search

cncf / toc

⚖️ The CNCF Technical Oversight Committee (TOC) is the technical governing body of the CNCF Foundation.
https://cncf.io
1.65k stars 628 forks source link

[SANDBOX PROJECT ONBOARDING] Open Policy Registry (OPCR) #976

Open amye opened 1 year ago

amye commented 1 year ago

Welcome to CNCF Project Onboarding! This is an issue created to help onboard your project into the CNCF after the TOC has voted to accept your project. We would like to complete onboarding within one month of acceptance.

From the project side, please ensure that you:

Things that CNCF will need from the project:

Things that the CNCF will do or help the project to do:

lukaszgryglicki commented 1 year ago

DevStats page added.

ogazitt commented 1 year ago

Welcome to CNCF Project Onboarding! This is an issue created to help onboard your project into the CNCF after the TOC has voted to accept your project. We would like to complete onboarding within one month of acceptance.

Thanks!

From the project side, please ensure that you:

OPCR is licensed under Apache-2: https://github.com/opcr-io/policy/blob/main/LICENSE

We have a slack - does it makes sense to create a new channel?

  • [x] Is your project in its own separate neutral github organization?

Yes - https://github.com/opcr-io

https://github.com/cncf/landscape/pull/2940

https://github.com/cncf/foundation/pull/489

Looks like this repo is now archived?

Things that CNCF will need from the project:

  • [x] Provide emails for the maintainers added to https://maintainers.cncf.io in order to get access to the maintainers mailing list and ServiceDesk
  • [x] Trademarks: transfer any trademark and logo mark assets over to the LF - https://github.com/cncf/foundation/tree/master/agreements has agreements
  • [x] GitHub: ensure 'thelinuxfoundation' and 'caniszczyk' are added as initial org owners, this helps us make sure we have continuity of GH ownership
  • [x] GitHub: ensure DCO or CLA are enabled for all GitHub repositories of the project
  • [x] GitHub: ensure that hat the CNCF Code of Conduct (or your adopted version of it) are explicitly referenced at the project's README on GitHub
  • [x] Website: ensure LF footer is there and website guidelines followed (if your project doesn't have a dedicated website, please adopt those guidelines to the README file of your project on GitHub).
  • [x] Website: Analytics transferred to projects@cncf.io
  • [x] CII: Start on a CII best practices badge https://bestpractices.coreinfrastructure.org/en

Things that the CNCF will do or help the project to do:

ogazitt commented 1 year ago

CII best practices: https://bestpractices.coreinfrastructure.org/en/projects/6859

Maintainers emails: gert@aserto.com, dani@aserto.com

amye commented 1 year ago

Invites are sent! I will pick back up on the rest of these.

amye commented 1 year ago

We have a slack - does it makes sense to create a new channel? We can help migrate that, you should have invites to Servicedesk now!

ogazitt commented 1 year ago

Hi @amye, Happy New Year!

We have more of these done :)

Projects like Open Policy Agent have their own slack, and newer sandbox projects like OpenFGA have a Discord - see discussion. We're not necessarily against creating a channel in the CNCF Slack, but it seems duplicative of the community slack we already have.

https://github.com/cncf/artwork/pull/395

We're ready to transfer openpolicycontainers.com. Are there any additional instructions on how to fill this out? What should we use for LF stakeholder email and community stakeholder email?

Our assumption is that once the transfer is complete, the site can still be hosted in Netlify (i.e. the transfer won't mess with the DNS settings / CNAME records that netlify requires).

Things that CNCF will need from the project:

Is there a source file (like a word or google doc) that we can modify, or do we need to buy Acrobat?

  • [x] GitHub: ensure 'thelinuxfoundation' and 'caniszczyk' are added as initial org owners, this helps us make sure we have continuity of GH ownership

done!

  • [x] GitHub: ensure DCO or CLA are enabled for all GitHub repositories of the project
  • [x] GitHub: ensure that hat the CNCF Code of Conduct (or your adopted version of it) are explicitly referenced at the project's README on GitHub
  • [x] Website: ensure LF footer is there and website guidelines followed (if your project doesn't have a dedicated website, please adopt those guidelines to the README file of your project on GitHub).

done!

done!

Things that the CNCF will do or help the project to do:

amye commented 1 year ago

"Projects like Open Policy Agent have their own slack, and newer sandbox projects like OpenFGA have a Discord - https://github.com/cncf/toc/issues/921#issuecomment-1311901202. We're not necessarily against creating a channel in the CNCF Slack, but it seems duplicative of the community slack we already have." CNCF + Kubernetes are the funded slack instances.

"We're ready to transfer openpolicycontainers.com. Are there any additional instructions on how to fill this out? What should we use for LF stakeholder email and community stakeholder email?" You're the community stakeholder, you can use projects@cncf.io for the LF stakeholder email (it's more than just me!)

ogazitt commented 1 year ago

"Projects like Open Policy Agent have their own slack, and newer sandbox projects like OpenFGA have a Discord - #921 (comment). We're not necessarily against creating a channel in the CNCF Slack, but it seems duplicative of the community slack we already have."

CNCF + Kubernetes are the funded slack instances.

We're not seeking funding the current slack instance. So let's leave it as-is and create a channel in the CNCF slack later if necessary?

"We're ready to transfer openpolicycontainers.com. Are there any additional instructions on how to fill this out? What should we use for LF stakeholder email and community stakeholder email?"

You're the community stakeholder, you can use projects@cncf.io for the LF stakeholder email (it's more than just me!)

Awesome - thanks!

ogazitt commented 1 year ago

@amye I'm not sure I received the invitation to the Service Desk... perhaps because I wasn't one of the maintainers I initially added to the list. I just updated the maintainers here: https://github.com/cncf/foundation/pull/495

ogazitt commented 1 year ago

Artwork is merged: https://github.com/cncf/artwork/pull/395

ogazitt commented 1 year ago

[x] Trademarks: transfer any trademark and logo mark assets over to the LF - https://github.com/cncf/foundation/tree/master/agreements has agreements

@amye I just created a version of this for Open Policy Containers and docusigned it over to projects@cncf.io.

amye commented 1 year ago

[x] Trademarks: transfer any trademark and logo mark assets over to the LF - https://github.com/cncf/foundation/tree/master/agreements has agreements

@amye I just created a version of this for Open Policy Containers and docusigned it over to projects@cncf.io.

Ah, better to send a PDF and we'll return a fully executed copy to you.

ogazitt commented 1 year ago

[x] Trademarks: transfer any trademark and logo mark assets over to the LF - https://github.com/cncf/foundation/tree/master/agreements has agreements @amye I just created a version of this for Open Policy Containers and docusigned it over to projects@cncf.io.

Ah, better to send a PDF and we'll return a fully executed copy to you.

Thanks @amye, I just emailed it to projects@cncf.io. Thanks!

amye commented 9 months ago

Checking in here: "We're not seeking funding the current slack instance. So let's leave it as-is and create a channel in the CNCF slack later if necessary?" You should migrate to CNCF to let the community come ask questions!

amye commented 9 months ago

@ogazitt -- I'm looking through projects@cncf.io and there isn't a OCPR trademark agreement in there, so let's do this. Send a PDF to project-onboarding@cncf.io and I'll get it docusigned internally. Thanks!

Cmierly commented 8 months ago

Hi @ogazitt ! My name is Crystal and I am the new project coordinator in charge of onboarding sandbox projects!

I can now confirm we have your trademark agreement so I went ahead and checked that task off. There are only two tasks that need completing:

Slack: Are your slack channels migrated to the Kubernetes or CNCF Slack? (see https://slack.com/help/articles/217872578-Import-data-from-one-Slack-workspace-to-another for more details) and Adopt a license scanning tool, like FOSSA or Snyk

the third open task will be handled on our end. Please keep an eye out for more information regarding LFX Insights!

krook commented 8 months ago

the third open task will be handled on our end. Please keep an eye out for more information regarding LFX Insights!

LFX Insights provides projects with more visibility into their community dynamics around contributors, organizations, issues, and pull request metrics. It v3 uses crowd.dev under the hood to gather data about certain repositories in a GitHub organization.

The way it does this is through an app installed (similar to the DCO bot) at the organization level. This is then connected to one or more public repos under the organization. You can see technical details here.

The LFX team will install it on behalf of your project using the Linux Foundation id GitHub id you granted access to earlier, so no action is needed on the project maintainer side. Once your project is onboarded, you'll see data flowing into the dashboards at the LFX Insights v3 site.

ogazitt commented 8 months ago

Adopt a license scanning tool, like FOSSA or Snyk

Can you enable Snyk on the repos in opcr-io, or is this something we should handle? I believe you have a free plan that may be good to utilize?

krook commented 8 months ago

@ogazitt can you please double check that thelinuxfoundation is set as an Owner of the https://github.com/opcr-io organization?

ogazitt commented 8 months ago

@caniszczyk is an owner, and I believe he was going to add thelinuxfoundation. I believe it's part of the CNCF Enterprise organization.

krook commented 8 months ago

Thanks @ogazitt. It is indeed part of the CNCF org, so that's good. But we will still need the org owner bit on the thelinuxfoundation id if you could please apply that.

ogazitt commented 8 months ago

Thanks @ogazitt. It is indeed part of the CNCF org, so that's good. But we will still need the org owner bit on the thelinuxfoundation id if you could please apply that.

We had invited that ID in the past, but the invitation expired. I just invited thelinuxfoundation again - hopefully you can see it!

Cmierly commented 6 months ago

Adopt a license scanning tool, like FOSSA or Snyk

Can you enable Snyk on the repos in opcr-io, or is this something we should handle? I believe you have a free plan that may be good to utilize?

Hi @ogazitt ! Did you still need help getting this completed?

ogazitt commented 6 months ago

Adopt a license scanning tool, like FOSSA or Snyk

Can you enable Snyk on the repos in opcr-io, or is this something we should handle? I believe you have a free plan that may be good to utilize?

Hi @ogazitt ! Did you still need help getting this completed?

Yes, would love to get help setting up Snyk on the repo.

Cmierly commented 6 months ago

Alrighty! @RobertKielty do you think you could jump in and help get them going?

krook commented 5 months ago

Bump @RobertKielty

ogazitt commented 5 months ago

@RobertKielty is there anything you need from us to enable this?

krook commented 1 month ago

@RobertKielty is this one set up for license scanning? Can we mark that complete? It's the last onboarding step, assuming the dangling Slack question is resolved...

RobertKielty commented 1 month ago

I have sent out invites to the maintainers for both FOSSA and Snyk.

@ogazitt Let me know if you have a preference for either service. (you can choose either or both!)

If you want to go with FOSSA please let me know.

For FOSSA, I have to add you to the team opcr team that I created there as the invite is not tied to the team. Once I have done that an invited maintainer can add project repos there so that they are scanned for compliance with the CNCF License policy.

For Snyk, you can just go ahead and add your code repos for scanning.