Update maintainer list and permissions for SAST analyzers
Problem to Solve
DangerBot regularly suggests GitLab team members outside of the SAST team perform do SAST analyzer reviews and doesn't suggest SAST/IaC team members.
Proposed solution
- Update SAST/IaC team_members pages so that they are maintainers of SAST analyzers
- Add SAST/IaC team members to the
.gitlab/CODEOWNERS
file - Update permissions of SAST/IaC team members to maintainer for each SAST analyzer
- (Suggestion) Ask team members outside of the SAST/IaC team to update their team_members page so they are no longer suggested as a reviewer
Suggested team_members page update
secure-SAST-kics: maintainer
secure-SAST-kubesec: maintainer
secure-SAST-pmd-apex: maintainer
secure-SAST-security-code-scan: maintainer
secure-SAST-semgrep: maintainer
secure-SAST-sobelow: maintainer
secure-SAST-spotbugs: maintainer
secure-SAST-tracking-calculator: reviewer
secure-common-command: reviewer
secure-common-report: reviewer
secure-common-ruleset: reviewer
Implementation Plan
-
@jleasure -
Add suggested team member page permissions to jleasure.yml -
Add @jleasure
to CODEOWNERS file and submit to @craigmsmith for review and permission update:
-
-
@hyan3 -
Add suggested team member page permissions to hyan3.yml -
Add @hyan3
to CODEOWNERS file and submit to @craigmsmith for review and permission update:
-
-
@julianthome -
Add suggested team member page permissions to julianthome.yml -
Add @julianthome
to CODEOWNERS file and submit to @craigmsmith for review and permission update:
-
Edited by Jason Leasure