project configuration guide

[matthew-l-weber]

For setup and maintenance of the ELISA, add a document that sets the basic defaults for our project configurations and workflow assumptions.

[matthew-l-weber]

Consider guidance and TSC discussion related to a recent attack

• autonomous attack campaign, tracked as “hackerbot-claw,” is actively scanning public repositories for insecure GitHub Actions workflows
• Consider certain defaults for the elisa-tech organization?
  • What can be minimal defaults to set?
  • Is there an existing best practice guide?
    • https://best.openssf.org/SCM-BestPractices/
    • https://openssf.org/blog/2024/08/12/mitigating-attack-vectors-in-github-workflows/
    • https://docs.github.com/en/actions/concepts/security/script-injections
    • https://www.wiz.io/blog/github-actions-security-guide
    • https://lf-decentralized-trust.github.io/governance/guidelines/automated-pipelines-best-practices/
• AeroWG took some action which can be shared.
• Template for setting up a new repo is useful to have like DCO, branch protection, ...

[matthew-l-weber]

Matt's notes on this

• A default minimal super linter config that checks the workflows - https://github.com/super-linter/super-linter
• github setttings outline of defaults
• pull in references from email and guidance ( see what minimally makes sense )
• set code codeowners?