Repository navigation
fix(footer): use the LF Projects copyright notice on every page - #736
Merged
Aleksei Sviridkin (lexfrei) merged 2 commits intoOct 8, 2026
Merged
Aleksei Sviridkin (lexfrei) merged 2 commits into
Aleksei Sviridkin (lexfrei) merged 2 commits into
Conversation
The CNCF website guidelines require every page footer to carry "Copyright <project> a Series of LF Projects, LLC" and the lfprojects.org policies line. The Docsy partial printed only "© <year>", and the policies line lived on the homepage alone, so CLOMonitor's trademark_disclaimer check found neither and scores the legal section at 0. Assisted-by: LLM Signed-off-by: Marian Koreniuk <[email protected]>
Contributor
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
✅ Deploy Preview for cozystack ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Marian Koreniuk (themoriarti)
marked this pull request as ready for review
October 5, 2026 20:05
Marian Koreniuk (themoriarti)
requested review from
Andrei Kvapil (kvaps),
Timofei Larkin (lllamnyp),
myasnikovdaniil and
Timur Tukaev (tym83)
as code owners
October 5, 2026 20:05
Aleksei Sviridkin (lexfrei)
approved these changes
Oct 8, 2026
Aleksei Sviridkin (lexfrei)
left a comment
Aleksei Sviridkin (lexfrei)
left a comment
Contributor
There was a problem hiding this comment.
Marian Koreniuk (@themoriarti) LGTM.
I checked it against the sources. Item 7 of the CNCF website guidelines asks for exactly these two lines in the footer, and CLOMonitor's trademark_disclaimer check matches Copyright .+ a Series of LF Projects, LLC on the homepage. The live footer today renders © and the year on separate lines with no "Copyright" word, so it can't match. On the deploy preview that regex matches on /, /docs/, /blog/, /de/ and a v1.6 docs page, and the policies line shows up once per page. The replacement markup also keeps what Docsy v0.12.0's footer/copyright.html renders for a plain string params.copyright, including the localized "All Rights Reserved".
Aleksei Sviridkin (lexfrei)
enabled auto-merge
October 8, 2026 10:14
Aleksei Sviridkin (lexfrei)
added a commit
to cozystack/cozystack
that referenced
this pull request
Oct 11, 2026
## What this PR does Adds `security-insights.yml` at the repository root, an [OpenSSF Security Insights](https://github.com/ossf/security-insights) v2.2.0 manifest. [CLOMonitor](https://clomonitor.io/projects/cncf/cozystack) reads two checks only from this file, `security_insights` and `dependencies_policy`, and both fail today although the facts already exist in prose. The manifest restates what SECURITY.md, MAINTAINERS.md, GOVERNANCE.md and the General Technical Review already say: the private reporting channel, the maintainers, the current Security Champion, the CodeQL / zizmor / Scorecard / Trivy controls, and the release distribution points. `dependency-management-policy` points at the Day 2 → Dependencies section of the GTR, which holds the dependency lifecycle policy. Expected effect after the next CLOMonitor scan: security section 72.73 → 86.36, project score +2.5. Who is named: - `project.administrators` lists the six people who hold admin on this repository (kvaps, lllamnyp, tym83, lexfrei, myasnikovdaniil, IvanHunters). The `thelinuxfoundation` service account is left out, as the comment above the list says. - `project.core-team` follows the active maintainers in MAINTAINERS.md. - `champions` names @tym83, the current Security Champion from SECURITY.md. The header comment asks for `last-reviewed` to be bumped on each rotation. Validation: the file passes `cue vet -d '#SecurityInsights'` against `spec/schema.cue` at v2.2.0 and the extra field checks in CLOMonitor's `security_insights/v2.rs`, and every file and anchor it links exists on main. ### Downstream repositories - [x] No downstream repository is affected by this change The trigger map has no entry for a root metadata file. A related but independent website change fixes CLOMonitor's `trademark_disclaimer` check: cozystack/website#736. The remaining CLOMonitor gaps are filed as #4758 (FOSSA), #4759 (signed releases and SBOM) and #4760 (Artifact Hub). ### Release note ```release-note docs(security): publish an OpenSSF Security Insights manifest (security-insights.yml) describing the project's vulnerability reporting, security tooling and dependency policy. ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a standardized security information document covering project and repository details, administrators, security contacts, private vulnerability reporting, governance, and release information. * Documented security assessments and tools, including which tools run in CI and the tools’ ad hoc and release scan settings. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
Makes the footer of every page carry the LF Projects notice required by the CNCF website guidelines, item 7:
Before this change the Docsy copyright partial printed only
© 2026 Cozystack a Series of LF Projects, LLC, and the policies sentence appeared on the homepage alone, inside the CNCF block. CLOMonitor'strademark_disclaimercheck matchesCopyright .+ a Series of LF Projects, LLC, so it fails and the project's legal score is 0.layouts/partials/footer/center.html: rendersCopyright © <year> <params.copyright>directly instead of Docsy'sfooter/copyright.html, keeps "All Rights Reserved", and adds the policies line under the badge.layouts/shortcodes/home/cncf.html: drops the homepage copy of the policies sentence, which the footer now shows on every page, the homepage included.Expected effect after the next CLOMonitor scan: legal section 0 → 100, project score about +4.
Checked on the deploy preview at desktop and 375 px widths: the footer carries the notice on
/,/docs/,/blog/and/de/, the policies line appears once per page, and nothing scrolls horizontally.Companion change in the main repository for the
security_insightsanddependencies_policychecks: cozystack/cozystack#4757.