Set up permissions/protections for new community roles

[GuySartorelli]

In order to introduce the new reviewer and refiner roles, we need to have some permissions and protections in place.

Epic

• EPIC: Empower community members to be more involved in Silverstripe CMS OSS #141

Notes

• We need to decide if we will initially provide access to one repo, multiple repos, or all repos.
  • We only need to add protection rules to the repo(s) we will initially be granting access to. Therefore it might make sense to try it out on a single repo first, make sure the rules work the way we want, and then grant more access when we're happy with it.
• We may decide to hold off on the refiner role for now and only proceed with the reviewer role until we've seen how that goes. In that case, we only need to do this for the one role for now.

Acceptance Criteria

• A new group is created for the "refiner" role, with appropriate permissions and access to relevant repos
  • They must have "Triage" access only. See the permissions matrix
• A new group is created for the "reviewer" role, with appropriate permissions and access to relevant repos
  • They must have "Write" access only. See the permissions matrix
• The permission for all roles are documented in our official documentation and are in-line with our Risk Accessement.
• Branch protection rules are added to relevant repos as rules set forth in the proposal document
• The new branch protections only restrict actions for the new roles
  • If any rule can be demonstrated to meaningfully impact the CMS Squad workflow, a conversation is held to decide how to proceed.
• Any confluence pages or public doc that need to be updated are updated (e.g. steps for creating new repos might need to include adding access for these new groups)

Related card

• Apply branch protection to our repos #198

Note

• Perform a risk analysis on the process for the new community roles #144 needs to be done first.
• ACs related to branch protections are crossed off because those rules are handled in Apply branch protection to our repos #198

[maxime-rainville]

We concluded those are the branch and tag protection that should be enabled on all our supported repos.

Branch protection

Tag protection

[GuySartorelli]

Note that I won't be adding these roles to the recipes - changes to recipes should really be reviewed by the CMS Squad and/or core committers.

[GuySartorelli]

New groups made:

• Peer Reviewers - added to all supported modules which aren't recipes
• Contribution Refiners - added to all supported modules including recipes

Docs updated in setting up a new github repository page in confluence to reflect the need to add these new groups

Moved Werner from "Triage" group to the new refiners group.
Per conversation with Max, the "Triage" group is not intended for triage - it's intended for giving access to Zenhub, which apparently requires write access.

[emteknetnz]

Looks good