Open source security: advisories and workflows to keep open source secure
summary
GitHub launches a concrete workflow: a security policy repo file and Security tab that prompts reporters away from public issues, a draft advisory workflow that creates a temporary private fork for patches with default access limited to org owners and repo admins, pull requests that deliberately skip CI to avoid early disclosure, and a publish step that collects affected/patched versions, package names and CVE IDs to generate alerts to downstream dependencies. Demo shows the flow end-to-end and GitHub review prevents duplicate alerts.
AI-written summary · about
chapters (8)
- 0:00Introduction to Session
- 1:03Reporter's Process
- 3:49Maintainer's Workflow
- 5:31Security Advisories Feature
- 7:27Fixing and Publishing
- 10:42Demo of Security Workflow
- 16:13Encouraging Best Practices
- 17:10Q&A and Conclusion
related talks
27mBuilding a Secure Open Source Project on GitHub
21mImplementing GitHub's private security issue reporting
41mBake Security into your workflow with GitHub Advanced Security and AI
48mAdvanced Security with GitHub without GitHub Advanced Security
39mDon’t Ignore Those GitHub Security Alerts. Automate Them Into your Workflow
17mNo More Walled Gardens: Removing Barriers with SCM...
37mBefore It's Out the Door Securing Outbound Open Source
30mSecuring the software supply chain together