TSC Meeting (02 Nov 2021): Finalizing v3.6.0, Maintenance, Security Brainstorming

November 2021 @StackStorm/tsc 1 hour planned meeting: Tuesday, 02 Nov 2021, 09:30 AM US Pacific. See #33 for more info about how to join.

TSC Meeting Hosts: @m4dcoder & @amanda11

Meeting Agenda

Finalizing StackStorm `v3.6.0`

Project: https://github.com/orgs/StackStorm/projects/22
Roadmap: https://github.com/StackStorm/st2/milestone/44
Release Manager: @winem, Release Assistant: @guzzijones (per release rotation)
Release status, progress and what's left (@winem, @guzzijones both to provide their perspective)
Filling a CVE - who/when?
Blog Post Announcement
Any post-release tasks, technical debt?
- CircleCI queues issue: migrate more repos to GH Actions
- st2cicd upgrade: (TSC Senior Maintainers)
- anything else?

Forum -> Github Discussions migration - @cognifloyd @winem

Plan: #89
~make forum read-only~ - done
~create GH Discussions replacement~ - done
~archive forum to GH static pages to avoid losing SEO/traffic~ - done
create daily Slack notification st2 action for new Discussions, see https://stackstorm-community.slack.com/archives/CSBELJ78A/p1631028662011000 and pack: https://github.com/StackStorm/stackstorm-st2community/blob/master/actions/get_forum_posts.yaml for example
create a st2 rule to post every new Discussion to #community Slack (pack: https://github.com/StackStorm/stackstorm-st2community/)
announce the migration/new discussions platform: a blog post

Migrating StackStorm-Exchange from CircleCI to GH Actions - @cognifloyd

Discussion: https://github.com/StackStorm/discussions/issues/63
@cognifloyd to highlight the advantages, disadvantages, corner cases and why's

Stackstorm.com website migration to GH static pages - @nzlosh

Plan: #76
any update: research, difficulties, corner cases, blockers

Discussion: StackStorm Maintenance & Security

OpenSource security topics are on the rise! There are new foundations, lots of projects, recommendations and frameworks appearing in this area. This is a collective StackStorm TSC effort to discuss and improve the StackStorm Maintenance Security around Releases, Signing, Artifacts, Control, Supply chain, - all of it.

Plan: https://github.com/StackStorm/private-discussions/issues/5
New project: https://github.com/orgs/StackStorm/projects/25
Interactive task for the team:
- For every Issue in the project list discuss the item, its impact, implementation, pros/cons and re-order the Security improvements based on priority: low/high, then lower/higher in every column.
- Brainstorm adding new security improvements/tasks live and their impact
- TODO: Define tasks/assignments/owners to follow-up on the next TSC meeting to continue the discussion

A quick report from my side since the previous TSC Meeting:

PackageCloud partnership
- Blog, Communication, Negotiation.
- We're confirmed on 500GB traffic/200GB storage FOSS plan.
- Announcement: https://stackstorm.com/2021/10/11/stackstorm-welcomes-packagecloud-as-a-partner/
- https://twitter.com/StackStorm/status/1447568669421211650
- https://stackstorm.com/partners/
forum.stackstorm.com
- HTML archive generation is done.
- GH static pages to avoid losing any SEO traffic: https://github.com/StackStorm/forum.stackstorm.com/
- Testing domain: https://forum1.stackstorm.com/ ->
- Billing is now cancelled.
- TODO: switch forum. CNAME to GH static pages before 2021-11-21.
@stackstorm.com emails migration
- Personal email accounts (paid) were replaced with email forwarders (free) per https://github.com/StackStorm/discussions/issues/87
- One paid account left for administration/mgmt shared with senior maintainers
- Filled the G Suite balance for 1 year in advance
- avoid monthly bureaucracy expensing it
- reduce the bus factor relying on a single billing owner
- Future ideas to optimize the bus factor/email mgmt:
- https://lfx.linuxfoundation.org/tools/project-control-center
- https://blog.cloudflare.com/introducing-email-routing/ (free)
Updated the project Expenses: https://github.com/StackStorm/discussions/issues/36

StackStorm / community