>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #2666584. --> Reported by: [jthorson](https://www.drupal.org/user/148199) >>> <h2>Why should this issue be prioritized:</h2> <p>Amendments to the project applications process will unblock significant roadblocks to on-boarding new contributors, and remove a long-standing <a href="https://www.drupal.org/project/issues/projectapplications?status=8&amp;order=last_comment_timestamp&amp;sort=asc">pain point</a> for new entrants to the Drupal community.</p> <h2>Summary of Proposal (500 words or less):</h2> <p>After numerous false starts in the attempt to revamp the existing project applications process for obtaining permission to create &lsquo;full projects&rsquo; on Drupal.org (largely due to a lack of clarity around governance and ownership of decision making surrounding the issue), the Technical Working Group coordinated with the Drupal.org Software Working Group and Drupal Security Team to come up with a proposed &lsquo;next step&rsquo; for the project applications process. The proposal, outlined in <span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/drupal_twg/issues/2453587" title="Status: Closed (fixed)">#2453587: [policy, no patch] Changes to the project application review process</a></span>, attempts to strike a balance between removing roadblocks to contribution for new contributors, and maintaining the community&rsquo;s reputation for high standards of quality with regards to both code and security coverage for contributed projects listed on Drupal.org.</p> <p>A proposed implementation plan is currently being circulated for comments amongst the TWG and Security team. Constructive comments and feedback welcome. <a href="https://docs.google.com/document/d/1eaI0Jq5CIVClCHv4uAxbJVHky5twPkWOqJ-AsG5u9HI/edit?usp=sharing">https://docs.google.com/document/d/1eaI0Jq5CIVClCHv4uAxbJVHky5twPkWOqJ-AsG5u9HI/edit?usp=sharing</a></p> <h3>Constraints on the Solution</h3> <ol> <li>We need to remove the gate to new contribution entirely - not just kick the can to a particular elevated role, or a specific limit on the # or kind of releases a new contributor is allowed.</li> <li>We need to continue to send strong signals about security coverage to users evaluating whether to use modules from Drupal.org. </li> <li><strong>Follow-up:</strong> We need to find ways to preserve the value collaborative code review, through changes to Project Discovery to provide signals about code quality, and by providing incentives and credit for review.</li> </ol> <p>After much discussion among many parties, including: @kattekrab, @dries, @mlhess and the security working group, myself, and users who have commented in these issues - we have found a solution. This is based on the initial proposal and work put together by @jthorson, adjusted to meet the above constraints more strongly. </p> <h3>Solution: High Level overview:</h3> <ul> <li>The git user role (which any confirmed user can get by agreeing to the terms) will be able to: <ul> <li>Create any number of projects (we will need a better policy for abundant namespaces) </li> <li>Create any releases for those projects</li> </ul> </li> <li>All new projects will have a new option to opt in to security team coverage. <ul> <li>Those that do not, will get a warning message on the project page and on the update status page for their sites. (this will require core updates for the update status)</li> <li>A role is required to opt in to security team coverage. We can repurpose the &ldquo;git vetted user&rdquo; role to &ldquo;Opt into security team coverage&rdquo; </li> </ul> </li> <li>For now, to get the new &ldquo;Opt into security team coverage&rdquo; role, we will use basically the current project application process - however instead of being a gate on new project contribution, it is only a gate on participating in security team coverage.</li> <li>Because this opt-in process is now decoupled from the project creation/release process and is wholly in the domain of security coverage it can be replaced by a coding standards quiz or whatever the SecWG decides will best manage their work, sometime in the future. </li> </ul> <h3>Solution: User stories/issues:</h3> <p><del>Phase 1: Preserve the signals about project that give Drupal its security reputation:<br> </del> </p><ul> <li><span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/drupalorg/-/work_items/2035277" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/drupalorg/-/work_items/2035277</a></span></li> <li><span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/drupalorg/-/work_items/786702" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/drupalorg/-/work_items/786702</a></span></li> <li><span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/drupalorg/-/work_items/2457643" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/drupalorg/-/work_items/2457643</a></span></li> <li><span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/drupalorg/issues/2787165" title="Status: Closed (fixed)">#2787165: Add security advisory coverage field to projects</a></span> <ul> <li>Mass update all existing full projects with stable releases to indicate they are 'covere'd ^^ in the new field</li> <li>Allow security team members to update the security advisory coverage field on projects</li> </ul> </li> <li><span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/drupalorg/issues/2853696" title="Status: Closed (fixed)">#2853696: Add security advisory coverage to update status XML</a></span></li> <li><span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-13"><a href="https://www.drupal.org/project/drupal/issues/2766491" title="Status: Needs work">#2766491: Update status should indicate whether installed contributed projects receive security coverage</a></span>, needs backport to D7</li> </ul> <p><del>Phase 2: Set up the opt-in process</del></p> <ul> <li><span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-5"><a href="https://www.drupal.org/project/drupalorg/issues/2825912" title="Status: Closed (won't fix)">#2825912: Rename &ldquo;Git vetted user&rdquo; role to &ldquo;Opt into security advisory coverage&rdquo;</a></span> &lt;- security team can set up their opt in process to receive that</li> <li>Allow node owners of projects with the 'May opt-in...' role to update the advisory coverage field to opt-in.</li> </ul> <p><del>Phase 3: Open the gates!</del></p> <ul> <li>Allow git-users to create full projects and releases* &lt;-- this opens the gates <ul> <li><span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/drupalorg/-/work_items/2666576" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/drupalorg/-/work_items/2666576</a></span></li> </ul> </li> <li>Update all appropriate documentation - <strong>Please help us with this!</strong> <ul> <li><a href="https://www.drupal.org/node/636570">Project application documentation</a></li> <li><a href="https://www.drupal.org/node/1011698">Applying for permission to opt-in to security advisory coverage</a></li> <li><a href="https://www.drupal.org/node/251466">Dealing with abandoned projects</a></li> </ul> </li> <li>Followups <ul> <li><span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/drupalorg/issues/2859739" title="Status: Closed (fixed)">#2859739: Make the &ldquo;not covered&rdquo; security warning more visible on project pages</a></span></li> <li><span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/drupalorg/issues/2858261" title="Status: Closed (fixed)">#2858261: Allow any vetted maintainer, not just project owner, to opt into security coverage</a></span> helps organization-account owned projects</li> <li><span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/drupalorg/issues/2860311" title="Status: Closed (fixed)">#2860311: Remind maintainers what a full release is when creating one</a></span></li> <li><span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-3"><a href="https://www.drupal.org/project/drupalorg/issues/2859696" title="Status: Closed (duplicate)">#2859696: Auto-delete projects without code</a></span> to help with namespace spam</li> </ul> </li> </ul> <p><strong>Next:</strong> <span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-1"><a href="https://www.drupal.org/project/drupalorg/issues/2861341" title="Status: Active">#2861341: [PAR Phase 4] Improve project discovery with strong project quality signals(automated) and incentivize peer code review(manual)</a></span></p> <h3>Community Team:</h3> <p><a href="https://www.drupal.org/u/jthorson">jthorson</a> TWG liason<br> <a href="https://www.drupal.org/u/mlhess">mlhess</a><br> <a href="https://www.drupal.org/u/kattekrab">kattekrab</a></p> <h3>Drupal Association Liaison(s):</h3> <p><a href="https://www.drupal.org/u/Drumm">Drumm</a><br> <a href="https://www.drupal.org/u/hestenet">hestenet</a> </p> <h3>Availability: </h3> <p>DA has prioritized time in Q1 2017</p> <h3>Long term support: </h3> <p>The DA and security team have agreed to support the process outlined in the high-level overview/user stories above</p> <h3>Related issues</h3> <h4>Meta / background</h4> <li><span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/drupal_twg/issues/2453587" title="Status: Closed (fixed)">#2453587: [policy, no patch] Changes to the project application review process</a></span></li> <h4>'Value Add' tasks</h4> <li><span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/drupalorg/-/work_items/2659570" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/drupalorg/-/work_items/2659570</a></span></li> <li><span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/project/issues/2660164" title="Status: Closed (fixed)">#2660164: Co-maintainer of a sandbox project can't promote that project</a></span></li> <li><span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/project/issues/1734960" title="Status: Closed (fixed)">#1734960: Provide no default project short name on full project promotion form</a></span></li> <h4>Long term 'value add' tasks to consider</h4> <ol> <li>Introduce Automated Scans for security and coding style <span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/drupalci_testbot/issues/1266444" title="Status: Closed (fixed)">#1266444: DrupalCI should return failed for poor code style - php</a></span></li> <li>Display scan results on project pages <span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-3"><a href="https://www.drupal.org/project/drupalci_testbot/issues/2589853" title="Status: Closed (duplicate)">#2589853: Integrate PHP CodeSniffer test with drupal.org</a></span></li> </ol> > Related issue: [Issue #2453587](https://www.drupal.org/node/2453587) > Related issue: [Issue #2660164](https://www.drupal.org/node/2660164) > Related issue: [Issue #1734960](https://www.drupal.org/node/1734960) > Related issue: [Issue #1266444](https://www.drupal.org/node/1266444) > Related issue: [Issue #2589853](https://www.drupal.org/node/2589853) > Related issue: [Issue #2809373](https://www.drupal.org/node/2809373) > Related issue: [Issue #2858911](https://www.drupal.org/node/2858911)