search

openedx / public-engineering

General public issue repository for the Open edX engineering community
3 stars 1 forks source link

Repo Check: No Outside Collaborators #169

Open feanil opened 1 year ago

feanil commented 1 year ago

As an organization we don't want to have Outside Collaborators on repos. Write a new check that ensures that no repos have outside collaborators.

sarina commented 1 year ago

BTR ticket management

Made a triage team for the BTR & Community WG repos (they can go hand in hand): https://github.com/orgs/openedx/teams/btr-triage/repositories

Added:

Removed:

Questions about write access

@gabew1984 you are listed as an outside collaborator on Paragon repo. Are you still at 2U?

@ali-hugo you have write access (added in an incorrect way) to Paragon and modular-learning. I was unaware you were considered a coding Core Contributor. Is this accurate? Are you contributing code to these repos? I'm removing you for now but we can add back.

@GlugovGrGlib do you need Triage access to credentials still?

Revoking non-contractual write access

The following people are granted write access to repositories in the openedx GitHub organization, and they are not Core Contributors or 2U employees. I have removed their access and they should comment if they believe that's incorrect.

Paragon repo

edx-developer-docs

tutor-contrib-multi repo

openedx-wordpress-site

@feanil : the only one left is the edx-status-bot which only has write access to the Android repo. I'd like to figure out if we need to use a seat for one bot for one repo; they should be using Actions if possible.

mdbc-tech commented 1 year ago

Thanks Sarina I was hoping that would get done sooner or later and thank you for removing me

I do keep up with things but no longer have the spare bandwidth to participate. Maybe someday I will have time again, I much prefer edx to my day job.

It was fun meeting you and the rest of the team and I learned a lot about seeing how a large distributed project works. I wish you happy holidays and all the best.

Dennis Bates

adamstankiewicz commented 1 year ago

@feanil @sarina I can speak to the following users in the Paragon repository:

IIRC I also had initially tried to add them to the @openedx/paragon-working-group Github team.

I'm definitely open to suggestions on how we can ensure 2U designers, UX Core Contributors, and Blended Development engineers who frequently contribute code and/or manage the Github issues / project board for Paragon will keep their access 😄

sarina commented 1 year ago

@adamstankiewicz ah. You should not be directly managing any membership. For adding or removing GH access, please create tickets at https://github.com/openedx/tcril-engineering/issues/new/choose for tcril's team to handle. The issue here was they were added as outside collaborators, which we are not using anymore. If you can make some tickets at the link I shared (ideally one per person), we will add them to the openedx GitHub organization with permissions we can reason about (ie, in groups that make sense).

adamstankiewicz commented 1 year ago

@sarina Sounds good! I'll try to get those tickets filed tomorrow (one per person). I opted for the path of least resistance to grant them access here 😉

sarina commented 1 year ago

Ah, one thing I meant to say. Only Core Contributors or 2U employees can have write access to a repo. Peter, Viktor, and Vlad are not a Core Contributor so therefore cannot have write access (this is a legal matter). You will need to manage their pull requests as you do for any community core contributor. Or, they need to become Core Contributors, if write access is something that's absolutely critical to their work.

adamstankiewicz commented 1 year ago

@sarina Noted. The issue is not so much around their pull requests but more so around the management of the Github issues and project board (e.g., associating PRs to Github issues for the board automation, etc.). I'm assuming "Triage" access gets them that? We have been doing the typical PR process for things merging to master.

The "Write" access is helpful for them to self-serve manage any pre-releases for Paragon. If it takes them becoming Core Contributors to keep that, I will run it by them to get their thoughts. If they have questions around what it means to be a Core Contributor more specifically, what might be the best documentation for them to learn more?

sarina commented 1 year ago

Triage access is very grantable to everyone, just note that in the ticket. Actually if you're requesting triage access to the same repo(s) for the same people, you can just make one ticket for that.

Raccoon Gang should be familiar with the Core Contributor program, Igor is a member. I'd suggest they talk with him and their bosses, because becoming a core contributor requires a level of commitment that I would assume they can't commit to on their own (currently, around 20h/month to the core project)

georgebabey commented 1 year ago

It is critical that RG can help manage the Paragon project board, which unfortunately "Triage" access does not provide.

@sarina Can we restore RGs access until we can work through the process. The immediate revocation of their access without a heads up to remediate has resulted in additional project board management for 2U, at a time when we're all about to go on break.

2U contributes significantly to the development of Paragon, both in house and through the BD-46 project.

I am also unclear what is meant by "because becoming a core contributor requires a level of commitment that I would assume they can't commit to on their own (currently, around 20h/month to the core project)". Are you implying Paragon is not part of the "core project" or that they are not contributing 20h/mo?