ci: [2024-Q3] CI/CD Audit Story

[rbarker-dev]

CI/CD Quarterly Audit

• Description: Perform quarterly CI/CD audit

Audit Criteria

• All workflow items are using pinned actions
• Appropriate permissions are set within the github workflows
• Dependabot is enabled on the repository
• The Repository is using self-hosted runners (if appropriate)
• The repository uses the current rulesets
• Individual branch protections are turned off
• Individual tag protections are turned off
• The Step-Security Hardened Security action is enabled
• CODEOWNERS is valid and up-to-date
• Teams are assigned to the repository
• Individual contributors that are part of assigned teams are removed from contributors list
• Actions are disabled if not in use within last 6 months
• Repository settings are configured per organization standard
• All webhooks present are needed and in use
• If Applicable: Alert repository owners of software versions that are no longer supported
• If Applicable: Alert repository owners when software versions are within 3 months of losing support
• Custom properties: last-ci-review-by-team is set
• Custom properties: last-ci-review-date is set (Use format: YYYY-MM-DD)

Repository Settings

• Require contributors to sign off on web-based commits
• Features: Issues
• Features: Preserve this Repository
• Features: Discussions
• Features: Projects
• Pull Requests: Allow Squash Merging
• Pull Requests: Always suggest updating pull request branches
• Pull Requests: Automatically delete head branches
• Pushes: Limit how many branches and tags can be updated in a single push

Acceptance Criteria

• All Audit Criteria have been met