Automating the BIST Code Security Checklist

[sumau]

Objective

Replace the manually maintained code security checklist with a centrally owned system in uktrade/github-standards that automatically creates, maintains and validates it organisation-wide.

Artefacts to build or configure

Artefact to build	Where	Function
Custom GitHub Action – checklist engine	github-standards	Creates, regenerates and validates code_security_checklist.md and creates or updates a checklist PR. The checklist PR can only be merged when all mandatory controls pass.
Reusable workflow wrapping the Action	github-standards	Central entry point that runs the Action against a repository and reports results.
code-security-ci ruleset	Org settings	Makes validation a required check on target repositories where code_security_enrolled = True.
code_security_enrolled GitHub custom property	Org settings	Works with the ruleset. This property should replace reusable_workflow_opt_in.
Maintainer attestation register	Private GitHub Org Project	A register where maintainers can attest they have completed requirements.
Maintainer compliance check	Action logic	Checks whether members of the primary team in CODEOWNERS have completed requirements (see below for more details). Ideally this should check against a learning provider' API but this is a flexible workaround that integrates easily with GitHub workflows.
Security configuration check	Action logic	Checks that the correct GitHub security configuration is applied and attached.
Datadog PR gates repository ruleset check	Action logic	Unfortunately the Datadog PR Gates ruleset has to be created per repository so this checks it has been applied. There's no need to check for the organisation rulesets because they are enabled using the code_security_enrolled GitHub custom property
scs_portfolio check	Action logic	Checks that the scs_portfolio custom property is populated.
PR template check	Action logic	Checks that, if the repository has a PR template, it contains the relevant checklist items.
SECURITY.md check	Action logic	Checks that the repository does not contain a SECURITY.md file.
CODEOWNERS check	Action logic	Verifies that the file exists and contains a valid primary owning team (The team associated with the * rule in CODEOWNERS)
BIST Code Security Checklist template (code_security_checklist.md)	github-standards	Canonical checklist template copied into repositories and populated by the Action with validation results.

Maintainer Compliance Check

1. Expand the primary team to current member logins via the GitHub API.
2. Join members to the attestation register by login.
3. Evaluate each (member × requirement) record as:
   • Current (≤ 12 months)
   • Expired (> 12 months)
   • No record
4. Highlight any member logins that have not met the required criteria.

Checklist items to skip

• CodeQL / Datadog GitHub Action for fork-based PRs because this should be automatically applied using a ruleset with condition repository visibility = public.
• Branch protection rules because these are automatically applied to repositories with reusable_workflow_opt_in / code_security_enrolled = True
• GitHub Secret Protection because it is automatically applied when the correct security configuration is set.
• Dependabot because it is automatically applied when the correct security configuration is set.
• CodeQL and Dependency Review because it will be removed.
• Team-membership review (leaver / mover removal) because it is out of scope and belongs to the access-management / IdP domain.