Add SECURITY_CONTACTS for k/community

[cblecker]

No description provided.

[wking]

Looks good to me :). Can this PR or follow up work adjust our current docs to link to the new local file? When I asked about linking a local example here, @jessfraz expected this repo to not need its own SECURITY_CONTACTS. With the local example to link to, I think we can drop the current template reference, but I don't have a problem keeping it either if folks want to link to both the local example and the template.

[cblecker]

No, I want to continue referencing the template project from the governance template.

[jessfraz]

Thanks for being awesome :)

[wking]

No, I want to continue referencing the template project from the governance template.

It doesn't have to be either/or, it can be both/and. For example:

  - Defined in [`SECURITY_CONTACTS`](/SECURITY_CONTACTS) files, this is only relevant to the root file in
    the repository, there is a template
    [here](https://github.com/kubernetes/kubernetes-template-project/blob/master/SECURITY_CONTACTS)

or:

  - Defined in `SECURITY_CONTACTS` files (like [this one](/SECURITY_CONTACTS)), this is only relevant to the root file in
    the repository, there is a template
    [here](https://github.com/kubernetes/kubernetes-template-project/blob/master/SECURITY_CONTACTS)

[cblecker]

There's no need to reference the SECURITY_CONTACTS file in this repo from the template description. The authoritative location if someone is referencing the template is the template project. This file is irrelevant to the template.

[wking]

There's no need to reference the SECURITY_CONTACTS file in this repo from the template description. The authoritative location if someone is referencing the template is the template project. This file is irrelevant to the template.

Ah, maybe I'm just getting confused by having project template docs in the sig-charter template. It looks like it's designed to cover sigs.yaml, but now some of the information is actually stored in external repositories (like OWNERS). So now I agree that we don't need a local OWNERS link, and am 100% on board with this PR as it stands. I'll file a separate PR to try and refocus the sig-charter template section on sigs.yaml.

[castrojo]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: castrojo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [castrojo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dims]

/lgtm