Let's face it. Most uses of x.y.z aren't SemVer and most people haven't read the spec :) I think something about graduated projects having a documented policy around versioning is probably worthwhile,

I think Gatekeeper is interesting, but it's a sub-project of Open Policy Agent, not the whole thing. Anecdotally I mainly talk to a lot more folks using OPA outside Kubernetes than those just using it

I'd be happy to join and help here. HUGE DISCLAIMER. I work at Snyk, which is the service powering the scans. I'm also a maintainer of Conftest as part of the Open Policy Agent project and know a bunc

+1 NB I'm biased here, as one of the maintainers of the Conftest project which is now part of OPA. I wanted to address the point above about Rego. I'm an unashamed DSL nerd. I was a user and contribut

+1 non-binding <chris=chrisshort.net@...> wrote:

+1, nb <ascavarda@...> wrote:

Hi All On a couple of calls yesterday (SIG Security, and discussions about the proposed SIG App Delivery), the topic of bias or conflict of interest came up. In discussion we thought it worth bringing