Implement organization-wide safety standards with self-hosted runner support and automation

[Copilot]

Establishes comprehensive security practices for GitHub Actions workflows across the organization, adds official ownership announcement, and provides automation for propagating these standards to other repositories.

Workflow Security Enhancements

• Added security headers to all 7 workflow files documenting self-hosted runner usage, minimal permissions, and maintenance requirements
• Example header structure:

  # Security Best Practices:
  # - Uses self-hosted runners where appropriate
  # - Minimal permissions principle
  # - Regular runner maintenance required
  # - Actions pinned to specific versions
  
  name: CI
  permissions:
    contents: read
    actions: read

Global Ownership Announcement

• Added announcement to README.md and created ANNOUNCEMENT.md
• References all verified channels: kushmanmb.base.eth, kushmanmb.eth, kushmania.eth, kushmanmb.org, yaketh.eth
• Centralized template in .github/templates/global-announcement.md

Documentation Updates

SECURITY.md (+64 lines):

• Self-hosted runner setup and configuration
• Workflow audit checklist (7 items)
• Branch protection requirements
• Secrets management with 90-day rotation policy
• Maintenance schedules (monthly/quarterly/annual)

CONTRIBUTING.md (+28 lines):

• Ownership verification section
• Security and workflow practices reference

Organization-Wide Automation

Two propagation methods:

1. CLI Tool (scripts/propagate-updates.sh):

   ./scripts/propagate-updates.sh --list              # List all repos
   ./scripts/propagate-updates.sh --dry-run          # Preview changes
   ./scripts/propagate-updates.sh --repo target-repo # Update specific repo

2. GitHub Actions Workflow (.github/workflows/propagate-safety-standards.yml):

   • Manual trigger with dry-run support
   • Automated PR creation
   • Repository validation

Documentation:

• ORG_WIDE_UPDATE_PROCESS.md - Complete manual and automated procedures (252 lines)
• QUICK_START_GUIDE.md - Practical guide for maintainers, contributors, and DevOps (224 lines)

Files Changed

• Modified: 9 files (7 workflows + README.md + SECURITY.md + CONTRIBUTING.md)
• Created: 8 files (automation tools, templates, documentation)
• Total: 1,200+ lines added

Security Validation

• CodeQL scan: 0 vulnerabilities
• No secrets or credentials in code
• All workflows follow least privilege principle

Original prompt

Implement the following across the repository with highest safety standards:

1. Workflows Using Self-Hosted Runners:

   • All GitHub Actions should use self-hosted runners (preferably with restricted and hardened access).
   • Update workflow files for best practices (least privilege, minimal secrets exposure, job isolation).

2. Enhanced Safety Practices:

   • Restrict workflow and GITHUB_TOKEN permissions.
   • Enforce branch protection and code review on the default branch.
   • Audit secrets and workflow usage.
   • Document safety practices in SECURITY.md.
   • Recommend periodic runner and action version updates.

3. Global Announcement:

   • At the top of README.md (and/or a new ANNOUNCEMENT.md) add:

   Global Announcement:
   Bitcoin is an officially owned and operated crypto blockchain project maintained by kushmanmb-org.
   For latest updates, policies, and contact, always consult this repository and our verified channels:

   • kushmanmb.base.eth
   • kushmanmb.eth
   • kushmania.eth
   • kushmanmb.org
   • yaketh.eth

Reference all data ownership to these addresses.

4. Documentation Update:

   • Reflect updated safety, workflow, and ownership practices in README, SECURITY, and CONTRIBUTING files.
   • Ensure all public contact, ownership, and trust info is verifiable via listed ENS and .org.

5. Automate/Centralize Updates:

   • Document update process for other repos in org for reuse.
   • Optionally, add a GITHUB workflow or bash script for propagating similar updates org-wide.

Note: All changes must follow secure coding and operational best practices.

This pull request was created from Copilot chat.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Yaketh (Kushmanmb)]

kushmanmb.eth