[Fanout Tracking] artifact-attestations-helm-charts - FY26Q2 Data Catalog Onboarding Metadata Review and Attestation

[fanout-bot-app]

Fanout Effort

https://github.com/github/fanout/issues/2873

🚦 Status

Field	Value
Trending
Company Priority	P1

🧳 Accountability

Field	Value
Exec Sponsor	aaroncathcart
DRI
Product Area

📅 Key Dates

Field	Value
Start Date	2025-11-03
Target Date	💪 Let’s aim to wrap by December 12 — ahead of peak winter holidays! 💀 2025-12-31 (drop-dead date)
Last Report Date	2025-12-31

🏔 Fanout Summary

This service issue tracks Data Catalog onboarding and classification for your service as part of the FY26Q2 Data Catalog rollout.

A pre-filled Databank PR will be linked here once generated. The YAML in that PR has been prepared from prior metadata inventories and requires your team’s review and attestation. If this service does not have prior metadata, a YAML will need to be created manually in Databank using the Onboarding Guide.

The goal of this work is to ensure your service has accurate, complete metadata in the Data Catalog that meets GitHub’s data governance requirements.

📈 Overview of the Requested Work

Teams will complete onboarding in three steps:

1. Review the PR for metadata accuracy

   • Open the pre-filled Databank YAML PR linked to this issue.
   • Review required fields for accuracy and completeness (name, owners, type, retention_period, service_names, domain, proxima_deployed, and fields with id, name and type).
   • Confirm ownership, retention, and compliance details are correct.
   • Tag @privacy-engineers in the PR once metadata is complete and ready for auto-classification.

2. Privacy Engineering auto-classification

   • Privacy Engineering will run auto-classification, verifying tagging and metadata completeness.
   • Once complete, your team will receive a PR update or notification.

3. Final review and attestation

   • Review the PR again after auto-classification is applied.
   • Confirm all personal or customer data fields are correctly tagged.
   • Fill in the existing attestation block to confirm final accuracy:

     attestation:
       attestation_date: YYYY-MM-DD
       attestor_handle: @github-username

   • Merge the PR after Privacy Engineering approval.

🚦 Success Target

Successful completion means the service’s Databank PR is reviewed, attested, and merged with no outstanding gaps or untagged personal data.

• YAML PR reviewed and validated by the service’s DRI.
• All required fields and classifications are complete and accurate.
• Privacy Engineering review completed and PR merged.

📝 Supporting Materials

• Data Catalog Onboarding Guidance
• Databank repo
• DG Wiki – Framework
• Engineering discussion: Shaping DG

Slack Support Channels:

• #data-catalog-onboarding-fy26q2: Support hub for Data Catalog onboarding (Databank + classification). Ask here for help with YAML validation, tagging personal data, or onboarding blockers.
• #privacy-engineering: Technical support and feedback related to onboarding services to Databank
• #data-governance: Program-wide updates, support, and coordination
• #privacy: General privacy questions and guidance

✔️ Tasks

• Review the pre-filled Databank YAML PR (or create one if none exists).
• Validate all required fields for accuracy and completeness.
• Tag @privacy-engineers in the PR once metadata is ready for auto-classification.
• Wait for Privacy Engineering to complete auto-classification and notify your team.
• Review the PR again after classification to confirm all personal or customer data fields are correctly tagged.
• Fill in the attestation block with date and handle to confirm final accuracy.
• Merge the PR after Privacy Engineering approval.
• Confirm metadata appears correctly in Databank and the Data Catalog.
• Close this issue once the PR is merged and validation is complete.