[discussion] PR merging policy / external contributors?

[iasdeoupxe]

Hi *,

more then 1 month ago i had created a PR #1583. As i'm not that often online at github i was a little bit surprised (and shocked) that this this PR didn't got merged yet or even received any response at all.

Without any insights into your merging policy i'm currently asking myself:

1. Is there anything wrong / missing with this PR?
2. Are external PR not accepted / desired?
3. Is anything else blocking merging the PR (resources, knowledge on how to test, ...)?

It seems that the PR itself is not the only one of external contributors without any response / assignment or feedback.

Based on the above i would give some feedback to the Wazuh project / repository. If a PR is created by external contributors it would be great:

1. to have at least a minor / small response like "Hey, thanks for your PR. We currently are reviewing your contribution and (come back to you later/requiring more time/currently don't have any resources to review it|...).

2. if no response is given at least assign the PR to a specific tag/milestone or PR reviewer to at least show that the PR was noticed.

Without the above i'm asking myself if it worth to put effort into creating PR into the future.

Thanks

[chemamartinez]

Hi @iasdeoupxe,

We are very sorry about your feelings.

Our first priority is always the users and the community, and for us it is very important to get feedback and contributions from them as well as it is very appreciated.

The only reason why your PR wasn’t reviewed until today is because of the lack of resources we have faced this last month. We were focused on a hard release, Wazuh v3.7.0, which took almost all of our time and probably we didn’t noticed your PR. I know it is not a valid argument due to give you a simple response would take about 1 minute, so the only thing I can say is that we are trying to improve our procedures every day to avoid this situations any more.

Please, if you find yourself in the same situation in the future don’t hesitate to insist us as much as needed.

Finally, the PR #1583 has already been reviewed and it will be included in the next released version. Thank you so much for your contribution again.

Best regards,
Chema.

[juergenc]

Hello @chemamartinez,

I read what @iasdeoupxe wrote here and I was keen on hearing what the answer here is. Alright, you was/are short in resources, also the project becomes more attention from the communitiy, on the other side you work on a hard release. Indeed, all points are in the area of conflict.

I observed the progess of release 3.7.0 the last two months with certain interest from "outside" and also it struck me that it is a very hard and big release -probably too big- and the team is really fighting. The lag response at the other side frustrates the community but also you, the dev-team, not getting feedback short time later about the new features or bug fixes. When I see 320 tickets and I don't know how many commits, 17 revisions and after two months a release with ~20 new or regression bugs four, five days after the hard release - mustn't it be frustrating to the dev-team (and what about the community)?

I drove a software project with many components and ~360.000 lines of code for many years. Making big releases is always a pain in the a** for all parties, the DEV-team, QA-team and the OPS-team, nobody likes this and it generates a lot of frustration cause of complexity, working effort and bearing higher risk of project failure.

Make smaller releases, release more often, means faster feedback from community, less effort and frustration and being faster providing forward-fixes.

Just my five pence,
Jürgen

[iasdeoupxe]

Hi @chemamartinez, thank you very much for your open words. This is really way more then i had expected to receive 👍 .

It is fully understandable that teams are busy with new releases, especially on such bigger ones. Adding the burden / additional workload of reviewing / testing submissions by external contributors doesn't make it easier.

Before doing this post i was just unsure because my PR was not the only one of external contributors (external in the meaning of (not) having a "Contributor" badge and not being part of the Wazu github orga) which are not commented / stuck since longer time: #1106, #1497, #1602 and similar.

If there are no additional topics to discuss (like the points mentioned by @juergenc above) i could happily closing this issue.

Happy to contribute additional things (if i find some things) to this project.

Thanks again to you and your team for the work on this great project.

[iasdeoupxe]

It seems something similar is also happening at the wazuh-ruleset repository. Quite a lot of PRs are "hanging" around since months without an assignee or a comment (e.g. wazuh/wazuh-ruleset#239, wazuh/wazuh-ruleset#246, wazuh/wazuh-ruleset#232 and so on). Especially with such simple PRs like wazuh/wazuh-ruleset#245 and wazuh/wazuh-ruleset#243 which are easy to review / merge.

I had even closed one PR (wazuh/wazuh-ruleset#187) because if something takes nearly 6 months to merge it doesn't make sense to keep the PR open.

Maybe if there are resources/manpower missing to review PRs it could make sense to ask for some help of the community around Wazuh?

[Zenidd]

Hello @iasdeoupxe,

We're really sorry for the delay we're taking with the community PR's. We are doing our best to be able to review all the PRs in depth before integrating them into the project to ensure that Wazuh remains stable.

We will continue improving our response time so that these situations do not occur.
I would also like to thank you for your contributions to the Wazuh project.



Best regards,

Juan Pablo Sáez

[iasdeoupxe]

All fine, i think we could close this issue. 👍