Audit repositories for security tools

[codeboten]

Get a questionnaire to SIGs in the org asking them what tools are enabled in their repos:

• open-telemetry/.github
• open-telemetry/assign-reviewers-action
• [security] audit repository tooling build-tools#212
• [security] audit repository tooling #71
• open-telemetry/docs-cn
• open-telemetry/docs-ja
• [security] audit repository tooling opamp-go#208
• [security] audit repository tooling opamp-java#9
• open-telemetry/opamp-spec
• [security] audit repository tooling opentelemetry-android#126
• open-telemetry/opentelemetry-collector
• open-telemetry/opentelemetry-collector-builder
• open-telemetry/opentelemetry-collector-contrib
• [security] audit repository tooling opentelemetry-collector-releases#418
• [security] audit repository tooling opentelemetry-configuration#52
• [security] audit repository tooling opentelemetry-cpp#2282
• open-telemetry/opentelemetry-cpp-contrib
• [security] audit repository tooling opentelemetry-demo#1073
• [security] audit repository tooling opentelemetry-dotnet#4817
• open-telemetry/opentelemetry-dotnet-contrib
• open-telemetry/opentelemetry-dotnet-instrumentation
• [security] audit repository tooling opentelemetry-network#236
• open-telemetry/opentelemetry-ebpf-build-tools
• open-telemetry/opentelemetry-erlang
• open-telemetry/opentelemetry-erlang-api
• open-telemetry/opentelemetry-erlang-contrib
• [security] audit repository tooling opentelemetry-go#4459
• [security] audit repository tooling opentelemetry-go-build-tools#390
• [security] audit repository tooling opentelemetry-go-contrib#4413
• [security] audit repository tooling opentelemetry-go-instrumentation#407
• [security] audit repository tooling opentelemetry-go-vanityurls#19
• [security] audit repository tooling opentelemetry-helm-charts#930
• [security] audit repository tooling opentelemetry-java#5745
• open-telemetry/opentelemetry-java-contrib
• open-telemetry/opentelemetry-java-examples
• open-telemetry/opentelemetry-java-instrumentation
• [security] audit repository tooling opentelemetry-js#4101
• open-telemetry/opentelemetry-js-api
• [security] audit repository tooling opentelemetry-js-contrib#1751
• [security] audit repository tooling opentelemetry-lambda#862
• open-telemetry/opentelemetry-log-collection
• open-telemetry/opentelemetry-operator
• [security] audit repository tooling opentelemetry-php#1131
• open-telemetry/opentelemetry-php-contrib
• open-telemetry/opentelemetry-php-instrumentation
• open-telemetry/opentelemetry-profiling
• open-telemetry/opentelemetry-proto
• [security] audit repository tooling opentelemetry-proto-go#139
• open-telemetry/opentelemetry-proto-java
• open-telemetry/opentelemetry-proto-profile
• [security] audit repository tooling  opentelemetry-python#3467
• [security] audit repository tooling opentelemetry-python-contrib#1991
• [security] audit repository tooling opentelemetry-ruby#1519
• open-telemetry/opentelemetry-ruby-contrib
• open-telemetry/opentelemetry-rust
• open-telemetry/opentelemetry-sandbox-web-js
• open-telemetry/opentelemetry-specification
• open-telemetry/opentelemetry-sqlcommenter
• open-telemetry/opentelemetry-swift
• [security] audit repository tooling opentelemetry.io#3212
• open-telemetry/otel-arrow
• open-telemetry/otel-arrow-collector
• open-telemetry/oteps
• open-telemetry/semantic-conventions
• open-telemetry/semantic-conventions-java
• open-telemetry/sig-security
• open-telemetry/stackoverflow2slack
• [security] audit repository tooling  prometheus-interoperability-spec#74

[codeboten]

Start this by documenting what's enabled in the collector repository and producing a form from it

[codeboten]

The following tools are configured for the OpenTelemetry Collector repository:

• CodeQL enabled via GitHub Actions
• Static code analysis: govulncheck [https://pkg.go.dev/golang.org/x/vuln] enabled on every build
• Repository security settings
  • Security Policy ✅
  • Security advisories ✅
  • Private vulnerability reporting ✅
  • Dependabot alerts ✅
  • Code scanning alerts ✅

[codeboten]

Confirmed the same is configured for the OpenTelemetry Collector Contrib repository

[JonZeolla]

We should consider Allstar for monitoring organization-wide policies. The quickstart may meet our needs