Skip to content

Commit 010d9f1

Browse files
AlmostBald-TRADINGAlmostBald-TRADING
committed
Add comprehensive GitHub security setup guides
- Add detailed step-by-step GITHUB_SECURITY_SETUP.md with screenshots guidance - Add quick reference card SECURITY_QUICK_REFERENCE.md for fast setup - Include direct links to all GitHub settings pages - Provide verification steps and troubleshooting guide - Add time estimates and priority ordering for setup tasks
1 parent ca8052a commit 010d9f1

File tree

2 files changed

+374
-0
lines changed

2 files changed

+374
-0
lines changed

‎GITHUB_SECURITY_SETUP.md‎

Lines changed: 279 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,279 @@
1+
# GitHub Repository Security Setup Guide
2+
3+
This comprehensive guide will walk you through configuring all the necessary security settings for your ContextForge Memory repository.
4+
5+
## Prerequisites
6+
7+
- Admin access to the `VirtualAgentics/ConextForge_memory` repository
8+
- 15-20 minutes to complete all configurations
9+
10+
## Step 1: Branch Protection Rules
11+
12+
### Navigate to Branch Protection
13+
1. Go to: `https://github.com/VirtualAgentics/ConextForge_memory`
14+
2. Click **Settings** (top menu bar)
15+
3. Click **Branches** (left sidebar)
16+
4. Click **Add rule** or **Edit** next to `main` branch
17+
18+
### Configure Branch Protection
19+
Set the following options:
20+
21+
#### ✅ **Rule name**
22+
- **Branch name pattern**: `main`
23+
24+
#### ✅ **Protect matching branches**
25+
- **Require a pull request before merging**
26+
- ✅ Check this box
27+
- **Required number of reviewers**: `1`
28+
- ✅ **Dismiss stale PR approvals when new commits are pushed**
29+
- ✅ **Require review from code owners**
30+
31+
#### ✅ **Require status checks to pass before merging**
32+
- ✅ Check this box
33+
- ✅ **Require branches to be up to date before merging**
34+
- **Status checks that are required**: Select `test` (from CI workflow)
35+
36+
#### ✅ **Require conversation resolution before merging**
37+
- ✅ Check this box
38+
39+
#### ✅ **Restrict pushes that create files**
40+
- ✅ Check this box (optional but recommended)
41+
42+
#### ✅ **Do not allow bypassing the above settings**
43+
- ✅ Check this box
44+
- **Restrict who can bypass the above settings**: Select yourself or team admins
45+
46+
#### ✅ **Allow force pushes**
47+
- ❌ Leave unchecked
48+
49+
#### ✅ **Allow deletions**
50+
- ❌ Leave unchecked
51+
52+
**Click "Create" or "Save changes"**
53+
54+
---
55+
56+
## Step 2: Security & Analysis Settings
57+
58+
### Navigate to Security Settings
59+
1. In repository settings, click **Security** (left sidebar)
60+
2. Click **Code security and analysis**
61+
62+
### Enable Security Features
63+
64+
#### ✅ **Dependabot alerts**
65+
- **Status**: Should show "Enabled" or click "Enable"
66+
- This scans for known vulnerabilities in dependencies
67+
68+
#### ✅ **Dependabot security updates**
69+
- **Status**: Should show "Enabled" or click "Enable"
70+
- Automatically creates PRs for security updates
71+
72+
#### ✅ **Secret scanning**
73+
- **Status**: Should show "Enabled" or click "Enable"
74+
- Scans for accidentally committed secrets
75+
76+
#### ✅ **Push protection**
77+
- **Status**: Should show "Enabled" or click "Enable"
78+
- Prevents commits with secrets from being pushed
79+
80+
#### ⚠️ **Code scanning** (Optional - requires GitHub Advanced Security)
81+
- If you have GitHub Advanced Security, enable this
82+
- Otherwise, skip this step
83+
84+
---
85+
86+
## Step 3: General Repository Settings
87+
88+
### Navigate to General Settings
89+
1. In repository settings, click **General** (left sidebar)
90+
91+
### Configure Merge Options
92+
1. Scroll down to **Pull Requests** section
93+
2. **Merge button**: Select **"Squash and merge"** or **"Rebase and merge"**
94+
3. ❌ **Uncheck "Allow merge commits"**
95+
96+
### Configure Branch Management
97+
1. Scroll down to **Pull Requests** section
98+
2. ✅ **Check "Automatically delete head branches"**
99+
100+
### Disable Unused Features
101+
1. Scroll down to **Features** section
102+
2. **Wikis**: ❌ Uncheck (unless you need it)
103+
3. **Projects**: ❌ Uncheck (unless you need it)
104+
4. **Discussions**: ❌ Uncheck (unless you need it)
105+
106+
### Configure Repository Visibility
107+
1. Scroll to **Danger Zone** (bottom of page)
108+
2. **Repository visibility**: Should be **Public**
109+
3. **Archive this repository**: ❌ Don't click (unless you want to archive)
110+
111+
---
112+
113+
## Step 4: Actions Settings
114+
115+
### Navigate to Actions Settings
116+
1. In repository settings, click **Actions** (left sidebar)
117+
2. Click **General**
118+
119+
### Configure Workflow Permissions
120+
1. Scroll to **Workflow permissions**
121+
2. Select **"Read repository contents and packages permissions"**
122+
3. ✅ **Check "Allow GitHub Actions to create and approve pull requests"**
123+
124+
### Configure Fork Pull Requests
125+
1. Scroll to **Fork pull request workflows from outside collaborators**
126+
2. Select **"Require approval for first-time contributors"**
127+
128+
### Configure Actions Access
129+
1. Scroll to **Actions access**
130+
2. Select **"Allow all actions and reusable workflows"**
131+
132+
---
133+
134+
## Step 5: Repository Access Settings
135+
136+
### Navigate to Access Settings
137+
1. In repository settings, click **Manage access** (left sidebar)
138+
139+
### Configure Collaborators
140+
1. **Repository access**: Should show your organization/team
141+
2. **Role**: Should be "Admin" for you
142+
3. If you need to add collaborators:
143+
- Click **"Add people"**
144+
- Enter username or email
145+
- Select appropriate role (Write, Admin, etc.)
146+
147+
---
148+
149+
## Step 6: Notifications Settings
150+
151+
### Navigate to Notifications
152+
1. In repository settings, click **Notifications** (left sidebar)
153+
154+
### Configure Security Alerts
155+
1. ✅ **Check "Dependabot alerts"**
156+
2. ✅ **Check "Dependabot security updates"**
157+
3. ✅ **Check "Secret scanning alerts"**
158+
159+
---
160+
161+
## Step 7: Verify Security Configuration
162+
163+
### Test Branch Protection
164+
1. Create a test branch: `git checkout -b test-security`
165+
2. Make a small change to any file
166+
3. Commit and push: `git push origin test-security`
167+
4. Create a PR from this branch to `main`
168+
5. Try to merge without approval - it should be blocked
169+
6. Delete the test branch after verification
170+
171+
### Check Security Tab
172+
1. Go to repository main page
173+
2. Click **Security** tab
174+
3. Verify you see:
175+
- Dependabot alerts
176+
- Secret scanning
177+
- Code scanning (if enabled)
178+
179+
### Verify CI Workflow
180+
1. Go to **Actions** tab
181+
2. Check that the CI workflow runs on PRs
182+
3. Verify it includes security checks
183+
184+
---
185+
186+
## Step 8: Additional Security Recommendations
187+
188+
### Enable Two-Factor Authentication
189+
1. Go to your GitHub profile settings
190+
2. Enable 2FA for your account
191+
3. Require 2FA for organization members
192+
193+
### Configure Organization Security
194+
If this is an organization repository:
195+
1. Go to organization settings
196+
2. Enable **"Require two-factor authentication"**
197+
3. Enable **"Require two-factor authentication for Git operations"**
198+
199+
### Set Up Security Policies
200+
1. The `SECURITY.md` file is already created
201+
2. Review and update contact information if needed
202+
3. Consider adding a security contact to the repository
203+
204+
---
205+
206+
## Verification Checklist
207+
208+
After completing all steps, verify:
209+
210+
- [ ] Branch protection rules are active
211+
- [ ] Dependabot alerts are enabled
212+
- [ ] Secret scanning is enabled
213+
- [ ] Push protection is enabled
214+
- [ ] CI workflow runs on PRs
215+
- [ ] PRs require approval before merging
216+
- [ ] Merge commits are disabled
217+
- [ ] Head branches are automatically deleted
218+
- [ ] Security tab shows active monitoring
219+
220+
---
221+
222+
## Troubleshooting
223+
224+
### Common Issues
225+
226+
**"Status checks must pass" error:**
227+
- Ensure CI workflow is running successfully
228+
- Check that the workflow file is in `.github/workflows/`
229+
230+
**"Review required" error:**
231+
- Make sure you have the required number of reviewers
232+
- Check that CODEOWNERS file is properly configured
233+
234+
**Dependabot not working:**
235+
- Verify `.github/dependabot.yml` is committed
236+
- Check that the file syntax is correct
237+
- Wait up to 24 hours for initial scan
238+
239+
**Secret scanning not detecting issues:**
240+
- This is normal - it only triggers on actual secrets
241+
- Test with a dummy secret (then immediately remove it)
242+
243+
### Getting Help
244+
245+
If you encounter issues:
246+
1. Check GitHub's documentation
247+
2. Review the repository's Security tab
248+
3. Check Actions tab for workflow errors
249+
4. Contact GitHub support if needed
250+
251+
---
252+
253+
## Security Best Practices
254+
255+
### For Contributors
256+
- Never commit secrets or sensitive data
257+
- Use environment variables for configuration
258+
- Keep dependencies up to date
259+
- Follow the contribution guidelines
260+
261+
### For Maintainers
262+
- Regularly review security alerts
263+
- Keep the security policy updated
264+
- Monitor for unusual activity
265+
- Review and merge Dependabot PRs promptly
266+
267+
---
268+
269+
## Next Steps
270+
271+
After completing this setup:
272+
273+
1. **Monitor the Security tab** for any alerts
274+
2. **Review Dependabot PRs** regularly
275+
3. **Test the workflow** with a few test PRs
276+
4. **Update documentation** as needed
277+
5. **Train team members** on security practices
278+
279+
Your repository is now properly secured for public contributions!

‎SECURITY_QUICK_REFERENCE.md‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# Security Setup Quick Reference
2+
3+
## 🔗 Direct Links to Settings
4+
5+
- **Branch Protection**: `https://github.com/VirtualAgentics/ConextForge_memory/settings/branches`
6+
- **Security & Analysis**: `https://github.com/VirtualAgentics/ConextForge_memory/settings/security_analysis`
7+
- **General Settings**: `https://github.com/VirtualAgentics/ConextForge_memory/settings`
8+
- **Actions Settings**: `https://github.com/VirtualAgentics/ConextForge_memory/settings/actions`
9+
10+
## ⚡ Quick Setup Checklist
11+
12+
### Branch Protection (5 minutes)
13+
- [ ] Go to Settings > Branches
14+
- [ ] Add rule for `main` branch
15+
- [ ] Enable "Require pull request before merging"
16+
- [ ] Set required reviewers to `1`
17+
- [ ] Enable "Require status checks to pass"
18+
- [ ] Enable "Require branches to be up to date"
19+
- [ ] Enable "Require conversation resolution"
20+
- [ ] Enable "Do not allow bypassing the above settings"
21+
22+
### Security Features (2 minutes)
23+
- [ ] Go to Settings > Security & analysis
24+
- [ ] Enable "Dependabot alerts"
25+
- [ ] Enable "Dependabot security updates"
26+
- [ ] Enable "Secret scanning"
27+
- [ ] Enable "Push protection"
28+
29+
### Repository Settings (3 minutes)
30+
- [ ] Go to Settings > General
31+
- [ ] Disable "Allow merge commits"
32+
- [ ] Enable "Automatically delete head branches"
33+
- [ ] Disable Wiki (if not needed)
34+
- [ ] Disable Projects (if not needed)
35+
36+
### Actions Settings (2 minutes)
37+
- [ ] Go to Settings > Actions > General
38+
- [ ] Set workflow permissions to "Read repository contents and packages permissions"
39+
- [ ] Enable "Require approval for first-time contributors"
40+
41+
## 🧪 Test Your Setup
42+
43+
1. **Create test branch**: `git checkout -b test-security`
44+
2. **Make change**: Edit any file
45+
3. **Push branch**: `git push origin test-security`
46+
4. **Create PR**: Try to merge without approval (should fail)
47+
5. **Clean up**: Delete test branch
48+
49+
## 🚨 Critical Settings
50+
51+
| Setting | Location | Status |
52+
|---------|----------|--------|
53+
| Branch Protection | Settings > Branches | ✅ Required |
54+
| Dependabot Alerts | Settings > Security | ✅ Required |
55+
| Secret Scanning | Settings > Security | ✅ Required |
56+
| Push Protection | Settings > Security | ✅ Required |
57+
| Merge Commits | Settings > General | ❌ Disabled |
58+
| Auto-delete Branches | Settings > General | ✅ Enabled |
59+
60+
## 📞 Emergency Contacts
61+
62+
- **Security Issues**: [email protected]
63+
- **Code of Conduct**: [email protected]
64+
- **General Support**: Check repository issues
65+
66+
## 🔍 Verification Commands
67+
68+
```bash
69+
# Check if branch protection is working
70+
git checkout -b test-branch
71+
echo "test" >> README.md
72+
git add README.md
73+
git commit -m "test"
74+
git push origin test-branch
75+
# Try to merge PR - should require approval
76+
77+
# Check security scanning
78+
# Look for "Security" tab in repository
79+
# Should show Dependabot alerts section
80+
```
81+
82+
## ⏱️ Time Estimates
83+
84+
- **Complete Setup**: 15-20 minutes
85+
- **Quick Setup**: 10 minutes
86+
- **Testing**: 5 minutes
87+
- **Total**: 20-25 minutes
88+
89+
## 🎯 Priority Order
90+
91+
1. **HIGH**: Branch protection rules
92+
2. **HIGH**: Secret scanning
93+
3. **MEDIUM**: Dependabot alerts
94+
4. **MEDIUM**: Merge settings
95+
5. **LOW**: Additional features

0 commit comments

Comments
 (0)