diff --git a/docs/repositories.md b/docs/repositories.md new file mode 100644 index 00000000000..8f0afcd3529 --- /dev/null +++ b/docs/repositories.md @@ -0,0 +1,61 @@ +# Repository Guidelines + +This document attempts to outline a structure for creating and associating +GitHub repositories with the OpenSSF Scorecard project. + + + + +- [Approval](#approval) +- [Requirements](#requirements) +- [Donated repositories](#donated-repositories) + - [Copyright headers](#copyright-headers) +- [Attribution](#attribution) + +## Approval + +New repositories require approval from the OpenSSF Scorecard Steering Committee. + +## Requirements + +The following requirements apply to all OpenSSF Scorecard repositories: + +- Must be identified in the OpenSSF Scorecard project documentation +- Must reside in the [OpenSSF GitHub organization](https://github.com/ossf) +- Must utilize the topic [`openssf-scorecard`](https://github.com/topics/openssf-scorecard) (ref: [managing topics](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/classifying-your-repository-with-topics)) +- Must adopt the OpenSSF Scorecard [Code of Conduct](/CODE_OF_CONDUCT.md) +- Must adopt an appropriate license, in compliance with the Intellectual Property Policy of OpenSSF Scorecard [charter](/CHARTER.md) +- Must include headers across all files that attribute copyright as follows: + + ```text + Copyright [YYYY] OpenSSF Scorecard Authors + ``` + +- Must enforce usage of the Developer Certificate of Origin (DCO) via the [DCO GitHub Application](https://github.com/apps/dco) +- All privileges to the repository must be defined via [GitHub teams](https://docs.github.com/en/organizations/organizing-members-into-teams/about-teams), [instead of individuals](https://github.com/ossf/tac/blob/main/policies/access.md#teams-not-individuals) +- All code review permissions must be defined via [CODEOWNERS](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners) +- All contributors with privileges to the repository must also be active members of the OpenSSF Scorecard project + +## Donated repositories + +The OpenSSF Scorecard project may at times accept repository donations. + +Donated repositories must: + +- Adhere to the [requirements for all project repositories](#requirements) + + +### Copyright headers + +The addition of required copyright headers to code created by the contributors +can occur post-transfer, but should ideally occur shortly thereafter. + +***Note that copyright notices should only be modified or removed by the people or organizations named in the notice.*** + +## Attribution + +These guidelines were drafted with inspiration from the [Kubernetes project's repository guidelines](https://github.com/kubernetes/community/blob/e65e7141f8c2bb82f33762c35e19059e9c5d034e/github-management/kubernetes-repositories.md).