Repo Check: No Outside Collaborators

[feanil]

As an organization we don't want to have Outside Collaborators on repos. Write a new check that ensures that no repos have outside collaborators.

• Add a repo check that would remove outside collaborators from all repos in the openedx org.

[sarina]

BTR ticket management

Made a triage team for the BTR & Community WG repos (they can go hand in hand): https://github.com/orgs/openedx/teams/btr-triage/repositories

Added:

• @angonz
• @ghassanmas
• @jalondonot
• @NeOneSoft
• @sambapete

Removed:

• @mdbc-tech - I don't believe he's participating anymore with BTR

Questions about write access

@gabew1984 you are listed as an outside collaborator on Paragon repo. Are you still at 2U?

@ali-hugo you have write access (added in an incorrect way) to Paragon and modular-learning. I was unaware you were considered a coding Core Contributor. Is this accurate? Are you contributing code to these repos? I'm removing you for now but we can add back.

@GlugovGrGlib do you need Triage access to credentials still?

Revoking non-contractual write access

The following people are granted write access to repositories in the openedx GitHub organization, and they are not Core Contributors or 2U employees. I have removed their access and they should comment if they believe that's incorrect.

Paragon repo

• @monteri
• @viktorrusakov

edx-developer-docs

• @PrecisionWordcraft

tutor-contrib-multi repo

• @keithgg
• @lpm0073
• @MoisesGSalas

openedx-wordpress-site

• @amirnafees88 (github account has no activity in past year, so assuming inactive)
• @khawaja-awais - also has no activity on GH account in past year

---

@feanil : the only one left is the edx-status-bot which only has write access to the Android repo. I'd like to figure out if we need to use a seat for one bot for one repo; they should be using Actions if possible.

[mdbc-tech]

Thanks Sarina I was hoping that would get done sooner or later and thank you for removing me I do keep up with things but no longer have the spare bandwidth to participate. Maybe someday I will have time again, I much prefer edx to my day job. It was fun meeting you and the rest of the team and I learned a lot about seeing how a large distributed project works. I wish you happy holidays and all the best. Dennis Bates

[adamstankiewicz]

@feanil @sarina I can speak to the following users in the Paragon repository:

• @gabew1984
  • Gabe is indeed a 2U employee; he's the design lead for the Paragon system. He has write access in order to help maintain issues, project board(s), etc. He wasn't part of the openedx Github org so I added him directly. May contribute code insofar as updates to the README files for the documentation website .
• @ali-hugo
  • Ali is a UX Core Contributor. I added their access for the same reasons as Gabe above.
• @viktorrusakov and @monteri
  • Viktor and Vlad are engineers from Raccoon Gang that help maintain and build new capabilities into the Paragon design system through the BD-46 Blended Development project. Their access was also added for the same reasons as the others, though they do contribute code (frequently). They were also previously able to merge PRs directly into our alpha branch, effectively managing the alpha release of Paragon design tokens.
  • Peter (@PKulkoRaccoonGang) is another engineer from Raccoon Gang who frequently contributes code to Paragon who should have similar access as Viktor and Vlad.

IIRC I also had initially tried to add them to the @openedx/paragon-working-group Github team.

I'm definitely open to suggestions on how we can ensure 2U designers, UX Core Contributors, and Blended Development engineers who frequently contribute code and/or manage the Github issues / project board for Paragon will keep their access 😄

[sarina]

@adamstankiewicz ah. You should not be directly managing any membership. For adding or removing GH access, please create tickets at https://github.com/openedx/tcril-engineering/issues/new/choose for tcril's team to handle. The issue here was they were added as outside collaborators, which we are not using anymore. If you can make some tickets at the link I shared (ideally one per person), we will add them to the openedx GitHub organization with permissions we can reason about (ie, in groups that make sense).

[adamstankiewicz]

@sarina Sounds good! I'll try to get those tickets filed tomorrow (one per person). I opted for the path of least resistance to grant them access here 😉

[sarina]

Ah, one thing I meant to say. Only Core Contributors or 2U employees can have write access to a repo. Peter, Viktor, and Vlad are not a Core Contributor so therefore cannot have write access (this is a legal matter). You will need to manage their pull requests as you do for any community core contributor. Or, they need to become Core Contributors, if write access is something that's absolutely critical to their work.

[adamstankiewicz]

@sarina Noted. The issue is not so much around their pull requests but more so around the management of the Github issues and project board (e.g., associating PRs to Github issues for the board automation, etc.). I'm assuming "Triage" access gets them that? We have been doing the typical PR process for things merging to master.

The "Write" access is helpful for them to self-serve manage any pre-releases for Paragon. If it takes them becoming Core Contributors to keep that, I will run it by them to get their thoughts. If they have questions around what it means to be a Core Contributor more specifically, what might be the best documentation for them to learn more?

[sarina]

Triage access is very grantable to everyone, just note that in the ticket. Actually if you're requesting triage access to the same repo(s) for the same people, you can just make one ticket for that.

Raccoon Gang should be familiar with the Core Contributor program, Igor is a member. I'd suggest they talk with him and their bosses, because becoming a core contributor requires a level of commitment that I would assume they can't commit to on their own (currently, around 20h/month to the core project)

[georgebabey]

It is critical that RG can help manage the Paragon project board, which unfortunately "Triage" access does not provide.

@sarina Can we restore RGs access until we can work through the process. The immediate revocation of their access without a heads up to remediate has resulted in additional project board management for 2U, at a time when we're all about to go on break.

2U contributes significantly to the development of Paragon, both in house and through the BD-46 project.

I am also unclear what is meant by "because becoming a core contributor requires a level of commitment that I would assume they can't commit to on their own (currently, around 20h/month to the core project)". Are you implying Paragon is not part of the "core project" or that they are not contributing 20h/mo?