Policing Open-Source Projects at Scale
summary
Eclipse Foundation stores each project’s settings as configuration-as-code repo per org (176 GitHub orgs, ~1,700 repos) using jsonnet templates, a GitHub App and CLI that create update delete resources (repos, branch protections, secrets) by validating PRs and applying changes automatically. Playwright web-scraping fills gaps in the API. A dashboard and GraphQL queries report compliance; a policy blocks unauthorized macOS large runners to control costs. The system works in production, speeds self-service, reduces helpdesk tickets, and encounters GitHub secondary rate-limit tuning.
AI-written summary · about
chapters (23)
- 0:00Policing open-source at scale
- 1:23Securing thousands of repos
- 3:12Requirements for security enforcement
- 5:17Non-disruptive config system
- 7:23Evaluating security tools
- 9:57Custom config management tool
- 12:04Transparent config hosting
- 13:30GitHub resources supported
- 15:18Resource renaming and state
- 17:02Jsonnet config example
- 18:47Managing Eclipse Foundation repos
- 20:36Templating benefits
- 22:00Dashboard for repo insights
- 24:34Config change workflow
- 26:20PR validation and error prevention
- 28:50Enforcing security policies
- 31:00First macOS runner policy
- 32:05Future policy plans
- 34:09Adoption and metrics monitoring
- 36:37Lessons from custom approach
- 39:11Limitations and challenges
- 40:39Support and future plans
- 41:56Q&A
related talks
47mPolicing Open-Source Projects at Scale
37mConfiguration as a Code: Managing Hundreds of GitHub Organizations to Streamline Supply Chain Security
31mGitHub as a self-sustaining product for large-scale environments
01h 21mOpen Source Best Practices at Eclipse Foundation
40mA Guide to Securing GitHub Based on Lessons Learned
30mEffective Vulnerability Management for Over 400 Projects at the Eclipse Foundation
36mWhale Care 101 - How We Organize A 200+ Devs Project
23mManaging the unmanageable: community driven projects at Eclipse Foundation