July 24th, 2023 Community Meeting community meeting

[qu1queee]

• Please add a topic in this thread and add a link to the GitHub issue associated with the topic.
• Please make sure you give folks enough time to review/discuss the topic offline on GitHub before coming into the meeting
• (optional) Paste the image of an animal 😸

[coreydaley]

Setup a few tools/integrations to make life easier:

• Setup shipwright-io/.github repository:
  • https://www.freecodecamp.org/news/how-to-use-the-dot-github-repository/
  • Example: https://github.com/gorilla/.github
• Setup workflows/verify.yaml to run: golangci-lint, gosec, govulncheck
• Setup snyk app
• Setup CodeQL scanning
• Setup regov.io app
• Setup Codecov app
• Setup GitHub project
  • Setup workflow to add new issues & pull requests to project automatically
  • Add existing issues and pull requests to project

[coreydaley]

• Discuss status of v1beta1 conversion functions and webhook

[coreydaley]

• We should all come up with pirate names to use when working on Shipwright

[qu1queee]

Meeting minutes:

• @coreydaley show us a little bit about the different Project Setup we can have to improve communication, overview and adoption. In addition , we should inline the new asks from the CD Foundation, on IP Policy(CLA/DCO). To consider OpenSSF best practices.
• @qu1queee to provide a summary on the above CD latest ask and to create a Project at the org level.
• To schedule a call on the state of the mutating webhook this week. @qu1queee to send invites.
• @apoorvajagtap would like to have a session on the ongoing e2e issues , see https://github.com/shipwright-io/build/issues/1326 .

[qu1queee]

Update per the latest information from CDF:

1. There was a discussion ongoing(TOC meeting) around if Project must adhere to some specific CDF Intellectual Property(IP) Policy. The conclusion is that the latest guidance from LF is to leave this to projects.
2. As a Project, we should revisit the following:
   • License: "All projects evaluated for inclusion in the CDF shall be completely licensed under an OSI-approved open source license. If the license for a project included in CNCF is not Apache License, Version 2.0, approval of the Governing Board shall be required." + Creative Commons for other content. (All good here for Shipwright)
   • CLA/DCO: We don't require DCO, see example. If we want CLA; then we should take a look first on what the LF offers. (.e.g. EasyCLA from the LFX tools)
   • Governance, we don't have a document on this. Some examples, https://www.jenkins.io/project/governance/ or https://github.com/tektoncd/community/blob/main/governance.md.