Skip to content

Commit 8273cb8

Browse files
gbartolinimnencia
gbartolini
and
mnencia
authored
chore: integrate SECURITY-INSIGHTS.yaml with baseline info (cloudnative-pg#10062)
Closes cloudnative-pg#10057 Signed-off-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com> Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com> Co-authored-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
1 parent a95b4d2 commit 8273cb8

File tree

1 file changed

+146
-5
lines changed

1 file changed

+146
-5
lines changed

‎SECURITY-INSIGHTS.yml‎

Lines changed: 146 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,60 +1,201 @@
11
header:
22
schema-version: 2.2.0
3-
last-updated: '2026-02-23'
4-
last-reviewed: '2026-02-23'
3+
last-updated: '2026-02-25'
4+
last-reviewed: '2026-02-25'
55
url: https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/SECURITY-INSIGHTS.yml
66

77
project:
88
name: CloudNativePG
9+
homepage: https://cloudnative-pg.io
10+
roadmap: https://github.com/orgs/cloudnative-pg/projects/1
11+
steward:
12+
uri: https://www.cncf.io/
13+
comment: CloudNativePG is a Cloud Native Computing Foundation project.
914
administrators:
1015
- name: Gabriele Bartolini
16+
email: gabriele.bartolini@enterprisedb.com
1117
primary: true
1218
- name: Francesco Canovai
19+
email: francesco.canovai@enterprisedb.com
1320
primary: false
1421
- name: Leonardo Cecchi
22+
email: leonardo.cecchi@enterprisedb.com
1523
primary: false
1624
- name: Jonathan Gonzalez V.
1725
primary: false
1826
- name: Marco Nenciarini
27+
email: marco.nenciarini@enterprisedb.com
1928
primary: false
2029
- name: Armando Ruocco
30+
email: armando.ruocco@enterprisedb.com
2131
primary: false
2232
- name: Philippe Scorsolini
33+
email: philippe.scorsolini@upbound.io
2334
primary: false
2435
repositories:
2536
- name: CloudNativePG
2637
url: https://github.com/cloudnative-pg/cloudnative-pg
38+
comment: Main repository for the CloudNativePG project
39+
40+
# Auxiliary repositories
41+
- name: Artifacts
42+
url: https://github.com/cloudnative-pg/artifacts
43+
comment: |
44+
Artifacts produced by CloudNativePG including YAML manifests, OLM
45+
bundles, image catalogs
46+
- name: Barman Cloud plugin
47+
url: https://github.com/cloudnative-pg/plugin-barman-cloud
48+
comment: Barman Cloud CNPG-I plugin for CloudNativePG
49+
- name: Charts
50+
url: https://github.com/cloudnative-pg/charts
51+
comment: Official Helm charts for CloudNativePG projects
52+
- name: CNPG Playground
53+
url: https://github.com/cloudnative-pg/cnpg-playground
54+
comment: |
55+
Local Learning Environment designed for learning and experimenting with
56+
CloudNativePG using Docker and Kind.
57+
- name: Documentation
58+
url: https://github.com/cloudnative-pg/docs
59+
comment: |
60+
Repository for building and maintaining the CloudNativePG documentation
61+
- name: Governance
62+
url: https://github.com/cloudnative-pg/governance
63+
comment: Repository containing governance documents for CloudNativePG
64+
- name: PostgreSQL Container Images
65+
url: https://github.com/cloudnative-pg/postgres-containers
2766
comment: |
28-
Main repository for the CloudNativePG project
67+
Maintenance scripts for generating immutable application containers for
68+
all supported PostgreSQL major versions
69+
- name: PostgreSQL Extensions Container Images
70+
url: https://github.com/cloudnative-pg/postgres-extensions-containers
71+
comment: |
72+
Maintenance scripts for building immutable container images containing
73+
PostgreSQL extensions supported by CloudNativePG
74+
- name: Website
75+
url: https://github.com/cloudnative-pg/cloudnative-pg.github.io
76+
comment: CloudNativePG website
77+
78+
documentation:
79+
design: https://github.com/cloudnative-pg/cloudnative-pg/blob/main/contribute/technical-architecture.md
80+
quickstart-guide: https://cloudnative-pg.io/docs/current/quickstart
81+
detailed-guide: https://cloudnative-pg.io/docs/current/
82+
code-of-conduct: https://github.com/cloudnative-pg/governance/blob/main/CODE_OF_CONDUCT.md
83+
release-process: https://github.com/cloudnative-pg/cloudnative-pg/blob/main/contribute/release_procedure.md
84+
support-policy: https://cloudnative-pg.io/docs/current/supported_releases
85+
signature-verification: https://github.com/cloudnative-pg/postgres-containers?tab=readme-ov-file#security
86+
2987
vulnerability-reporting:
3088
reports-accepted: true
3189
bug-bounty-available: false
90+
policy: https://github.com/cloudnative-pg/cloudnative-pg/security/policy
91+
contact:
92+
name: Alias to a private mailing list in Google Groups containing just the maintainers of the project
93+
email: security@cloudnative-pg.io
94+
primary: true
3295

3396
repository:
3497
url: https://github.com/cloudnative-pg/cloudnative-pg
3598
status: active
3699
accepts-change-request: true
37100
accepts-automated-change-request: false
101+
no-third-party-packages: false
38102
core-team:
39103
- name: Gabriele Bartolini
104+
email: gabriele.bartolini@enterprisedb.com
40105
primary: true
41106
- name: Francesco Canovai
107+
email: francesco.canovai@enterprisedb.com
42108
primary: false
43109
- name: Leonardo Cecchi
110+
email: leonardo.cecchi@enterprisedb.com
44111
primary: false
45112
- name: Jonathan Gonzalez V.
46113
primary: false
47114
- name: Marco Nenciarini
115+
email: marco.nenciarini@enterprisedb.com
48116
primary: false
49117
- name: Armando Ruocco
118+
email: armando.ruocco@enterprisedb.com
50119
primary: false
51120
- name: Philippe Scorsolini
121+
email: philippe.scorsolini@upbound.io
52122
primary: false
123+
documentation:
124+
contributing-guide: https://github.com/cloudnative-pg/cloudnative-pg/blob/main/CONTRIBUTING.md
125+
review-policy: https://github.com/cloudnative-pg/cloudnative-pg/tree/main/contribute#about-our-development-workflow
126+
security-policy: https://github.com/cloudnative-pg/cloudnative-pg/security/policy
127+
governance: https://github.com/cloudnative-pg/governance/blob/main/GOVERNANCE.md
128+
dependency-management-policy: https://github.com/cloudnative-pg/cloudnative-pg/blob/main/DEPENDENCIES.md
53129
license:
54130
url: https://www.apache.org/licenses/LICENSE-2.0
55131
expression: Apache-2.0
132+
133+
release:
134+
changelog: https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/{version}
135+
automated-pipeline: true
136+
distribution-points:
137+
- uri: https://github.com/cloudnative-pg/cloudnative-pg/pkgs/container/cloudnative-pg
138+
comment: GitHub packages for CloudNativePG
139+
- uri: https://github.com/cloudnative-pg/artifacts/blob/release-{version}/manifests/operator-manifest.yaml
140+
comment: Kubernetes manifests
141+
56142
security:
143+
tools:
144+
- name: Dependabot
145+
type: SCA
146+
rulesets: ["default"]
147+
results: {}
148+
integration:
149+
adhoc: true
150+
ci: false
151+
release: false
152+
- name: Renovate
153+
type: SCA
154+
rulesets: ["default"]
155+
results: {}
156+
integration:
157+
adhoc: true
158+
ci: true
159+
release: false
160+
- name: Snyk
161+
type: SAST
162+
rulesets: ["default"]
163+
results: {}
164+
comment: |
165+
Performs both Static Code Analysis (Snyk Code) and Vulnerability
166+
Scanning (Snyk Open Source).
167+
integration:
168+
adhoc: true
169+
ci: true
170+
release: true
171+
- name: Cosign
172+
type: container
173+
rulesets: ["default"]
174+
results: {}
175+
comment: Used to cryptographically sign container images (operator and operand).
176+
integration:
177+
adhoc: true
178+
ci: true
179+
release: true
180+
- name: CodeQL
181+
type: SAST
182+
rulesets: ["default"]
183+
results: {}
184+
comment: Performs static analysis of Go code on pushes, PRs, and weekly schedules.
185+
integration:
186+
adhoc: false
187+
ci: true
188+
release: false
189+
- name: GitHub Code Scanning
190+
type: SAST
191+
rulesets: ["default"]
192+
results: {}
193+
comment: Ingests SARIF results from Snyk for integrated GitHub security alerts.
194+
integration:
195+
adhoc: true
196+
ci: true
197+
release: true
198+
57199
assessments:
58200
self:
59-
comment: |
60-
Self assessment has not yet been completed.
201+
comment: Self assessment has not yet been completed.

0 commit comments

Comments
 (0)