Project Governance

Contribute / Project Governance

Project governance and policy

SDLC, supply-chain controls, and dependency license policy for OpenBao Operator.

Open SDLCOpen supply chain security

Covers

• secure development and release flow across the project lifecycle
• supply-chain controls, provenance expectations, and reproducibility requirements
• dependency license policy for shipped binaries
• maintainer and policy work outside day-to-day feature development

Project governance guides

1. 01

   Software development lifecycle

   Planning, implementation, verification, release, and operations in the project lifecycle.

   Open
2. 02

   Supply chain security

   Review provenance, reproducibility, signing, evidence, and release-control expectations.

   Open
3. 03

   Supply-chain incident response

   Maintainer runbook for freezing Actions, suspending release automation, rotating trust roots, or inspecting publication state.

   Open
4. 04

   Dependency license policy

   Understand which licenses are allowed for shipped binaries and how the policy is enforced.

   Open

Related maintainer work

Release managementRelease workflow for turning policy into an actual release event.Continuous integrationCI implementation that enforces many of these policy expectations in practice.