From 5446c0b7123392e882709b397dca4f8a2e08f46e Mon Sep 17 00:00:00 2001 From: Gabriele Bartolini Date: Tue, 4 Aug 2026 11:57:27 +1000 Subject: [PATCH 1/3] chore: add SECURITY-INSIGHTS.yml Modeled on cloudnative-pg/postgres-containers' file: a repository-scoped file pointing back to the main project.yaml/SECURITY-INSIGHTS.yml via header.project-si-source, with this repo's own core-team, license, release distribution points, and actual security tooling (verified against this repo's real CI workflows and repo settings, not copied blindly from another repo). Signed-off-by: Gabriele Bartolini Assisted-by: Claude --- SECURITY-INSIGHTS.yml | 107 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 107 insertions(+) create mode 100644 SECURITY-INSIGHTS.yml diff --git a/SECURITY-INSIGHTS.yml b/SECURITY-INSIGHTS.yml new file mode 100644 index 0000000..ec08be8 --- /dev/null +++ b/SECURITY-INSIGHTS.yml @@ -0,0 +1,107 @@ +header: + schema-version: 2.2.0 + last-updated: '2026-08-04' + last-reviewed: '2026-08-04' + url: https://raw.githubusercontent.com/cloudnative-pg/postgres-extensions-containers/main/SECURITY-INSIGHTS.yml + # reference the main SECURITY-INSIGHTS file from CNPG repo + project-si-source: https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/SECURITY-INSIGHTS.yml + +repository: + url: https://github.com/cloudnative-pg/postgres-extensions-containers + status: active + accepts-change-request: true + accepts-automated-change-request: true + no-third-party-packages: false + core-team: + - name: Gabriele Bartolini + email: gabriele.bartolini@enterprisedb.com + primary: true + - name: Leonardo Cecchi + email: leonardo.cecchi@enterprisedb.com + primary: false + - name: Marco Nenciarini + email: marco.nenciarini@enterprisedb.com + primary: false + - name: Francesco Canovai + email: francesco.canovai@enterprisedb.com + primary: false + - name: Armando Ruocco + email: armando.ruocco@enterprisedb.com + primary: false + - name: Niccolò Fei + email: niccolo.fei@enterprisedb.com + primary: false + - name: Gabriele Fedi + email: gabriele.fedi@enterprisedb.com + primary: false + license: + url: https://www.apache.org/licenses/LICENSE-2.0 + expression: Apache-2.0 + + release: + automated-pipeline: true + distribution-points: + - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/pgvector + comment: GitHub packages for the pgvector extension image + - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/postgis-extension + comment: GitHub packages for the PostGIS extension image + - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/pgaudit + comment: GitHub packages for the pgaudit extension image + - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/pg-ivm + comment: GitHub packages for the pg_ivm extension image + - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/pg-crash + comment: GitHub packages for the pg_crash extension image + - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/timescaledb-oss + comment: GitHub packages for the TimescaleDB (OSS) extension image + - uri: https://github.com/cloudnative-pg/postgres-extensions-containers/pkgs/container/wal2json + comment: GitHub packages for the wal2json extension image + + security: + tools: + - name: Dependabot + type: SCA + rulesets: ["default"] + results: {} + integration: + adhoc: true + ci: false + release: false + - name: Renovate + type: SCA + rulesets: ["default"] + results: {} + integration: + adhoc: true + ci: true + release: false + - name: Snyk + type: container + rulesets: ["default"] + results: {} + comment: Scans container images for known vulnerabilities. + integration: + adhoc: false + ci: true + release: true + - name: Cosign + type: container + rulesets: ["default"] + results: {} + comment: Used to cryptographically sign container images. + integration: + adhoc: false + ci: true + release: true + - name: GitHub Code Scanning + type: SAST + rulesets: ["default"] + results: {} + comment: GitHub's default CodeQL setup, enabled at the repo-settings level. + integration: + adhoc: false + ci: false + release: false + + assessments: + self: + comment: Refer to the main project. From 5d3668c2720d32d45f7d44e07bd8c345b8769550 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Niccol=C3=B2=20Fei?= Date: Tue, 4 Aug 2026 13:21:16 +0200 Subject: [PATCH 2/3] chore: add CodeQL and Dockle MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Niccolò Fei --- SECURITY-INSIGHTS.yml | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/SECURITY-INSIGHTS.yml b/SECURITY-INSIGHTS.yml index ec08be8..e648144 100644 --- a/SECURITY-INSIGHTS.yml +++ b/SECURITY-INSIGHTS.yml @@ -92,15 +92,33 @@ repository: adhoc: false ci: true release: true - - name: GitHub Code Scanning + - name: CodeQL type: SAST rulesets: ["default"] results: {} - comment: GitHub's default CodeQL setup, enabled at the repo-settings level. + comment: GitHub's default CodeQL setup; analyzes Go and GitHub Actions workflow code on pull requests and pushes to main. integration: adhoc: false - ci: false + ci: true release: false + - name: GitHub Code Scanning + type: SAST + rulesets: ["default"] + results: {} + comment: Ingests SARIF results from Snyk for integrated GitHub security alerts. + integration: + adhoc: false + ci: true + release: true + - name: Dockle + type: container + rulesets: ["default"] + results: {} + comment: Container image linter enforcing CIS Docker Benchmark best practices; fails the build on any warning. + integration: + adhoc: false + ci: true + release: true assessments: self: From a7411e77c0f04622b00b079eae5f5f29d982a619 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Niccol=C3=B2=20Fei?= Date: Tue, 4 Aug 2026 13:26:56 +0200 Subject: [PATCH 3/3] docs: update doc and PR templates to mention SECURITY-INSIGHTS.yml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Niccolò Fei --- .github/PULL_REQUEST_TEMPLATE/new_extension.md | 5 +++++ CONTRIBUTING_NEW_EXTENSION.md | 4 ++++ 2 files changed, 9 insertions(+) diff --git a/.github/PULL_REQUEST_TEMPLATE/new_extension.md b/.github/PULL_REQUEST_TEMPLATE/new_extension.md index 44c8600..26e886a 100644 --- a/.github/PULL_REQUEST_TEMPLATE/new_extension.md +++ b/.github/PULL_REQUEST_TEMPLATE/new_extension.md @@ -52,6 +52,9 @@ Closes # - [ ] An entry for the new extension folder was added to [`CODEOWNERS`](https://github.com/cloudnative-pg/postgres-extensions-containers/blob/main/CODEOWNERS) with the component owner's GitHub handle(s). +- [ ] A `distribution-points` entry for the new image was added under + `repository.release` in + [`SECURITY-INSIGHTS.yml`](https://github.com/cloudnative-pg/postgres-extensions-containers/blob/main/SECURITY-INSIGHTS.yml). - [ ] I confirm my commitment to maintain this extension on behalf of the CloudNativePG community. @@ -84,4 +87,6 @@ Closes # when `create_extension = true`) are valid. - [ ] `CODEOWNERS` entry is present and the component owner(s) accept the long-term maintenance commitment. +- [ ] `SECURITY-INSIGHTS.yml` has a matching `distribution-points` entry for + the new image. - [ ] PR targets `main` and is ready to merge. diff --git a/CONTRIBUTING_NEW_EXTENSION.md b/CONTRIBUTING_NEW_EXTENSION.md index 9b76769..0b20959 100644 --- a/CONTRIBUTING_NEW_EXTENSION.md +++ b/CONTRIBUTING_NEW_EXTENSION.md @@ -301,6 +301,10 @@ Submission Requirements: - **CODEOWNERS**: The PR must add an entry to the [`CODEOWNERS`](./CODEOWNERS) file listing the GitHub handles of the component owner(s) for the new extension folder. +- **SECURITY-INSIGHTS.yml**: The PR must add a `distribution-points` entry for + the new image under `repository.release` in + [`SECURITY-INSIGHTS.yml`](./SECURITY-INSIGHTS.yml), pointing to its GitHub + Packages page (using the `image_name` from `metadata.hcl`). > [!IMPORTANT] > When opening the Pull Request, use the **new extension** template, which