Home

GitHub Policy

This repository attempts to demonstrate how colleagues can implement the GitHub Policy (Link to internal site, not accessible externally) created by ONS' Software Engineering Community.

Repository Management

• 4.1 Repository Creation
• 4.2 Private/Internal Repository Information
• 4.3 README Files
• 4.4 Licensing
• 4.5 .gitignore
• 4.6 Documentation
• 4.7 Archiving Repositories

Collaboration and Communication

• 5.1 Team Names
• 5.2 Collaboration through teams
• 5.3 Code of Conduct
• 5.4 Collaboration Workflow
• 5.5 Unsolicited pull requests
• 5.6 Branching Strategy
• 5.7 Branch Protection rules
• 5.8 Signed Commits

Security and Compliance

6.1 Privacy Settings 6.2 Security

6.3 Compliance

Source todo link to sharepoint document

6. Continuous Integration and Deployment (CI/CD) 6.1 CI/CD Pipelines: Where appropriate use GitHub Actions to implement CI/CD pipelines to automate testing, building, and deployment processes. Action for Daniel O’Brien: Provide recommendation/policy for using the GitHub Action.
7. Reporting Issues 7.1 Reporting Security Concerns: Report security vulnerabilities or suspicious activities immediately to the appropriate contact within the Organization or follow the established incident reporting procedures. Action for Fahad: Link to Security (Depenabot alert is not included in it)
8. Compliance and Enforcement 8.1 Policy Violations: Violations of this GitHub Usage Policy may result in consequences, including warnings, access revocation, or other disciplinary actions, as determined by the Organisation. 8.2 Policy Enforcement Teams: Designate a policy enforcement team or individual responsible for monitoring and enforcing policy compliance. 8.3 Periodic Audits: Conduct periodic audits of repositories, teams, and access permissions to ensure compliance. Use automation to assist in auditing and reporting.