Home

GitHub Policy

• 4.1 Repository Creation
• 4.2 Private/Internal Repository Information
• 4.3 README Files
• 4.4 Licensing
• 4.5 .gitignore
• 4.6 Documentation
• 4.7 Archiving Repositories
• 5.1 Team Names
• 5.2 Collaboration through teams

Source todo link to sharepoint document

4.3 Code of Conduct: ONS encourages respectful and inclusive interactions on GitHub. Adopt and adhere to a code of conduct to ensure a welcoming and harassment-free environment for contributors. 4.4 Collaboration Workflow: Collaborate effectively by using pull requests for code reviews and discussions. Use issues and discussions to track and discuss project changes and enhancements. 4.5 Unsolicited pull requests: If we get an unsolicited pull request from outside of the organisation it must not be merged. It should be raised to the Technical Lead or nominated Sr. team member. 4.6 Branching Strategy: Implement a clear and effective branching strategy (e.g., feature branches, release branches) to organise and manage code changes. 4.7 Branch Protection rules: Use of Branch Protection rules must be used to enforce security policies by preventing accidental branch deletions, enforcing code reviews, and requiring successful automated checks before pull requests can be merged etc. 4.8 Signed Commits: Use of signed commits are encouraged, so other people can verify that your work comes from a trusted source. If a commit or tag has a GPG or S/MIME signature that is cryptographically verifiable, GitHub marks the commit or tag as verified. 12:56 5.1 Privacy Settings: Review and adjust your privacy settings on GitHub to ensure that your contributions and personal data are appropriately protected. 4.7 Security: Regularly review and update dependencies to address security vulnerabilities. Utilise automated security tools and services to identify and remediate vulnerabilities. 5.2 Compliance: Ensure that all GitHub activities and repositories comply with applicable laws, regulations, and organisational policies. Be aware of any data protection or export control regulations. 12:57 6. Continuous Integration and Deployment (CI/CD) 6.1 CI/CD Pipelines: Where appropriate use GitHub Actions to implement CI/CD pipelines to automate testing, building, and deployment processes. Action for Daniel O’Brien: Provide recommendation/policy for using the GitHub Action. 7. Reporting Issues 7.1 Reporting Security Concerns: Report security vulnerabilities or suspicious activities immediately to the appropriate contact within the Organization or follow the established incident reporting procedures. Action for Fahad: Link to Security (Depenabot alert is not included in it) 8. Compliance and Enforcement 8.1 Policy Violations: Violations of this GitHub Usage Policy may result in consequences, including warnings, access revocation, or other disciplinary actions, as determined by the Organisation. 8.2 Policy Enforcement Teams: Designate a policy enforcement team or individual responsible for monitoring and enforcing policy compliance. 8.3 Periodic Audits: Conduct periodic audits of repositories, teams, and access permissions to ensure compliance. Use automation to assist in auditing and reporting.