HAMi/SECURITY-INSIGHTS.yml at master · Project-HAMi/HAMi · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
header:
  schema-version: 2.0.0
  last-updated: '2026-07-22'
  last-reviewed: '2026-07-22'
  url: https://github.com/Project-HAMi/HAMi/blob/master/SECURITY-INSIGHTS.yml
  comment: |
    Security metadata for the HAMi project, following the OpenSSF
    Security Insights specification.

project:
  name: HAMi
  homepage: https://project-hami.io
  documentation:
    code-of-conduct: https://github.com/Project-HAMi/HAMi/blob/master/CODE_OF_CONDUCT.md
  administrators:
    - name: Li Mengxuan
      affiliation: dynamia.ai
      email: archlitchi@gmail.com
      primary: true
    - name: Xiao Zhang
      affiliation: dynamia.ai
      email: xiaozhang0210@hotmail.com
      primary: false
  repositories:
    - name: HAMi
      url: https://github.com/Project-HAMi/HAMi
      comment: |
        Main repository, heterogeneous AI computing virtualization
        middleware for Kubernetes.
    - name: HAMi-core
      url: https://github.com/Project-HAMi/HAMi-core
      comment: |
        In-container GPU resource controller (libvgpu), compiled into
        HAMi release images via a git submodule.
    - name: HAMi-WebUI
      url: https://github.com/Project-HAMi/HAMi-WebUI
      comment: |
        Web dashboard for HAMi resource monitoring.
    - name: ascend-device-plugin
      url: https://github.com/Project-HAMi/ascend-device-plugin
      comment: |
        Device plugin for Huawei Ascend NPUs, deployed with HAMi.
    - name: volcano-vgpu-device-plugin
      url: https://github.com/Project-HAMi/volcano-vgpu-device-plugin
      comment: |
        vGPU device plugin variant for the Volcano scheduler.
    - name: website
      url: https://github.com/Project-HAMi/website
      comment: |
        Source for the project documentation site at project-hami.io.
  vulnerability-reporting:
    reports-accepted: true
    bug-bounty-available: false
    contact:
      name: HAMi maintainers
      primary: true
    security-policy: https://github.com/Project-HAMi/HAMi/blob/master/SECURITY.md
    comment: |
      Report vulnerabilities privately via GitHub Security Advisories:
      https://github.com/Project-HAMi/HAMi/security/advisories/new
      See SECURITY.md for the full policy, scope, and response process.

repository:
  url: https://github.com/Project-HAMi/HAMi
  status: active
  accepts-change-request: true
  accepts-automated-change-request: true
  bug-fixes-only: false
  no-third-party-packages: false
  core-team:
    - name: Li Mengxuan
      affiliation: dynamia.ai
      email: archlitchi@gmail.com
      primary: true
    - name: Xiao Zhang
      affiliation: dynamia.ai
      email: xiaozhang0210@hotmail.com
      primary: false
    - name: Wang Leibo
      affiliation: Nvidia
      email: wang.platform@gmail.com
      primary: false
    - name: Yin Yu
      affiliation: Independent Developer
      email: nimbus-nimo@proton.me
      primary: false
    - name: Shouren Yang
      affiliation: 4Paradigm
      email: yangshouren@gmail.com
      primary: false
  documentation:
    contributing-guide: https://github.com/Project-HAMi/HAMi/blob/master/CONTRIBUTING.md
    dependency-management-policy: https://github.com/Project-HAMi/HAMi/blob/master/DEPENDENCY.md
    security-policy: https://github.com/Project-HAMi/HAMi/blob/master/SECURITY.md
    governance: https://github.com/Project-HAMi/community/blob/main/community-membership.md
  license:
    url: https://github.com/Project-HAMi/HAMi/blob/master/LICENSE
    expression: Apache-2.0
  security:
    assessments:
      self:
        comment: |
          Dependencies are monitored with Dependabot and scanned in CI
          (CodeQL, image scanning, FOSSA license and dependency checks).
          Go toolchain and module updates are applied promptly when
          vulnerabilities are published.
    tools:
      - name: Dependabot
        type: SCA
        version: latest
        rulesets:
          - built-in
        integration:
          adhoc: false
          ci: true
          release: false
        results: {}
        comment: |
          Automated dependency update PRs for Go modules and GitHub Actions.
      - name: CodeQL
        type: SAST
        version: latest
        rulesets:
          - built-in
        integration:
          adhoc: false
          ci: true
          release: false
        results: {}
        comment: |
          Static analysis on pull requests via GitHub Actions.
      - name: GitHub secret scanning
        type: secret-scanning
        version: latest
        rulesets:
          - built-in
        integration:
          adhoc: false
          ci: true
          release: false
        results: {}
        comment: |
          GitHub native secret scanning with push protection, enabled
          on the repository to detect supported secret patterns and
          block them from being pushed.