Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Move per project state into the github repo by defaul #60

Open
mlieberman85 opened this issue Feb 25, 2024 · 0 comments
Open

Move per project state into the github repo by defaul #60

mlieberman85 opened this issue Feb 25, 2024 · 0 comments

Comments

@mlieberman85
Copy link
Contributor

@adityasaky had a good suggestion that the state of what is created/managed by skootrs for a project can be stored in the github repo in something like a .skootrs file or directory (similar to allstar) instead of storing the state in a local database. The data would probably include things like:

  • Facets created
  • Parameters to generate the facets (e.g. where they are located in the repo)
  • Important into of non-file facets (e.g. important API call response info if relevant or perhaps a call that can be run to validate that the functionality enabled by that api call like branch protection is still enabled?)
  • Hashes of the files created. This is useful for just verifying if a facet has been modified out of band
  • Commit hash of when the file was committed. This is useful for audits so you have a record of when a facet was enabled.
  • What properties a facet hits, e.g. this workflow facet include SLSA builder, SBOM generator, etc.

This is useful for a few reasons. I am assuming that no one is abusing .skootrs by modifying it out of band.

  • This lets skootrs be able to continually manage a project. Since Skootrs can verify the state of a repository and know what it needs to change.
  • This lets folks adopt new projects into a local reference cache. For example if someone changes workstations or if multiple people have access to manage a project.
  • This lets external parties run audits against the .skootrs state. This is untrustworthy until multiple security considerations are sorted out.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant