Get added to GitHub Integrations directory

[chadwhitacre]

@EdOverflow kicked this off (slack), and I've received and accepted an invite to GitHub's private repo where they manage integrations. But ... what exactly is our integration? 😳

Todo

• figure out OAuth login link
• review marketing copy
• route security@ into HackerOne?

[EdOverflow]

We are a tool that help open source developers. On top of that, Gratipay allows users to set up an account with OAuth through GitHub.

[chadwhitacre]

I'm following up to let you know that we are putting a pause our Integrations Directory pipeline starting April 1 until early June. If you would like to have Gratipay listed in the directory before June, please follow the instructions in the readme.md of our Integrations Directory repository. Otherwise, we'll reach back out in June to remind you.

[EdOverflow]

I am currently writing our application and I should be done by Saturday.

[chadwhitacre]

I'm thinking of this in the context of our strategy to implement business-grade crowdfunding through aggregation.

This could be big.

Basically I'm thinking maybe we should switch to GitHub instead of npm for our first integration focus.

• GitHub is larger than npm by two orders of magnitude
  • 54,000,000 projects on GitHub [src]
  • 400,000 packages on npm [src]
• npm packages can link to a GitHub repo in their metadata, so GitHub would actually cover some subset (what %age?) of npm anyway.
• We have a stronger existing relationship with GitHub than with npm.
• There is no existing "Sustainability" category ... and there should be, and GitHub (Nadia, Brandon) will agree.
• We are partnering with GitHub on the $ustain conference coming up in June: we could target a joint launch then.

---

Thanks for the heads up, []! Would you be up for a video chat to discuss? This is actually a potentially very interesting opportunity for us and I'd like to make sure we're evaluating it appropriately. Any of these times work?

March 9 (tomorrow) at 10am US/Pacific
March 13 at 10am
March 16 at 10am

[chadwhitacre]

Our current integration consists in:

• GitHub oauth for authentication.
• User pages that dereference if linked.
• Organization pages (uuuugggglllyyy) that show what members of the org have an account on Gratipay.

We have 2,400+ oauth users, though probably only a couple hundred(?) who have logged in recently.

What does it do?
How does it integrate with GitHub?
How does it empower developers?

https://developer.github.com/integrations-directory/marketing-guidelines/

[chadwhitacre]

My thought here is that we focus pledging on pages like:

https://gratipay.com/on/github/AspenWeb/pando.py/

But then what does aggregation look like? What's the experience for a company that wants to give to their stack in aggregate? What do they upload or how do they start? How do we go from that to a list of projects with distribution amounts?

[nobodxbodon]

@whit537 it's indeed huge chance. Not sure if the tech-debt is light enough to be ready for this chance though. Npm could have been a test field for proof of concept. Anyways, do you plan to chat with Github contacts about this before we flip the switch?

BTW is there other service provider that already belongs to "Sustainability" category? BS?

[chadwhitacre]

From slack:

@mattbk I think your point that with npm, it’s easy to determine who you want to give to. With GitHub, how do you see that happening?
@clone1018 with npm you have a dependency graph

[chadwhitacre]

Ideally we can hit #920 with pledging for both GitHub and npm ... though that'll be a stretch for us.

If GitHub wants to launch a new "Sustainability" category on the integrations directory, then they'll want to do so with multiple integrations (Liberapay, OpenCollective, Bountysource).

Conversely, it'd be great for us to be able to announce our own integration efforts as N vs. 1.

[mattbk]

I don't really understand how GitHub integrations work.

Is it essentially injecting code into the GitHub page that will let you do X?

[chadwhitacre]

It's not really injecting code, it's using GitHub APIs to do things like report back on test results like we get from Travis CI on PRs.

[chadwhitacre]

Call (closed) scheduled for Monday, March 13.

[chadwhitacre]

it's indeed huge chance.

Meaning a huge risk (bad) or a huge opportunity (good)? ... or both? :)

Anyways, do you plan to chat with Github contacts about this before we flip the switch?

Yup! Scheduled for next Monday, so we can revisit this decision next week.

BTW is there other service provider that already belongs to "Sustainability" category? BS?

Nope! New category.

[EdOverflow]

Another "feature" I think we could add for our GitHub integration is a widget page with Gratipay metadata badges.

[mattbk]

Could it go further? The next version of widgets should be able to take credit card information and set up a donation. Is that something that could be done with this integration?

[chadwhitacre]

I think we need to find the lowest hanging fruit for getting listed, especially if we don't want to drop npm.

[EdOverflow]

Could it go further? The next version of widgets should be able to take credit card information and set up a donation. Is that something that could be done with this integration?

As long as the widget can be embedded in Markdown then it should work.

[chadwhitacre]

@EdOverflow Are you able to make the call on Monday?

[EdOverflow]

@EdOverflow Are you able to make the call on Monday?

Unfortunately, I do not think I will be present for the call on Monday. I hope this is not an issue.

I will make sure to get as much of our first application draft done by Saturday (including the design). I will also prepare a list of questions that you may reference during the call. :)

[mattbk]

I think we need to find the lowest hanging fruit for getting listed, especially if we don't want to drop npm.

👍

[nobodxbodon]

Meaning a huge risk (bad) or a huge opportunity (good)? ... or both? :)

Both for sure. One crucial part will be to keep satisfying demands of better reporting, both project and company levels. Project-level: project history (gratipay/gratipay.com#4128), forecast (#993). Company-level (our own finance) might be lower priority compared to project-level stuff, but if we decide to open it, it'll be an obligation to keep it open and up-to-date, with cross-checks and accuracy.

One thing I'm not sure about is, how many OS developers will be willing to contribute to dev work of gratipay. I can't imagine with 100x users, and maybe 10x number of new issues (and 10x of the comments per issue) per day, how can the project be sustained without extra manpower (coding, support, etc). Considering the small number of project owners who's contributing code to gratipay, I can't easily get an estimation. There might be more motivation when we pick up steam, but we also need to prepare for the worst. Ideally we will get enough income to pay FTE, ant it may be a worthwile exercise to estimate how much pledge we will need (like, 1 dev, 1 support, all together 150k a year? assuming income is 5% of the total pledge, that means 3 million pledge a year is needed)

Speaking of manpower, there are some routine processes that are not automated enough, which seems to me will be hard to scale. One I notice is running payday. There are so many steps to go and it could takes altogether multiple man/days to solve all the issues during the process. I imagine it'll only be much more problematic if 100x projects need to get paid.

Also there are technical details like upper limit of masspay (5000?), though they may be relatively simpler than the issues before, as human issues are usually more difficult to handle than technical issues.

The call with github will worth much more than my speculation here, and I'll look forward to the sum up. As we are still pre-startup, I hope we can enjoy some tolerance of "just do it, before figuring everything out" :)

[mattbk]

Speaking of manpower, there are some routine processes that are not automated enough, which seems to me will be hard to scale. One I notice is running payday. There are so many steps to go and it could takes altogether multiple man/days to solve all the issues during the process. I imagine it'll only be much more problematic if 100x projects need to get paid.

I think this is part of do things that don't scale. Sure, the people who know what they're doing (i.e., not me) could devote dev time to automating payday, but is that as important as getting more money into the system?

[chadwhitacre]

Okay! Just had a quick call with our partnerships contacts (relevant ;). Sounds like we're on the right track. 👍 💃

Short term: Let's get an application for the current integrations directory in before the door closes on April 1. Here's a draft from @EdOverflow. We don't need any new feature development before that happens. Yes, our API integration is not very deep right now, but we do at least have OAuth (they are able to gauge traction for themselves from this—we have plenty of traction for our purposes here). More important is that we provide "unique value" in the software development cycle, which we do ("There are hundreds of CI vendors. We have 30 in the directory. We don't have anyone doing what you're doing"). They seem genuinely interested in having us. 💃

Medium term: GitHub is working towards a new version of the directory, hence the April 1 application freeze. OSCON (#948) and $ustain (#920) will both be potential touchpoints to see how we're each coming along and talk about the future.

Longer term: Once the new integrations directory is out, we can talk in earnest about pioneering a new "Sustainability" category. For now they want to put us under "Open Source management." I shared at a high level our roadmap towards business-grade crowdfunding through aggregation. GitHub is trickling out new work around deps comprehension, potentially with APIs to follow.

@EdOverflow in slack:

My main question for [] is: "Will Gratipay be notified if there's an urgent issue found in GitHub that could affect our users?"

The impression I got is that there's nothing formal here, but that they take a fairly hands-on approach to partnerships, like, if some APIs are changing that they know we use, they would reach out. Unfortunately I didn't have the presence of mind to realize you mean urgent security issue, so I didn't ask specifically about that. I also missed your follow-ups in the Slack thread, so I will follow-up in email ...

[chadwhitacre]

As we are still pre-startup, I hope we can enjoy some tolerance of "just do it, before figuring everything out" :)

💯 😃

[chadwhitacre]

so I will follow-up in email ...

---

Thanks for the call, []! Here's my summary on our (public) ticket, feel free to chime in and/or subscribe there.

Also, I neglected to pass along Ed's questions in full (sorry, Ed!), so I'm including them here:

1. Will Gratipay be notified if there's an urgent [security] issue found in GitHub that could affect our users?
2. Apart from TLS, what other security requirements are needed?
3. How can we contact GitHub if we discover a security issue? (HackerOne?)

[chadwhitacre]

Just had a positive first conversation with @ GitHub's partnerships team. Stay tuned! 👍 😁 💃 📺

https://twitter.com/Gratipay/status/841353503012458496

[chadwhitacre]

https://developer.github.com/integrations-directory/getting-listed/

[chadwhitacre]

https://github.com/github/integrations-directory

[chadwhitacre]

Using @joeyespo's https://github.com/joeyespo/grip 📝 to draft our application for https://github.com/integrations. ❤️ #opensource 💸

https://twitter.com/Gratipay/status/842099232198819853 💃

[chadwhitacre]

I'm hung up on:

provide a URL that will immediately redirect to GitHub's OAuth authorization flow.

https://developer.github.com/integrations-directory/getting-listed/#oauth-installation-listing

We use a POST for login. Hmm ... 🤔

[chadwhitacre]

I've started a todo in the ticket description here.

[chadwhitacre]

@EdOverflow and I talked in slack (also) about the OAuth link.

[chadwhitacre]

PR started! https://github.com/github/integrations-directory/pull/36 (private).

[chadwhitacre]

Going back and forth, getting close! Here's a mirror of our application, btw.

[EdOverflow]

Gratipay is now a GitHub integration! https://github.com/integrations/gratipay 🎉

[mattbk]

Exciting!

The tagline is too long at https://github.com/integrations/feature/open-source-management: 😞

[mattbk]

Also, the other taglines are more "Use this to do X" and ours is all about us.

[chadwhitacre]

@mattbk How about "Pay for open source"?

[chadwhitacre]

Okay, per slack, I've asked if we can change to "Pay for open source."

[chadwhitacre]

!m @EdOverflow *