-
Notifications
You must be signed in to change notification settings - Fork 0
FAPI_Meeting_Notes_2026 07 08_Atlantic
Date: 2026-07-08 14:00 UTC
Location: Zoom
| Name | Affiliation |
|---|---|
| Nat Sakimura | NAT.Consulting / Authlete (Chair) |
| Christopher Robbertse | Ozone API |
| Imran Ulghar | Open Banking Limited (OBL) |
| Filip Skokan | Okta |
| Kosuke Koiwai | KDDI |
| Domingos Creado | OIDF |
| George Fletcher | Practical Identity |
| Lukasz Jaromin | Raidiam |
| Matthew Murphy | Mastercard (left 00:29:36, before AOB) |
| Bjorn Hjelm | Yubico |
1. Roll Call (Nat)
2. Adoption of Agenda (Nat)
3. Reporting on the GitHub migration (Domingos)
4. Events (Nat)
5. External Orgs & Liaisons (Nat)
6. PRs (Nat) — skipped
7. Issues (Nat) — skipped
8. AOB (Nat)
Agenda adopted without additions.
Domingos presented a status update on the Bitbucket-to-GitHub migration:
-
Driver: Bitbucket is reaching end of life (expected beginning of next month), prompting the Foundation to phase out all repos there. FAPI was the last group migrated, using the same tooling previously applied to the Connect and eKYC-IDA working groups.
-
Identity mapping: Bitbucket and GitHub use different user IDs/aliases with no reliable 1:1 mapping, so:
- Issue assignments could not be preserved and were dropped.
- References to individuals inside issue text/comments were preserved as plain text (original Bitbucket display name), not as linked GitHub mentions.
- Some historical Bitbucket users had not shared a public name/email on Atlassian; their comments now show as an anonymous user.
-
Merge Requests (MRs): Not migrated. Some MRs sourced from external systems/other Git repos, so all MR data was extracted and archived for posterity instead of being recreated on GitHub.
-
Issues: Migrated and mapped as closely as possible to GitHub's issue model:
- Bitbucket priority, type, and "component" metadata were all mapped to GitHub Labels (not the newer GitHub Issue Fields feature — Filip asked specifically; Domingos confirmed labels were used throughout).
- Some issues have no component label because the source issue had none assigned.
-
Repo state: The GitHub repo is currently public. Open items needing WG input:
- The README is a stale copy of the Bitbucket README and needs a refresh (also add a note pointing to GitHub as the new home).
- All Git branches were copied over 1:1, including many stale ones; disposition (keep vs. delete) is undecided. Nat suggested closing stale ones since nothing should currently be outstanding.
Filip flagged that a new issue was filed in the old Bitbucket tracker only yesterday, confirming it isn't yet closed or read-only, and that some contributors still have notifications enabled there. He suggested posting a one-time comment on all currently open (not closed) Bitbucket issues pointing people to GitHub before locking the tracker down.
Domingos noted Bitbucket has no native read-only/archive mode for issue trackers (unlike GitHub); the closest available option is revoking all permissions on the repo.
Agreed approach:
- Nat will open a new Bitbucket issue (862 (post-cutoff; not migrated)) with an all-caps banner — "DON'T POST ISSUES HERE, WE'VE MIGRATED TO GITHUB, SEE DETAILS IN THIS TICKET" — pointing to the GitHub repo.
- Nat will then switch the Bitbucket FAPI issue tracker to private so it's no longer publicly visible.
Bitbucket previously displayed a notice requiring a signed IPR contribution agreement before an issue could be filed. GitHub issues are currently open to anyone, and it's unresolved whether/how to restrict issue creation there.
Discussion of options:
- Domingos referenced how W3C handles this: a bot checks whether a GitHub ID has signed their agreement, auto-labels issues accordingly, and performs initial triage.
- Filip noted several existing CLA-checking GitHub Marketplace apps could likely be adapted to check for IPR (rather than CLA) sign-off, auto-label issues, and post a reminder comment to unsigned contributors. A custom GitHub Action scripted in-house is an alternative.
- Domingos noted a practical blocker: the Foundation's DocuSign-based membership/contribution agreements don't currently correlate to GitHub IDs. A campaign to map signer emails to GitHub IDs would be needed. He has a proposal and will discuss it with Nat offline.
-
Nat confirmed he can pull the existing OIDF wiki meeting notes and push them into the GitHub repo himself; Domingos confirmed Nat has admin/maintain rights on the repo with full permissions to do so.
-
Open question from Domingos: should WG members be able to create branches directly on the shared repo, or should all contributions go through personal forks + PRs (mirroring the Bitbucket process)? No decision reached.
-
Current baseline ruleset already applied by Domingos to all migrated repos:
-
masterbranch is protected. - All changes to
mastermust land via merge commit (no force-pushes). - At least one PR approval is required.
- GitHub supports stronger options not yet adopted (e.g., requiring two or three reviewer approvals).
-
-
George Fletcher suggested the Foundation should define a default cross-WG governance policy (who can merge to main, who can approve PRs), which chairs could then extend per working group — noting the same gap has come up in the Connect WG.
-
Bjorn Hjelm agreed, and noted it would have been easier to settle this before the newer working group with existing approval/closing rules was chartered. There was no formal written policy in the Bitbucket era, though most groups followed similar informal conventions. It's unclear who should own collecting chair feedback to converge on a harmonised policy; ideally this would have been resolved before the migration began.
-
Domingos separately raised whether the Foundation's new IAM access-review policy (adopted as the org grows) extends to GitHub repo access — this is unresolved; he had previously raised it with Mike L. without a clear answer.
-
Nat clarified the IAM policy is intended primarily for OIDF employees, not working-group repo administration, and that a separate access policy is needed for WG GitHub repos. He asked members to send suggestions to the mailing list or to the chairs, so they can be raised with the board subcommittee on process.
In chat, Kosuke Koiwai noted that Mike Jones had previously objected to naming repos after specific working groups, since specifications can move between working groups over time. George Fletcher confirmed the same point was raised during the Connect WG migration.
Nat relayed Mike Leszcz's report: no changes to previously reported events. No new items raised from the floor.
Mike Leszcz reported no material updates from last week.
Christopher Robbertse noted he is meeting with the OpenAPI working group next week to discuss FAPI/security-profile alignment. Anyone wanting to join should contact Chris directly (cc the chairs) for an invite.
Skipped — frozen during the migration. No items raised.
None raised.
| Owner | Action | Due Date |
|---|---|---|
| Domingos | Refresh GitHub repo README (currently stale Bitbucket copy); add pointer to new GitHub home | TBD |
| Domingos | Decide disposition of stale/legacy branches carried over from Bitbucket | TBD |
| Domingos | Draft proposal for IPR/CLA verification bot (labelling + reminder comments or GitHub Action); discuss with Nat offline | TBD |
| Domingos | Develop process to map DocuSign contribution-agreement signers to GitHub IDs; discuss with Nat offline | TBD |
| Nat | Open Bitbucket issue 862 (post-cutoff; not migrated) with banner directing users to GitHub | TBD |
| Nat | Set Bitbucket FAPI issue tracker to private | TBD |
| Nat | Pull existing wiki meeting notes and push to GitHub repo | TBD |
| WG members | Send repo governance / branch & PR-approval policy suggestions to mailing list or chairs, for board subcommittee discussion | TBD |
| Christopher Robbertse | Add interested members to OpenAPI/FAPI security alignment meeting invite | Next week (~2026-07-15) |
| Reference | Link |
|---|---|
| OIDF Policies (Antitrust/IPR) | openid.net/policies |
| Bitbucket sunset notice issue | 862 (post-cutoff; not migrated) (Bitbucket FAPI tracker) |