MokoConsulting/MokoCassiopeia
1
1
Fork 0
Code Issues 2 Pull Requests Actions Packages Releases 1 Activity

Add organization-level protection ruleset configuration

Browse Source 
Co-authored-by: jmiller-moko <230051081+jmiller-moko@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-01-11 17:07:44 +00:00
parent 2563425a64
commit 0084c7a17a
4 changed files with 302 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
SECURITY.md
View File

@@ -127,6 +127,17 @@ The project aims to manage supply chain risk through:
If you identify a supply chain issue (for example compromised action, dependency confusion, or malicious upstream artifact), report it as a vulnerability.
## Repository Protection and Access Controls
The project uses organization-level repository rulesets to enforce security and governance policies:
* **Branch Protection:** Main development branches (`main`, `dev/**`, `rc/**`, `version/**`) are protected with required reviews and status checks.
* **Required Status Checks:** All changes must pass validation and quality checks before merging.
* **Commit Signing:** Commits must be signed to verify author identity and prevent tampering.
* **Code Review:** At least one approving review is required, including code owner approval.
Configuration files for organization-level rulesets are maintained in `.github/org-rulesets/`. See the README in that directory for implementation details.
## Secure Development and CI Expectations
Security posture is reinforced through operational controls: