Publish the eng-pipes repo #112
Description
The eng-pipes repo is one of two that OSPO engineers spend the most time in (the other is self-hosted). It's private only by historical accident, it really should be public. I want this especially because it will make hiring easier, we can link people to the repo and the best candidates can engage with us there as part of their application.
- Switch to Apache license (no reason for it to be BSL, it's not a core component of Sentry-the-product)
- Go through security review🔒.
- Resolve critical and high dependabot vulns.
- Flip the bit.
Security Review
- Repo has a suitable license.
- Dependabot is configured, if applicable.
- Review current dependabot alerts and resolve all critical or high severity findings.
- Code scanning (CodeQL) is enabled, if applicable.
- CodeQL is typically not available (for free) to private repos, so enabling this may not be possible until the repo is public. Be prepared to submit a PR as soon as the repo is made public.
- Secret scanning is enabled. (requires public repo or GHAS on private repos)
- Review for any leaked secrets.
- Run gitleaks and ensure there are no detected secrets.
- Review any screenshots for potential captures of API tokens, session cookies, etc.
- git log -p if the repo is small and manually scan for anything sensitive.
- Review repo settings and environment variables.
- Do all secrets exist under “Secrets” ?
- Review any Github Actions.
- Ensure there is no accidental printing of a secret value.
- Ensure there is no basic encoding of a secret value that is printed (e.g. base64).
- Review configured webhooks.
- Are all URLs expected destinations?
- Are they documented somewhere, either in Notion or the repo, and their purpose understood?
- Do they use sufficiently strong secrets for signing.
- Does the main branch have a protection rule in place requiring an approved PR to merge?
- Review collaborators on the repo.
- Are access levels properly scoped (e.g. least privilege)?
- Are all collaborators Sentry employees?
Metadata
Metadata
Assignees
Labels
No labels