From 77200abb4efee43f7bd30b524d1e0f0f0c0492a9 Mon Sep 17 00:00:00 2001 From: Sven Strittmatter Date: Thu, 9 Apr 2026 17:03:11 +0200 Subject: [PATCH 1/2] #3499 Add Fossa to PM Docs Signed-off-by: Sven Strittmatter --- documentation/docs/contributing/project-management.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/documentation/docs/contributing/project-management.md b/documentation/docs/contributing/project-management.md index d4f4a5240c..fb2f84250a 100644 --- a/documentation/docs/contributing/project-management.md +++ b/documentation/docs/contributing/project-management.md @@ -66,6 +66,10 @@ In our [Sonatype organization](https://central.sonatype.com/) we have the namesp Users of this namespace are the _project leads_ and a bot user for deployments. +### FOSSA + +We use [FOSSA](https://fossa.com/) in the free tier for open source projects to check our dependnecies for violating licenses. It is integrated in the repo as webhok. Individual persons login there with GitHub aftr onboarding. We onboard everyone in the _admin-team_. + ## Organizational - The _project leads_ do a regular sync meeting: @@ -81,13 +85,14 @@ For on- and off-boarding we create an issue for each member. On- and off-boardin - _core-team_: - Add to our GitHub organization with following roles: - - core-team - - contributer-Team + - _core-team_ + - _contributor-team_ - _admin-team_ (additionally to the _core-team_ on-boarding): - Add to our GitHub organization with following roles: - admin-team - Register user at [Sonatype](https://central.sonatype.com/) & add to namespace "io.securecodebox" - Add to [OWASP valut](https://team-securecodebox.1password.com/). + - Invite to [FOSSA organization](https://app.fossa.com/account/settings/organization/users) with role _Admin_ (we use the OWASP mail address because GH invite didn't work when tried). ### Off-boarding @@ -99,6 +104,7 @@ For on- and off-boarding we create an issue for each member. On- and off-boardin - admin-team - Remove user from namespace "io.securecodebox" in [SonaType](https://central.sonatype.com/). - Remove access to [OWASP vault](https://team-securecodebox.1password.com/). + - Remove from [FOSSA organization](https://app.fossa.com/account/settings/organization/users) [google-shared-drive]: https://drive.google.com/drive/folders/1cwAjEyEabdj4By-Ox6ho49NiT-vQUeDq?usp=drive_link [iteratec]: https://www.iteratec.com/ From 8c1b25db5bc271d3c8477eb348bb31b8c7bbb169 Mon Sep 17 00:00:00 2001 From: Sven Strittmatter Date: Tue, 28 Apr 2026 13:59:34 +0200 Subject: [PATCH 2/2] Update documentation/docs/contributing/project-management.md Co-authored-by: Samreet Singh Signed-off-by: Sven Strittmatter --- documentation/docs/contributing/project-management.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/documentation/docs/contributing/project-management.md b/documentation/docs/contributing/project-management.md index fb2f84250a..ada77fe3d2 100644 --- a/documentation/docs/contributing/project-management.md +++ b/documentation/docs/contributing/project-management.md @@ -68,7 +68,7 @@ Users of this namespace are the _project leads_ and a bot user for deployments. ### FOSSA -We use [FOSSA](https://fossa.com/) in the free tier for open source projects to check our dependnecies for violating licenses. It is integrated in the repo as webhok. Individual persons login there with GitHub aftr onboarding. We onboard everyone in the _admin-team_. +We use [FOSSA](https://fossa.com/) in the free tier option for open source projects to check our dependencies for violating licenses. It is integrated in the repository as a webhook. Individual persons log in there using GitHub after onboarding. We onboard everyone in the _admin-team_. ## Organizational