docs: OpenSSF Best Practices proposal — Silver plan, Scorecard fixes, Gold roadmap - #216
Merged
Merged
Conversation
Audit of badge project 12651 against the current repo: Passing is 100% but every Silver/Gold/OSPS question is unanswered, and the badge entry still points at the pre-rename infobloxopen org URL, which is why Scorecard's CII-Best-Practices check reports 0 despite the badge. Sequence the work into four phases: badge URL fix, questionnaire pass over already-met criteria, small repo changes (roadmap, assurance case, coverage gate, signed tags), and Gold items gated on contributor growth. Signed-off-by: Ingmar Van Glabbeek <ivanglabbeek@infoblox.com>
…proposal Interview outcomes: 1-approval review policy bound via enforce_admins, dedicated coverage push to 90/80, repro-build + Atheris + OSS-Fuzz all in scope, Infoblox internal security review, Gold-ready in 1-2 cycles. Verified same day: 0 org members lack 2FA (require-2FA is safe to flip), main already requires 1 review + 8 strict checks, and the uncovered- statement mass concentrates in cli/main.py and mcp/server.py (~41%). Signed-off-by: Ingmar Van Glabbeek <ivanglabbeek@infoblox.com>
This was referenced Jul 30, 2026
Open
2 tasks
iracic82
approved these changes
Jul 30, 2026
iracic82
left a comment
iracic82
left a comment
Member
There was a problem hiding this comment.
Solid plan man. Maps out the whole road to Gold really well. Heads up that a chunk of it already landed. Phase 0 badge URL is fixed so CII sits at 5 now. Token-Permissions is 10 after the reusable workflow fix. #218 covers repro-build and fuzzing and pinned deps. And enforce_admins went on this morning. Approving.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Audit-backed proposal for taking the project from the achieved Passing badge (100%, 2026-04-25) to Silver and Gold, plus Scorecard fixes.
Key findings from the audit:
infobloxopenorg URL — this is why Scorecard's CII-Best-Practices check reports 0/10 despite the badge. @iracic82: updating the entry's repo/homepage URL is the single cheapest score improvement available.Companion PRs implement the plan: docs set (roadmap/assurance case/policy paragraphs), CI hardening (coverage floor, hash-pinned release deps, repro-build, fuzzing), and the coverage push.
Review notes
docs/proposals/openssf-best-practices.md— no behavior changes.