Enhance FOSS Compliance and OSSF Scorecard Posture

.github/workflows/python-tests.yml

@@ -0,0 +1,39 @@
+name: Python Tests
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.12", "3.13"]
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Install uv
+      uses: astral-sh/setup-uv@v3
+      with:
+        enable-cache: true
+        version: "latest"
+
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ matrix.python-version }}
+
+    - name: Install dependencies
+      run: uv sync --all-extras --dev
+
+    - name: Run unit tests
+      run: uv run pytest tests/micro-tests/ -m unit
+
+    - name: Verify SBOM generation
+      run: |
+        uvx --from cyclonedx-bom cyclonedx-py environment --output-format json --output-file bom.json
+        ls -l bom.json

.github/workflows/release.yml

@@ -66,6 +66,11 @@ jobs:
       - name: Build package
         run: uv build
 
+      - name: Generate SBOM
+        run: |
+          uvx --from cyclonedx-bom cyclonedx-py environment --output-format json --output-file dist/bom.json
+          uvx --from cyclonedx-bom cyclonedx-py environment --output-format xml --output-file dist/bom.xml
+
       - name: Publish to PyPI
         # release/v1 is a floating branch, not a tag -- pypa's own convention
         # for this action's "stable" channel, updated more often than a

.github/workflows/scorecard.yml

@@ -0,0 +1,55 @@
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard-action#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard-action#maintained
+  schedule:
+    - cron: '20 7 * * 2'
+  push:
+    branches: [ "main" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@dc50aa6d9966401f441295b8d21c2302195df180 # v2.4.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "repo_token" with "public_repo" scope contributes to "GitHub-provided" counts
+          # and helps avoid rate limiting. See https://github.com/ossf/scorecard-action#authentication
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@v4
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif

CITATION.cff

@@ -0,0 +1,14 @@
+cff-version: 1.2.0
+message: "If you use this software, please cite it as below."
+authors:
+  - name: "Contributors to the ODPi Egeria project"
+title: "pyegeria: A Python SDK for Egeria"
+url: "https://github.com/odpi/egeria-python"
+abstract: "A lightweight Python 3.12+ client and CLI for the Egeria open metadata and governance platform."
+keywords:
+  - metadata
+  - governance
+  - egeria
+  - python
+  - sdk
+license: Apache-2.0

CODEOWNERS

@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright Contributors to the ODPi Egeria project.
+
+# Code ownership for Egeria=trellis - see https://help.github.com/articles/about-codeowners/
+# Note that the LAST matching pattern will be effective so please more generic paths towards the top
+
+# Top level
+
+# TODO: Update with new owners of files added
+/* @dwolfson @pcoldico

CODE_OF_CONDUCT.md

@@ -0,0 +1,107 @@
+<!-- SPDX-License-Identifier: CC-BY-4.0 -->
+<!-- Copyright Contributors to the ODPi Egeria project. -->
+
+# Code of Conduct
+
+All members of this project agree to adhere to the following Code of Conduct
+
+## Statement of Intent
+
+The Egeria project is committed to maintain a **positive** [work environment](#work-environment). This commitment calls for a workplace where [participants](#participant) at all levels behave according to the rules of the following code. A foundational concept of this code is that we all share responsibility for our work environment.
+## Code
+1. Treat each other with [respect](#respect), professionalism, fairness, and sensitivity to our many differences and strengths, including in situations of high pressure and urgency.
+1. Never [harass](#harassment) or [bully](#workplace-bullying) anyone verbally, physically or [sexually](#sexual-harassment).
+1. Never [discriminate](#discrimination) on the basis of personal characteristics or group membership.
+1. Communicate constructively and avoid [demeaning](#demeaning-behavior) or [insulting](#insulting-behavior) behavior or language.
+1. Seek, accept, and offer objective work criticism, and [acknowledge](#acknowledgement) properly the contributions of others.
+1. Be honest about your own qualifications, and about any circumstances that might lead to conflicts of interest.
+1. Respect the privacy of others and the confidentiality of data you access.
+1. With respect to cultural differences, be conservative in what you do and liberal in what you accept from others, but not to the point of accepting disrespectful, unprofessional or unfair or [unwelcome behavior](#unwelcome-behavior) or [advances](#unwelcome-sexual-advance).
+1. Promote the rules of this Code and take action (especially if you are in a [leadership position](#leadership-position)) to bring the discussion back to a more civil level whenever inappropriate behaviors are observed.
+1. Stay on topic: Make sure that you are posting to the correct channel and avoid off-topic discussions. Remember when you update an issue or respond to an email you are potentially sending to a large number of people.
+1. Step down considerately: Members of every project come and go, and the Egeria project is no different. When you leave or disengage from the project, in whole or in part, we ask that you do so in a way that minimizes disruption to the project. This means you should tell people you are leaving and take the proper steps to ensure that others can pick up where you left off.
+
+## Glossary
+
+#### Demeaning behavior
+is acting in a way that reduces another person's dignity, sense of self-worth or respect within the community.
+
+#### Discrimination
+is the prejudicial treatment of an individual based on criteria such as: physical appearance, race, ethnic origin, genetic differences, national or social origin, name, religion, gender, sexual orientation, family or health situation, pregnancy, disability, age, education, wealth, domicile, political view, morals, employment, or union activity.
+
+#### Insulting behavior
+is treating another person with scorn or disrespect.
+
+#### Acknowledgement
+is a record of the origin(s) and author(s) of a contribution.
+
+#### Harassment
+is any conduct, verbal or physical, that has the intent or effect of interfering with an individual, or that creates an intimidating, hostile, or offensive environment.
+
+#### Leadership position
+includes TSC/RT Chairs, Egeria Maintainers, staff members, and Board members.
+
+#### Participant
+includes the following persons:
+* Developers
+* Member representatives
+* Staff members
+* Anyone from the Public partaking in the Egeria work environment (e.g. contribute code, comment on our code or specs, email us, attend our conferences, functions, etc)
+
+#### Respect
+is the genuine consideration you have for someone (if only because of their status as participant in Egeria Project, like yourself), and that you show by treating them in a polite and kind way.
+
+#### Sexual harassment
+includes visual displays of degrading sexual images, sexually suggestive conduct, offensive remarks of a sexual nature, requests for sexual favors, unwelcome physical contact, and sexual assault.
+
+#### Unwelcome behavior
+Hard to define? Some questions to ask yourself are:
+* how would I feel if I were in the position of the recipient?
+* would my spouse, parent, child, sibling or friend like to be treated this way?
+* would I like an account of my behavior published in the organization's newsletter?
+* could my behavior offend or hurt other members of the work group?
+* could someone misinterpret my behavior as intentionally harmful or harassing?
+* would I treat my boss or a person I admire at work like that ?
+
+_Summary_: if you are unsure whether something might be welcome or unwelcome, don't do it.
+
+#### Unwelcome sexual advance
+includes requests for sexual favors, and other verbal or physical conduct of a sexual nature, where:
+* submission to such conduct is made either explicitly or implicitly a term or condition of an individual's employment,
+* submission to or rejection of such conduct by an individual is used as a basis for employment decisions affecting the individual,
+* such conduct has the purpose or effect of unreasonably interfering with an individual's work performance or creating an intimidating hostile or offensive working environment.
+
+#### Workplace Bullying
+is a tendency of individuals or groups to use persistent aggressive or unreasonable behavior (e.g. verbal or written abuse, offensive conduct or any interference which undermines or impedes work) against a co-worker or any professional relations.
+
+#### Work Environment
+is the set of all available means of collaboration, including, but not limited to messages to mailing lists, private correspondence, Web pages, chat channels, phone and video teleconferences, and any kind of face-to-face meetings or discussions.
+
+## Incident Procedure
+
+To report incidents or to appeal reports of incidents, send email to the Egeria TSC at [https://lists.lfaidata.foundation/g/egeria-tsc](https://lists.lfaidata.foundation/g/egeria-tsc). 
+Please include any available relevant information, including links to any publicly accessible material relating to the matter. 
+Every effort will be taken to ensure a safe and collegial environment in which to collaborate on matters relating to the Project. In order to protect the community,
+the Project reserves the right to take appropriate action, potentially including the removal of an individual from any and all participation in the project. 
+The Project will work towards an equitable resolution in the event of a misunderstanding.
+
+## Use of AI tools when working on Egeria code
+
+The use of AI tools in the Egeria project is encouraged, but all contributors must adhere to the following guidelines:
+
+- AI tools must not be used to generate code that violates the Egeria code of conduct or the Apache License.
+- AI tools must not be used to generate code that is not properly attributed to its original source.
+- AI tools must not be used to generate code that cannot be properly licensed under the Apache License.
+- AI tools must not be used to generate code that is not properly documented.
+- AI tools must not be used to generate code that is not properly tested.
+- AI tools use must be responsible - it is expensive on resources and so should not be used for repetitive tasks.  Use AI to generate code that runs the repetitive tasks and add them into the project for others to use.
+
+The human contributor is **ALWAYS** responsible for the quality of the code built by their use of AI tools.  The "AI made a mistake" is no excuse.
+
+## Credits
+
+This code is based on the [Hyperledger Project](https://github.com/hyperledger/hyperledger/wiki/Hyperledger-Project-Code-of-Conduct)‘s Code of Conduct. It has been modified to cover the use of AI tools in the Egeria project.
+
+----
+License: [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/),
+Copyright Contributors to the ODPi Egeria project.

CONTRIBUTING.md

@@ -42,7 +42,21 @@ To run against a live Egeria instance:
 
 ## Pull Request Process
 
+### Developer Certificate of Origin (DCO)
+
+All contributions to this project must be accompanied by a Developer Certificate of Origin (DCO) sign-off. This is a formal declaration that you have the right to submit the code under the project's license.
+
+To sign off on a commit, use the `-s` or `--signoff` flag:
+
+```bash
+git commit -s -m "Your commit message"
+```
+
+This will add a `Signed-off-by: Your Name <your.email@example.com>` line to your commit message.
+
+### Submission Steps
+
 1. Create a feature branch.
-2. Ensure scenario tests pass for your new module.
+2. Ensure unit and scenario tests pass.
 3. Update the `EgeriaTech` client if adding a new OMVS.
 4. Submit your PR for review.

Community-Guide.md

@@ -0,0 +1,22 @@
+<!-- SPDX-License-Identifier: CC-BY-4.0 -->
+<!-- Copyright Contributors to the ODPi Egeria project. -->
+
+# Egeria Community Guide
+
+This project welcomes contributors from any organization or background, provided they are
+willing to follow the simple processes outlined below, as well as adhere to the 
+[Code of Conduct](CODE_OF_CONDUCT.md).
+
+The [community guide](https://egeria-project.org/guides/community/) has moved to our new [documentation site](https://egeria-project.org/).
+
+----
+* Return to [Egeria's Home Page](https://egeria.odpi.org)
+* Return to [Egeria's GitHub Top-level](https://github.com/odpi/egeria)
+
+
+* Link to [Egeria's Operations Guide](https://egeria-project.org/guides/project-operations/)
+
+
+----
+License: [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/),
+Copyright Contributors to the ODPi Egeria project.

GOVERNANCE.md

@@ -0,0 +1,28 @@
+<!-- SPDX-License-Identifier: CC-BY-4.0 -->
+<!-- Copyright Contributors to the ODPi Egeria project. -->
+
+# Egeria Governance
+
+The Egeria project's governance processes are described in
+the [Egeria Operations Guide](https://egeria-project.org/guides/project-operations/).
+This includes the requirements to earn either of Egeria's two
+[Acclaim badges](developer-resources/badges).
+
+![Egeria Contributors Badge](developer-resources/badges/ODPi_Egeria_Badges-Contributor.png) 
+![Egeria Maintainers Badge](developer-resources/badges/ODPi_Egeria_Badges-Maintainer.png)
+
+The Egeria Conformance program is supported by the
+[Open Metadata Conformance Suite](open-metadata-conformance-suite).
+
+![Egeria Conformant Mark](open-metadata-conformance-suite/docs/egeria-conformance-mark.png)
+
+The operation of the Egeria project is overseen by the
+[Egeria's technical steering committee (TSC)](https://wiki.lfaidata.foundation/display/EG/Egeria+Technical+Steering+Committee+%28TSC%29+Home).
+
+If you are interested in joining the Egeria community,
+see the [community guide](https://egeria-project.org/guides/community/) to find out more.
+
+
+----
+License: [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/),
+Copyright Contributors to the ODPi Egeria project.

README.md

@@ -3,6 +3,11 @@
 
 ![Egeria Logo](https://egeria-project.org/assets/images/egeria-header.png)
 
+[![Python Tests](https://github.com/odpi/egeria-python/actions/workflows/python-tests.yml/badge.svg)](https://github.com/odpi/egeria-python/actions/workflows/python-tests.yml)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/odpi/egeria-python/badge)](https://securityscorecards.dev/viewer/?uri=github.com/odpi/egeria-python)
+[![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/3044/badge)](https://bestpractices.coreinfrastructure.org/projects/3044)
+[![Contributor Covenant](https://img.shields.io/badge/Contributor%20Covenant-2.1-4baaaa.svg)](CODE_OF_CONDUCT.md)
+[![Governance](https://img.shields.io/badge/Governance-Egeria-blue)](GOVERNANCE.md)
 [![GitHub](https://img.shields.io/github/license/odpi/egeria)](LICENSE)
 
 

SECURITY.md

@@ -1,30 +1,22 @@
 <!-- SPDX-License-Identifier: CC-BY-4.0 -->
 <!-- Copyright Contributors to the ODPi Egeria project. -->
 
-# Security Policy
+# Code Quality and Security
 
-pyegeria is part of the [ODPi Egeria](https://github.com/odpi/egeria) project family and follows Egeria's own
-[code quality and security practices](https://github.com/odpi/egeria/blob/main/SECURITY.md), including:
+Egeria has a clear focus on ensuring the code delivered is of the highest quality to ensure that downstream consumers can leverage Egeria with as minimal risk as possible.
 
-- [GitHub Dependabot](https://dependabot.com/) to automatically update dependencies (`.github/dependabot.yml`).
-- [GitHub CodeQL](https://github.com/features/security) to automatically scan for security vulnerabilities
-  (`.github/workflows/codeql.yml`).
-- PyPI [Trusted Publishing](https://docs.pypi.org/trusted-publishers/) (OIDC) for releases — no long-lived API
-  token is stored in this repository.
-- GitHub Actions steps pinned to a specific commit SHA rather than a mutable tag, so a workflow can't be
-  silently altered by a tag being moved upstream.
+Specific items that Egeria employs include but are not limited to...
 
-## Reporting a Vulnerability
+- Participation in the [Core Infrastructure Initiative Best Practices Badge Program](https://bestpractices.coreinfrastructure.org/en/projects/3044). This is a [free program](https://www.coreinfrastructure.org/programs/best-practices-program/) designed with the open source community with criteria that evolves to allow for compensating controls rather than a strict mechanical process.
+- [GitHub Actions](https://github.com/features/actions) to automatically build, test, and scan for vulnerabilities.
+- [GitHub Dependabot](https://dependabot.com/) to automatically update dependencies.
+- [GitHub CodeQL](https://github.com/features/security) to automatically scan for security vulnerabilities.
+- **SBOM (Software Bill of Materials)** generated for every release in CycloneDX format (JSON and XML).
+- [GitHub Security Advisories](https://help.github.com/en/github/managing-security-vulnerabilities/about-github-security-advisories) for triaging security issues that come through (egeria-security@lists.lfaidata.foundation) and other confidential channels before publishing them for broader community awareness.
 
-If you believe you've found a security vulnerability in pyegeria, please report it privately rather than
-opening a public issue:
+For more questions on Egeria's commitment to code quality, feel free to reach out to the [Egeria development team](mailto:egeria-technical-discuss@lists.lfaidata.foundation)
 
-- Use GitHub's [private vulnerability reporting](https://github.com/odpi/egeria-python/security/advisories/new)
-  for this repository, or
-- Email [egeria-security@lists.lfaidata.foundation](mailto:egeria-security@lists.lfaidata.foundation).
-
-For general questions about this policy, reach out to the
-[Egeria development team](mailto:egeria-technical-discuss@lists.lfaidata.foundation).
+If you would like to report a security vulnerability, please do so via the [Egeria development team](mailto:egeria-technical-discuss@lists.lfaidata.foundation).
 
 ----
 License: [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/),