Hi Ansible Community!
Welcome back to our ongoing series on the EU Cyber Resilience Act (CRA). Today’s post is a short update on the stewardship status of the Ansible project.
We are happy to report that, as of last week, we are officially ‘light-compliant’ meaning we meet the baseline criteria under the CRA! 
Let’s go into some of the changes made in recent months.
New pages on docs.ansible.com
There are three new pages on docs.ansible.com:
At a high level, all three documents cover how the Ansible ecosystem prevents vulnerabilities through secure development practices, manages the reporting and triage of security issues, handles the response and disclosure processes, and uses files like SECURITY.md to guide these practices. Thank you to everyone who reviewed the pull requests for these new pages!
ansible.com/security Updated Redirect
ansible.com/security now redirects to the Ansible security policy for easier discoverability of the new policy.
SECURITY.md File Rollout
A standard SECURITY.md file has been rolled out to all GitHub organizations listed in the security policy using the special .github repository. This change ensures that anyone viewing a repository on GitHub will see the SECURITY.md file.
Furthermore, if you are a collection maintainer or maintainer of a repository under one of the GitHub organizations listed in the security policy, you may have noticed a PR to either add, or update the SECURITY.md file - bringing it in line with the standard Ansible project template.
CI Hardening
Several GitHub Action workflows across critical Ansible repositories have been hardened with pinning to reduce risk of supply chain compromise. Thank you to the community members that have contributed and reviewed these changes to secure the software supply chain! Amazing work! 
Call to Action
If you see a SECURITY.md PR come your way, we’d appreciate your support with getting it merged! 
Also, join the discussion in Pinning GHA actions/shared workflows to commits - #2 by felixfontein where there are open questions about pinning shared GitHub Action workflows.
If you’d like to read more about the other posts in the CRA series, see also: