DevOps, Tooling, and Community Collaboration Practices
DevOps, Tooling, and Community Collaboration Practices
This domain tests how open projects automate quality and security, and how contributors communicate in public without creating avoidable risk.
Core rules
- CI should run on pull requests: build, tests, linters, and security checks. Use Dependabot or Renovate for dependency updates, CodeQL or similar for static analysis, and OpenSSF Scorecard for project hygiene.
- Releases should be repeatable: signed tags or commits, changelogs, semantic versioning, and automated publishing. Sigstore/cosign can sign artifacts.
- Community work is asynchronous: issues, pull requests, Discussions, mailing lists, and working-group calls. Assume good faith, keep decisions in public, and document outcomes.
- Security tooling is not a substitute for maintainer judgment; forks and third-party actions are supply-chain surfaces.
Worked example
A maintainer configures a repository. CI runs tests and CodeQL on every PR, Dependabot opens weekly update PRs, and releases use signed tags plus a Keep a Changelog entry. A contributor from a fork opens a PR; the workflow does not expose secrets to fork PRs, and a maintainer reviews before merge. The maintainer does not force-push the contributor's branch.
Traps
- Assuming green CI means secure code.
- Exposing repository secrets to pull requests from forks.
- Discussing a vulnerability in a public issue before a fix.
- Force-pushing to shared branches and losing review context.
- Accepting drive-by PRs without tests or a license check.