Closed t-persson closed 9 months ago
Reflect on what security settings to have for dormant repos. See https://github.com/organizations/eiffel-community/settings/security_analysis
"Eiffel Store" should be set to dormant once that status exists, according to discussions with the creator of Eiffel Store (Azeem) in Aug 2023. We should keep Eiffel VICI for now and try to get it in shape so we have some visualization to use.
Closing this since we don't intend to add the dormant state anymore. Instead we will use the built-in archived state in GitHub.
Description
We should add a stage for dormant repositories where there have been no real activity and no maintainers for a while. Related to: eiffel-community/eiffel-jira-plugin#36
We might also want to keep projects in the dormant stage for a while and if they do not become maintained during a time period, they could be put into either "Deprecated" or "End of Life" (which would be two new stages that could be added in the future). This could give users an incentive to take over maintainership of a tool. This idea is taken from here: https://github.com/hyperledger/toc/blob/gh-pages/project-lifecycle.md
Motivation
It's bad marketing and it increases the workload of the TC when there are repositories with no maintainers and since PRs are not merged there are high security risks involved with using these tools which reflects poorly on the Eiffel community as a whole.
Exemplification
Someone uses a tool created by the Eiffel community. They find a bug or that tool is vulnerable. A PR can be created but it will never get merged. Frustration ensues.
Benefits
All tools that we "advertise" on github are maintained and up to date with security fixes.
Possible Drawbacks
Our portfolio will decrease, but a portfolio of bug-ridden tools is worse than not having them at all.