Repository navigation
Three maintainers, and what that does and does not close - #72
Merged
Merged
Conversation
Zach Mead and Mike Hostetler join as maintainers with review, merge, tag and release rights. GOVERNANCE.md gains a Continuity section saying what happens when any one maintainer is unavailable, and naming the exceptions rather than leaving them to be discovered: organisation administration, the domain and the security mailbox still rest with the author, and restoring those is a legal matter rather than a technical one. MAINTAINERS.md, CONTRIBUTING.md, CODE_OF_CONDUCT.md and SECURITY.md stop saying one maintainer. The code of conduct gains the thing further maintainers actually buy a reporter: a report concerning one of them is handled by the others. R22 is appended to rather than rewritten, and separates two things the phrase "bus factor" runs together. Availability is closed: the project can accept a change and publish a release without any one person, which is what the OpenSSF access_continuity criterion asks. Knowledge and independence are not: every commit in the tree to date has one author, so a bus factor of two or more is being established rather than claimed. The row states a lift condition a stranger can check instead of a date. MAINTAINERS.md records that one of the two invitations is still pending acceptance, because that file is the one people check against the repository's own collaborator list. Signed-off-by: Ayla Croft <aylacroft@proton.me>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Zach Mead (@znmead) and Mike Hostetler (@mikehostetler) join as maintainers with review, merge, tag and release rights. Until today this project had one maintainer and said so in five files.
What changes
MAINTAINERS.md— three named people, their GitHub handles, and their scope. It also records that one of the two invitations is still pending acceptance at the time of writing, because a maintainers file is precisely the document a reviewer checks against the repository's own collaborator list.GOVERNANCE.md— a new Continuity section: if any one maintainer becomes unavailable, the others hold the access needed to keep the project running, and nothing in the ordinary workflow requires a specific individual. It also names the exceptions rather than leaving them to be found: organisation administration, the domain and the security mailbox still rest with the author, and restoring those is a legal matter rather than a technical one.CODE_OF_CONDUCT.md— the thing extra maintainers actually buy a reporter: a report concerning one of them is handled by the others.CONTRIBUTING.md,SECURITY.md— stop saying one maintainer.What it does not change, stated plainly
docs/06-risk-register.mdR22 is appended to rather than rewritten, and it separates two things the phrase "bus factor" runs together.Availability is closed. The project can accept a change and publish a release without any one person. That is what the OpenSSF
access_continuitycriterion asks for, and it is a MUST at the silver level.Knowledge and independence are not. Every commit in the tree to date has one author. A "bus factor" of two or more, in the sense the criteria mean it — the number of people who would have to disappear before the work stalls for lack of competent personnel — is being established, not yet demonstrated, and the badge answer should say so.
bus_factoris a SHOULD at silver and a MUST at gold, so nothing is blocked by answering it honestly now.R22 carries a lift condition a stranger can check: reviews and merged changes from a maintainer other than the author in the git history, and the administrative access documented as recoverable.
Evidence
mix gateexit 0; 575 passed, 18 excluded; coverage 80.31%.