Should we move this repo to an organization?

[altendky]

@sunu, @crwood, what do you think about moving this project to an organization? I'm concerned by the low activity from all of us for extended times. Sure, the code works but if we drift away then having it in an organization would make it more readily handed on to any successors. Also, it would put more people as admin for the GitHub side of things. I checked and @glyph was willing to consider it for inclusion in the Twisted organization (I didn't ask about the core repo, just the org).

To be open and complete, I might be drifting towards trio so I can't make promises that I'll be a long term maintainer. I'm only in preliminary stages of exploring how to build up the Qt and pytest integration after they recently implemented their guest mode. Even if that all pans out I still have a pile of code for work that would need to be rewritten before I was no longer using Twisted/qt5reactor. Still, I figure it's good for all to be aware as part of this discussion.

(FYI @exarkun, @meejah)

• Pick Twisted vs. dedicated org
  • Twisted it is
• Decide if we are going to change names
  • Maybe later
• Change names if we decided to
• Give @sunu acccess to org
• Move repository to org
• Add existing maintainers in new org
• Add new Twisted maintainers to PyPI
• Update all links (I think just in-repo plus release to PyPI after?)
• Shutdown existing CI
• Setup new CI (at least GitHub 'all' job as required)
• New release to get PyPI link updated (probably wait until the PRs are resolved)

[glyph]

I'm +0. I don't really have any extra capacity to manage any extra projects, but I'm more than happy for the Twisted "brand" to make this official somehow.

[altendky]

@glyph, all I'm proposing you would bring to the table is that if the three (I think?) present maintainers become unresponsive and a new dev shows up... you (or anyone else with proper Twisted org authority) could decide to let them take it over. It's possible I'm making up fake benefits of being in an org. I'm not expecting a move to the Twisted org would infuse qt5reactor with more developers.

(am I supposed to say "brand" instead of org? :] )

[sunu]

I am totally open to the move if that's a possibility

[altendky]

Assuming all agree with the value I expect to get from being in an org... I guess we can move forward? I think what I lay out below is more or less the same regardless if we create a python-qt5reactor org for just this or if we move to Twisted. I think the latter makes more sense but either is better by allowing multiple people to admin the repo on GitHub (I think...).

@sunu, who all are maintainers right now? I'm aware of @sunu, @crwood, and @altendky.

Our CI is pretty minimal so I don't think there's much to really transfer there. Just setup new within the Twisted organizations. Maybe don't bother and just let the GitHub actions stuff go with no setup. Well... there is updating build links I suppose.

There's transferring of the repository. https://help.github.com/en/github/administering-a-repository/transferring-a-repository

Looks like on PyPI all owners are equal so we just add a few more. pypi/warehouse#1745

Thoughts on any steps I'm missing? I haven't worked with an org on GitHub before so hopefully I'm not missing important nuances.

I'm adding an activity tracking list to the OP.

[sunu]

@nehbit and @ghtdak are also listed as maintainers. But I'm not sure whether this project is of interest to them anymore.
Once we decide where to move the repo, I can initiate the transfer.

[crwood]

I would be happy to see this repo moved to an org -- preferably Twisted's in order to increase the visibility of the project.

Along the way, we may also want to consider whether it makes sense to rename the package -- say from "qt5reactor" to just plain "qtreactor" or similar -- in order to pave the way for Qt6 compatibility (while still keeping the appropriate shims, etc. in place so that "qt5reactor" continues to work as expected).

[ghtdak]

I no longer work on qtreactor so moving it is fine with me

[nehbit]

OK with me. I've moved from Python to Go a few years ago, so while I can act as a maintainer of last resort, I'd prefer someone who works with Python take care of it.

[altendky]

Sounds like we're good to go and will move to the Twisted org. I added a new step before moving to decide if we're changing names (and a followup to change it if we decide to). @crwood, I see a few years ago you squatted qtreactor. I haven't thought about it much but here's some first considerations.

• Would we need to create a 'forwarding' package in qt5reactor on PyPI?
• Would we need to create a backwards compatibility qt5reactor import package?
• Do few enough people use this that we can just throw our hands in the our like we just don't care?
  • I'm not going to push this option myself but won't argue super strongly against others either as long as existing pins continue to work.

[crwood]

Given that Qt6 isn't slated for (pre)release until the end of this year -- and given that it may be some time beyond that before I or anyone else might even add support for Qt6 -- I, for one, am fine to keep the package-name as-is for now and figure we can worry about forwarding, compatibility, etc. if/when it actually becomes a pressing issue. (I mostly just wanted to raise the question now to see whether anyone felt strongly about it one way or the other.)

But yes, I've squatted a number of variants on the package name years ago in anticipation of this issue and would be happy to put them to use (and/or pass them along to any future maintainers of this project who might). :)

[altendky]

I'm ok with not handling a rename now. So on the checklist above we're up to starting the transfer, @sunu.

[sunu]

If I understand the docs correctly, I need to be a member of the org to be able to make the transfer.

To transfer a repository that you own to an organization, you must have permission to create a repository in the target organization.

[altendky]

Oh, for some reason I thought the original owner could initiate and a recipient could accept it. I'm not sure why I thought that. @glyph, looks like dealing with access to the Twisted org may be an earlier step here than expected.

[altendky]

@sunu, I just checked in with glyph and they sent you an invite to the twisted org. Let me know whether you are now able to transfer the repo.

[sunu]

@altendky The transfer is done now!

[altendky]

Thanks! Side note, looks like the failure on the daily build was just some random GHA stuff this morning. I had another repo fail similarly.

Next step: Add other maintainers (@crwood and @altendky) to the Twisted org to whatever level allows them (us...) to do administration/settings tasks on the qt5reactor repository.

Next next (optionally parallel) step: @glyph, who from Twisted should be added to the PyPI project? Everyone listed as maintainers at https://pypi.org/project/Twisted/? Just some?

Thanks all for trekking through this long list of steps... at some point I'll assign one to myself. :]

[sunu]

I don't seem to have admin/settings access to qt5reactor repo anymore. So we may need to create a group that has admin/settings access to this repo and add all current maintainers into it.

Re: PyPI, @altendky iirc you're already an owner there. If you could add @glyph and others as owners as well, that would be great! 🙂

[glyph]

Regarding PyPI access, we don't really have a clear process for that on the twisted org. It'd be great to have a mailing list thread about that, probably, if someone has a proposal.

We do have a 1password subscription for sharing secrets, so we could invite you along to that.

@sunu You're now an administrator. I've also given existing Twisted Contributors team members write access, since presumably that's the advantage of org membership :).

[sunu]

@altendky I have sent you an invite to the repo

[altendky]

#52 with github link updates is marked for review. I think just the PyPI maintainers question is left then. I asked in #pypa if there were any advice and will send an email to the Twisted list.

Just added a final (I think) step to do a release but that can wait until we get the PRs handled (which I think is on me to go through them, recheck, and request reviews).

[crwood]

I've reviewed #52 but noticed along the way that I don't (yet?) have any form of write-access to the repo. Could you add me, @altendky?

[altendky]

Hmm, you did have 'write' level but not 'maintain' or 'admin'. I bumped you to 'admin'.

[altendky]

... and... waiting... and... finally: https://twistedmatrix.com/pipermail/twisted-python/2020-July/065180.html

So we've got 'PyPI maintainers' and 'release' left on the list to complete this. I'll call both of those 'mine' though there are three PRs up for review.

[adiroiban]

I guess that password/secrets can be stored in GitHub at the repo level.

Ex https://github.com/twisted/qt5reactor/settings/secrets

And release qt5reactor via GitHub actions.

For the pypi account used to do the release, maybe add  security@twistedmatrix.com as a secondary email.
In this case, someone can recover/reset the password.