Simplifing (and cleaning up) our Repositories

[josephlr]

Hey @tpm-rs/trustaceans!

I'm Joe Richey, and I recently changed teams at Google to be working on tpm-rs full time! I'm also now a member of the TPM-RS Steering Committee (tpm-rs/governance#8). I've done some work with TPM2 + Rust in the past (https://github.com/josephlr/tpm2-rs and #65), I'm a former maintainer of go-tpm and go-tpm-tools, and I'm a current maintainer of the getrandom and rand Rust crates.

Initially, I'm focusing on simplifying:

• Where we have our discussions (see Proposing limiting locations for various discussions #177)
• How many repositories we have (12 is a lot)

Please let me know if you have feedback on the plan below. I don't want to step on anyone's toes.

Discussions and Issues

I migrated all of the issues/discussions in the org to one of:

• The Issues for tpm-rs/tpm-rs: https://github.com/tpm-rs/tpm-rs/issues
  • This is where the vast majority of discussion was taking place, so I didn't want to disturb it.
• The Discussions for tpm-rs/tpm-rs: https://github.com/tpm-rs/tpm-rs/discussions
  • This is also now what https://github.com/orgs/tpm-rs/discussions points to, which should reduce confusion.
  • I added some initial discussion categories, but these are just an initial idea for sorting discussion.
  • We will probably want to establish what things go in Issues vs Discussions.

Organization Teams

I updated our permissions to be less confusing.

• @tpm-rs/steering-committee (who are also the Org Owners) now have Admin privileges on all repositories.
• @tpm-rs/maintainers now have Maintainer privileges on tpm-rs/tpm-rs and tpm-rs/docs.
  • @oddcoder is still also a maintainer of tpm-rs/docs.
• @tpm-rs/trustaceans now have Triage privileges on most repositories.
  • This means that most org members no longer have direct write access to tpm-rs/tpm-rs, but this is probably a good thing. In my experience, if all contributors have write access, you end up with way too many branches in the repo. It's much easier to have most/all contributors contribute from their own forks.
  • @esmusick and @nzietlow still have Write access to tpm-rs/tpm-rs for now, as they have personal branches there. I'm fairly sure these are stale and can be deleted, but I wanted to check with them first.

Note that @tpm-rs/moderators is currently empty, so the Steering Committee members are also the moderators, but we can add additional moderators to that group if it's ever necessary.

Repositories I think we should keep

• Public: https://github.com/tpm-rs/tpm-rs (duh)
  • This is main Public repo which hosts our Issues and Discussions.
• Public: https://github.com/tpm-rs/docs
  • We might want to consider just having the docs be part of the main repo. However, as https://github.com/rust-lang/rfcs shows, it can be useful to have our design docs and associated discussions in a standalone repo.
• Public: https://github.com/tpm-rs/governance
  • This only has @tpm-rs/steering-committee as the maintainers, as they have to approve any changes.
• Private: https://github.com/tpm-rs/.github
  • Special repo only used to set our Org-level README
• Private: https://github.com/tpm-rs/template
  • Contains the legal docs used to create new repositories.
• Private: https://github.com/tpm-rs/cla-signatures
  • Needed to make the CLA bot work
  • Only visible to @tpm-rs/steering-committee as it might contain personal info of folks who've signed the CLA.

These repos should also have:

• Branch protection for main
  • Requiring PRs with an approval to push changes
  • Maintainers/Owners/Admins should also be subject to this requirement, so that all changes are reviewed.
• "Automatically delete head branches" enabled (to ensure stale branches are cleaned up)
• Only merge commits or squash merging allowed (so that the PR# is in the git history)

Repositories I think we should delete

• https://github.com/tpm-rs/project-wide-discussions
  • With the discussion migration to tpm-rs, this is now empty and unnecessary.
• https://github.com/tpm-rs/.github-private
  • We should just have https://github.com/tpm-rs/.github contain our Org-Level README. I don't think there's a need for a "member's only" view.
• https://github.com/tpm-rs/media
  • This only contains two images, it should just be moved to https://github.com/tpm-rs/docs
• https://github.com/tpm-rs/SteeringCommitteePrivate and https://github.com/tpm-rs/MaintainersPrivate
  • Github isn't a great medium for having private discussions, and we should try to have most of our discussions in public.
  • In practice, most private discussions take place over email anyway, as we often have to include other members of the TCG.
  • For security related stuff, Github's Security Advisories are a better fit than locked-down repos.
• https://github.com/tpm-rs/clabot-test
  • @bradlitterell I think this is no longer needed?

Housekeeping things I still need to do

• Fix the LICENSE files so GitHub recognizes them
• Fix the failing CLA bot
• Update tpm-rs/governance docs to include the team structure and other stuff I mentioned above, provided there are no objections.
• Update https://github.com/tpm-rs/tpm-rs/blob/main/MAINTAINERS.md to:
  • Reflect the current maintainers
  • Document the process for adding/removing maintainers from the org