docs: add code review policy and update security insights #1844 (#2134)

* docs: add code review policy and update security insights #1844

Signed-off-by: Simon Essien <champbreed1@gmail.com>

* docs: implement code review policy #1844

Signed-off-by: Simon Essien <champbreed1@gmail.com>

* style: fix markdown formatting nits via mdformat

Signed-off-by: Simon Essien <champbreed1@gmail.com>

* docs: sync maintainers with core team and update security insights

Signed-off-by: Simon Essien <champbreed1@gmail.com>

---------

Signed-off-by: Simon Essien <champbreed1@gmail.com>
Co-authored-by: Lou DeGenaro <lou.degenaro@gmail.com>

Author: Champbreed

.github/security-insights.yml

@@ -1,7 +1,7 @@
 header:
   schema-version: 2.0.0
-  last-updated: '2025-03-20'
-  last-reviewed: '2025-03-20'
+  last-updated: '2026-04-17'
+  last-reviewed: '2026-04-17'
   url: https://github.com/oscal-compass/compliance-trestle/blob/develop/.github/security-insights.yml
   project-si-source: https://raw.githubusercontent.com/oscal-compass/.github/refs/heads/main/.github/security-insights.yml
   comment: |
@@ -17,21 +17,16 @@ repository:
   # From the complaince-trestle MAINTAINER.md file
   # https://github.com/oscal-compass/compliance-trestle/blob/develop/MAINTAINERS.md
   core-team:
-  - name:        Alejandro Jose Leiva Palomo
-    primary:     true
   - name:        Christopher Butler
     primary:     true
   - name:        Lou Degenaro
     primary:     true
-  - name:        Jennifer Power
-    primary:     true
-  - name:        Manjiree Gadgil
-    primary:     true
   - name:        Vikas Agarwal
     primary:     true
   documentation:
     contributing-guide: https://github.com/oscal-compass/compliance-trestle/blob/develop/CONTRIBUTING.md
     security-policy: https://github.com/oscal-compass/community/blob/main/SECURITY.md
+    review-policy: https://github.com/oscal-compass/compliance-trestle/blob/develop/docs/code-review-policy.md
   license:
     url: https://github.com/oscal-compass/compliance-trestle/blob/develop/LICENSE
     expression: Apache-2.0

docs/code-review-policy.md

@@ -0,0 +1,30 @@
+# Code Review Policy
+
+This document outlines the mandatory quality assurance checks and standards for all contributions to Compliance Trestle, as required by OSPS-GV-03.02.
+
+## Review Requirements
+
+All Pull Requests must satisfy the following criteria before they are eligible for merging. Technical setup and legal requirements (such as DCO sign-off and license headers) are maintained in the [OSCAL Compass Community CONTRIBUTING guide](https://github.com/oscal-compass/community/blob/main/CONTRIBUTING.md).
+
+### 1. Quality Assurance
+
+- **Code style:** Contributions must adhere to project-specific formatting (PEP 8 via yapf/flake8).
+- **Documentation:** Changes must include updated documentation following Google-style docstrings.
+- **Testing:** PRs must meet the project-configured code coverage threshold of **96%**. Reviewers must verify that new tests cover logic edge cases.
+- **CI gates:** All automated checks must pass, including the **SonarCloud** scan for code quality and security vulnerabilities. SonarCloud is a mandatory gate — no PR may be merged while SonarCloud checks are failing.
+
+### 2. Review Standards
+
+- **Reviewer count:** In accordance with the project's governance, every PR requires at least **two (2) LGTMs** (Looks Good To Me) before merging. At least one of these reviewers must be a designated **Code Owner**.
+- **Logic verification:** Reviewers must verify that the change is functionally sound and does not introduce security vulnerabilities or logic regressions.
+- **Maintainability:** Code should be reviewed for complexity; reviewers are encouraged to suggest simplifications to promote long-term maintainability and readability.
+- **Issue alignment:** Every PR must be linked to a tracked issue to maintain the project's audit trail for compliance.
+
+### 3. Submission Workflow
+
+- **Commit history:** In alignment with the community guide, all merges into the `develop` branch MUST be conducted via a **squash-merge**.
+- **Audit trail:** Reviewers are responsible for verifying that the final squash message provides a clear description of the functional changes to ensure a clean, searchable history for auditing.
+
+## Security Oversight
+
+In accordance with OSPS-GV-03.02, this policy ensures that every code change undergoes a rigorous review to maintain the security posture of the Compliance Trestle ecosystem.