Update organization level policy for Microsoft Graph #9
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| # Copyright (c) Microsoft Corporation. | ||
| # Licensed under the MIT License. | ||
|
|
||
| name: Advanced Security Settings | ||
| description: SDL Requirements | ||
|
|
||
| resource: repository | ||
| configuration: | ||
| advancedSecurity: | ||
| # Enable code and secret scanning on all repositories | ||
| secretScanning: true | ||
| # Prevent push of secrets, requires secretScanning: true | ||
| secretScanningPushProtection: true | ||
| # If a dependency has been added or modified, check for vulnerabilities. | ||
| enablePrCheck: true | ||
| # PR check will fail if the severity of the code, secret, or dependency scan is Moderate, High, or Critical | ||
| failOnSeverity: Moderate | ||
| # Specify exceptions to TEMPORARILY allow a specific vulnerability. | ||
| allowGhasVulnerability: [] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| # Copyright (c) Microsoft Corporation. | ||
| # Licensed under the MIT License. | ||
|
|
||
| name: branch_protection_apps_services | ||
| description: Organization branch protection policy for Microsoft Graph applications, services, and tools. | ||
| resource: repository | ||
| where: | ||
| - | | ||
| repository.name.contains("agora", StringComparison.InvariantCultureIgnoreCase) | ||
| || repository.name.equals("kibali", StringComparison.InvariantCultureIgnoreCase) | ||
| || repository.name.equals("csdl-diagrams", StringComparison.InvariantCultureIgnoreCase) | ||
| || repository.name.startsWith("microsoft-graph-devx", StringComparison.InvariantCultureIgnoreCase) | ||
| || repository.name.equals("microsoft-graph-explorer-v4", StringComparison.InvariantCultureIgnoreCase) | ||
| || repository.name.equals("msgraph-developer-proxy", StringComparison.InvariantCultureIgnoreCase) | ||
| || repository.name.equals("msgraph-github-content-utility", StringComparison.InvariantCultureIgnoreCase) | ||
| || repository.name.equals("msgraph-metadata", StringComparison.InvariantCultureIgnoreCase) | ||
| || repository.name.equals("msgraph-permissions-scraper", StringComparison.InvariantCultureIgnoreCase) | ||
| || repository.name.equals("msgraph-ps-compatibility-azuread", StringComparison.InvariantCultureIgnoreCase) | ||
| || repository.name.equals("msgraph-samples-dashboard", StringComparison.InvariantCultureIgnoreCase) | ||
| || repository.name.equals("MSGraph-SDK-Code-Generator", StringComparison.InvariantCultureIgnoreCase) | ||
| configuration: | ||
| branchProtectionRules: | ||
| - branchNamePattern: main | ||
| requiredApprovingReviewsCount: | ||
| min: 1 | ||
| # Must have a CODEOWNER approve for the PR to be merged. | ||
| requireCodeOwnersReview: true | ||
| # Require status checks to pass before merging. TODO: this value should be true, we should work to support this. | ||
| # Used with the requiredStatusChecks setting to specify which checks must pass for the PR to be merged. | ||
| requiresStrictStatusChecks: false | ||
| # TODO: all commits should be signed. We need to get everyone signing their commits. | ||
| requiresCommitSignatures: false | ||
| # Dismiss stale pull request approvals when new commits are pushed | ||
| dismissStaleReviews: true | ||
| # Require conversation resolution before merging. Address all concerns, and resolve in the GitHub PR UI. | ||
| requiresConversationResolution: true | ||
| - branchNamePattern: "master" | ||
| requiredApprovingReviewsCount: | ||
| min: 1 | ||
| requireCodeOwnersReview: true | ||
| requiresStrictStatusChecks: false | ||
| requiresCommitSignatures: false | ||
| dismissStaleReviews: true | ||
| requiresConversationResolution: true | ||
| dismissStaleReviews: true | ||
| - branchNamePattern: "dev" | ||
| requiredApprovingReviewsCount: | ||
| min: 1 | ||
| requireCodeOwnersReview: true | ||
| requiresStrictStatusChecks: false | ||
| requiresCommitSignatures: false | ||
| dismissStaleReviews: true | ||
| requiresConversationResolution: true | ||
| dismissStaleReviews: true | ||
| - branchNamePattern: "[Rr]elease/*" | ||
| requiredApprovingReviewsCount: | ||
| min: 1 | ||
| requireCodeOwnersReview: true | ||
| requiresStrictStatusChecks: false | ||
| requiresCommitSignatures: false | ||
| dismissStaleReviews: true | ||
| requiresConversationResolution: true | ||
| dismissStaleReviews: true | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| # Copyright (c) Microsoft Corporation. | ||
| # Licensed under the MIT License. | ||
|
|
||
| name: branch_protection_sdks | ||
| description: Organization branch protection policy for Microsoft Graph SDKs | ||
| resource: repository | ||
| where: | ||
| - | | ||
| repository.name.startsWith("msgraph-sdk-", StringComparison.InvariantCultureIgnoreCase) | ||
| || repository.name.startsWith("msgraph-beta-sdk-", StringComparison.InvariantCultureIgnoreCase) | ||
| || repository.name.equals("msgraph-cli", StringComparison.InvariantCultureIgnoreCase) | ||
| || repository.name.equals("msgraph-cli-core", StringComparison.InvariantCultureIgnoreCase) | ||
| || repository.name.equals("msgraph-beta-cli", StringComparison.InvariantCultureIgnoreCase) | ||
| || repository.name.equals("msgraph-beta-typescript-typings", StringComparison.InvariantCultureIgnoreCase) | ||
| || repository.name.equals("msgraph-typescript-typings", StringComparison.InvariantCultureIgnoreCase) | ||
| || repository.name.equals("microsoft-graph-toolkit", StringComparison.InvariantCultureIgnoreCase) | ||
| configuration: | ||
| branchProtectionRules: | ||
| - branchNamePattern: main | ||
| requiredApprovingReviewsCount: | ||
| min: 1 | ||
| # Must have a CODEOWNER approve for the PR to be merged. | ||
| requireCodeOwnersReview: true | ||
| # Require status checks to pass before merging. TODO: this value should be true, we should work to support this. | ||
| # Used with the requiredStatusChecks setting to specify which checks must pass for the PR to be merged. | ||
| requiresStrictStatusChecks: false | ||
| # TODO: all commits should be signed. We need to get everyone signing their commits. | ||
|
Member
There was a problem hiding this comment. let me know if you want me to drop my setup script somewhere in a doc
Contributor
Author
There was a problem hiding this comment. Can you provide me with a link to your script so I can add it to my planning doc?
Member
There was a problem hiding this comment. #this line is only for windows, we'll need to document the equivalent for linux and mac
winget install GnuPG.Gpg4win
#generate a certificate, the email must match for the line below, upload the public key to github sign keys, get the certificate thumbprint. For all those steps, see the blog post below
git config user.email <microsoft-email>
git config user.signingkey <certificateThumbprint>
git config user.name <FirstNameLastName>
git config commit.gpgsign true
git config tag.gpgsign true
# this line is only needed for windows
git config --global gpg.program "C:\Program Files (x86)\GnuPG\bin\gpg.exe"
# for linux/mac if the $PATH is setup to include gpg, it should not be needed
https://jamesmckay.net/2016/02/signing-git-commits-with-gpg-on-windows/ |
||
| requiresCommitSignatures: false | ||
| # Dismiss stale pull request approvals when new commits are pushed | ||
| dismissStaleReviews: true | ||
| # Require conversation resolution before merging. Address all concerns, and resolve in the GitHub PR UI. | ||
| requiresConversationResolution: true | ||
| - branchNamePattern: "master" | ||
| requiredApprovingReviewsCount: | ||
| min: 1 | ||
| requireCodeOwnersReview: true | ||
| requiresStrictStatusChecks: false | ||
| requiresCommitSignatures: false | ||
| dismissStaleReviews: true | ||
| requiresConversationResolution: true | ||
| dismissStaleReviews: true | ||
| - branchNamePattern: "dev" | ||
| requiredApprovingReviewsCount: | ||
| min: 1 | ||
| requireCodeOwnersReview: true | ||
| requiresStrictStatusChecks: false | ||
| requiresCommitSignatures: false | ||
| dismissStaleReviews: true | ||
| requiresConversationResolution: true | ||
| dismissStaleReviews: true | ||
| - branchNamePattern: "[Rr]elease/*" | ||
| requiredApprovingReviewsCount: | ||
| min: 1 | ||
| requireCodeOwnersReview: true | ||
| requiresStrictStatusChecks: false | ||
| requiresCommitSignatures: false | ||
| dismissStaleReviews: true | ||
| requiresConversationResolution: true | ||
| dismissStaleReviews: true | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
With just one owner, we have a situation where the code owner is away on leave for a considerably long period of time, and there are no secondary owners. Would this be a challenge that slows down work output
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you Shem for bringing this up. We should always have secondary owners setup. We should pull in this change until we have GitHub team setup so we can easily add new CODEOWNERS without requiring PRs. I'll make sure I get your review on the GitHub teams management document so that we get this addressed.