bau: initial commit

[willp-bl]

Pair: WillPa

[annashipman]

I think this is a great idea.

However, I think maybe we should include the contributor code of conduct rather than linking to it as it may require some personalisation. For example, under 'enforcement' it says '[INSERT EMAIL ADDRESS]'.

[willp-bl]

Updated, but still need to add an email address/contact point

[davidillsley]

Maybe needs some language about the scoping of the Civil Service Code thing eg I don't think it's realistic or desirable to ask non-civil-servant/contracted contributors to be politically impartial outside of the alphagov org

[willp-bl]

@davidillsley I've added some scoping of the Civil Service Code

[davbo]

Still needs an email address under enforcement. I'm guessing that shouldn't be a large group of people, perhaps our heads of community ? @rboulton @rjw1 ?

[rboulton]

I think the heads of the tech community would be a suitable list; gds-tech-community-lead-members@digital.cabinet-office.gov.uk would be a suitable address to reach this set of people.

[rjw1]

Its that or the github owners list. 

[annashipman]

Can those lists receive emails from outside the digital.cabinet-office org?

[rjw1]

nope. but we could change that.

[annashipman]

I think GitHub owners might be the more suitable one for this, as this is for external contributors contacting us for code of conduct breaches, which may also involve other external contributors, and GitHub owners is the group with the power to block people etc (I think?)

But I don't feel strongly, either would be fine I think.

[timblair]

The wording of the imported code of conduct talks a lot about a "project": project maintainers, project team, project leadership etc. I don't think this works for our use case, where we're using it as standard for an organisation. The variety of terms (maintainers vs team vs leaders) is also confusing.

I'm also slightly concerned about our ability to actively enforce the CoC in the way stated:

Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.

Hopefully we'd never have to, but given that all maintainers (GitHub owners?) are likely to be GDS employees, it would be a line management thing, not just up to the other maintainers/leaders.

[willp-bl]

If we clarify that in the context of the code of conduct, "project" means alphagov/GDS that clears up most of the issues you describe. In that case "repercussions" could be dealt with by line management. "maintainers" could translate to tech leads/senior staff.

I would prefer for us to use a off the shelf code of conduct rather than re-inventing or modifying one. That code of conduct is used in quite a lot of places - https://www.contributor-covenant.org/adopters.html

[willp-bl]

@timblair I've added some context

[annashipman]

I think those changes work and I agree, better to use a recognised one wholesale than modify it.

We still need an email address. GitHub owners?

[maisiefernandes]

Use this email address disclosure@digital.cabinet-office.gov.uk

[timblair]

It seems that address is used for responsible disclosure of security issues within Verify's code. Is that right? That's the only reference I can find to it, anyway.

If so, that doesn't feel like the correct channel to be using for enforcement of this CoC. The use-cases are very different, as are the people who'd deal with such things (I'd imagine).

[rjw1]

How about we create alphagov-code-of-conduct@digital.cabinet-office.gov.uk and subscribe gds-github-owners to it.

[rjw1]

The mailing list now exists

[willp-bl]

I've added the email address, so this is looking like it is ready to go

[rjw1]

👍

[annashipman]

👍

[willp-bl]

Anyone want to press merge?

Also, I am considering not deleting this PR + comments when we make this public, any objections?

[annashipman]

I have no objections to leaving this PR & comments in place.