Support private repos in the open-telemetry org

[trask]

I'd like to change the member base permission from "Read" (which gives all members read permission to all private repos) to "No permission" (which shouldn't affect anyone's ability to read public repos, but should allow us to create truly private repos as needed.

I suspect this may also allow us to get rid of https://github.com/open-telemetry-private, which was set up for https://github.com/open-telemetry/community/blob/main/assets.md#grafana-organization-for-sig-security (cc @open-telemetry/sig-security-maintainers).

[danielgblanco]

This makes sense to me

[trask]

I've made this change, I don't think it should affect anything, but please let me know if you see anything weird.

[trask]

Reopening because this had an unforeseen side-effect.

From @dmathieu in slack:

The opentelemetry-go-contrib has a CI task that auto-requests reviews for code owners (who are members of the otel org, but not necessarily approvers on the repo).
I see the task is now unable to assign review, with an error saying only collaborators can be requested for review.

I don't think this will affect the opentelemetry-java-contrib repo because in that repo all the component owners are added to @open-telemetry/java-contrib-triagers (e.g. so that they can label issues), which then makes them repo "collaborators".

I'm hoping this is a reasonable path forward for repos that were relying on the previous behavior, and that we don't need to roll back this change.

[dmathieu]

cc @open-telemetry/go-maintainers

[trask]

as @dmathieu points out in slack, probably this is affecting collector contrib as well

cc @open-telemetry/collector-contrib-maintainers

[dmathieu]

An alternative could be a new "x-codeowners" group?

[pellared]

because in that repo all the component owners are added to @open-telemetry/java-contrib-triagers (e.g. so that they can label issues), which then makes them repo "collaborators".

Maybe we could do the same (add to Triggers) for code owners in Go Contrib and Collector Contrib?

EDIT: I created open-telemetry/opentelemetry-go-contrib#7443

[arminru]

@trask We ran into this issue already in 2023 when I performed the same change there 🙃
#1715 (comment)
#1826 (comment)
That was why we came up with the https://github.com/open-telemetry-private workaround.

[pellared]

During the Project triage - EU-friendly we discussed that probably it would be better to create a new Code Owner role in https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md and that the these teams will have Triage permission granted in the repositories.

The reason is that the current "Triager" role description does not fit well the "Code Owner" role. The alternative, could be trying to change the description of the "Triager" role, but we found it difficult and we concluded that these are indeed separate roles.

PS. In Go Contrib we already got feedback that some Code Owners do not want to be seen as Triagers.

Some existing definitions of Code Owners:

• https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CONTRIBUTING.md#code-owners
• https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/CONTRIBUTING.md#becoming-a-code-owner

We propose that it would be placed before "triager" role.

[trask]

I find the term "code owners" a little confusing in this context, since we aren't giving those people write permission, and I've been strongly conditioned by github to think that code owners == write permission 😅

The people you choose as code owners must have write permissions for the repository.

I sort of prefer the term "component owner" from @dyladan. wdyt?

[dyladan]

I think if I remade that action today I'd use the term "collaborator." At the end of the day the maintainers are still the owners responsible for the code.