search

numfocus / gsoc

NumFOCUS Google Summer of Code Materials
http://numfocus.org/programs/gsoc.html
456 stars 296 forks source link

GSoC 2024: Adapting to Google Open Source Security Rules, Policies, standards #470

Open henrykironde opened 3 months ago

henrykironde commented 3 months ago

An example of a project using OSSF

Project Pipeline source code Results visualized
NumPy actions yaml file Logs

Ref: https://github.com/ossf/scorecard?tab=readme-ov-file

henrykironde commented 3 months ago

Data Retriever, https://github.com/weecology/retriever, @henrykironde Deepforest, https://github.com/weecology/deepforest, @henrykironde

matthewfeickert commented 3 months ago

Hi. :wave: Responding to the "Adapting to Google Open Source Security Rules, Policies, standards" email the pyhf team's repository of choice is https://github.com/scikit-hep/pyhf. I (@matthewfeickert) will be the mentor from our team.

(We'll additionally propagate the security enhancements applied to our repo out to the other projects in the https://github.com/scikit-hep/ GitHub org. :+1:)

fonnesbeck commented 3 months ago

Submitting PyMC and PyMC Examples for security checks. Feel free to contact me directly!

fcollonval commented 3 months ago

I'll be the contact point for JupyterLab security checks. I started the submission for the OpenSSF best practices badge.

MatthewMiddlehurst commented 3 months ago

Hello, I am the contact point for aeon. Feel free to send me an email, direct message or @ me on GitHub.

CAM-Gerlach commented 3 months ago

Hello! After discussion with our lead maintainer @ccordoba12 , Spyder ( https://github.com/spyder-ide/spyder ) would like to participate! Myself, @CAM-Gerlach , will be the contact and mentor for it. I was actually just looking into implementing and certifying the OpenSSF best practices myself for Spyder and related repos that we are the maintainers of; ideally at least https://github.com/spyder-ide/spyder-kernels https://github.com/spyder-ide/qtpy, https://github.com/spyder-ide/qtawesome , https://github.com/python-lsp/python-lsp-server , and https://github.com/jupyter/qtconsole , all of which are core dependencies of Spyder and (besides Spyder-Kernels) all widely depended upon by other projects in the scientific ecosystem and beyond. I've been wanting to add many of those things (security linting, Trusted Publishers release pipeline, etc) anyway, so this is a perfect opportunity to have some help from an expert in that area. Thanks!

isidorostsa commented 3 months ago

Hello, I along with with @pansysk75 will be the points of contact for HPX. Looking forward to this project :)

PatriceJada commented 3 months ago

Hello @di , I am interested in working on this project . I am submitting my proposal and I was wondering if you are able to increase the number of hours to a large project based on the number of repsos that are involved.

yugalkaushik commented 3 months ago

hii, I am interest in working on a project of Matplotlib but I'm not able to contact the mentors of that project from many months. If anyone would help me with it then feel free to contact me at yugalkaushik14@gmail.com

agriyakhetarpal commented 2 months ago

Hi, we are from PyBaMM (https://pybamm.org/), a NumFOCUS-sponsored project and we would love to opt in for this initiative for the main PyBaMM repository. If this is still in and remains in the ambit over the next few months, the relevant resource to contact would be me (@agriyakhetarpal) and @Saransh-cpp would like to act as an additional contact person – both of us serve as maintainers at the time of writing. We would love to help the mentee navigate through our repository and let them propose infrastructure-related changes keeping in line with modern-day security practices in order to build up our scorecard.

PatriceJada commented 1 month ago

PR Checklist of Repo's