[juzhiyuan]

Summary

Enroll Apache APISIX (apache/apisix), a cloud-native API gateway that processes
untrusted network traffic and applies routing, authentication, access-control,
and TLS policies before forwarding requests to upstream services.

projects/apache-apisix/
├── project.yaml       # gateway repository, security contact, upstream threat model
└── Dockerfile         # debug runtime, source dependencies, offline core tests

Use docs/en/latest/security-threat-model.md from the scanned checkout as the
authoritative threat model. Although that document also discusses the Ingress
Controller, this enrollment scans only apache/apisix; it does not enroll or
clone apache/apisix-ingress-controller or the Dashboard.

The image retains the full checkout at /src, the debug runtime installed by
upstream CI with its SHA-256 check, LuaRocks dependencies, Test::Nginx at the
upstream CI revision, test-toolkit submodule, and local etcd binaries.

The submitting account is juzhiyuan; the report recipient supplied by the
maintainer is security@apache.org. Maintainer and terms declarations remain unchecked until
the submitting maintainer confirms them. This PR is a draft enrollment.

Evidence

• Before: no enrollment for apache/apisix in the base revision.
  After: python3 tools/validate.py passes with the new project.
• tools/check apache-apisix --no-shell passes, including the scanner tooling layer.
• Offline verification at gateway commit 9326926e3c59f0be4c0dd254672c545bffd2b707:
  oss-scanner-test passes all 194 assertions in 4 test files in a container
  with --network none --cpus 2 --memory 8g. The local etcd starts successfully.

docker run --rm --init --network none --cpus 2 --memory 8g \
  -w /src oss-scanner-check/built:apache-apisix \
  timeout 900 oss-scanner-test

The image provides oss-scanner-test, which starts an ephemeral local etcd,
initializes APISIX, and runs t/core/table.t, t/core/json.t, t/core/string.t,
and t/core/schema_def.t. The full plugin integration matrix and its external
backend services are not provisioned.

Merge Danger

Door: two-way

Reports can be paused with disabled: true, or enrollment can be removed.

Blast Radius: APISIX

Only projects/apache-apisix/ changes. Merging enrolls this gateway repository
and sends model-generated findings to the configured public security contact.

Enrollment checklist

• I am a core maintainer of this project.
• I accept the OSS Scanner terms.
• I confirm that I believe my project meets the inclusion criteria and is an established project that users depend on.
• project.yaml follows the README (one project per PR; tools/validate.py passes locally).
• tools/check apache-apisix builds the project, and its tests run in the offline image.
• primary_contact is confirmed as the project's primary security contact.
• There is a Dockerfile next to project.yaml that builds the project.
• threat_model points to the project's authoritative threat model in its repository.

The submitting maintainer must personally complete any required CLA signature.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[github-actions]

Enrolment triage: projects/apache-apisix

Repository: apache/apisix · opened by juzhiyuan

	Check	Result
✅	Repository	created 7 years ago, last push today
ℹ️	Stars / forks	17,241 stars · 2,974 forks · 311 watching
ℹ️	Outside participants	41 people from outside the project opened 66 of the last 100 issues and pull requests
ℹ️	Criticality score	0.70 on the OpenSSF scale of 0 to 1 signals created_since 91, updated_since 0, contributor_count 520, org_count 5, commit_frequency 11.9, recent_releases_count 5, closed_issues_count 232, updated_issues_count 344, comment_frequency 1.1, dependents_count 2,666
ℹ️	Package rank	by downloads: nothing from this repository found in the top 15,000 on PyPI or the top 10,000 on npm
✅	License	Apache-2.0
✅	Opened by an active maintainer	member of the owning organisation; 1 commits in the last 12 months; #23 contributor
✅	Contact in SECURITY.md	security@apache.org is in SECURITY.md
ℹ️	OSS-Fuzz	not found in OSS-Fuzz
ℹ️	.oss-scanner/ in the repository	not present; the Dockerfile is in this pull request
✅	Pull request scope	only this project's directory
✅	tools/validate.py	passes
✅	Checklist	all 8 ticked

_{Automated, from public data, to help reviewers. Enrolment is decided case by case against the criteria. If you think we got something wrong, please tell us in a reply.}

[juzhiyuan]

I have read the CLA Document and I hereby sign the CLA