PR Metrics

Miradi inayofuata mazoea bora hapa chini inaweza kujihakikisha kwa hiari na kuonyesha kuwa wamepata nishani ya mazoea bora ya Open Source Security Foundation (OpenSSF).

Hakuna seti ya mazoea yawezayo kuhakikisha kuwa programu haitakuwa na kasoro au udhaifu; hata mbinu rasmi zinaweza kushindwa ikiwa vipimo au dhana ni sahihi. Wala hakuna seti ya mazoea yawezayo kuhakikisha kuwa mradi utaendelea kuwa na jamii ya maendeleo yenye afya na inayofanya kazi vizuri. Hata hivyo, kufuata mazoea bora kunaweza kusaidia kuboresha matokeo ya miradi. Kwa mfano, baadhi ya mazoea huwezesha ukaguzi wa watu wengi kabla ya kutolewa, ambayo inaweza kusaidia kupata udhaifu wa kiufundi ambao vinginevyo ni vigumu kupata na kusaidia kujenga uaminifu na hamu ya mwingiliano wa kurudia kati ya wasanidi programu kutoka makampuni tofauti. Ili kupata nishani, vigezo vyote vya LAZIMA na LAZIMA WALA USIWAHI lazima vifuatwe, vigezo vyote vya INAPASWA lazima vifuatwe AU visivyo fufufutiliana na thibitisho, na vigezo vyote vya PENDEKEZA lazima vifuatwe AU visivyo fufufutiliana (tunataka vifikiwe angalau). Ikiwa unataka kuingiza maandishi ya thibitisho kama maoni ya jumla, badala ya kuwa maelezo ya busara kwamba hali ni inakubaliwa, anza kifungu cha maandishi na '//' ikifuatiwa na nafasi. Maoni ni karibu kupitia tovuti ya GitHub kama masuala au maombi ya kuvuta Kuna pia orodha ya barua pepe kwa majadiliano ya jumla.

Tunafuraha kutoa habari katika lugha nyingi, hata hivyo, ikiwa kuna mgongano au kutokuwa na usawa kati ya tafsiri, toleo la Kiingereza ni toleo lenye mamlaka.
Ikiwa huu ni mradi wako, tafadhali onyesha hali ya nishani yako ya msingi kwenye ukurasa wa mradi wako! Hali ya nishani ya msingi inaonekana kama hii: Kiwango cha nishani ya msingi kwa mradi 11987 ni baseline-3 Huu ndiyo jinsi ya kuweka nishani ya msingi:
Unaweza kuonyesha hali ya nishani yako ya msingi kwa kuweka hii katika faili yako ya markdown:
[![OpenSSF Baseline](https://www.bestpractices.dev/projects/11987/baseline)](https://www.bestpractices.dev/projects/11987)
au kwa kuweka hii katika HTML yako:
<a href="https://www.bestpractices.dev/projects/11987"><img src="https://www.bestpractices.dev/projects/11987/baseline"></a>


Hizi ni vigezo vya Kiwango cha Msingi 3. Vigezo hivi vinatoka toleo la msingi v2025.10.10 na maandishi ya vigezo yaliyosasishwa kutoka toleo v2026.02.19. Vigezo vipya katika toleo v2026.02.19 vimewekwa alama "mustakabali" na vitaanza kutekelezwa kuanzia 2026-06-01. Tafadhali toa majibu kwa vigezo vya "mustakabali" kabla ya tarehe hiyo.

Baseline Series: Kiwango cha Msingi 1 Kiwango cha Msingi 2 Kiwango cha Msingi 3

        

 Misingi

  • Jumla

    Kumbuka kwamba miradi mingine inaweza kutumia jina sawa.

    A GitHub Action & Azure Pipelines task for augmenting pull request titles to let reviewers quickly determine PR size and test coverage.

    Tafadhali tumia muundo wa maneno ya leseni ya SPDX; mifano ni pamoja na "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "GPL-2.0+", "LGPL-3.0+", "MIT", na "(BSD-2-Clause OR Ruby)". Usitumie alama za nukuu za moja au mbili.
    Ikiwa kuna lugha zaidi ya moja, ziorodhe kama thamani zilizotengwa kwa koma (nafasi ni za hiari) na ziorodhe kuanzia iliyotumiwa zaidi hadi iliyotumiwa kidogo. Ikiwa kuna orodha ndefu, tafadhali orodhesha angalau tatu za kawaida zaidi. Ikiwa hakuna lugha (k.m., huu ni mradi wa nyaraka tu au wa majaribio tu), tumia herufi moja "-". Tafadhali tumia herufi kubwa za kawaida kwa kila lugha, k.m., "JavaScript".
    Common Platform Enumeration (CPE) ni mpango wa kuweka majina yenye muundo kwa mifumo ya teknolojia ya habari, programu, na vifurushi. Inatumika katika mifumo na hifadhidata nyingi wakati wa kuripoti udhaifu.

 Udhibiti 20/21 ●

  • Udhibiti


    Ya kutosha kwa nishani!

    Ruhusa zinapopeana kwa kazi katika mfumo wa CI/CD, msimbo wa chanzo au usanidi LAZIMA upee tu ruhusa za chini zaidi zinazohitajika kwa shughuli zinazohusiana. [OSPS-AC-04.02]
    Sanidi mifumo ya CI/CD ya mradi ili kupea ruhusa za chini zinazopatikana kwa watumiaji na huduma kwa chaguomsingi, ukipandisha ruhusa tu inapohitajika kwa kazi maalum. Katika baadhi ya mifumo ya udhibiti wa toleo, hii inaweza kufanyika katika kiwango cha shirika au hifadhi. Ikiwa sivyo, weka ruhusa katika kiwango cha juu cha mfumo.

    All three GitHub Actions workflow files (build.yml at https://github.com/microsoft/PR-Metrics/blob/main/.github/workflows/build.yml, release-initiate.yml at https://github.com/microsoft/PR-Metrics/blob/main/.github/workflows/release-initiate.yml, release-publish.yml at https://github.com/microsoft/PR-Metrics/blob/main/.github/workflows/release-publish.yml) set permissions: {} at the top level, defaulting all jobs to no permissions. Each job explicitly requests only the specific permissions it requires. For example, the release job in release-publish.yml requests only attestations: write and id-token: write, while the build job in build.yml requests permissions: {} (no permissions). The Azure DevOps pipelines extend the Office.Official.PipelineTemplate and Office.Unofficial.PipelineTemplate templates, which enforce organisational security policies including least-privilege defaults.


    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    (Kigezo cha baadaye) Mifuko ya CI/CD inayokubali pembejeo za mshirika anayeaminika LAZIMA isafishe na kuthibitisha pembejeo hiyo kabla ya kutumia katika mfuko. [OSPS-BR-01.04]
    Mifuko ya CI/CD inapaswa kusafisha (kunukuu, kutoroka au kutoka kwa maadili yanayotarajiwa) pembejeo zote za mshirika kwenye utekelezaji wa mtiririko wa kazi wa wazi. Ingawa washirika kwa ujumla wanaaminika, pembejeo za mwongozo kwa mtiririko wa kazi haiwezi kukaguliwa na inaweza kutumiwa vibaya na utekaji wa akaunti au tishio la ndani.

    Ya kutosha kwa nishani!

    Toleo rasmi linapobuniwa, mali zote ndani ya toleo hilo LAZIMA zihusianishwe wazi na kitambulisho cha toleo au kitambulisho kingine cha kipekee kwa mali hiyo. [OSPS-BR-02.02]
    Panga kitambulisho cha kipekee cha toleo kwa kila mali ya programu inayozalishwa na mradi, ukifuata kawaida ya uainishaji thabiti au mpango wa nambari. Mifano ni pamoja na SemVer, CalVer, au kitambulisho cha git commit.

    Each release is assigned a unique Semantic Versioning (https://semver.org/) identifier (e.g., v1.7.11). The version is maintained consistently across package.json (https://github.com/microsoft/PR-Metrics/blob/main/package.json), task.json (https://github.com/microsoft/PR-Metrics/blob/main/src/task/task.json), and vss-extension.json (https://github.com/microsoft/PR-Metrics/blob/main/src/vss-extension.json). Release assets (the VSIX extension, Sigstore signature bundle, and CycloneDX SBOM) are published as part of the GitHub Release (https://github.com/microsoft/PR-Metrics/releases) tagged with the version identifier. The release-publish.yml workflow (https://github.com/microsoft/PR-Metrics/blob/main/.github/workflows/release-publish.yml) reads the version from release-publish-trigger.txt (https://github.com/microsoft/PR-Metrics/blob/main/.github/workflows/support/release-publish-trigger.txt) and creates the release with that version tag.


    Ya kutosha kwa nishani!

    Mradi LAZIMA ufafanue sera ya kudhibiti siri na ushahidi unaotumika na mradi. Sera inapaswa kujumuisha mwongozo wa kuhifadhi, kufikia, na kuzungusha siri na ushahidi. [OSPS-BR-07.02]
    Eleza jinsi siri na ushahidi vinavyodhibitiwa na kutumika ndani ya mradi. Hii inapaswa kujumuisha maelezo ya jinsi siri zinavyohifadhiwa (k.m., kwa kutumia zana ya usimamizi wa siri), jinsi ufikiaji unavyodhibitiwa, na jinsi siri zinavyozungushwa au kusasishwa. Hakikisha kwamba habari nyeti haziingizwi kwa msimbo katika msimbo wa chanzo au kuhifadhiwa katika mifumo ya udhibiti wa toleo.

    The project documents its secrets and credentials management policy in docs/secrets-management.md (https://github.com/microsoft/PR-Metrics/blob/main/docs/secrets-management.md). The policy covers all secrets used by the project (including GITHUB_TOKEN, PR_METRICS_TOKEN, and ESRP service connections), how they are stored (exclusively in GitHub Secrets and Azure DevOps variable groups), how access is controlled (repository-level permissions, fork restrictions, least-privilege workflow permissions), and how secrets are rotated (GITHUB_TOKEN is auto-rotated per workflow run; PATs are reviewed periodically). The policy also describes preventative measures including Gitleaks secret scanning, environment variable usage instead of command-line arguments, and automatic log masking.


    Ya kutosha kwa nishani!

    Mradi ulipotoa toleo, nyaraka za mradi LAZIMA ziwe na maelekezo ya kuthibitisha uadilifu na uhalali wa mali za toleo. [OSPS-DO-03.01]
    Maelekezo katika mradi yanapaswa kuwa na habari kuhusu teknolojia iliyotumika, amri za kuendesha, na matokeo yanayotarajiwa. Inapowezekana, epuka kuhifadhi nyaraka hizi katika mahali pamoja na mfumo wa ujenzi na utoaji wa toleo ili kuepuka ukiukaji mmoja kuhatarisha programu na nyaraka za kuthibitisha uadilifu wa programu.

    The docs/verification.md file (https://github.com/microsoft/PR-Metrics/blob/main/docs/verification.md) provides comprehensive instructions for verifying release integrity and authenticity using two independent methods: Build provenance attestation, verified via GitHub CLI (gh attestation verify), confirming the artefact was built by the official release workflow and hasn't been tampered with. Cosign signature, verified via Sigstore cosign (cosign verify-blob), confirming cryptographic integrity using keyless signing backed by GitHub's OIDC tokens. The documentation includes prerequisites, step-by-step verification commands, expected output, and troubleshooting guidance. This documentation is maintained in the repository's docs/ folder, separate from the build and release pipeline configuration.


    Ya kutosha kwa nishani!

    Mradi unapotoa toleo, nyaraka za mradi LAZIMA ziwe na maelekezo ya kuthibitisha utambulisho unaotarajiwa wa mtu au mchakato unaothibitisha toleo la programu. [OSPS-DO-03.02]
    Utambulisho unaotarajiwa unaweza kuwa katika muundo wa vitambulisho vya funguo vilivyotumika kusaini, mtoa na utambulisho kutoka cheti cha sigstore, au aina nyingine zinazofanana. Inapowezekana, epuka kuhifadhi nyaraka hii mahali palipo sawa na mirija ya kujenga na kutoa ili kuepuka ukiukaji mmoja kuhatarisha programu na nyaraka za kuthibitisha uadilifu wa programu.

    The docs/verification.md file (https://github.com/microsoft/PR-Metrics/blob/main/docs/verification.md) includes instructions to verify the expected identity of the process authoring the release. The cosign verification command specifies the expected identity via: --certificate-identity-regexp matching ^https://github.com/microsoft/PR-Metrics/.github/workflows/release-publish.yml@refs/heads/main$ and --certificate-oidc-issuer matching https://token.actions.githubusercontent.com. This confirms that the release was authored by the release-publish.yml workflow running on the main branch of the microsoft/PR-Metrics repository, using GitHub's OIDC identity provider. The build provenance attestation additionally links the artefact to a specific workflow run and commit. This documentation is maintained separately from the build and release pipeline.


    Ya kutosha kwa nishani!

    Mradi unapotoa toleo, nyaraka za mradi LAZIMA zijumuishe kauli ya maelezo kuhusu wigo na muda wa msaada kwa kila toleo. [OSPS-DO-04.01]
    Ili kuwasilisha wigo na muda wa msaada kwa rasilimali za programu zilizotolewa za mradi, mradi unapaswa kuwa na faili ya SUPPORT.md, sehemu ya "Msaada" katika SECURITY.md, au nyaraka nyingine zinazoweka wazi mzunguko wa maisha wa msaada, ikijumuisha muda unaotarajiwa wa msaada kwa kila toleo, aina za msaada zinazotolewa (k.m., marekebisho ya hitilafu, sasisho za usalama), na sera au taratibu yoyote husika ya kupata msaada.

    The SUPPORT.md file (https://github.com/microsoft/PR-Metrics/blob/main/.github/SUPPORT.md) documents the support lifecycle for the project. It states that PR Metrics follows a rolling release model where only the latest release is actively supported with bug fixes and security updates. Previous releases do not receive patches. The document also describes the end-of-life policy: should the project become inactive, the last published release will remain available but will not receive further updates. Consumers will be notified of any planned end of life through GitHub Discussions.


    Ya kutosha kwa nishani!

    Mradi unapotoa toleo, nyaraka za mradi LAZIMA zitoe kauli ya maelezo ya wakati matoleo au matoleo hayatapokea tena sasisho za usalama. [OSPS-DO-05.01]
    Ili kuwasilisha wigo na muda wa msaada kwa marekebisho ya usalama, mradi unapaswa kuwa na SUPPORT.md au nyaraka nyingine zinazoweka wazi sera ya mradi ya sasisho za usalama.

    The SUPPORT.md file (https://github.com/microsoft/PR-Metrics/blob/main/.github/SUPPORT.md) provides a clear statement on when releases will no longer receive security updates: "Once a new version is published, the previous version no longer receives security updates." The document further states that critical security issues may result in an expedited patch release, and that consumers should always run the latest version. The end-of-life section clarifies that if the project becomes inactive, the last release will remain available but will not receive security patches.


    Ya kutosha kwa nishani!

    Inapokuwa hai, nyaraka za mradi LAZIMA ziwe na sera kwamba washirikiano wa msimbo wanapimwa kabla ya kupewa ruhusa zilizopandishwa kwa rasilimali nyeti. [OSPS-GV-04.01]
    Chapisha sera inayoweza kutekelezwa katika nyaraka za mradi inayohitaji washirikiano wa msimbo kupimwa na kuidhinishwa kabla ya kupewa ruhusa zilizopandishwa kwa rasilimali nyeti, kama vile idhini ya kuunganisha au ufikiaji kwa siri. Inashauriwa kwamba upimaji ujumuishe kuanzisha mfululizo wa utambulisho unaoweza kuhalalishwa kama vile kuthibitisha ushirikiano wa mchangiaji na shirika linalojulikana na kuaminika.

    The GOVERNANCE.md file (https://github.com/microsoft/PR-Metrics/blob/main/GOVERNANCE.md) includes a "Collaborator Review Policy" section that requires contributors to be reviewed and approved before being granted escalated permissions to sensitive resources. The policy requires nomination by an existing maintainer based on sustained quality contributions, identity verification through association with a known trusted organisation, and approval by at least one existing maintainer. Permissions are granted at the minimum level required for the contributor's role. Access to signing infrastructure is restricted to automated CI/CD pipelines and cannot be granted to individual contributors.


    Ya kutosha kwa nishani!

    Mradi unapotoa toleo, rasilimali zote za programu zilizotolewa na zilizokusanywa LAZIMA zikabidhi pamoja na orodha ya bili ya programu. [OSPS-QA-02.02]
    Inashauriwa kuzalisha SBOM kiotomatiki wakati wa kujenga kwa kutumia zana ambayo imepimwa kwa usahihi. Hii huwezesha watumiaji kuingiza data hii kwa njia ya kiwango pamoja na miradi mingine katika mazingira yao.

    The release-publish.yml workflow (https://github.com/microsoft/PR-Metrics/blob/main/.github/workflows/release-publish.yml) generates a CycloneDX (https://cyclonedx.org/) Software Bill of Materials (SBOM) using "npm sbom --sbom-format cyclonedx --sbom-type library". The SBOM (ms-omex.PRMetrics.sbom.cdx.json) is included as a release asset alongside the VSIX extension and Sigstore signature bundle on the GitHub Releases page (https://github.com/microsoft/PR-Metrics/releases). This enables consumers to ingest dependency data in a standardised format alongside other projects in their environment.


    Ya kutosha kwa nishani!

    Mradi unapotoa toleo linalojumuisha hifadhi nyingi za chanzo cha msimbo, miradi yote midogo LAZIMA ilazimishe mahitaji ya usalama ambayo ni kali au kali zaidi kuliko msimbo wa msingi. [OSPS-QA-04.02]
    Hifadhi yoyote ya ziada ya msimbo wa miradi midogo iliyozalishwa na mradi na kukusanywa katika toleo lazima ilazimishe mahitaji ya usalama kama inavyolingana na hali na nia ya msimbo husika. Kwa kuongeza kufuata mahitaji ya msingi wa OSPS yanayolingana, hii inaweza kujumuisha kuhitaji ukaguzi wa usalama, kuhakikisha kuwa haina udhaifu, na kuhakikisha kuwa haina masuala ya usalama yanayojulikana.

    The project does not have any subprojects. It is a single codebase that produces artefacts for both GitHub Actions and Azure DevOps Pipelines via shared source code with platform-specific abstraction layers, as described in docs/cross-platform-architecture.md (https://github.com/microsoft/PR-Metrics/blob/main/docs/cross-platform-architecture.md).


    Ya kutosha kwa nishani!

    Inapokuwa hai, nyaraka za mradi LAZIMA ziweke wazi lini na jinsi majaribio yanavyotekelezwa. [OSPS-QA-06.02]
    Ongeza sehemu kwenye nyaraka za kuchangia inayoweka wazi jinsi ya kutekeleza majaribio kienyeji na jinsi ya kutekeleza majaribio katika mirija ya CI/CD. Nyaraka zinapaswa kuweka wazi majaribio yanajaribu nini na jinsi ya kutafsiri matokeo.

    The project's testing procedures are documented across multiple files: docs/development.md (https://github.com/microsoft/PR-Metrics/blob/main/docs/development.md) contains a "Testing" section explaining how to run tests locally ("npm test"), the test framework (Mocha at https://mochajs.org/ with ts-mockito at https://github.com/NagRock/ts-mockito), the Arrange-Act-Assert pattern used, code coverage reporting via c8 (https://github.com/bcoe/c8), and manual test case instructions. CONTRIBUTING.md (https://github.com/microsoft/PR-Metrics/blob/main/.github/CONTRIBUTING.md) describes how to run tests locally and in CI/CD, what the tests cover, and how to interpret results (pass/fail status and coverage percentages). It also documents that all automated checks in build.yml (https://github.com/microsoft/PR-Metrics/blob/main/.github/workflows/build.yml) (unit tests, CodeQL, Super-Linter) must pass before a pull request can be merged.


    Ya kutosha kwa nishani!

    Inapokuwa hai, nyaraka za mradi LAZIMA zijumuishe sera kwamba mabadiliko yote makubwa kwa programu inayozalishwa na mradi yanapaswa kuongeza au kusasisha majaribio ya utendaji katika seti ya majaribio ya kiatomati. [OSPS-QA-06.03]
    Ongeza sehemu kwenye nyaraka za kuchangia inayoweka wazi sera ya kuongeza au kusasisha majaribio. Sera inapaswa kuweka wazi ni nini kinachojumuisha mabadiliko makubwa na majaribio yapi yanapaswa kuongezwa au kusasishwa.

    The CONTRIBUTING.md file (https://github.com/microsoft/PR-Metrics/blob/main/.github/CONTRIBUTING.md) includes a "Test Policy for Major Changes" section requiring that all major changes include corresponding test updates. The policy defines specific requirements for new features (unit tests covering new functionality and edge cases), bug fixes (regression tests), and refactoring (existing tests must continue to pass). A "major change" is defined as any modification that alters extension behaviour, adds configuration parameters, changes metric calculations, or modifies API interactions. The pull request template (https://github.com/microsoft/PR-Metrics/blob/main/.github/pull_request_template.md) includes a testing checklist to enforce compliance.


    Ya kutosha kwa nishani!

    Wakati kuruhusu kumefanywa kwa tawi kuu, mfumo wa udhibiti wa toleo la mradi LAZIMA uhitaji angalau idhini moja ya binadamu asiye mwandishi ya mabadiliko kabla ya kuunganisha. [OSPS-QA-07.01]
    Sanidi mfumo wa udhibiti wa toleo la mradi kuhitaji angalau idhini moja ya binadamu asiye mwandishi ya mabadiliko kabla ya kuunganisha katika toleo au tawi kuu. Hii inaweza kupatikana kwa kuhitaji ombi la kuvuta kupimwa na kuidhinishwa na angalau mshirikiano mmoja mwingine kabla ya kunaweza kuunganishwa.

    The repository is protected by multiple rulesets (default-ruleset, microsoft-production-ruleset) that prevent direct commits to the main branch and require pull request reviews. At least one non-author approval is required before a pull request can be merged. The CODEOWNERS file (https://github.com/microsoft/PR-Metrics/blob/main/.github/CODEOWNERS) assigns @microsoft/omex as the required reviewer for all files. See repository rulesets at https://github.com/microsoft/PR-Metrics/rules.


    Ya kutosha kwa nishani!

    Mradi unapotoa toleo, mradi LAZIMA ufanye ufuatiliaji wa tisho na uchambuzi wa uso wa shambulio ili kuelewa na kulinda dhidi ya mashambulizi kwenye njia za msimbo muhimu, majukumu, na mwingiliano ndani ya mfumo. [OSPS-SA-03.02]
    Ufuatiliaji wa tisho ni shughuli ambapo mradi unaangalia msimbo, michakato na miundombinu inayohusiana, viunganishi, vipengele muhimu na "kufikiria kama kibogoyo" na kufanya mapendekezo ya jinsi mfumo unaweza kuvunjwa au kuhatarisha. Kila tisho iliyotambuliwa imeorodheshwa ili mradi uweze kufikiria jinsi ya kuepuka au kufunga pengo/udhaifu wowote unaoweza kutokea kwa kujihadhari. Hakikisha hii imesasishwa kwa vipengele vipya au mabadiliko ya kuvunja.

    The project maintains a comprehensive security assessment in docs/security-assessment.md (https://github.com/microsoft/PR-Metrics/blob/main/docs/security-assessment.md), which includes a Mermaid diagram of trust boundaries, an asset sensitivity table, and detailed threat analysis covering five threat categories: access token exposure, injection via untrusted PR content, supply chain attacks on dependencies, CI/CD permission escalation, and Git command injection. Each threat includes likelihood and impact ratings with specific mitigations. The assessment also identifies residual risks and specifies a review cadence.


    Ya kutosha kwa nishani!

    Wakati uko hai, udhaifu wowote katika vipengele vya programu visivyoathiri mradi LAZIMA viwe vimeainishwa katika hati ya VEX, ikiendeleza ripoti ya udhaifu na maelezo ya kutokutumiwa vibaya. [OSPS-VM-04.02]
    Weka mfumo wa mlisho wa VEX unaowasiliana hali ya utumiaji vibaya wa udhaifu unaojulikana, ikiwa ni pamoja na maelezo ya tathmini au marekebisho yoyote yaliyowekwa kusimamisha msimbo ulio na udhaifu usiotekelezwa.

    The docs/security-scanning-policy.md file (https://github.com/microsoft/PR-Metrics/blob/main/docs/security-scanning-policy.md) documents the project's VEX policy. When a vulnerability is identified in a dependency that does not affect PR Metrics (e.g., the vulnerable code path is not reachable), the finding is assessed and documented as non-exploitable via GitHub Security Advisories (https://github.com/microsoft/PR-Metrics/security/advisories) and Dependabot alert dismissals with documented reasons. As of the last assessment, no known vulnerabilities in project dependencies have been identified as non-exploitable requiring VEX documentation; all known vulnerabilities are either resolved through dependency updates or actively being addressed per the documented remediation thresholds.


    Ya kutosha kwa nishani!

    Wakati uko hai, nyaraka za mradi LAZIMA zijumuishe sera inayofafanua kiwango cha marekebisho ya matokeo ya SCA yanayohusiana na udhaifu na leseni. [OSPS-VM-05.01]
    Andika sera katika mradi inayofafanua kiwango cha marekebisho ya matokeo ya SCA yanayohusiana na udhaifu na leseni. Jumuisha mchakato wa kutambua, kutanguliza, na kurekebisha matokeo haya.

    The docs/security-scanning-policy.md file (https://github.com/microsoft/PR-Metrics/blob/main/docs/security-scanning-policy.md) defines remediation thresholds for SCA findings. Critical and high severity findings must be resolved by the next patch release. Medium and low severity findings must be addressed by the next scheduled release. The policy includes a severity-to-remediation-target mapping table and describes the process for identifying, prioritising, and remediating findings via Dependabot alerts, CodeQL, and Component Governance.


    Ya kutosha kwa nishani!

    Wakati uko hai, nyaraka za mradi LAZIMA zijumuishe sera ya kushughulikia ukiukaji wa SCA kabla ya toleo lolote. [OSPS-VM-05.02]
    Andika sera katika mradi wa kushughulikia matokeo ya Uchambuzi wa Muundo wa Programu yanayotumika kabla ya toleo lolote, na ongeza ukaguzi wa hali unaothibitisha kufuata sera hiyo kabla ya toleo.

    The docs/security-scanning-policy.md file (https://github.com/microsoft/PR-Metrics/blob/main/docs/security-scanning-policy.md) documents a pre-release policy requiring that: (1) no unresolved Dependabot alerts of critical or high severity exist; (2) all npm dependencies are updated to their latest compatible versions via the release workflow; (3) Component Governance detection in the Azure DevOps pipeline completes without blocking findings; and (4) non-exploitable findings are documented. The release-initiate.yml workflow (https://github.com/microsoft/PR-Metrics/blob/main/.github/workflows/release-initiate.yml) enforces dependency updates as part of the release process, and the Azure DevOps pipeline applies the M365 Guardian policy.


    Ya kutosha kwa nishani!

    Wakati uko hai, mabadiliko yote kwenye msingi wa msimbo wa mradi LAZIMA yaangaliwe kiatomati dhidi ya sera iliyoandikwa ya utegemezi mbaya na udhaifu unaojulikana katika utegemezi, kisha yazuiliwe katika hali ya ukiukaji, isipokuwa inapotangazwa na kuzuiliwa kama isiyotumiwa vibaya. [OSPS-VM-05.03]
    Unda ukaguzi wa hali katika mfumo wa kudhibiti toleo la mradi unaoendesha zana ya Uchambuzi wa Muundo wa Programu kwenye mabadiliko yote ya msingi wa msimbo. Hitaji kwamba ukaguzi wa hali upite kabla mabadiliko kusanywa.

    All changes to the codebase are automatically evaluated for malicious dependencies and known vulnerabilities: CodeQL (https://codeql.github.com/) runs on every pull request via the Validate job in build.yml (https://github.com/microsoft/PR-Metrics/blob/main/.github/workflows/build.yml), using security-and-quality, security-experimental, and security-extended query sets. Dependabot alerts (https://docs.github.com/code-security/dependabot/dependabot-alerts/about-dependabot-alerts) are configured at the repository level. Component Governance (https://docs.opensource.microsoft.com/tools/cg/) runs dependency detection in the Azure DevOps PR pipeline. The repository rulesets require that all status checks pass before merging. Non-exploitable findings are documented via Dependabot alert dismissals with justification or in the security scanning policy.


    Ya kutosha kwa nishani!

    Wakati uko hai, nyaraka za mradi LAZIMA zijumuishe sera inayofafanua kiwango cha marekebisho ya matokeo ya SAST. [OSPS-VM-06.01]
    Andika sera katika mradi inayofafanua kiwango cha marekebisho ya matokeo ya Upimaji wa Usalama wa Programu Tuli (SAST). Jumuisha mchakato wa kutambua, kutanguliza, na kurekebisha matokeo haya.

    The docs/security-scanning-policy.md file (https://github.com/microsoft/PR-Metrics/blob/main/docs/security-scanning-policy.md) defines remediation thresholds for SAST findings. Critical and high severity findings block pull request merging via required status checks and must be resolved immediately. Medium severity findings must be resolved before the next release. Low severity findings are addressed on a best-effort basis. The policy covers CodeQL, ESLint, CredScan, and PoliCheck findings, and describes how suppressed findings are documented with justification.


    Ya kutosha kwa nishani!

    Wakati uko hai, mabadiliko yote kwenye msingi wa msimbo wa mradi LAZIMA yaangaliwe kiatomati dhidi ya sera iliyoandikwa ya udhaifu wa usalama na kuzuiliwa katika hali ya ukiukaji isipokuwa inapotangazwa na kuzuiliwa kama isiyotumiwa vibaya. [OSPS-VM-06.02]
    Unda ukaguzi wa hali katika mfumo wa kudhibiti toleo la mradi unaoendesha zana ya Upimaji wa Usalama wa Programu Tuli (SAST) kwenye mabadiliko yote ya msingi wa msimbo. Hitaji kwamba ukaguzi wa hali upite kabla mabadiliko kusanywa.

    All changes to the codebase are automatically evaluated for security weaknesses: CodeQL (https://codeql.github.com/) is a required status check on every pull request, running extended security query sets against the JavaScript/TypeScript codebase. Super-Linter (https://github.com/super-linter/super-linter) runs ESLint and Gitleaks (https://github.com/gitleaks/gitleaks) on every pull request. CredScan (https://secdevtools.azurewebsites.net/helpcredscan.html) and Guardian PostAnalysis run in the Azure DevOps PR pipeline, enforcing the M365 security policy. The repository rulesets require that all status checks pass before merging. Suppressed findings are documented with justification in configuration files such as CredScanSuppressions.json (https://github.com/microsoft/PR-Metrics/blob/main/.github/azure-devops/CredScanSuppressions.json) and gitleaks.toml (https://github.com/microsoft/PR-Metrics/blob/main/.github/linters/gitleaks.toml).



Data hii inapatikana chini ya Community Data License Agreement – Permissive, Version 2.0 (CDLA-Permissive-2.0). Hii inamaanisha kuwa Mpokeaji wa Data anaweza kushiriki Data, na au bila marekebisho, mradi Mpokeaji wa Data anapatanisha maandishi ya mkataba huu na Data iliyoshirikiwa. Tafadhali tambua Muiris Woulfe na wachangiaji wa nishani ya Mazoea Bora ya OpenSSF.

Ingizo la nishani ya mradi linamilikiwa na: Muiris Woulfe.
Ingizo liliundwa siku 2026-02-19 17:32:37 UTC, iliyosasishwa mara ya mwisho siku 2026-02-27 19:06:06 UTC. Ilipoteza mara ya mwisho nishani ya kupita siku 2026-02-23 14:15:17 UTC. Ilipata mara ya mwisho nishani ya kupita siku 2026-02-23 14:43:51 UTC.