OSV Schema TI Graduation Application by GeauxJD · Pull Request #456 · ossf/tac

GeauxJD · 2025-03-05T21:52:28Z

This is an initial draft of the application with some of the basic information included. Submitting as a draft PR to allow for contributions from others collaborating on this app.

This adds a CONTRIBUTING.md and CODE_OF_CONDUCT.md to address deficiencies and assist with progressing OSV Schema TI Graduation Application (ossf/tac#456) For want of something better, I used what is present at https://github.com/ossf/oss-vulnerability-guide

This adds a CONTRIBUTING.md and CODE_OF_CONDUCT.md to address deficiencies and assist with progressing OSV Schema TI Graduation Application (ossf/tac#456) For want of something better, I used what is present at https://github.com/ossf/oss-vulnerability-guide Signed-off-by: Andrew Pollock <andrew@pollock.id.au> Signed-off-by: Andrew Pollock <andrewpollock@users.noreply.github.com>

andrewpollock

I've suggested a few modifications based on conversations with related parties

process/project-lifecycle-documents/osv-schema_graduation_stage.md

This adds a CONTRIBUTING.md and CODE_OF_CONDUCT.md to address deficiencies and assist with progressing OSV Schema TI Graduation Application (ossf/tac#456) For want of something better, I used what is present at https://github.com/ossf/oss-vulnerability-guide Signed-off-by: Andrew Pollock <andrew@pollock.id.au> Signed-off-by: Andrew Pollock <andrewpollock@users.noreply.github.com>

process/project-lifecycle-documents/osv-schema_graduation_stage.md

andrewpollock · 2025-06-26T22:36:15Z

process/project-lifecycle-documents/osv-schema_graduation_stage.md

+  * The project has a standing agenda item in the Vulnerability Disclosures Working Group meetings. [Meeting Notes](https://docs.google.com/document/d/1TdxiFofLOfpHUEQILlKq7qkjSsRXVab0uApSDJ8c5rI/edit?tab=t.0)
+
+Implements, practices, and refines mature software development and release practices, such as adherence to semantic versioning, and having a declared policy for stable releases and backported fixes.
+  * "link to policy for (or describe here) software development and release practices"


@oliverchang can you suggest an edit here to describe the release process of the schema?

Actually, it'd be better for that to be in something like a RELEASING.md in the osv-schema repo, I think.

I will take a look at making a RELEASING.md file, the current release process is pretty simple:

Bump up the version (patch version bump for new ecosystems, minor version bump for non breaking schema field changes)

Add schema changes to the changelog

Publish github release

Update the github pages branch to the new release.

SecurityCRob

I approve this!

process/project-lifecycle-documents/osv-schema_graduation_stage.md

Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

updating based on Oliver's feedback Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

marcelamelara

It's really exciting to see OSV schema reach this stage! That said, I would like to see a clearer roadmap for a project at this maturity level, so I hope that we can start to clarify this as part of this process.

marcelamelara · 2025-08-04T21:10:35Z

process/project-lifecycle-documents/osv-schema_graduation_stage.md

+  * https://github.com/ossf/osv-schema/blob/main/CHARTER.md
+
+Have a defined and documented roadmap and annual goals for the project
+  * https://github.com/ossf/osv-schema/projects?query=is%3Aopen


The project board is currently empty. Do you a have a sense for the open issues (or other tasks) you might prioritize next?

marcelamelara · 2025-08-04T21:13:20Z

process/project-lifecycle-documents/osv-schema_graduation_stage.md

+  * https://github.com/ossf/osv-schema/projects?query=is%3Aopen
+
+Project has met at least 4 times over a period of at least 2 months since becoming incubating
+  * The project has a standing agenda item in the Vulnerability Disclosures Working Group meetings. [Meeting Notes](https://docs.google.com/document/d/1TdxiFofLOfpHUEQILlKq7qkjSsRXVab0uApSDJ8c5rI/edit?tab=t.0)


Besides the requirements for graduation, there doesn't seem to be a lot of discussion about OSV in recent meetings. Per my comment about prioritization above, once this application is completed, do you have a sense for what's next?

marcelamelara · 2025-08-04T21:20:38Z

process/project-lifecycle-documents/osv-schema_graduation_stage.md

+|-----------------------|-----|
+| Repo                  | https://github.com/ossf/osv-schema |
+| Website               | https://ossf.github.io/osv-schema/ |
+| Contributing guide    |     |


Can you please add the link to the CONTRIBUTING.md file?

lehors · 2025-08-05T07:01:02Z

process/project-lifecycle-documents/osv-schema_graduation_stage.md

+## Project graduation application
+
+### Project has met all Incubating requirements
+  * n/a


Why is this said to be not applicable? It is not optional. A project doesn't have to go through every step of the lifecycle and may apply for a status at any level but it still needs to fulfill all the requirements for the previous ones.

lehors · 2025-08-05T07:06:52Z

This PR should also include the related necessary change to be made to the table in the README.md file.

steiza · 2025-08-05T12:39:54Z

process/project-lifecycle-documents/osv-schema_graduation_stage.md

+
+### Security Baseline
+
+The project meets all applicable Security Baseline requirements:


It looks like there are some open issues with respect to meeting the security baseline: https://github.com/ossf/osv-schema/issues?q=state%3Aopen%20label%3A%22security%20baseline%22

process/project-lifecycle-documents/osv-schema_graduation_stage.md

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

andrewpollock mentioned this pull request Apr 24, 2025

docs: add missing base documentation ossf/osv-schema#349

Merged

andrewpollock suggested changes Apr 24, 2025

View reviewed changes

oliverchang reviewed Apr 24, 2025

View reviewed changes

andrewpollock reviewed Jun 26, 2025

View reviewed changes

SecurityCRob approved these changes Jul 18, 2025

View reviewed changes

SecurityCRob added the TI Lifecycle Issue/PR related to TIs' lifecycle status. Needs 5 approvals, 10d review. label Jul 18, 2025

SecurityCRob marked this pull request as ready for review July 18, 2025 15:43

SecurityCRob requested a review from a team as a code owner July 18, 2025 15:43

andrewpollock reviewed Jul 21, 2025

View reviewed changes

process/project-lifecycle-documents/osv-schema_graduation_stage.md Outdated Show resolved Hide resolved

GeauxJD and others added 7 commits August 4, 2025 13:51

Create initial draft of OSV application

951b0d3

Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

Update process/project-lifecycle-documents/osv-schema_graduation_stag…

cab00d8

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

Update process/project-lifecycle-documents/osv-schema_graduation_stag…

940511f

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

Update process/project-lifecycle-documents/osv-schema_graduation_stag…

5d818c1

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

Update process/project-lifecycle-documents/osv-schema_graduation_stag…

600c67c

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

Update osv-schema_graduation_stage.md

704a5ba

updating based on Oliver's feedback Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

Update process/project-lifecycle-documents/osv-schema_graduation_stag…

e7f7d7b

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

marcelamelara force-pushed the osv-schema-app branch from e28c7eb to e7f7d7b Compare August 4, 2025 20:51

marcelamelara reviewed Aug 4, 2025

View reviewed changes

lehors reviewed Aug 5, 2025

View reviewed changes

steiza reviewed Aug 5, 2025

View reviewed changes

andrewpollock reviewed Sep 25, 2025

View reviewed changes

process/project-lifecycle-documents/osv-schema_graduation_stage.md Outdated Show resolved Hide resolved

andrewpollock reviewed Sep 25, 2025

View reviewed changes

process/project-lifecycle-documents/osv-schema_graduation_stage.md Outdated Show resolved Hide resolved

GeauxJD and others added 2 commits December 18, 2025 15:27

Update process/project-lifecycle-documents/osv-schema_graduation_stag…

e5a1bf5

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

Update process/project-lifecycle-documents/osv-schema_graduation_stag…

127cbd6

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

GeauxJD mentioned this pull request Dec 23, 2025

Technical Initiatives Documentation Updates #557

Open

13 tasks


		### Security Baseline

		The project meets all applicable Security Baseline requirements:

Conversation

GeauxJD commented Mar 5, 2025

Uh oh!

andrewpollock left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SecurityCRob left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

marcelamelara left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lehors commented Aug 5, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants