HSDEV-49384-update-security-config

.security_config/security_config.yaml

@@ -0,0 +1,27 @@
+# yaml-language-server: $schema=https://security-api.appsec.inday.io/schemas/security_config.json
+# This is the configuration file for Chimera. This file is required to allow the scanning platform to scan your repo.
+# Please see https://wolinks.com/chimera for details.
+
+#####################
+# SLACK CONFIGURATION
+#####################
+# Uncomment the below section and provide a Slack channel's name to allow Chimera to
+# notify your slack channel about scans. Please see Chimera documentation on how to do this.
+# slack:
+# enabled: true
+# channel: <slack-channel-name>
+
+##########################
+# SCAN TOOL  CONFIGURATION
+##########################
+tools_config:
+  sast:
+    rulesets:
+    - p/python
+    - p/terraform
+  sca: {}
+  secrets:
+    # To set this to false,
+    # Please see https://confluence.workday.com/display/PENTEST/gitleaks#gitleaks-WorkdayInternalRules
+    use_wday_internal_rules: true
+  iac: {}

.security_config/security_contact.yaml

@@ -0,0 +1,59 @@
+# This file contains contact info for the team that maintains
+# this repo. This information will be used by security in the
+# event that we need to contact you about security issues
+# discovered in this code.
+#
+# See https://wolinks.com/repocontact for more information.
+#
+# You may use the Red Hat YAML extension in VS Code to validate this file.
+# yaml-language-server: $schema=https://security-api.appsec.inday.io/schemas/security_contact.json
+
+version: "1.0"
+
+# Owners identify the individuals/groups who maintain this repo.
+owners:
+    # Users are Corp AD/LDAP usernames (CNs), prefixed with 'corp:'.
+    # We require at least one user to be specified to allow us to
+    # map users into WoW. This might be the manager or tech lead
+    # for this repo.
+    users:
+        - corp: ofer.levi
+    # Groups are optional, but allow you to point to existing AD/LDAP
+    # user groups (CNs), prefixed with 'corp:'. This might be your
+    # team's existing DL group or similar. You may remove 'groups' or
+    # keep it empty if you are not using any groups.
+    groups: []
+
+# Specify how you would like to be contacted if security finds an issue
+# in your code. You must provide at least one contact method. You may
+# remove any contact methods you are not using. You may set 'notify' to
+# 'false' for cases where you'd like to list a contact method for
+# completeness, but don't actually want us to send automated alerts to it.
+contact:
+    jira:
+        - project: jira2
+          component: HSDEV
+          notify: true
+    slack:
+        - channel: platform
+          notify: true
+    email:
+        - address: ofer.levi@workday.com
+          notify: false
+
+# Which services does the code in this repo support?
+# Service names should match those in https://wolinks.com/servicenames.
+# This field also supports some special values for repos that do not
+# directly host code for production services, including:
+#    - LIBRARY: For cases where the repo is a library imported by prod services
+#    - BUILDTOOL: For cases where the repo is a tool that builds prod services
+#    - LEGACY: For cases where the repo is no longer in use
+#    - NONE: For cases where the repo does not support prod services or fall
+#            into any of the other categories above.
+services:
+    - LIBRARY
+
+# Which service account(s) does your team use with artifactory? You may
+# this or leave a blank list if this repo does not store build artifacts
+# in artifactory.
+service_accounts: []