OAyDaBy AAm=/y SAinRe9L TArT, wait what?
summary
Angular documents concrete changes: the org removes human push rights so no one has write access and uses a separate auth system that issues temporary action tokens for CI to perform merges. The repo workflow stays fork‑and‑pull but now require approval on latest commit and GitHub Actions re‑requests reviews when commits change approvals. The project limits dependencies, joins Google’s OSS VRP, updates security docs, and routes reports to bughunters.com.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:54Talk overview
- 2:57Supply chain security
- 4:00Software supply chain
- 5:29Software bill of materials
- 6:54Angular team’s security
- 7:57Rogue access elimination
- 9:01Stricter PR approvals
- 10:03Minimal dependencies handling
- 10:43Google OSS VRP updates
related talks
19mHow Angular manages community contributions and repositories
55mBeyond the Commit: Weaponizing and Hardening GitHub Actions
17mNo More Walled Gardens: Removing Barriers with SCM...
43mGitHub Actions Best Practices
25mWhen the supply chain hits a sour note
48mAdvanced Security with GitHub without GitHub Advanced Security
57mGitHub Actions: A Cloudy Day for Security
28mPwning the CI (with GitHub Action Workflows)