanning and push protection when available.
  4. Enable private vulnerability reporting.
  5. Add repository variable DEPENDENCY_REVIEW_ENABLED=true.

The dependency review workflow remains safely skipped until that variable is set. This avoids a false failing check on new repositories where the dependency graph API is not yet active.

Branch protection

After the first successful runs, protect main:

  • require a pull request before merging
  • require the CI Quality gate job
  • require CodeQL when available
  • require dependency review after enabling it
  • require conversation resolution
  • block force pushes and branch deletion
  • apply the rules to administrators unless an emergency procedure says otherwise

Do not require the deployment workflow for code pull requests. It intentionally runs only for manual dispatch or configured main-branch deployment.

Production environment

Create an environment named production. Add the variables and secrets from Cloudflare deployment. Use required reviewers for this environment when available.

Keep deployment secrets at the environment level so pull requests and routine CI cannot access them.

If encrypted snapshots are enabled, add ZAATI_SNAPSHOT_KEY only to this protected environment. Do not add it as a repository-wide variable, workflow file, build artifact, or pull request secret.