Skip to content

maintainer-setup.md

Latest commit

 

History

History
42 lines (27 loc) · 2.36 KB

maintainer-setup.md

File metadata and controls

42 lines (27 loc) · 2.36 KB
Raw

Maintainer setup

GitHub repository security features need a one-time configuration after the initial foundation is merged.

Security and analysis

In repository Settings, Security and analysis:

  1. Enable Dependency graph.
  2. Enable Dependabot alerts and security updates.
  3. Enable secret scanning and push protection when available.
  4. Enable private vulnerability reporting.
  5. Add repository variable DEPENDENCY_REVIEW_ENABLED=true.
  6. Enable release immutability. GitHub applies it only to releases published after the setting is enabled.

The dependency review workflow remains safely skipped until that variable is set. This avoids a false failing check on new repositories where the dependency graph API is not yet active.

Branch protection

After the first successful runs, protect main:

  • require a pull request before merging
  • require the CI Quality gate job
  • require CodeQL when available
  • require dependency review after enabling it
  • require conversation resolution
  • block force pushes and branch deletion
  • apply the rules to administrators unless an emergency procedure says otherwise

Create a second active ruleset targeting refs/tags/v*. Block tag updates and deletion, and create each release tag as a signed tag. Together with repository release immutability, these controls protect the tag, release metadata, and assets from later changes.

For every private data repository, add a second ruleset for .github/** and zaati.data.json. Require trusted-owner review and block the producer identity from bypassing it. The producer needs Contents and Pull requests write access only. It must have no Actions, Workflows, Administration, secrets, variables, environments, or repository-settings write access.

Do not require the deployment workflow for code pull requests. It intentionally runs only for manual dispatch or configured main-branch deployment.

Production environment

Create an environment named production. Add the variables and secrets from Cloudflare deployment. Use required reviewers for this environment when available.

Keep deployment secrets at the environment level so pull requests and routine CI cannot access them.

If encrypted snapshots are enabled, add ZAATI_SNAPSHOT_KEY only to this protected environment. Do not add it as a repository-wide variable, workflow file, build artifact, or pull request secret.