Skip to main content

Project Management

Under the topic "project management" we describe how we do the organizational stuff besides coding such as on-/off-boarding new maintainers or contributors.

Infrastructure​

Domains​

We use these full qualified domain names:

Website​

The website and documentation is based on Docusaurus and hosted on Netlify. The login is documented in our vault.

GitHub Secrets​

https://github.com/secureCodeBox/secureCodeBox​

  • DOCKER_NAMESPACE: Namespace for the DockerHub images. For the main repository this is securecodebox.
  • DOCKER_TOKEN: Token that enables the CI to push images to DockerHub.
  • DOCKER_USERNAME: Username used to push images to DockerHub.
  • GPG_COMMITS_PASSPHRASE: GPG passphrase for the secureCodeBoxBot used to sign commits.
  • GPG_COMMITS_PRIVATE_KEY: GPG private key for the secureCodeBoxBot used to sign commits.
  • SCB_BOT_DOCU_ROULETTE_TOKEN: GitHub token for the documentation roulette (needs org:read permission).
  • SCB_BOT_USER_TOKEN: GitHub token for the secureCodeBoxBot.
  • SONAR_TOKEN: Token for SonarCloud code analysis in CI.

https://github.com/secureCodeBox/defectdojo-client-java​

  • MAVEN_PASSWORD: For authenticate against Maven Central.
  • MAVEN_USERNAME: For authenticate against Maven Central.
  • SCB_BOT_GPG_KEY: GPG private key for the secureCodeBoxBot used to sign commits.
  • SCB_BOT_GPG_PASSPHRASE: GPG private key for the secureCodeBoxBot used to sign commits.
  • SCB_BOT_USER_TOKEN: GitHub token for the secureCodeBoxBot.
  • SIGNING_KEY: GPG private key for the secureCodeBoxBot used to sign commits and Maven releases.
  • SIGNING_PASSWORD: GPG passphrase for the secureCodeBoxBot used to sign commits and Maven releases.
  • SONAR_TOKEN: Token for SonarCloud code analysis in CI.

Teams​

GitHub​

In our GitHub organization we have several teams:

  1. admin-team: Members are the project leads.
  2. core-team: Company sponsored core team.
  3. contributor-team: Active contributors from the community.
  4. bot-team: Team containing all bots allowed to push directly to the main branch.

DockerHub​

In our DockerHub organization we have several teams:

  1. adminteam: Members are the project leads.
  2. coreteam: Company sponsored core team.
  3. botteam: Team containing all bot accounts.

Sonatype (Maven Central)​

In our Sonatype organization we have the namespace "io.securecodebox" for Java Maven artifacts.

Users of this namespace are the project leads and a bot user for deployments.

FOSSA​

We use FOSSA in the free tier option for open source projects to check our dependencies for violating licenses. It is integrated in the repository as a webhook. Individual persons log in there using GitHub after onboarding. We onboard everyone in the admin-team.

Organizational​

  • The project leads do a regular sync meeting:
    • Monday 16:05-17:00 CET, every 4 weeks from 28.5.25 on. Next meetings: 23.6.25, 21.7.25 etc.
    • We write an agenda beforehand and notes in a Google Doc, one per meeting.
    • There is a template document in the shared drive.

On- and Off-Boarding​

For on- and off-boarding we create an issue for each member. On- and off-boardings need to be done by a member of the admin-team.

On-boarding​

  • core-team:
    • Add to our GitHub organization with following roles:
      • core-team
      • contributor-team
  • admin-team (additionally to the core-team on-boarding):
    • Add to our GitHub organization with following roles:
      • admin-team
    • Register user at Sonatype & add to namespace "io.securecodebox"
    • Add to OWASP valut.
    • Invite to FOSSA organization with role Admin (we use the OWASP mail address because GH invite didn't work when tried).

Off-boarding​

  • core-team:
    • Remove role:
      • core-team
  • admin-team: