Teams and Routines

Create and Manage Teams

Assign operational ownership, members and routines.

Create your team(s)

Open Settings → Operations → Teams and routines, choose Create team, enter a name, and select organization members where appropriate.

Use names that match the organization structure you already know. Teams own repositories and the remediation actions within those repositories. Teams are also responsible for their own working practices and therefore routines.

Reporting is available at a team level so it’s important that you create BIMP teams that align with your responsible owners.

Assign members

To add or remove team members open Settings → Operations → Teams and routines. Select edit team and select / deselect members.

Most developers will interact with BIMP using comments on a pull or merge request. There is no need to add your entire organisation to BIMP.

Organization roles and permissions remain separate. Adding a user to a team does not grant them any inherited permissions.

Assign repository ownership

On the Repositories page, open the settings for the repository you are assigning using the cog icon on the right hand side. You can select a team from the drop down.

Repositories are owned by one team but a team can own many repositories.

When working at scale you can script team assignments using the API, you can find detailed instructions in “Automate Repository Setup”.

Delete a team

To delete a team open Settings → Operations → Teams and routines. If you have permission to manage teams you will be able to delete teams directly from this page.

Deleting a team will leave their repositories without an owner so it is advisable to reassign repositories first.

Routines

Routines set a practical cadence for remediation work. Using routines teams make a commitment to merging BIMP changes on a regular basis.

Set the organization default

Open Settings → Organization → Defaults and set the default routine interval. The default is 28 days.

New team routines use the organization default as their starting interval. A team can then configure a different cadence to align with their working practices and risk tolerance.

Create a team routine

Use these settings to define your team’s working practices in BIMP. How often is your team able to perform routine remediation work?

Open Settings → Operations → Teams and routines, select a team, and create a routine with:

• a team name;
• a frequency in days, this is the interval between routine pull or merge requests
• a routine start date, this is when the routine interval is calculated from;
• a routine time, this is when the pull or merge request will be opened;
• and an option to set a routine as active or paused;

For example, if you want to schedule routine maintenance for a Wednesday every 2 weeks then you should set your frequency as 14 days and your start date as a Wednesday. You could name this “Every 2 weeks on a Wednesday”.

Use more than one routine

A team can own several routines when repositories need different review cadences. Assign the appropriate routine at repository level using the settings cog on the Repositories Page. Avoid creating a duplicate team for timing alone.

Choose a workable cadence

More frequent work is useful only when the team can review it. Consider:

• the number of repositories and artifacts the team owns;
• the speed and reliability of repository builds;
• the reviewers available for routine pull or merge requests; and
• the cost of batching many image changes into one infrequent update.

Frequent, smaller changes can be easier to test and diagnose. A cadence that creates pile ups of ignored requests does not improve the operating loop.

Set the remediation grace period

Under Settings → Organization → Defaults, set the number of days you have to act on an open remediation before its operational state changes. The default grace period is seven days.

The grace period is not a routine interval. The routine decides when work is prepared; the grace period describes how long that active work can remain open before it needs attention.

A repository will be in an Active health state during the grace period. If the team does not action the change during the grace period then the repository will move to a Critical health state.

Pause or update a routine

Pause a routine when the team should not receive scheduled work. Update its start date or frequency when the operating cadence changes.

Routines vs. Incidents

Routine remediation follows the assigned schedule. A Security Administrator or Owner can instead declare a security incident and cascade emergency changes to all impacted repos.

Using the security incident option queues immediate work and labels the provider request bimp-security-incident. It will not impact the next routine update.