diff options
Diffstat (limited to '.gitlab/issue_templates/Security developer workflow.md')
| -rw-r--r-- | .gitlab/issue_templates/Security developer workflow.md | 12 |
1 files changed, 4 insertions, 8 deletions
diff --git a/.gitlab/issue_templates/Security developer workflow.md b/.gitlab/issue_templates/Security developer workflow.md index 695f0167ad4..7de137bd2e2 100644 --- a/.gitlab/issue_templates/Security developer workflow.md +++ b/.gitlab/issue_templates/Security developer workflow.md @@ -9,19 +9,17 @@ Set the title to: `Description of the original issue` ## Prior to starting the security release work - [ ] Read the [security process for developers] if you are not familiar with it. -- [ ] Mark this [issue as related] to the Security Release tracking issue. You can find it on the topic of the `#releases` Slack channel. -- [ ] Run `scripts/security-harness` in your local repository to prevent accidentally pushing to any remote besides `gitlab.com/gitlab-org/security`. +- [ ] Mark this [issue as related] to the Security Release Tracking Issue. You can find it on the topic of the `#releases` Slack channel. - Fill out the [Links section](#links): - [ ] Next to **Issue on GitLab**, add a link to the `gitlab-org/gitlab` issue that describes the security vulnerability. - - [ ] Next to **Security Release tracking issue**, add a link to the security release issue that will include this security issue. ## Development +- [ ] Run `scripts/security-harness` in your local repository to prevent accidentally pushing to any remote besides `gitlab.com/gitlab-org/security`. - [ ] Create a new branch prefixing it with `security-`. - [ ] Create a merge request targeting `master` on `gitlab.com/gitlab-org/security` and use the [Security Release merge request template]. -- [ ] Follow the same [code review process]: Assign to a reviewer, then to a maintainer. -After your merge request has been approved according to our [approval guidelines], you're ready to prepare the backports +After your merge request has been approved according to our [approval guidelines] and by a team member of the AppSec team, you're ready to prepare the backports ## Backports @@ -41,7 +39,6 @@ After your merge request has been approved according to our [approval guidelines - [ ] Fill in any upgrade notes that users may need to take into account in the [details section](#details) - [ ] Add Yes/No and further details if needed to the migration and settings columns in the [details section](#details) - [ ] Add the nickname of the external user who found the issue (and/or HackerOne profile) to the Thanks row in the [details section](#details) -- [ ] Once your `master` MR is merged, comment on the original security issue with a link to that MR indicating the issue is fixed. ## Summary @@ -50,7 +47,6 @@ After your merge request has been approved according to our [approval guidelines | Description | Link | | -------- | -------- | | Issue on [GitLab](https://gitlab.com/gitlab-org/gitlab/issues) | #TODO | -| Security Release tracking issue | #TODO | ### Details @@ -64,7 +60,7 @@ After your merge request has been approved according to our [approval guidelines | Thanks | | | [security process for developers]: https://gitlab.com/gitlab-org/release/docs/blob/master/general/security/developer.md -[secpick documentation]: https://gitlab.com/gitlab-org/release/docs/blob/master/general/security/developer.md#secpick-script +[secpick documentation]: https://gitlab.com/gitlab-org/release/docs/-/blob/master/general/security/utilities/secpick_script.md [security Release merge request template]: https://gitlab.com/gitlab-org/security/gitlab/blob/master/.gitlab/merge_request_templates/Security%20Release.md [code review process]: https://docs.gitlab.com/ee/development/code_review.html [approval guidelines]: https://docs.gitlab.com/ee/development/code_review.html#approval-guidelines |