Implement libs team refactor (RFC 3984) - #2651
Conversation
0810b15 to
14cbe3a
Compare
Dry-run check results |
|
I think the Zulip stream setup proposed here makes sense, and I wouldn't change it. Same with merging the alumni, it checks out. The only bit I'm not 100% sure on archiving vs deleting libs-contributors & libs-api since functionally they're all just being merged, but I think this is the right call for historical preservation reasons. lgtm, and I'm happy to merge this as-is as soon as the refactor FCP is done |
|
Probably still gonna need a sign off from @Amanieu too as a team lead but otherwise, yeah, I figure Zulip rearranging can happen after the fact. |
This comment has been minimized.
This comment has been minimized.
14cbe3a to
6f1b9de
Compare
| [[zulip-streams]] | ||
| name = "t-libs/private" |
There was a problem hiding this comment.
We should just drop the private channel. It's basically dead and all the internal discussions are happening on the t-libs/reviewers channel. I see no need to keep a separate channel for libs-fcp.
There was a problem hiding this comment.
I'm fine with that, although my inclination is to assign libs-fcp to it first so it doesn't dump the new libs team in there immediately, then delete it in a future PR. Not that it matters, since it's not going to reveal old messages or anything, but to avoid confusion.
Since I believe deleting it from this PR will just cause its permissions to remain the same, which would dump all of the new libs into it.
There was a problem hiding this comment.
i believe perms are per-user, not per-group. either way this is smth infra can clarify, it seems we agree on the intent being to archive that channel without adding anyone new
There was a problem hiding this comment.
AFAIK the Zulip channel has group permissions, so the users would be added because their group changed, not because the channel changed. But either way, yeah, I'm happy to remove the channel from the PR if infra is fine coordinating that.
We would also want to name the reviewers channel to t-libs/private too, presumably.
There was a problem hiding this comment.
Permissions are tied to per-user at least from I can tell.
jieyouxu
left a comment
There was a problem hiding this comment.
team-repo-admin approval given, this needs an infra-admin review as well since this modifies rust-lang/rust permissions.
There was a problem hiding this comment.
NB: this touches rust-lang/rust
| [[zulip-streams]] | ||
| name = "t-libs/private" |
There was a problem hiding this comment.
Permissions are tied to per-user at least from I can tell.
Mark-Simulacrum
left a comment
There was a problem hiding this comment.
It's unfortunately hard to tell what is actually changing permissions wise (i.e., where the libs team growing has influence). I think the crates.io thing is the primary one I see real risk in, but I may be missing other cases we granted libs access that may want to get removed as part of this transition.
| "the8472", | ||
| "thomcc", | ||
| "workingjubilee", | ||
| "yaahc", |
There was a problem hiding this comment.
This is adding everyone in this list with publish etc. access to the 20 crates currently owned (in part) by libs on crates.io - https://crates.io/teams/github:rust-lang:libs
I suspect we don't really want that. It's not an "umbrella privilege" laid out in the RFC. Some subset of those probably have restricted publishing to trusted publishing, which moves this to a question of repository access.
Should we maybe either remove that access on crates.io or move it to (say) crate-maintainers or libs-fcp? A few of those are controlled by team so we could do it here.
There was a problem hiding this comment.
libs-fcp is imo an acceptable option. we can always add perms to libs or crate-maintainers later, and libs-fcp should not consist of anyone we don't trust with that kind of access. we can always give libs write but not maintain perms for those crates
There was a problem hiding this comment.
cc @Amanieu in case you have a better idea short term, otherwise we can just move crate publishing to libs-fcp for now
There was a problem hiding this comment.
I brought this up at #t-infra > crates.io owners of rust-lang crates as well. But libc-fcp seems fine to me as well for now.
I think the solution mentioned there of having some bot handle yanks (release-plz?) and eventually removing libs-fcp would be the best long term option.
There was a problem hiding this comment.
I remember this discussion and wasn't 100% sure what the best long-term solution is, since write access to repos with CI publishing would mean that everyone effectively has crate-publishing privileges, but I also have no idea what the threat model here is anyway.
There was a problem hiding this comment.
I just went through every single crate owned by rust-lang/libs on crates.io. I think we can safely just remove rust-lang/libs from all of them (and add rust-lang-owner to the ones that are missing it).
These all fall into one of these categories:
- Crates where release-plz is used for publishing, which uses rust-lang-owner and is controlled by write access in the team repo.
- Crates that are mostly maintained by a select number of people who are additional owners (e.g. dlmalloc-rs which is maintained by alexcrichton)
- Crates that are deprecated/unmaintained and haven't had a release in years.
There was a problem hiding this comment.
As long as infra can yank crates as needed until we get a better solution for that (I assume they can), this sounds reasonable to me.
There was a problem hiding this comment.
infra-admins can, it's just a bit of a hassle since we need to get into the owner account. I guess we can mint a token with yank permissions and stash it somewhere easier/less risky to get into.
There was a problem hiding this comment.
So, just to clarify what exactly would be necessary to make these changes in the repo: we just need to remove teams = ["libs"] from the crates-io section of repos wherever it's present, right? (I did this, but what Amanieu said implies there is more than just a handful of them.)
There was a problem hiding this comment.
Side note, there are a few crates that have this listed for compiler as well, and since that team is so large, I'm actually unsure if this was noticed when they did their team refactor either.
| name = "T-libs" | ||
|
|
||
| [[zulip-streams]] | ||
| name = "t-libs/reviewers" |
There was a problem hiding this comment.
why not leave this as reviewers? that way private can be archived entirely and won't need a rename
There was a problem hiding this comment.
We could do that, I just figured it shouldn't be too difficult to coordinate.
Note: blocked on RFC 3984 merging, still has a few unanswered questions like renaming Zulip streams. Tried to split into a few commits to make reviewing easier.
Resolved items:
Remaining items: