docs(GOVERNANCE): membership rules and consensus

[ghermeto]

This is what we agreed in the meeting with a a couple slight modifications:

1. It was suggested by @wesleytodd that instead of opening a ticket to confirm membership we could open a PR for 7 days. I like the idea because allows us to automate pretty much everything. Past members are always welcome back by opening a PR and adding themselves back to the membership list;
2. we will only suggest removal from members that have no activity in the last 6 months. This way, even if someone didn't have time to comment on the PR they won't be removed as long as they had any activity on this repo;

[Ethan-Arrowood]

LGTM

[wesleytodd]

I like these changes. I think with a GH action on a cron we can automate the entire things. The only requirement will be someone who can manage team membership in the org needs to create a token and add it to this repo as a secret. Who wants to do this for us? I can setup the action once we have that.

[ljharb]

Note that secrets are only available to PRs from the same repo, not from forks, which means that a user must have write access on the repo to be able to utilize the secret.

[wesleytodd]

The user's PR wouldn't be the trigger for the one which needs the secret. The secret would be in the prune job which would be on a cron. After a discussion on the first meeting we discussed only adding to the team after merging the the original PR and then seeing the person actually participate some. That part is manual, so maybe we could also automate that, but I was more focused on the 6mo revisit since that will be hard to remember and do without some automation.

[mhdawson]

LGTM

[wesleytodd]

Ok, I think this is ready, but I would like to get the automation landed before we update the instructions. Once we have that I can test it out with all of the existing open issues by migrating them all to PR's. Does this sound reasonable? If so I can land that this weekend.

[ghermeto]

Can you give more context on why you prefer having the automation first? To me feels like the automation is an outcome of this PR...

[wesleytodd]

Well if we merge this PR then someone opens a membership request it will require extra work. I would prefer to have the automation in place so the instructions are actually correct about what to expect. I guess maybe that is being to particular, so if others disagree I guess we can just merge this. I will hopefully be able to get it done tonight anyway, so maybe it is not of consequence.

[ghermeto]

Well, I guess it doesn’t matter... it can wait. I was just assuming the automation to add new members would kick in on approvals and not on PR creation, and this way it would work for open PRs.

How are we aligning on those GH actions anyway? Do you create PRs for these as well?

[wesleytodd]

I was just assuming the automation to add new members would kick in on approvals and not on PR creation, and this way it would work for open PRs.

It is a bit of a combination, but yeah I think the implementation I have would work on older ones as well because it waits for 48 hours, no "change request" reviews and at least 2 approvals by existing members. So I see what you mean that it probably will just work. If you want to go ahead and merge it that is fine by me!

How are we aligning on those GH actions anyway? Do you create PRs for these as well?

I will be tomorrow. I got about half way done with it tonight. As a part of building it I will have a set of tests so folks can make sure the functionality is reasonable. My hope is this can also be used for how we manage the triage team on Express, so I may have went a little overboard 😝

[ghermeto]

@wesleytodd can I merge this?

[wesleytodd]

@ghermeto for sure! Sorry I meant that in my previous message, sorry I was unclear.

For an update on the automation, I have most of it done and you can see it here: https://github.com/pkgjs/membership-updater

It is a WIP commit because I was working out some details with GH actions and it is missing the 6 month review step. I will finish that up before we add it here, as well as adding documentation. If I have time this week I will do that, if not and nodejs/admin#467 is resolved I will just manually add everyone who is outstanding for now.