Policing Open-Source Projects at Scale
summary
Eclipse Foundation implements a config-as-code system that stores each project’s GitHub configuration in an eclipse-fdn repo per org, currently covering 176 GitHub organizations and over 1,700 repositories. The system uses Jsonnet templating to create delete and modify resources, compares live settings statelessly, and applies changes via a GitHub App plus CLI; it validates PRs, shows diffs, and surfaces errors. It also uses Playwright web scraping for UI-only settings and runs policies (for example blocking unauthorised macOS large runners to control costs); deployment accelerates fixes but requires rate-limit tuning.
AI-written summary · about
chapters (23)
- 0:00Policing open-source at scale
- 1:23Securing thousands of repos
- 3:12Requirements for security enforcement
- 5:17Non-disruptive config system
- 7:23Evaluating security tools
- 9:57Custom config management tool
- 12:04Transparent config hosting
- 13:30GitHub resources supported
- 15:18Resource renaming and state
- 17:02Jsonnet config example
- 18:47Managing Eclipse Foundation repos
- 20:36Templating benefits
- 22:00Dashboard for repo insights
- 24:34Config change workflow
- 26:20PR validation and error prevention
- 28:50Enforcing security policies
- 31:00First macOS runner policy
- 32:05Future policy plans
- 34:09Adoption and metrics monitoring
- 36:37Lessons from custom approach
- 39:11Limitations and challenges
- 40:39Support and future plans
- 41:56Q&A
related talks
47mPolicing Open-Source Projects at Scale
01h 21mOpen Source Best Practices at Eclipse Foundation
23mManaging the unmanageable: community driven projects at Eclipse Foundation
30mEffective Vulnerability Management for Over 400 Projects at the Eclipse Foundation
27mOpen Source Health - A Crisis of Expectations
50mEclipse Apoapsis - Open Source based Software Composition Analysis at scale
16mA Journey of Contribution and Collaboration in Open Source
39mRevising the Eclipse Foundation's Intellectual Property Due Diligence Process