CNCF Defender Tasks for devfile/alizer

[Jdubrick]

Which area/kind this issue is related to?

/area alizer

Issue Description

As part of our effort to maintain best practices we have added all of our repositories to the CLO Monitor. This issue aims to resolve the checks needed for our repositories to reach 100% on the monitor.

A list of the checks for each check set can be found here: https://clomonitor.io/docs/topics/checks/

Remaining Items

Security

• Dependencies Policy
• Dependency Update Tool
• Software Bill of Materials (SBOM)
• Security Insights
• Security Policy
• Signed Releases
• Token Permissions

[Jdubrick]

Defender tasks with the same checklist items were sized as Major with 5 story points. Assigning this the same and moving to backlog.

[thepetk]

As discussed the security policy will be covered after the completion of #1461. We might need to ignore for now the following checks:

• Software Bill of Materials (SBOM)
• Signed Releases
• Token Permissions
  cc @Jdubrick @michael-valdron

[Jdubrick]

As discussed the security policy will be covered after the completion of #1461. We might need to ignore for now the following checks:

• Software Bill of Materials (SBOM)
• Signed Releases
• Token Permissions
  cc @thepetk @michael-valdron

Are these checks being ignored for now as in leaving unchecked or should a discussion be had for exemption them from the checks? Also, would that be relevant for all repos covered under #1297

[thepetk]

As discussed the security policy will be covered after the completion of #1461. We might need to ignore for now the following checks:

• Software Bill of Materials (SBOM)
• Signed Releases
• Token Permissions
  cc @thepetk @michael-valdron

Are these checks being ignored for now as in leaving unchecked or should a discussion be had for exemption them from the checks? Also, would that be relevant for all repos covered under #1297

I think we can revisit the topic in a future devtools week. So I'd say we can:

• Close the parent epic and all the children issues when the Dependencies Policy, Dependency Update Tool & Security Insights are covered.
• Create a new epic for future work around SBOMs, Signed Releases and Token Permissions.
• The Security Policy Check is included here: Create Security Policy for the Devfiles Org #1461

WDYT?

[Jdubrick]

As discussed the security policy will be covered after the completion of #1461. We might need to ignore for now the following checks:

• Software Bill of Materials (SBOM)
• Signed Releases
• Token Permissions

Are these checks being ignored for now as in leaving unchecked or should a discussion be had for exemption them from the checks? Also, would that be relevant for all repos covered under #1297

I think we can revisit the topic in a future devtools week. So I'd say we can:

• Close the parent epic and all the children issues when the Dependencies Policy, Dependency Update Tool & Security Insights are covered.
• Create a new epic for future work around SBOMs, Signed Releases and Token Permissions.
• The Security Policy Check is included here: Create Security Policy for the Devfiles Org #1461

WDYT?

I think that is a good idea. I will create an epic and initial investigation issue for SBOM, Signed Releases and Token Permissions that we can refer to.

[Jdubrick]

Epic created here with initial spike: #1465

cc: @michael-valdron @thepetk