Update security-repository.md #285
Conversation
The guidance around Teams setup is incorrect. - Child teams cannot have their visibility set to secret. - CODEOWNERS file will not work with secret teams.
|
Kudos, SonarCloud Quality Gate passed!
|
| - Create one child team within the team, for admins only (e.g. `Engineering Quality Framework Admins`). Add admins only to this team. Set the visibility of the team to `Secret`. | ||
| - Create a second child team, for code owners (e.g. `Engineering Quality Framework Code Owners`). Add relevant members to this team, and reference in the CODEOWNERS file (example [here](https://github.com/NHSDigital/software-engineering-quality-framework/blob/master/.github/CODEOWNERS)). Set the visibility of the team to `Secret`. | ||
| - Create another team, for admins only (e.g. `Engineering Quality Framework Admins`). Add admins only to this team. Set the visibility of the team to `Secret`. | ||
| - Create another team, for code owners (e.g. `Engineering Quality Framework Code Owners`). Set the parent of this team to be your programme team. Add relevant members to this team, and reference in the CODEOWNERS file (example [here](https://github.com/NHSDigital/software-engineering-quality-framework/blob/master/.github/CODEOWNERS)). |
There was a problem hiding this comment.
I think we lost here the requirement for the code owners team to be a secret team. Is this intentional?
There was a problem hiding this comment.
Hi, this is intentional as the CODEOWNERS file doesn't support secret teams:
"...When the code owner is a team, that team must be visible..." https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
There was a problem hiding this comment.
Hi @LouPritch, sorry it took a while to get here.
I'm reviewing the content of the ./practices/securing-repositories.md file and have relised that some changes that you requested have already been made there. Please, could you check if you are happy with it so we can close this PR?
The guidance around Teams setup is incorrect.
Altered markdown to reflect the above.