Notes from 11/30/20 Meeting

[mateoclarke]

Attendees:

• @mateoclarke
• @amenity
• @johnclary
• @chiaberry
• @sergiogcx

Notes:

• discussion of process for certifying admins
• putting some structure around Github, organization and ownership
• ⭐ reigning in the number of owner in the Github org, global access to delete or modify any repo
  • we need to figure out stakeholder work groups (departments, divisions, etc)
• ppl in CTM who aren't in ODD are all owners
  • how active they are?
• Establishing a naming convention, ex: atd-...
• We don't know who to ask to close or archive a repo
• we need structure in place around owners
• List of minimum things know to create a repo
  • README with department
  • flag unaccounted for repos
  • communicate a timeline to start archiving
  • should we establish a timeframe?, for example if there hasn't been a commit in 3 years
    • ex: police forms
• Comparing gh owner accounts to active directory list of CoA employees
• Potential for a Github + Active Directory integration, both MSFT owned projects
• Is the current subscription with CTM the best deal for our usage?
• Who manages Github at CTM?
  • Maybe Sally C, interim mgr web app team?
  • [ ] @chiaberry to ask Sally about github vs enterprise use.
• Concern: could CTM start to block our progress
• are there record retentions policies to consider before we archive or delete inactive projects?
  • we should at least download and file before pulling it offline
• [x] ⭐ create a governance repo - @mateoclarke
• ⭐ Google Sheets, notes about users. Get a list of users via Github API
• [x] ⭐ create Github governance Slack channel @mateoclarke
• ⭐ do some research about other city gh org mgmt
• code of conduct
  • avoid unilateral decision making when it comes to tricky situations or revoking access
• thinking of GISOB (operating board) as model for GH
  • every dept has designee, spoc
  • bylaws
  • meet monthly or bi-monthly
  • identify the right ppl
• implement bots, automated msg, identify stale repos
  • how many admins/owners per repos?
  • send msg or email, contact the owner
  • could find dispreancies in AD and github
  • generated reports using GIthub API
• enforcing use of .gov emails
  • what about contractors?
• Looping in CISO at some point?

[amenity]

Thanks, y'all. 🙏 A couple additional thoughts:

• If turning CoA's old-school on-prem enterprise account into a Active-Directory-connected Github Cloud account is in the cards, it might make sense to do these sooner rather than later

  • Help move that negotiation along, or at least stay on top of the timeline
  • Learn which problems it will solve for us — and whether it will present any new ones ... @chiaberry - I'll forward you the last email thread with Tanner (Github sales rep) Sally, Divya, et al. I could swear there was a presentation deck at some point...

• It would be good to document the permissions different apps (Zenhub and Gitbook are top of mind) require and best practice for granting access to those are. In addition to ATD, ODD and Innovation use these tools.