doc: update GitHub Org Management Policy to reflect actual practice #456

Trott · 2017-12-27T20:41:27Z

There are several aspects of the GitHub org management policy that are
not followed in practice and may be unworkable. This change tries to
move the document closer to actual practice.

@nodejs/moderation @nodejs/community-committee @nodejs/tsc

Note that the intention here isn't to say that we can't or shouldn't do the things that are in the policy currently, but since we don't and since it's clear from nodejs/admin#33 that we aren't going to do so imminently, let's update the policy to be more accurate, and then discuss any changes that people want.

I know this will be disappointing and frustrating to many people, but I also think it's better to have an accurate document for us to discuss than to have it be de facto acceptable that we simply ignore this document.

addaleax

Generally 👍 to this, thank you for picking it up!

addaleax · 2017-12-27T20:43:19Z

GitHub-Org-Management-Policy.md

-
-Upon the completion of the terms of service for each of these individuals,
-their Owner permissions within the GitHub organization shall be removed.
+The TSC Director shall be the only individuals granted Owner permissions within


s/TSC Director/TSC members/ (for current practice) or s/individuals/individual/?

oh, i wasn't sure whether this actually only meant TSC director, if it means the TSC members then my review is redundant

Fixed, thanks.

addaleax · 2017-12-27T20:44:28Z

GitHub-Org-Management-Policy.md

-TSC oversight.
-
-Repositories that are under the operational direction of the Community Committee
-are subject to CommComm oversight.


It’s not quite obvious to me why this is being removed … because we don’t currently follow it?

Sort of. Also, it's redundant (or maybe just has some nuance I'm missing?). It basically can be paraphrased as: "Repositories that are under CommComm oversight are subject to CommComm oversight." Like, I read that, and other than including CommComm, I'm not sure why it's even there.

I agree its bad to have a doc that does not reflect reality but I think instead of removing references to the Community Committee having oversight as the interim solution, we should be making the CommComm chairs owners in addition to all TSE members. I don't think its our final state but I think its a more acceptable interim state than simply removing any CommComm onership.

@mhdawson If you would like to add a commit to make that change, feel free. We will need everyone who has approved to re-approve, I think (or remove their approval if they don't approve). My intention had been to open a PR to that effect immediately after this lands, but if you think it's better to do that now, I'm certainly OK with seeing what everyone thinks about that.

ghost · 2017-12-27T20:44:12Z

GitHub-Org-Management-Policy.md

-
-Upon the completion of the terms of service for each of these individuals,
-their Owner permissions within the GitHub organization shall be removed.
+The TSC Director shall be the only individuals granted Owner permissions within


individuals should be singular

Thanks. I removed Director. (Missed it the first time.) Should say: The TSC shall be the only individuals granted Owner permissions....

(Note that I'm not saying this is the way it should be but it is the way it is and there's at least some resistance to changing it based on conversation in nodejs/admin#33.)

rvagg · 2018-01-02T01:17:01Z

I'm not a fan of this doc in general but this is an improvement so +1 from me

mcollina

LGTM with some nits

mcollina · 2018-01-02T07:17:11Z

GitHub-Org-Management-Policy.md

-
-Upon the completion of the terms of service for each of these individuals,
-their Owner permissions within the GitHub organization shall be removed.
+The TSC shall be the only individuals granted Owner permissions within the


I think it should be “The TSC members”.

Thanks, fixed.

mcollina · 2018-01-02T07:18:25Z

GitHub-Org-Management-Policy.md

-No repository may be deleted, transferred in to, or transferred out of, the
-Node.js Foundation GitHub Organization without a simple majority of both
-the TSC and CommComm in *favor* of the action. In certain cases, Node.js
-Foundation Board of Directors approval may also be required.


I think this paragraph is still needed, without the CommComm reference.

Reinstated. Thanks.

mhdawson · 2018-01-02T21:50:08Z

Pushed commit with my suggested changes after discussing with @Trott .

@mcollina @fhinkel @cjihrig can you re-review as my commit changes enough to warrant you reviewing again and either confirming you are ok with it or revoking your ok.

mhdawson

LGTM

mhdawson · 2018-01-02T21:51:20Z

@rvagg see you had +1 instead of approval with button so FYI to you to re-review as well.

Trott · 2018-01-02T21:51:43Z

GitHub-Org-Management-Policy.md

-
-Upon the completion of the terms of service for each of these individuals,
-their Owner permissions within the GitHub organization shall be removed.
+TSC members and the Chair of the Community Comittee are the only individuals granted


Committee is misspelled here.

(Actually, never mind, I'll correct the spelling. No need to make someone else do it when I can just use GitHub's edit feature and be done with it.)

cjihrig · 2018-01-02T22:20:05Z

I'm still OK with this after @mhdawson's commit.

ghost · 2018-01-02T22:37:40Z

GitHub-Org-Management-Policy.md

+
+### Owners
+
+TSC members and the Chair of the Community Committee are the only individuals granted


there can be multiple chairs of the commcomm

Agreed, I thought that was a detail we could leave out with the the assumption it would include chairs in the exception case (which of course is what we have now).

that works!

joyeecheung · 2018-01-04T08:15:05Z

GitHub-Org-Management-Policy.md

+The [Node.js admin repository](https://github.com/nodejs/admin) will serve as
+the central location for managing Node.js GitHub Organization administrative
+activities. Only Node.js GitHub Organization owners, TSC members, and Community
+Committee members will have write permissions to the Node.js admin repository.


s/will have/have/?

joyeecheung · 2018-01-04T08:15:59Z

GitHub-Org-Management-Policy.md

+### Members
+
+GitHub users are added as members to the Node.js GitHub Organization when they
+are added to any Working Group. Organization Owners should add new members


At the moment we also add users when they are added to a team (not necessarily belong to any charted WG), so maybe ...to any Working Groups or teams.?

joyeecheung · 2018-01-04T08:16:23Z

GitHub-Org-Management-Policy.md

+
+GitHub users are added as members to the Node.js GitHub Organization when they
+are added to any Working Group. Organization Owners should add new members
+to the organization when requested by a Working Group.


...by a Working Group or a team.

Also it may be worth mentioning the owner should suggest new members to follow https://github.com/nodejs/admin/blob/master/CODE_OF_CONDUCT.md and enable 2FA prior to adding them to the organization. I believe we usually do that when adding people.

joyeecheung · 2018-01-04T08:18:35Z

GitHub-Org-Management-Policy.md

+
+No repository may be deleted, transferred in to, or transferred out of the
+Node.js Foundation GitHub Organization without a simple majority of both the
+TSC and CommCom in favor of the action. In certain cases, Node.js Foundation


s/CommCom/CommComm

joyeecheung · 2018-01-04T08:19:37Z

GitHub-Org-Management-Policy.md

+
+## Repositories
+
+Any organization member may request the creation of a new repository within the


Maybe moving how to do this to the first sentence to increase visibility, e.g. ...by opening an issue in the Node.js admin repository.?

joyeecheung · 2018-01-04T08:29:57Z

GitHub-Org-Management-Policy.md

+be approved by the TSC and CommComm and are subject to regular security audits.
+Bots that perform actions on behalf of the project (such as moderation or membership
+management actions) are required to maintain a log, accessible to all individuals
+granted Owner permissions, of all actions taken.


In the current practice, only people who have added their public keys to the related directory in the secrets repo have access. I would consider documenting this as .. required to maintain a log of all actions taken. The secrets and the logs of the bots and the services are accessible to individuals granted permissions in the nodejs/secrets repo.

Also it might be worth mentioning https://github.com/nodejs/automation/blob/master/enable-travis-under-nodejs.md here, maybe something like See [this document][] on how to migrate Travis integration of a repository transferred into the Node.js organization.

I'm not sure I'll get this right. Maybe you or someone else can propose this particular change subsequently? (Or add a squash commit to this PR if you prefer?)

@Trott Sure, I can open a subsequent PR for this.

joyeecheung · 2018-01-04T08:35:42Z

GitHub-Org-Management-Policy.md

+a project under the ownership of the Node.js Foundation, and thereby subject
+to the Intellectual Property and Governance policies of the Foundation.
+
+No repository may be deleted, transferred in to, or transferred out of the


s/in to/into/

bnb · 2018-01-08T17:34:40Z

@Trott Could you please add cc-agenda label to this issue? 🙏

Trott · 2018-01-10T22:36:12Z

Per TSC meeting discussion, this is ready to land but we're going to leave it open for another 48 hours or so. If anyone has objections, now is the time to say so.

ghost · 2018-01-10T22:39:25Z

@Trott let's wait until after tomorrow's CC meeting

ghost · 2018-01-11T17:32:01Z

nobody from the commcomm objected to this, so i'd say it's ready to land @Trott

hackygolucky · 2018-01-11T17:33:18Z

I'm +1 to shipping this from the CommComm and Moderation team side if we can immediately start working on a doc that enables both groups to do the work they need to do by getting appropriate permissions to the org. I understand the need for accurate reflection of the-world-as-it-exists.

We've had this discussion about org ownership and how it needs to evolve in multiple issues, PRs, and in TSC/CommComm meetings over the last year, with little movement.

I think we need a coordinated discussion with both TSC, CommComm, and Moderation members to make sure we've documented the needs so that we can expedite this instead of running in conversation circles and finding folks not able to do their work. For ex: a bot is suggested most times these convos come up, but there's work required for that to happen and no one with bandwidth to do that work, which makes it a great future solution but not feasible right now or in the near term.

Also something brought up in CommComm convo: Board member access as org owners. As far as I'm aware, the Board, as representatives of the fiduciary responsibility of the Foundation, have full access to all properties of the Foundation, including the project. Meaning, I don't think the Board directors necessarily need/want(you'd want to ask them) org owner responsibilities, but legally can see anything in the project including private repos if they were to request it. They are held to a high legal standard for privacy and protecting the Node.js Foundation entity as directors, so them abusing that access is something they would get in big trouble for if it were to occur(so it puts the fear into them to not want to).

There are several aspects of the GitHub org management policy that are not followed in practice and may be unworkable. This change tries to move the document closer to actual practice.

Trott · 2018-01-11T22:14:14Z

Now that this has landed, it is official policy that CommComm chairs have owner permissions, so I'm going to add them. (When is the next election for CommComm chair?)

ghost · 2018-01-11T23:05:40Z

@Trott september 2018

ghost · 2018-01-11T23:07:02Z

@hackygolucky do you want to create an issue that tries to pull all of the future and past discussion about this together?

Trott mentioned this pull request Dec 27, 2017

GitHub Owner permissions nodejs/admin#33

Closed

addaleax reviewed Dec 27, 2017

View reviewed changes

ghost reviewed Dec 27, 2017

View reviewed changes

cjihrig approved these changes Dec 27, 2017

View reviewed changes

Trott added the tsc-review label Jan 2, 2018

Trott mentioned this pull request Jan 2, 2018

Node.js Foundation Technical Steering Committee (TSC) Meeting 2018-01-03 #458

Closed

fhinkel approved these changes Jan 2, 2018

View reviewed changes

mcollina approved these changes Jan 2, 2018

View reviewed changes

mhdawson approved these changes Jan 2, 2018

View reviewed changes

Trott commented Jan 2, 2018

View reviewed changes

ghost reviewed Jan 2, 2018

View reviewed changes

ghost approved these changes Jan 2, 2018

View reviewed changes

rvagg approved these changes Jan 4, 2018

View reviewed changes

joyeecheung reviewed Jan 4, 2018

View reviewed changes

targos added the cc-agenda label Jan 8, 2018

mhdawson mentioned this pull request Jan 8, 2018

Node.js Foundation Technical Steering Committee (TSC) Meeting 2018-01-10 #465

Closed

Trott removed the tsc-review label Jan 10, 2018

bnb mentioned this pull request Jan 11, 2018

Node.js Foundation Community Committee (CommComm) Meeting 2018-01-11 nodejs/community-committee#213

Closed

Trott added 3 commits January 11, 2018 14:12

doc: update GitHub Org Management Policy to reflect actual practice

f107111

There are several aspects of the GitHub org management policy that are not followed in practice and may be unworkable. This change tries to move the document closer to actual practice.

squash

ddcc438

squash

ab35937

Trott and others added 9 commits January 11, 2018 14:12

squash

cb39d4a

squash: update as per my suggestion

0525cd1

Update GitHub-Org-Management-Policy.md

be45375

Update GitHub-Org-Management-Policy.md

aa32008

squash

e8f3c52

squash: remove aspirational tense

3c7914a

squash: team

1c0ab31

squash: team

7dbea95

squash

017771f

Trott force-pushed the GitHub branch from e0dcdc0 to 017771f Compare January 11, 2018 22:12

Trott merged commit 10bdd31 into nodejs:master Jan 11, 2018

bnb removed the cc-agenda label Feb 16, 2018

Trott deleted the GitHub branch March 11, 2021 14:35


		### Owners

		TSC members and the Chair of the Community Committee are the only individuals granted


		## Repositories

		Any organization member may request the creation of a new repository within the

doc: update GitHub Org Management Policy to reflect actual practice #456

doc: update GitHub Org Management Policy to reflect actual practice #456

Conversation

Trott commented Dec 27, 2017

addaleax left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Trott Dec 27, 2017 • edited Loading

Choose a reason for hiding this comment

rvagg commented Jan 2, 2018

mcollina left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mhdawson commented Jan 2, 2018

mhdawson left a comment

Choose a reason for hiding this comment

mhdawson commented Jan 2, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cjihrig commented Jan 2, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

joyeecheung Jan 4, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

joyeecheung Jan 4, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bnb commented Jan 8, 2018

Trott commented Jan 10, 2018

ghost commented Jan 10, 2018

ghost commented Jan 11, 2018

hackygolucky commented Jan 11, 2018 • edited Loading

Trott commented Jan 11, 2018

ghost commented Jan 11, 2018 • edited by ghost Loading

ghost commented Jan 11, 2018

Trott Dec 27, 2017 •

edited

Loading

joyeecheung Jan 4, 2018 •

edited

Loading

joyeecheung Jan 4, 2018 •

edited

Loading

hackygolucky commented Jan 11, 2018 •

edited

Loading

ghost commented Jan 11, 2018 •

edited by ghost

Loading