Add security and coverage scanning to best practices for new repos (#741

)
open-telemetry · Jun 16, 2021 · 8b0922c · 8b0922c
1 parent aeca2bc
commit 8b0922c
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/docs/how-to-configure-new-repository.md b/docs/how-to-configure-new-repository.md
@@ -63,7 +63,10 @@ policies:
 
 ## Best practices
 
-It is recommended to set the following settings:
+It is recommended to follow these best practices:
 
 1. Only set "Allow squash merging" for the Merge button. It will ensure clean
    history for the repository.
+2. Set up a security scanning tool like, for example, [Github CodeQL](https://docs.github.com/en/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning).
+3. Set up a test coverage scanning tool like, for example, [Codecov](https://codecov.io/).
+4. Add status badges for passing builds and scans to the root README.