[QGIS-Developer] qgis/QGIS repo: revoking commit rights on "dormant" contributors

[Alessandro Pasotti]

Hi,

at the security meeting in LAAX we talked about how to reduce the
vulnerabilities and decided that we should keep the number of people
that have commit rights to qgis/QGIS repo at the minimum.

There are many people that haven't committed anything for years, and
they do not need to have commit rights right now.

The problem is that commit rights are currently bound to voting rights.

Before I draft a QEP I'd like to hear from you if you think this is a good idea:

- create a github "fake" core committers repository with just a README inside
- create a "QGIS Committers" team that has commit rights in the "fake" repo
- put every contributor that currently have commit rights in any of
the qgis org repositories into the "QGIS Committers" team
- for all repositories except the "fake" one: revoke commit rights to
all developers that haven't committed anything in the last 6 months

Note: committers that need their commit rights back will just need to
ask to get them back.

This way we don't need to change the statute of the QGIS association
(and wait for the next AGM).


-- 
Alessandro Pasotti
QCooperative:  www.qcooperative.net
ItOpen:   www.itopen.it