Change Details

=== Background On 2019-02-27 TechCom approved {T216295}, giving birth to the unified and consolidated [Gerrit Privilege policy](https://www.mediawiki.org/w/index.php?title=Gerrit/Privilege_policy&oldid=3395019) as part of the [official Wikimedia development policies](https://www.mediawiki.org/wiki/Development_policy). The policy outlines the rights and responsibilities of developers holding the C+2 right and describes the processes for requesting and revoking these rights. === Problem The current policy, as stated, has some holes that need to be covered, as illustrated by a recent example (T234124). TechCom has identified the following areas needing further clarifications: 1. Process to follow in case there are no comments from relevant parties to a given request - As per the current policy, when there is no consensus, the request should be escalated to TechCom. However, TechCom feels that //no comments// does not equate to //no consensus//, and therefore this explicit case should be covered. 2. Involvement of current extension maintainers - The privilege request section of the policy deals with the general case. Alas, most requests are for extension repositories, so this particular case should be addressed. 3. Process to follow when privilege is being requested for an unmaintained repository - The policy addresses existing and new extensions, and assumes they have active maintainers, but that's not always the case: there is a number of repositories without active maintainers. The policy should be amended to clarify the process in this case. 4. Which developers are deemed as //trusted// - The //Requesting Gerrit privileges// section mentions trusted developers, but it is not clear from this or any other policy who they are. It should be clarified. === Proposed Amendments The proposal is to amend the //Requesting Gerrit privileges// section to address all of the aforementioned drawbacks. The following changes are proposed: - Add a new paragraph after Paragraph 3 with the following contents: //Upon the task's creation, a Gerrit administrator must ensure all relevant parties are notified, always involving at least some trusted developers. Additionally, for repositories other than mediawiki-core (and specifically all extensions and services deployed in the WMF cluster) the repository's maintainer(s) must also be notified and their explicit consent on the ticket is needed for the request to be granted. Should the request be made for a repository without an active maintainer, the request is to be rejected and the requester instructed to create a new repository based on the one they are asking access to.// - Paragraph 6: Add at the beginning //If there are no comments from relevant parties after the grace period, the request should be rejected.// Furthermore, the //Definitions// section should be amended to include the definition of //trusted developers//: - //Trusted developers: The group of developers that were granted the +2 right at least two years prior to the request and have actively contributed to either the repository in question or to mediawiki-core since.// For clarity, a draft containing the full version of the policy amended per the above proposal can be found [here](https://www.mediawiki.org/w/index.php?title=User:Mobrovac-WMF/Draft_Gerrit_policy_v1.1&oldid=3500115) (the amendments can also be seen in wikitext form by looking at [this diff](https://www.mediawiki.org/w/index.php?title=User%3AMobrovac-WMF%2FDraft_Gerrit_policy_v1.1&type=revision&diff=3500115&oldid=3500113)).

=== Background On 2019-02-27 TechCom approved {T216295}, giving birth to the unified and consolidated [Gerrit Privilege policy](https://www.mediawiki.org/wiki//index.php?title=Gerrit/Privilege_policy&oldid=3395019) as part of the [official Wikimedia development policies](https://www.mediawiki.org/wiki/Development_policy). The policy outlines the rights and responsibilities of developers holding the C+2 right and describes the processes for requesting and revoking these rights. === Problem The current policy, as stated, has some holes that need to be covered, as illustrated by a recent example (T234124). TechCom has identified the following areas needing further clarifications: 1. Process to follow in case there are no comments from relevant parties to a given request - As per the current policy, ..when there is no consensus, the request should be escalated to TechCom. However, TechCom feels that //no comments// does not equate to //no consensus//, and therefore this explicit case should be covered. 2. Involvement of current extension maintainers - they should be mentionedThe privilege request section of the policy deals with the general case. Alas, most requests are for extension repositories, so this particular case should be addressed. 3. Process to follow when privilege is being requested for an unmaintained repository - this should not be possibleThe policy addresses existing and new extensions, and assumes they have active maintainers, but that's not always the case: there is a number of repositories without active maintainers. The policy should be amended to clarify the process in this case. 4. Which developers are deemed as //trusted// - it should be clear to everyone who these areThe //Requesting Gerrit privileges// section mentions trusted developers, but it is not clear from this or any other policy who they are. It should be clarified. === Proposed Amendments {{todo}}The proposal is to amend the //Requesting Gerrit privileges// section to address all of the aforementioned drawbacks. The following changes are proposed: - Add a new paragraph after Paragraph 3 with the following contents: //Upon the task's creation, a Gerrit administrator must ensure all relevant parties are notified, always involving at least some trusted developers. Additionally, for repositories other than mediawiki-core (and specifically all extensions and services deployed in the WMF cluster) the repository's maintainer(s) must also be notified and their explicit consent on the ticket is needed for the request to be granted. Should the request be made for a repository without an active maintainer, the request is to be rejected and the requester instructed to create a new repository based on the one they are asking access to.// - Paragraph 6: Add at the beginning //If there are no comments from relevant parties after the grace period, the request should be rejected.// Furthermore, the //Definitions// section should be amended to include the definition of //trusted developers//: - //Trusted developers: The group of developers that were granted the +2 right at least two years prior to the request and have actively contributed to either the repository in question or to mediawiki-core since.// For clarity, a draft containing the full version of the policy amended per the above proposal can be found [here](https://www.mediawiki.org/w/index.php?title=User:Mobrovac-WMF/Draft_Gerrit_policy_v1.1&oldid=3500115) (the amendments can also be seen in wikitext form by looking at [this diff](https://www.mediawiki.org/w/index.php?title=User%3AMobrovac-WMF%2FDraft_Gerrit_policy_v1.1&type=revision&diff=3500115&oldid=3500113)).