Home

GitHub Policy

Repository Management

• 4.1 Repository Creation
• 4.2 Private/Internal Repository Information
• 4.3 README Files
• 4.4 Licensing
• 4.5 .gitignore
• 4.6 Documentation
• 4.7 Archiving Repositories

Collaboration and Communication

• 5.1 Team Names
• 5.2 Collaboration through teams
• 5.3 Code of Conduct
• 5.4 Collaboration Workflow
• 5.5 Unsolicited pull requests
• 5.6 Branching Strategy
• 5.7 Branch Protection rules
• 5.8 Signed Commits

Security and Compliance

Source todo link to sharepoint document

5.1 Privacy Settings: Review and adjust your privacy settings on GitHub to ensure that your contributions and personal data are appropriately protected. 4.7 Security: Regularly review and update dependencies to address security vulnerabilities. Utilise automated security tools and services to identify and remediate vulnerabilities. 5.2 Compliance: Ensure that all GitHub activities and repositories comply with applicable laws, regulations, and organisational policies. Be aware of any data protection or export control regulations. 12:57 6. Continuous Integration and Deployment (CI/CD) 6.1 CI/CD Pipelines: Where appropriate use GitHub Actions to implement CI/CD pipelines to automate testing, building, and deployment processes. Action for Daniel O’Brien: Provide recommendation/policy for using the GitHub Action. 7. Reporting Issues 7.1 Reporting Security Concerns: Report security vulnerabilities or suspicious activities immediately to the appropriate contact within the Organization or follow the established incident reporting procedures. Action for Fahad: Link to Security (Depenabot alert is not included in it) 8. Compliance and Enforcement 8.1 Policy Violations: Violations of this GitHub Usage Policy may result in consequences, including warnings, access revocation, or other disciplinary actions, as determined by the Organisation. 8.2 Policy Enforcement Teams: Designate a policy enforcement team or individual responsible for monitoring and enforcing policy compliance. 8.3 Periodic Audits: Conduct periodic audits of repositories, teams, and access permissions to ensure compliance. Use automation to assist in auditing and reporting.