Add Piotr?

[potiuk]

Shoul we add @ppkarwasz to the team ? @dfoulks1 @dave2wave @raboof (and @ppkarwasz tell us if you want ) ?

[ppkarwasz]

Now that it is so explicit (unlike the mention in #748), I can not tactically forget to answer. 😜

I can certainly help reviewing the incoming upgrades although I am not certain what the criteria are. In the current situation we probably need to add some internal documentation on how the supply chain of the various actions is protected (especially those that pull executables from other ecosystems) and add a delay between our review and the moment the action becomes effectively allowed (which will enforce the 7 days cooldown for PMCs).

[potiuk]

Actually we have the criteria already - broadly https://github.com/apache/infrastructure-actions#reviewing - and more detailed discussion is held here #686 and maybe when you join we can get to a conclusion on some of the missing parts or new ideas and consolidate them into README ?

That would be nice first contribution - with @dave2wave @raboof @dfoulks1 myself and you - we would have 5 people to decide which will also make it nice to break ties if we disagree on some of the criteria.

[potiuk]

Actually ... we also have this checklist @ppkarwasz (linked at the bottom of the review action output - forgot about it :) )

https://github.com/apache/infrastructure-actions#security-review-checklist

[dave2wave]

I fee!l that any interested ASF Member is welcome to volunteer here. So, welcome @ppkarwasz

[ppkarwasz]

I am happy to volunteer! 😉

[potiuk]

I have no Karma to add Piotr. Who has?

[dave2wave]

@dfoulks1 do you have karma to add @ppkarwasz to the team in order to write?