-
Notifications
You must be signed in to change notification settings - Fork 181
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add RFC to remove non-standard Github teams #262
Conversation
Before this can be made a reality we will need to start tracking ci/bot accounts used by the different working groups in their charters. In addition, how do we want to deal with repos containing ci related configuration for a ci instance maintained by a single vendor? For those repos it makes sense to give the whole team of the vendor access, maybe these repos should not be part of the cloudfoundry org, or ci should be moved over to common infrastructure. However, both options require effort, and probably should not block the adoption of this process. A pragmatic solution would be to generate |
I'm pretty confident that this will impact teams I'm on, but would we be able to get a list of all the current teams that would be deleted, before deleting them, so teams know who'll be impacted? Also, I'm not exactly clear on what needs to be done to make a team compliant (if that's possible)? Is it just renaming it to follow the naming structure defined? Or do we have to migrate to an approved team & ensure that we still have all the correct access? |
My proposal would be to first generate the new teams conforming to rfc-0005-github-teams-and-access in addition to the existing teams. This allows all WGs to start deleting unneeded teams (because they got replaced by the new ones) or at least remove the majority of members in the non-standard teams. Once #248 is merged, I can add the team generation. Need to find a time slot with @rkoster . |
PR for generating WG teams: #310 |
- This is temporary, as this team will go away once #262 is implemented [#315] Authored-by: Greg Cobb <[email protected]>
The standard github teams for the WG areas are setup meanwhile according to the WG charters. We are good to go and apply the spice... One observation: branch restriction rules need to be adapted to the new teams |
@cloudfoundry/wg-leads Hi folks, in the week commencing July 18th we plan to remove all the non-standard teams (by merging this PR). In the meantime, let us know if there are any teams which need preserving (because they use team discussions, for example), or if there's any extra config we need to apply for the new teams. |
Could someone please post a list of the teams that are scheduled for removal? |
This change will likely hit private repositories hardest, since they don't appear to be linked to working groups. |
@davewalter This proposal would remove all the entries under community/org/cloudfoundry.yml Lines 2283 to 6650 in 05f1754
The automation process now generates the teams specified in RFC 0005 from the YAML embedded in the WG charter definitions and applies them to the CF GitHub org. @Gerg and other @cloudfoundry/wg-leads, if there are existing private repos that WG areas should continue to have access to, please propose adding them to the appropriate charters. @cloudfoundry/toc I had forgotten when we were discussing during the TOC call today that this proposal was structured as an RFC that still needs ratification. If @Gerg approves as well, I suggest we vote asynchronously via comment to start the week-long Final Comment Period for this RFC, with the expectation of accepting the RFC next week. At that point, we will be cleared to carry out the team changes proposed here. |
Looks like the majority of private repos defined in Total number of private repos: $ yq '.orgs.cloudfoundry.repos | to_entries[] | select(.value.private != null) | .key' org/cloudfoundry.yml | wc -l
106 Private repos appearing in working group charters (I'm manually omitting some false positives): $ yq '.orgs.cloudfoundry.repos | to_entries[] | select(.value.private != null) | .key' org/cloudfoundry.yml | xargs -I _ rg _ ./toc/working-groups
./toc/working-groups/foundational-infrastructure.md
171: - cloudfoundry/bosh-bbl-ci-envs
./toc/working-groups/foundational-infrastructure.md
176: - cloudfoundry/bosh-cpi-environments
./toc/working-groups/foundational-infrastructure.md
178: - cloudfoundry/bosh-cpi-kb
./toc/working-groups/foundational-infrastructure.md
200: - cloudfoundry/bosh-workstation
./toc/working-groups/cf-on-k8s.md
67: - cloudfoundry/cf-k8s-secrets
./toc/working-groups/app-runtime-platform.md
86: - cloudfoundry/diego-team
...
./toc/working-groups/app-runtime-platform.md
145: - cloudfoundry/garden-ci
146: - cloudfoundry/garden-ci-artifacts-release
...
./toc/working-groups/app-runtime-platform.md
257: - cloudfoundry/networking-oss-deployments I suspect this is because our effort earlier this year to assign orphaned repositories excluded private repositories. |
I vote we merge this. Possibly not in the meeting on the 19th July, because folks are actively raising PRs to address problems, but definitely on the 26th July. |
Would this remove teams only or individual access as well? We have bots that are specific to different areas of the working group and hence not included in the wg-service-management-bots. Would those be affected? |
This PR would only remove the non-standard teams listed in cloudfoundry.yml (orgs > cloudfoundry > teams). Individual contributors (and lots of other repository configuration options) are not listed in cloudfoundry.yml and not managed by peribolos. https://github.com/relengfam/peribolos/blob/main/org/repos.go#L191-L205 gives an idea what is managed for a repo by the automation. Teams (members and repo access) are separate peribolos entities. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Suggested some exemptions for CFF staff teams and for temporary teams to ease over the transition. Also, s/Github/GitHub/g
.
|
||
## Proposal | ||
|
||
Delete all Github teams in the `cloudfoundry` organization that do not conform |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Delete all Github teams in the `cloudfoundry` organization that do not conform | |
Delete all GitHub teams in the `cloudfoundry` organization that do not conform |
🔑 The App Autoscaler CI uses this bot's credentials to interact with the App Autoscaler GitHub repos. 👎 The bot currently gets its access from the the `cf-autoscaler` team, which will likely be deleted when cloudfoundry#262 is implemented. :arrow_right: Bring the bot account into the fold as a working group bot.
@Gerg Unless you have any objections, I'll add my suggested changes to the RFC draft before the TOC meeting next week. |
Authored-by: Greg Cobb <[email protected]>
Authored-by: Greg Cobb <[email protected]>
- Fix GitHub capitalization [#262] Co-authored-by: Eric Malm <[email protected]>
06df03e
to
a0f17ef
Compare
@emalm Sorry, busy week and I lost track of this. I went ahead and incorporated your changes. Looks good! |
@cloudfoundry/toc Let's make sure we discuss starting the Final Comment Period for this RFC at tomorrow's meeting. |
Final comment period starts today (2022-08-02) and finishes in 7 days (2022-08-09) |
🌶
https://cloudfoundry.slack.com/archives/C026XJGNC2U/p1651186805030849