Document branch protection to our repos

[maxime-rainville]

As the Silverstripe CMS product owner, I want to restrain the ability of all individuals to direct push commits or tags to our supported module repos to minimise the risk of unreviewed code changes making it to our codebase.

Acceptance criteria

Documentation and process

• Use cases requiring direct push/tag access are identified and documented.
• Individuals performing these use cases are identified and documented.
• To the extent that exceptions are required, a process is defined for documenting and approving these exceptions.
  • Staff members who do regular direct push (e.g. people doing debugging merges ups) may retain direct push access.
• Access level of core committers and CMS Squad members are reviewed with a view to disallowing direct push access.
• Branch protection process and rules are documented and apply only to branches following semantic visioning.
• The technical process for setting up branch protection is documented.
• All the documents above are documented in the developer docs.
• Relevant security policies in our internal Confluence are updated to point to the public doc (to discuss with CISO)

PRs

After merging, assign to Max to discuss updating confluence with CISO, and to decide what the specific process is for exceptions to the documented rules.

• DOC Add documentation about repository management developer-docs#487

[maxime-rainville]

I'm pretty sure we'll end up splitting this, but I'm not sure how and where.

[GuySartorelli]

We can't remove direct push access without removing our ability to fix broken merge-ups.

[maxime-rainville]

We moved all the implementation details to a separate card.

[GuySartorelli]

@maxime-rainville to "discuss with CISO" about confluence pages, and to determine what the policy should be for making and documenting exceptions for the documented process.

[maxime-rainville]

I've email CISO with an update. I think the follow up point can be handled with the follow other cards.

• Review access model and core core committer access #221
• Apply branch protection to our repos #198
• Review Core Committer policy #166