diff options
Diffstat (limited to '.gitlab/issue_templates')
| -rw-r--r-- | .gitlab/issue_templates/Feature proposal.md | 9 | ||||
| -rw-r--r-- | .gitlab/issue_templates/Security developer workflow.md | 12 |
2 files changed, 12 insertions, 9 deletions
diff --git a/.gitlab/issue_templates/Feature proposal.md b/.gitlab/issue_templates/Feature proposal.md index 45b5fc85cd1..589310b4cef 100644 --- a/.gitlab/issue_templates/Feature proposal.md +++ b/.gitlab/issue_templates/Feature proposal.md @@ -43,7 +43,14 @@ https://about.gitlab.com/handbook/engineering/ux/ux-research-training/user-story ### Permissions and Security -<!-- What permissions are required to perform the described actions? Are they consistent with the existing permissions as documented for users, groups, and projects as appropriate? Is the proposed behavior consistent between the UI, API, and other access methods (e.g. email replies)?--> +<!-- What permissions are required to perform the described actions? Are they consistent with the existing permissions as documented for users, groups, and projects as appropriate? Is the proposed behavior consistent between the UI, API, and other access methods (e.g. email replies)? +Consider adding checkboxes and expectations of users with certain levels of membership https://docs.gitlab.com/ee/user/permissions.html +* [ ] Add expected impact to members with no access (0) +* [ ] Add expected impact to Guest (10) members +* [ ] Add expected impact to Reporter (20) members +* [ ] Add expected impact to Developer (30) members +* [ ] Add expected impact to Maintainer (40) members +* [ ] Add expected impact to Owner (50) members --> ### Documentation diff --git a/.gitlab/issue_templates/Security developer workflow.md b/.gitlab/issue_templates/Security developer workflow.md index 695f0167ad4..7de137bd2e2 100644 --- a/.gitlab/issue_templates/Security developer workflow.md +++ b/.gitlab/issue_templates/Security developer workflow.md @@ -9,19 +9,17 @@ Set the title to: `Description of the original issue` ## Prior to starting the security release work - [ ] Read the [security process for developers] if you are not familiar with it. -- [ ] Mark this [issue as related] to the Security Release tracking issue. You can find it on the topic of the `#releases` Slack channel. -- [ ] Run `scripts/security-harness` in your local repository to prevent accidentally pushing to any remote besides `gitlab.com/gitlab-org/security`. +- [ ] Mark this [issue as related] to the Security Release Tracking Issue. You can find it on the topic of the `#releases` Slack channel. - Fill out the [Links section](#links): - [ ] Next to **Issue on GitLab**, add a link to the `gitlab-org/gitlab` issue that describes the security vulnerability. - - [ ] Next to **Security Release tracking issue**, add a link to the security release issue that will include this security issue. ## Development +- [ ] Run `scripts/security-harness` in your local repository to prevent accidentally pushing to any remote besides `gitlab.com/gitlab-org/security`. - [ ] Create a new branch prefixing it with `security-`. - [ ] Create a merge request targeting `master` on `gitlab.com/gitlab-org/security` and use the [Security Release merge request template]. -- [ ] Follow the same [code review process]: Assign to a reviewer, then to a maintainer. -After your merge request has been approved according to our [approval guidelines], you're ready to prepare the backports +After your merge request has been approved according to our [approval guidelines] and by a team member of the AppSec team, you're ready to prepare the backports ## Backports @@ -41,7 +39,6 @@ After your merge request has been approved according to our [approval guidelines - [ ] Fill in any upgrade notes that users may need to take into account in the [details section](#details) - [ ] Add Yes/No and further details if needed to the migration and settings columns in the [details section](#details) - [ ] Add the nickname of the external user who found the issue (and/or HackerOne profile) to the Thanks row in the [details section](#details) -- [ ] Once your `master` MR is merged, comment on the original security issue with a link to that MR indicating the issue is fixed. ## Summary @@ -50,7 +47,6 @@ After your merge request has been approved according to our [approval guidelines | Description | Link | | -------- | -------- | | Issue on [GitLab](https://gitlab.com/gitlab-org/gitlab/issues) | #TODO | -| Security Release tracking issue | #TODO | ### Details @@ -64,7 +60,7 @@ After your merge request has been approved according to our [approval guidelines | Thanks | | | [security process for developers]: https://gitlab.com/gitlab-org/release/docs/blob/master/general/security/developer.md -[secpick documentation]: https://gitlab.com/gitlab-org/release/docs/blob/master/general/security/developer.md#secpick-script +[secpick documentation]: https://gitlab.com/gitlab-org/release/docs/-/blob/master/general/security/utilities/secpick_script.md [security Release merge request template]: https://gitlab.com/gitlab-org/security/gitlab/blob/master/.gitlab/merge_request_templates/Security%20Release.md [code review process]: https://docs.gitlab.com/ee/development/code_review.html [approval guidelines]: https://docs.gitlab.com/ee/development/code_review.html#approval-guidelines |