Create access management policies for github.com/ossf

[steiza]

This work was in-flight before the new TAC was seated, see #155.

There's essentially two parts:

• Having repo membership managed by teams instead of individual accounts
• Should anyone be able to join github.com/ossf (to display a badge on their GitHub user profile)

[ljharb]

I'd be happy to find time to attend a TAC meeting if either of these points receive pushback, to argue in favor :-)

[SecurityCRob]

I agree that permission should be managed through roles/groups and not via individual entitlements. Can we get some folks to donate some time in assisting with the repo review and implementation of changes if the TAC approves?

[lehors]

Is there any downsides to this (other than requiring some work to implement it)?

[hythloda]

This was brought up in the TAC with @steiza @AevaOnline volunteering to help.
Some key terms: Member, Contributor, Maintainer

[AevaOnline]

I suggest separating these two tasks. The former (manage github access for maintainers by roles / groups) seems well supported by other procedural improvements that are in flight; the latter (allow open membership) would facilitate improvements in voting and representation of the contributor community, but may require more time to flesh out.

Key terms to capture definitions of, as we proceed with this:

• Member: an organization that is a Member of the Foundation, and typically has representation (either directly or indirectly) within the GB
• Maintainer: an individual responsible for maintaining one or more GitHub repositories within the Foundation
• Contributor: an individual who contributes to the Foundation's mission, and expressly includes those whose contributions are not reflected on GitHub such as participation in meetings, presentations at events, etc.

[ljharb]

I'm also able to help; I've already spent a bunch of time doing this auditing.

[hythloda]

I made the first pass of this for all the repositories in ossf. All individuals have been put on a team with similar access. If there are any problems with this you can ping me on slack or email us at [email protected]

I decided to remove individuals from the repo rather than wait for them to join the team so that we can move this more quickly. Some contributors are no longer active and I did not want the process held up.

[lehors]

SGTM. Thanks Amanda!

[steiza]

Both #155 and #171 have landed.