[Security Slam 26] Achievement 4 - Mechanizer Badge (Automated Evaluation) #10060

The Mechanizer badge focuses on making security sustainable through automation. Manual security checks are prone to being skipped or becoming outdated; automated checks ensure our security posture is continuously verified.

For this achievement, we must ensure that our baseline security evaluation is fully automated and passes. As CloudNativePG is already onboarded to LFX Insights, we will use the platform to monitor our Security and Best Practices scores.

Tasks

• LFX Insights Audit: Review the LFX Insights Security & Best Practices Dashboard for CloudNativePG.

  • Identify any failing controls or "red" metrics.
  • Remediate issues to achieve a 100% score on the curated baseline subset.

• CI Integration (Optional but Recommended): Evaluate the use of the OpenSSF Baseline Scanner GitHub Action to catch regressions in pull requests.

  • Run the scanner locally using pvtr-github-repo-scanner for an initial gap analysis.
  • If integrated into CI, ensure the workflow results in zero failures.

• Update Security Insights: Add the details of our automated security tooling (LFX Insights and any GitHub Actions) to the SECURITY-INSIGHTS.yml file.

• Apply for the Mechanizer badge

Key Principles

• Sustainability: Automated checks keep running even when the team is focused on feature development, ensuring we don't regress on security hygiene.
• Immediate Feedback: Automation provides answers at a glance for maintainers and up-to-date information for regulated end-users performing conformity assessments.
• Verifiable Progress: Automated dashboards allow Slam evaluators and CNCF maintainers to verify our progress without requiring manual reviews of the codebase.

Resources

• LFX Insights Dashboard
• Privateer Project
• OSPS Baseline GitHub Action
• pvtr-github-repo-scanner

Creation of this issue assisted by Google Gemini.