darnit/example.project.yaml at main · darnitdevorg/darnit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
# .project.yaml - CNCF Project Configuration
# https://github.com/cncf/automation/tree/main/utilities/dot-project
#
# OpenSSF Baseline extension: x-openssf-baseline
# https://baseline.openssf.org/

# =============================================================================
# CNCF Standard Fields
# =============================================================================

name: my-project
description: A brief description of this project
schema_version: "1.0"
type: software  # software | specification | documentation | infrastructure | data

# CNCF Maturity Tracking (required for CNCF projects, optional otherwise)
# maturity_log:
#   - phase: sandbox
#     date: 2024-01-15
#     issue: https://github.com/cncf/toc/issues/123
#   - phase: incubating
#     date: 2024-06-01
#     issue: https://github.com/cncf/toc/issues/456

# Repository references
repositories:
  - https://github.com/myorg/my-project
  - https://github.com/myorg/my-project-docs

# Project presence
website: https://my-project.io
# artwork: https://github.com/cncf/artwork/tree/main/projects/myproject

# Community channels
social:
  twitter: https://twitter.com/myproject
  slack: https://slack.myproject.io
  # youtube: https://youtube.com/@myproject

mailing_lists:
  - dev@my-project.io
  - users@my-project.io

# Security documentation (CNCF standard)
security:
  policy:
    path: SECURITY.md
  threat_model:
    path: docs/THREAT_MODEL.md
  contact: security@my-project.io

# Governance documentation (CNCF standard)
governance:
  contributing:
    path: CONTRIBUTING.md
  codeowners:
    path: .github/CODEOWNERS
  governance_doc:
    path: GOVERNANCE.md
  # gitvote_config:
  #   path: .gitvote.yml

# Legal documentation (CNCF standard)
legal:
  license:
    path: LICENSE

# Project documentation (CNCF standard)
documentation:
  readme:
    path: README.md
  support:
    path: SUPPORT.md
  architecture:
    path: docs/ARCHITECTURE.md
  api:
    path: docs/API.md

# Security audits (CNCF standard - useful for compliance!)
audits:
  - date: 2024-06-15
    type: security
    url: https://example.com/audit-report.pdf

# =============================================================================
# OpenSSF Baseline Extension (x-openssf-baseline)
# =============================================================================
#
# This extension provides fields for OpenSSF Baseline compliance that are
# not (yet) part of the CNCF .project standard.
#
# THE GOLDEN RULE:
#   .project.yaml changes when YOU change something about your project.
#   .project.yaml does NOT change when an audit runs.

x-openssf-baseline:
  # Extension metadata
  version: "1.0"
  osps_version: v2025.10.10

  # Control overrides - mark specific controls as N/A with reasoning
  # These are human decisions that explain why a control doesn't apply
  controls:
    OSPS-BR-02.01:
      status: n/a
      reason: Internal tool with no distributable artifacts
    # OSPS-BR-03.01:
    #   status: n/a
    #   reason: Specification project - no releases to sign

  # User-confirmed project context
  # These affect how controls are evaluated
  context:
    has_subprojects: false
    has_releases: true
    is_library: false
    has_compiled_assets: false
    ci_provider: github

  # Extended governance (not in CNCF spec yet - will propose upstream)
  governance:
    maintainers:
      path: MAINTAINERS.md
    code_of_conduct:
      path: CODE_OF_CONDUCT.md

  # Quality tracking
  quality:
    changelog:
      path: CHANGELOG.md

  # Security advisories and policies
  security:
    advisories: https://github.com/myorg/my-project/security/advisories
    # secrets_policy:
    #   path: docs/SECRETS.md

  # Contributor licensing
  legal:
    contributor_agreement:
      type: dco  # dco | cla | none
      # url: https://developercertificate.org/

  # Build artifacts
  artifacts:
    sbom:
      path: sbom.json
      format: cyclonedx  # cyclonedx | spdx
    signing:
      enabled: true
      method: sigstore
    provenance:
      path: .attestations/
      format: slsa

  # Dependency management
  dependencies:
    lockfile: uv.lock
    manifest: pyproject.toml
    # docs: DEPENDENCIES.md

  # CI/CD configuration
  ci:
    provider: github
    workflows:
      - .github/workflows/ci.yml
      - .github/workflows/release.yml
    dependency_scanning: .github/dependabot.yml
    security_scanning:
      - .github/workflows/codeql.yml
    testing:
      - .github/workflows/ci.yml
    code_quality:
      - .github/workflows/ci.yml