Creating a Bot Policy Document

[bnb]

Per some discussion in yesterday's CommComm meeting, we'd be interested to know if there's an official and finalized org bot policy? Specifically

This question was brought up in reference to this issue in the Build repo and getting an update on the Bot policy, as @williamkapke noted that the Build WG was the only other hold-out for the bot he'd worked on.

If not, I'd like to propose that we pull together a document in this repository to begin to codify the current state, and enable members of the org to have a resource to reference when they're interested in building integrations for the org.

[bnb]

Forgot the pings: @nodejs/tsc @nodejs/community-committee

[keywordnew]

+1 to having a resource for this. It would be helpful to give people:

• a starting point for the current state of bot use/integrations
• what (technical and convention-driven) barriers there would be for a new bot/integration being greenlit

[MylesBorins]

@nodejs/tsc ptal

[Trott]

There is a brief bot policy in the TSC repo:

https://github.com/nodejs/TSC/blob/f197e5ed3fa2c891ac326671c5f5d19a8ae515d9/GitHub-Org-Management-Policy.md#use-of-bots-and-services

Automation tools such as bots and third-party services on any repository must be approved by the TSC and CommComm and are subject to regular security audits. Bots that perform actions on behalf of the project (such as moderation or membership management actions) are required to maintain a log, accessible to all individuals granted Owner permissions, of all actions taken.

[Trott]

I guess this bit from the Moderation Policy is not-unrelated:

https://github.com/nodejs/admin/blob/d2900ae615673cad293c3ba4032b77af1c7c731a/Moderation-Policy.md#non-collaborator-posts

Accounts that are reasonably believed to be bots (other than bots authorized by the TSC) are subject to immediate Blocking.

That probably needs to be updated to say "TSC and CommComm". I'll open a PR.

[Trott]

Given current policy, I would say that a bot is OK if (and only if) it is approved by both TSC and CommComm. The mechanism for approval is not specified, but I think asking for a vote in both committees is a pretty solid choice. One or both committees can choose to involve Build WG if they think it is appropriate. (6 TSC members are also Build WG members so it seems unlikely that TSC would fail to refer to Build WG when appropriate.)

[Trott]

Closing stuff that has been inactive for more than a year in this repo, but if someone plans on picking this up, just go ahead and re-open! No strong opinions from me. Just tidying.