Update governance (#2197)

* switch to cncf-antrea-maintainers@lists.cncf.io as the maintainers
  mailing list
* use the CNCF code of conduct
* define antrea-io Github org membership and how to become a member
* clarify PR merging process

Signed-off-by: Antonin Bas <abas@vmware.com>

CODE_OF_CONDUCT.md

@@ -1,77 +1,3 @@
-# Contributor Covenant Code of Conduct
+# Community Code of Conduct
 
-## Our Pledge
-
-In the interest of fostering an open and welcoming environment, we as
-contributors and maintainers pledge to making participation in the Antrea
-project and our community a harassment-free experience for everyone, regardless
-of age, body size, disability, ethnicity, sex characteristics, gender identity
-and expression, level of experience, education, socio-economic status,
-nationality, personal appearance, race, religion, or sexual identity and
-orientation.
-
-## Our Standards
-
-Examples of behavior that contributes to creating a positive environment
-include:
-
-* Using welcoming and inclusive language
-* Being respectful of differing viewpoints and experiences
-* Gracefully accepting constructive criticism
-* Focusing on what is best for the community
-* Showing empathy towards other community members
-
-Examples of unacceptable behavior by participants include:
-
-* The use of sexualized language or imagery and unwelcome sexual attention or
-  advances
-* Trolling, insulting/derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or electronic
-  address, without explicit permission
-* Other conduct which could reasonably be considered inappropriate in a
-  professional setting
-
-## Our Responsibilities
-
-Project maintainers are responsible for clarifying the standards of acceptable
-behavior and are expected to take appropriate and fair corrective action in
-response to any instances of unacceptable behavior.
-
-Project maintainers have the right and responsibility to remove, edit, or
-reject comments, commits, code, wiki edits, issues, and other contributions
-that are not aligned to this Code of Conduct, or to ban temporarily or
-permanently any contributor for other behaviors that they deem inappropriate,
-threatening, offensive, or harmful.
-
-## Scope
-
-This Code of Conduct applies both within project spaces and in public spaces
-when an individual is representing the project or its community. Examples of
-representing a project or community include using an official project e-mail
-address, posting via an official social media account, or acting as an appointed
-representative at an online or offline event. Representation of a project may be
-further defined and clarified by project maintainers.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting the project team at oss-coc@vmware.com. All complaints
-will be reviewed and investigated and will result in a response that is deemed
-necessary and appropriate to the circumstances. The project team is obligated to
-maintain confidentiality with regard to the reporter of an incident.  Further
-details of specific enforcement policies may be posted separately.
-
-Project maintainers who do not follow or enforce the Code of Conduct in good
-faith may face temporary or permanent repercussions as determined by other
-members of the project's leadership.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
-available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
-
-[homepage]: https://www.contributor-covenant.org
-
-For answers to common questions about this code of conduct, see
-https://www.contributor-covenant.org/faq
+Project Antrea follows the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md).

GOVERNANCE.md

@@ -2,9 +2,6 @@
 
 This document defines the project governance for Antrea.
 
-This is a Work in Progress, documenting approximately how we plan to operate the
-project.
-
 ## Overview
 
 **Antrea** is committed to building an open, inclusive, productive and
@@ -34,14 +31,34 @@ The Antrea community abides by this [code of conduct](CODE_OF_CONDUCT.md).
 Anyone can contribute to the project (e.g. open a PR) as long as they follow the
 guidelines in [CONTRIBUTING.md](CONTRIBUTING.md).
 
+Frequent contributors to the project can become members of the antrea-io Github
+organization and receive write access to the repository. Write access is
+required to trigger re-runs of workflows in [Github
+Actions](https://docs.github.com/en/actions/managing-workflow-runs/re-running-a-workflow). Becoming
+a member of the antrea-io Github organization does not come with additional
+responsibilities for the contributor, but simplifies the contributing
+process. To become a member, you may [open an
+issue](https://github.com/antrea-io/antrea/issues/new?template=membership.md&title=REQUEST%3A%20New%20membership%20for%20%3Cyour-GH-handle%3E)
+and your membership needs to be approved by two maintainers: approval is
+indicated by leaving a `+1` comment. If a contributor is not active for a
+duration of 12 months (no contribution of any kind), they may be removed from
+the antrea-io Github organization. In case of privilege abuse (members receive
+write access to the organization), any maintainer can decide to disable write
+access temporarily for the member. Within the next 2 weeks, the maintainer must
+either restore the member's privileges, or remove the member from the
+organization. The latter requires approval from at least one other maintainer,
+which must be obtained publicly either on Github or Slack.
+
 ### Maintainers
 
 The list of current maintainers can be found in
 [MAINTAINERS.md](MAINTAINERS.md).
 
-Maintainers have write access to the repository. While anyone can review a PR -
-and is welcome to do so -, only maintainers can leave an approving review, which
-will allow the PR to be merged.
+While anyone can review a PR and is encouraged to do so, only maintainers are
+allowed to merge the PR. To maintain velocity, only one maintainer's approval is
+required to merge a given PR. In case of a disagreement between maintainers, a
+vote should be called (on Github or Slack) and a simple majority is required in
+order for the PR to be merged.
 
 New maintainers must be nominated from contributors by an existing maintainer
 and must be elected by a [supermajority](#supermajority) of the current
@@ -52,6 +69,16 @@ maintainers or can resign by notifying the maintainers.
 
 A supermajority is defined as two-thirds of members in the group.
 
+## Code of Conduct
+
+The code of conduct is overseen by the Antrea project maintainers. Possible code
+of conduct violations should be emailed to the project maintainers at
+cncf-antrea-maintainers@lists.cncf.io.
+
+If the possible violation is against one of the project maintainers that member
+will be recused from voting on the issue. Such issues must be escalated to the
+appropriate CNCF contact, and CNCF may choose to intervene.
+
 ## Updating Governance
 
 All substantive changes in Governance require a supermajority vote of the

SECURITY.md

@@ -7,7 +7,7 @@ The community adopted this security disclosure policy to ensure vulnerabilities
 
 If you believe you have identified a vulnerability, please work with the Antrea maintainers to fix it and disclose the issue responsibly.
 All security issues, confirmed or suspected, should be reported privately.
-Please avoid using github issues, and instead report the vulnerability to projectantrea-maintainers@googlegroups.com.
+Please avoid using github issues, and instead report the vulnerability to cncf-antrea-maintainers@lists.cncf.io.
 
 A vulnerability report should be filed if any of the following applies:
 
@@ -29,7 +29,7 @@ Provide a descriptive subject and include the following information in the body:
 ## Responding to a vulnerability
 
 A coordinator is assigned to each reported security issue. The coordinator is a member from the Antrea maintainers team, and will drive the fix and disclosure process.
-At the moment reports are received via email at projectantrea-maintainers@googlegroups.com.
+At the moment reports are received via email at cncf-antrea-maintainers@lists.cncf.io.
 The first steps performed by the coordinator are to confirm the validity of the report and send an embargo reminder to all parties involved.
 Antrea maintainers and issue reporters will review the issue for confirmation of impact and determination of affected components.
 
@@ -59,7 +59,7 @@ A fix is proposed as a patch to the current main branch, formatted with:
 git format-patch --stdout HEAD~1 > path/to/local/file.patch
 ```
 
-and then sent to projectantrea-maintainers@googlegroups.com.
+and then sent to cncf-antrea-maintainers@lists.cncf.io.
 
 **Please don't push the patch to the Antrea fork on your github account!**
 

ci/clair-scan/notify.go

@@ -39,7 +39,6 @@ const (
 
 var Recipients = []string{
 	"projectantrea-dev@googlegroups.com",
-	"projectantrea-maintainers@googlegroups.com",
 }
 
 func isNeeded(stats *reportStats, maxScore int, newStats *reportStats) bool {

docs/contributors/github-labels.md

@@ -33,6 +33,7 @@ The labels in this list originated within Kubernetes at
 | area/flow-visibility/aggregation   | Issues or PRs related to flow aggregation | Any |
 | area/flow-visibility/elk           | Issues or PRs related to the reference ELK configuration for flow visualization | Any |
 | area/flow-visibility/export        | Issues or PRs related to the Flow Exporter functions in the Agent | Any |
+| area/github-membership             | Categorizes an issue as a membership request to join the antrea-io Github organization | Any |
 | area/ipam                          | Issues or PRs related to IP address management (IPAM) | Any |
 | area/interface                     | Issues or PRs related to network interfaces | Any |
 | area/licensing                     | Issues or PRs related to Antrea licensing | Any |