Review project scanning results

[maoo]

Using the code on https://github.com/robmoffat/landscape-scanning , we are now able to generate a CSV report like this : https://github.com/robmoffat/landscape-scanning/blob/main/scan.csv

A few notes:

• There's more data than required, below the mapping between TOC report and scan results
• Scanning takes in consideration 6 months as timeframe, as opposed to 3 ; this can be easily tweaked and configured
• "Commit Activity" maps well with "Number of code changes"
• "Issue Activity" in the CSV can help understanding "Average response time to inquiries", though it's not a 1:1 mapping; in the future we can parse comment timestamps to understand response time.
• "CII Best Practices badge" maps 1:1 with "OpenSSF Status" (who's label should rather be "OpenSSF CII Best Practices Status")
• "Documentation" maps 1:1 with "Length of Readme"
• "SBOM Report" is still missing, given that none of our hosted projects is currently generating SBOM files; worth noticing that Github introduced https://github.blog/2023-03-28-introducing-self-service-sboms/ , but after some initial simple tests, we've noticed that dependencies were missing, so we didn't bother investigating further. We're working on a pilot of Sonatype Lifecycle, which could be promising. If and when we have a mechanism to generate SBOM files, next would be to build a convention (e.g. adding a badge into the readme with label xyz)

Questions for the TOC:

• Can you use the information as is to build a project report and deliver it to the board ? Note that the focus should be around "opportunities for projects to be either activated or archived" (as per TOC responsibilities)
• What other metrics currently available in the attached scan (e.g. number of contributors) should we take in consideration ?
• What changes/improvements/enhancements would you suggest to drive future developments of the landscape-scanning project?

Kudos to @robmoffat for building the code!

[psmulovics]

I like where we are at now with this; I think we should be able to start working with it.

[psmulovics]

@maoo, so what should be the format we want to get from this? Slides? Excel?

[maoo]

I think that https://github.com/robmoffat/landscape-scanning/blob/main/scan.csv could be used for:

1. Identifying opportunities for archiving or activating projects
2. Building the TOC report for the Board

On item 2, I could use some help, as I'm building the TOC report slides for the next Board meeting (June 27) as we speak.

[maoo]

@finos/toc - quick update on this; I followed up on this internally, both with the FINOS and LFX team, and we believe that we should make some consistent change in this approach:

• The project-analysis , although it can be useful for checks and validations (which is something we cover internally at FINOS across all our projects) cannot possibly reach the level of complexity needed to build meaningful metrics that determine the health of a codebase
• Project health metrics is the main focus of LFX Insights, which - although still working on challenges like contributors affiliations - already provides a lot (if not most) of the metrics needed to track health (see below)

I still believe that the TOC should be able to report on FINOS project health back to board, and that the FINOS team should help aggregating metrics that the TOC can consume/visualize, so I'm going to create a new issue where I'm going to aggregate a new CSV file with new metrics pulled (for now manually) from LFX Insights.