Update repository settings

[github-actions]

Caution

This issue is raised due to current limitations of the GitHub API and/or for security reasons.
Human should review and apply all/some of the settings described here.

Pre-requisites

Enable the following for all repositories:

• Mend Renovate Bot App for GitHub (automatically updates dependencies).
• StepSecurity Actions Security (manages GitHub Actions egress rules).

Note

If StepSecurity App is not installed, your code remains functional but less secure. More details here.

Security hardening

Follow these steps for best practices (available in your plan).

Creating Personal Access Token (PAT)

Caution

Use the suggested scope and expiration date to reduce exposure.

1. Go to GitHub Personal Access Token creation page and create a token with:

• Token name: opentemplate-one-time-settings

• Resource owner: open-nudge

• Expiration date: Custom ➡️ next day

• Repository access: Only select repositories ➡️ Select repositories ➡️ open-nudge/opentemplate

• Permissions: Repository permissions:

  • Administration: Read & write (multiple operations: rulesets, gh-pages, general, private vulnerability reporting, vulnerability alerts, enabling discussions)
  • Pages: Read & write (setup gh-pages; permission source)

Click Generate token and copy it.

1. Add it to repository secrets:

• Open secrets
• Name: TEMPLATE_GITHUB_TOKEN (exactly this name).
• Secret: Paste the token.

Running the workflow

Manually run the Harden workflow (click here) and enter:

• Plan type: Check here if unsure.
• Reviewers for pull requests: 2 (secure), 1 (common), 0 (solo devs). Read more here.

Cleanup

Remove TEMPLATE_GITHUB_TOKEN from repository secrets.

PyPI deployment

Caution

Skip if you want a private project. You can enable this later.

To deploy a Python package to PyPI:

Go to PyPI Publishing, scroll to "Add a new pending publisher" and enter:

• PyPI Project Name: opentemplate
• Owner: open-nudge
• Repository name: opentemplate
• Workflow name: release.yml

GitHub Actions will now deploy to PyPI on new releases.

Tip

Releasing to PyPI after the setup is advised. Due to the versioning scheme, first release will be 0.0.1 which can be iterated later on (with 0.1.0 marking first usable release).

Dependency Graph

Enable Dependency Graph manually. Without it, GitHub SBOM will not appear in Releases.

Organization setup

Tip

Refer to this guide for community health files (e.g. funding.yml).

Additional resources

• Open Source Guide
• Open Source Security Foundation Guides