Skip to content

Commit b86deda

Browse files
themoriartithemoriarti
committed
docs(security): add an OpenSSF Security Insights manifest
CLOMonitor reads its security_insights and dependencies_policy checks only from a Security Insights manifest, so both fail today even though SECURITY.md and the General Technical Review already document the vulnerability process and the dependency lifecycle. The manifest restates those facts in the machine-readable v2 schema and points dependency-management-policy at the Day 2 Dependencies section of the GTR. Assisted-by: LLM Signed-off-by: Marian Koreniuk <[email protected]>
1 parent a5d12e7 commit b86deda

1 file changed

Lines changed: 154 additions & 0 deletions

File tree

‎security-insights.yml‎

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
# OpenSSF Security Insights, schema: https://github.com/ossf/security-insights/blob/main/spec/schema.cue
2+
# Bump header.last-updated with every edit, and header.last-reviewed whenever the
3+
# facts below are re-checked, including a Security Champion rotation (SECURITY.md).
4+
header:
5+
schema-version: 2.2.0
6+
last-updated: '2026-10-05'
7+
last-reviewed: '2026-10-05'
8+
url: https://raw.githubusercontent.com/cozystack/cozystack/main/security-insights.yml
9+
10+
project:
11+
name: Cozystack
12+
homepage: https://cozystack.io
13+
roadmap: https://github.com/cozystack/cozystack/blob/main/ROADMAP.md
14+
administrators:
15+
- name: Andrei Kvapil
16+
social: https://github.com/kvaps
17+
affiliation: Ænix
18+
primary: true
19+
- name: Timofei Larkin
20+
social: https://github.com/lllamnyp
21+
affiliation: Ænix
22+
primary: false
23+
- name: Timur Tukaev
24+
social: https://github.com/tym83
25+
affiliation: Ænix
26+
primary: false
27+
- name: Ivan Okhotnikov
28+
social: https://github.com/IvanHunters
29+
affiliation: Ænix
30+
primary: false
31+
repositories:
32+
- name: cozystack
33+
url: https://github.com/cozystack/cozystack
34+
comment: The platform itself, its operator, packages, Talos image, and release automation.
35+
- name: website
36+
url: https://github.com/cozystack/website
37+
comment: Source of the cozystack.io documentation site.
38+
vulnerability-reporting:
39+
reports-accepted: true
40+
bug-bounty-available: false
41+
policy: https://github.com/cozystack/cozystack/blob/main/SECURITY.md
42+
comment: Report privately through GitHub Private Vulnerability Reporting at https://github.com/cozystack/cozystack/security/advisories/new. SECURITY.md lists the fallback channels, response targets and the 90-day disclosure window.
43+
documentation:
44+
detailed-guide: https://cozystack.io/docs/
45+
quickstart-guide: https://cozystack.io/docs/getting-started/
46+
code-of-conduct: https://github.com/cozystack/cozystack/blob/main/CODE_OF_CONDUCT.md
47+
release-process: https://github.com/cozystack/cozystack/blob/main/docs/release.md
48+
support-policy: https://github.com/cozystack/cozystack/blob/main/SECURITY.md#supported-versions
49+
50+
repository:
51+
url: https://github.com/cozystack/cozystack
52+
status: active
53+
accepts-change-request: true
54+
accepts-automated-change-request: true
55+
core-team:
56+
- name: Andrei Kvapil
57+
social: https://github.com/kvaps
58+
affiliation: Ænix
59+
primary: true
60+
- name: Kingdon Barrett
61+
social: https://github.com/kingdonb
62+
affiliation: Urmanac
63+
primary: false
64+
- name: Timofei Larkin
65+
social: https://github.com/lllamnyp
66+
affiliation: Ænix
67+
primary: false
68+
- name: Timur Tukaev
69+
social: https://github.com/tym83
70+
affiliation: Ænix
71+
primary: false
72+
- name: Matthieu Robin
73+
social: https://github.com/matthieu-robin
74+
affiliation: Hidora
75+
primary: false
76+
- name: Mattia Eleuteri
77+
social: https://github.com/mattia-eleuteri
78+
affiliation: Hidora
79+
primary: false
80+
- name: Aleksei Sviridkin
81+
social: https://github.com/lexfrei
82+
affiliation: Ænix
83+
primary: false
84+
- name: Daniil Miasnikov
85+
social: https://github.com/myasnikovdaniil
86+
affiliation: Ænix
87+
primary: false
88+
- name: Ivan Okhotnikov
89+
social: https://github.com/IvanHunters
90+
affiliation: Ænix
91+
primary: false
92+
license:
93+
expression: Apache-2.0
94+
url: https://github.com/cozystack/cozystack/blob/main/LICENSE
95+
documentation:
96+
contributing-guide: https://github.com/cozystack/cozystack/blob/main/CONTRIBUTING.md
97+
dependency-management-policy: https://github.com/cozystack/cozystack/blob/main/GENERAL_TECHNICAL_REVIEW.md#dependencies
98+
governance: https://github.com/cozystack/cozystack/blob/main/GOVERNANCE.md
99+
security-policy: https://github.com/cozystack/cozystack/blob/main/SECURITY.md
100+
release:
101+
automated-pipeline: true
102+
distribution-points:
103+
- uri: https://github.com/cozystack/cozystack/releases
104+
comment: Operator manifests, CRDs, cozypkg binaries and Talos images are attached to each release.
105+
- uri: ghcr.io/cozystack/cozystack
106+
comment: Container images and the packages OCI artifact.
107+
changelog: https://github.com/cozystack/cozystack/blob/main/docs/changelogs/v{version}.md
108+
security:
109+
assessments:
110+
self:
111+
name: Cozystack Self-assessment
112+
comment: Security self-assessment prepared by the maintainers for the CNCF Incubation application.
113+
evidence: https://github.com/cozystack/cozystack/blob/main/docs/security/self-assessment.md
114+
champions:
115+
- name: Timur Tukaev
116+
social: https://github.com/tym83
117+
primary: true
118+
tools:
119+
- name: CodeQL
120+
type: SAST
121+
rulesets: [default]
122+
integration:
123+
adhoc: true
124+
ci: true
125+
release: false
126+
results: {}
127+
comment: Runs on every pull request to main, on push to main, and weekly.
128+
- name: zizmor
129+
type: SAST
130+
rulesets: [default]
131+
integration:
132+
adhoc: false
133+
ci: true
134+
release: false
135+
results: {}
136+
comment: Audits the GitHub Actions workflows; part of the required pre-commit check, scoped by .github/zizmor.yml.
137+
- name: OpenSSF Scorecard
138+
type: other
139+
rulesets: [default]
140+
integration:
141+
adhoc: true
142+
ci: false
143+
release: false
144+
results: {}
145+
comment: Runs weekly and publishes to https://scorecard.dev/viewer/?uri=github.com/cozystack/cozystack.
146+
- name: Trivy
147+
type: SCA
148+
rulesets: [default]
149+
integration:
150+
adhoc: true
151+
ci: false
152+
release: false
153+
results: {}
154+
comment: Organization-wide scan of Go modules, base images and packaged container images; CRITICAL every 6 hours, the rest weekly. Aggregate reports are published under docs/security/reports/.

0 commit comments

Comments
 (0)