artifacts/SECURITY-INSIGHTS.yml at main · cloudnative-pg/artifacts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
header:
  schema-version: 2.2.0
  last-updated: '2026-08-04'
  last-reviewed: '2026-08-04'
  url: https://raw.githubusercontent.com/cloudnative-pg/artifacts/main/SECURITY-INSIGHTS.yml
  # reference the main SECURITY-INSIGHTS file from CNPG repo
  project-si-source: https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/SECURITY-INSIGHTS.yml

repository:
  url: https://github.com/cloudnative-pg/artifacts
  status: active
  accepts-change-request: true
  accepts-automated-change-request: true
  no-third-party-packages: false
  core-team:
    - name: Gabriele Bartolini
      email: gabriele.bartolini@enterprisedb.com
      primary: true
    - name: Francesco Canovai
      email: francesco.canovai@enterprisedb.com
      primary: false
    - name: Leonardo Cecchi
      email: leonardo.cecchi@enterprisedb.com
      primary: false
    - name: Marco Nenciarini
      email: marco.nenciarini@enterprisedb.com
      primary: false
    - name: Armando Ruocco
      email: armando.ruocco@enterprisedb.com
      primary: false
    - name: Niccolò Fei
      email: niccolo.fei@enterprisedb.com
      primary: false
  license:
    url: https://www.apache.org/licenses/LICENSE-2.0
    expression: Apache-2.0

  release:
    automated-pipeline: true
    distribution-points:
      - uri: https://github.com/cloudnative-pg/artifacts/blob/release-{version}/manifests/operator-manifest.yaml
        comment: Kubernetes manifests for the operator
      - uri: https://github.com/cloudnative-pg/artifacts/tree/main/image-catalogs
        comment: ClusterImageCatalog/ImageCatalog manifests for PostgreSQL operand images
      - uri: https://github.com/cloudnative-pg/artifacts/tree/main/image-catalogs-extensions
        comment: ClusterImageCatalog/ImageCatalog manifests for PostgreSQL extension images
      - uri: https://github.com/cloudnative-pg/artifacts/tree/main/bundles
        comment: OLM (Operator Lifecycle Manager) bundles, one directory per released version

  security:
    tools:
      - name: Dependabot
        type: SCA
        rulesets: ["default"]
        results: {}
        comment: |
          No dedicated CI workflows in this repo -- content is generated and
          committed by other repos' pipelines (see repo-policy.yaml's
          category: automated in cloudnative-pg/cnpg-infra). Dependabot
          security updates and GitHub's default code-scanning setup are
          still enabled at the repo-settings level, org-wide.
        integration:
          adhoc: true
          ci: false
          release: false
      - name: GitHub Code Scanning
        type: SAST
        rulesets: ["default"]
        results: {}
        comment: GitHub's default CodeQL setup, enabled at the repo-settings level.
        integration:
          adhoc: false
          ci: false
          release: false

    assessments:
      self:
        comment: Refer to the main project.