Limiting team/repository access for users inactive for 60 months #77
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
The following access changes will be introduced as a result of applying the plan: Access Changes |
|
Before merge, verify that all the following plans are correct. They will be applied as-is after the merge. Terraform plansipfs-shipyard |
lidel
reviewed
Mar 1, 2024
There was a problem hiding this comment.
Similar to ipfs/github-mgmt#193 (review), nothing controversial stands out, removing permissions from inactive members makese sense.
Realization: we have a lot of dead teams.
| @@ -4666,29 +4550,16 @@ teams: | |||
| description: People with write access to Javascript repositories | |||
There was a problem hiding this comment.
💭 I don't think we've been using this group for day-to-day, superseded by helia-dev.
Wonder if majority of groups is no longer used and will fade-away over time, when no members are left.
There was a problem hiding this comment.
The current version of a script assumes that a team is active as long as any user in that team remains active in at least one repository that team grants access to. So if we know of some teams that should not exist anymore, I think it'll be more efficient to flag and remove them proactively.
galargh
changed the title
|
Hi! We're ready to open up the PR for general review 🥳 I'd like to ask you to review the changes affecting you and flag any that should be reverted, are wrong, or need more explanation. You can find the detailed explanation of this PR, the reasoning for introducing the changes and the process itself in the description - #77 (comment) Thank you, and let me know if you have any questions 💁 Tagging all the people whose access changes (#77 (comment)) as a result of this PR (no one is being removed from the org):
1/2 |
|
Continuation of #77 (comment) 2/2 |
SgtPooki
suggested changes
Mar 5, 2024
Comment on lines
-2808
to
-2809
| push: | ||
| - ipfs-gui-bot |
There was a problem hiding this comment.
I dont think we need this bot anymore, i can make sure this repo is configured with unifiedCI properly if i come across it again
Comment on lines
-3132
to
-3134
| collaborators: | ||
| admin: | ||
| - achingbrain |
There was a problem hiding this comment.
I think Alex was the primary dev here but im sure he'd like less on his plate
| - magik6k | ||
| - momack2 | ||
| - olizilla | ||
| - vasco-santos |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR cleans up user access by removing users who have been inactive for over 60 months (5 years) from teams and repositories.
A user is deemed inactive if they haven't performed any of the following actions in the past 60 months in a repository in question or in any of the repositories the team in question grants access to:
Any user who, after the introduction of the above changes, isn't a direct collaborator in any of the repositories and isn't a member of any teams is assigned to the
Alumniteam.If a user's access to a repository or team should be restored, the appropriate line change should be reverted, and a comment starting with
KEEP:(followed by a reason) should be added directly above that line.This pertains to the "'archive' inactive users and teams" in ipfs/ipfs#511.
Who is this targeting?
The current PR is what results from a script to identify inactive users in an org.
Why is this being done?
See "Why do we care about periodically cleaning up permissions across the orgs?" in ipfs/ipfs#511
Is this set in stone?
No. This PR was created and being left open for some days to give awareness and incorporate feedback. We're not taking a "ask for permission" approach, as that would require way too much wrangling. Instead, we're giving visibility to what's proposed and inviting folks to comment and influence. A saving grace here is that none of this is a "one-way door". If something got messed up or missed, a follow-up PR can be done to correct it.
Is anyone being removed from the organization?
No. All existing members of the org are staying members. In the most reduced/scoped-down case, someone will still be part of an "Alumni" team in the org to signal their past involvement. Thank you for your past contributions, and we certainly welcome you to play a more active role in the future.
Timeline
2024-02-26: public PR
2024-03-04: notify affected parties with @mention:
2024-03-08: merge this change after incorporating feedback
2024-03-08: remove empty teams