FYI GitHub pull request / issue tracker lockdown bot

FYI GitHub pull request / issue tracker lockdown bot

[Daniel P. Berrangé]

QEMU, like libvirt, has a github.com project which contains automated
read-only mirrors of QEMU repositories.

  https://github.com/qemu/

An unfortunate side effect of this is that some users will try to open
pull requests against these mirrors. These get ignored until eventually
someone notices and closes the request. QEMU has had about 90 prs opened
over the years.

  https://github.com/qemu/qemu/pulls

The same applies to the issue tracker, but fortunately github lets
projects disable this feature, which QEMU has done.

I have recently discovered that there is a nice 3rd party bot for github
which can autorespond to pull requests with a friendly comment, close the
request, and then lock it to prevent further comments.

  https://github.com/apps/repo-lockdown

I'm setting this up for libvirt and it was suggested QEMU can probably
benefit from it too as an example see:

  https://github.com/libvirt/test/issues/2
  https://github.com/libvirt/test/pull/3


Configuration just requires creation of a ".github/lockdown.yml" file
which provides the friendly message to add to the merge requests. This
can be either done per-repository, or a special repo can be created
called ".github" and this will apply to all repos within the project.

Ideally each repo would have a CONTRIBUTING.md file created too, since
both GitHub and GitLab will direct users to this file for guidelines
on how to contribute.

I don't have time right now to do this for QEMU, so consider this email
a friendly suggestion for some other interested person to do for QEMU...

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|

Re: FYI GitHub pull request / issue tracker lockdown bot

[John Snow]

On 4/3/20 10:22 AM, Daniel P. Berrangé wrote:
> QEMU, like libvirt, has a github.com project which contains automated
> read-only mirrors of QEMU repositories.
> 
>   https://github.com/qemu/
> 
> An unfortunate side effect of this is that some users will try to open
> pull requests against these mirrors. These get ignored until eventually
> someone notices and closes the request. QEMU has had about 90 prs opened
> over the years.
> 
>   https://github.com/qemu/qemu/pulls
> 
> The same applies to the issue tracker, but fortunately github lets
> projects disable this feature, which QEMU has done.
> 
> I have recently discovered that there is a nice 3rd party bot for github
> which can autorespond to pull requests with a friendly comment, close the
> request, and then lock it to prevent further comments.
> 
>   https://github.com/apps/repo-lockdown
> 
> I'm setting this up for libvirt and it was suggested QEMU can probably
> benefit from it too as an example see:
> 
>   https://github.com/libvirt/test/issues/2
>   https://github.com/libvirt/test/pull/3
> 
> 
> Configuration just requires creation of a ".github/lockdown.yml" file
> which provides the friendly message to add to the merge requests. This
> can be either done per-repository, or a special repo can be created
> called ".github" and this will apply to all repos within the project.
> 
> Ideally each repo would have a CONTRIBUTING.md file created too, since
> both GitHub and GitLab will direct users to this file for guidelines
> on how to contribute.
> 
> I don't have time right now to do this for QEMU, so consider this email
> a friendly suggestion for some other interested person to do for QEMU...
> 
> Regards,
> Daniel
> 

This looks cool. Who has access to our github to request it start
scanning our repo to look for said .github/lockdown.yml file?

--js

Re: FYI GitHub pull request / issue tracker lockdown bot

[Daniel P. Berrangé]

On Mon, Apr 06, 2020 at 03:51:52PM -0400, John Snow wrote:
> 
> 
> On 4/3/20 10:22 AM, Daniel P. Berrangé wrote:
> > QEMU, like libvirt, has a github.com project which contains automated
> > read-only mirrors of QEMU repositories.
> > 
> >   https://github.com/qemu/
> > 
> > An unfortunate side effect of this is that some users will try to open
> > pull requests against these mirrors. These get ignored until eventually
> > someone notices and closes the request. QEMU has had about 90 prs opened
> > over the years.
> > 
> >   https://github.com/qemu/qemu/pulls
> > 
> > The same applies to the issue tracker, but fortunately github lets
> > projects disable this feature, which QEMU has done.
> > 
> > I have recently discovered that there is a nice 3rd party bot for github
> > which can autorespond to pull requests with a friendly comment, close the
> > request, and then lock it to prevent further comments.
> > 
> >   https://github.com/apps/repo-lockdown
> > 
> > I'm setting this up for libvirt and it was suggested QEMU can probably
> > benefit from it too as an example see:
> > 
> >   https://github.com/libvirt/test/issues/2
> >   https://github.com/libvirt/test/pull/3
> > 
> > 
> > Configuration just requires creation of a ".github/lockdown.yml" file
> > which provides the friendly message to add to the merge requests. This
> > can be either done per-repository, or a special repo can be created
> > called ".github" and this will apply to all repos within the project.
> > 
> > Ideally each repo would have a CONTRIBUTING.md file created too, since
> > both GitHub and GitLab will direct users to this file for guidelines
> > on how to contribute.
> > 
> > I don't have time right now to do this for QEMU, so consider this email
> > a friendly suggestion for some other interested person to do for QEMU...
> > 
> > Regards,
> > Daniel
> > 
> 
> This looks cool. Who has access to our github to request it start
> scanning our repo to look for said .github/lockdown.yml file?

https://wiki.qemu.org/AdminContacts

Says afaerber, aliguori, paolo, stsquad - that probably needs updating
since two of those people aren't usually involved in QEMU anymore.

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|

Re: FYI GitHub pull request / issue tracker lockdown bot

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 1815 bytes --]

On Fri, Apr 03, 2020 at 03:22:13PM +0100, Daniel P. Berrangé wrote:
> QEMU, like libvirt, has a github.com project which contains automated
> read-only mirrors of QEMU repositories.
> 
>   https://github.com/qemu/
> 
> An unfortunate side effect of this is that some users will try to open
> pull requests against these mirrors. These get ignored until eventually
> someone notices and closes the request. QEMU has had about 90 prs opened
> over the years.
> 
>   https://github.com/qemu/qemu/pulls
> 
> The same applies to the issue tracker, but fortunately github lets
> projects disable this feature, which QEMU has done.
> 
> I have recently discovered that there is a nice 3rd party bot for github
> which can autorespond to pull requests with a friendly comment, close the
> request, and then lock it to prevent further comments.
> 
>   https://github.com/apps/repo-lockdown
> 
> I'm setting this up for libvirt and it was suggested QEMU can probably
> benefit from it too as an example see:
> 
>   https://github.com/libvirt/test/issues/2
>   https://github.com/libvirt/test/pull/3
> 
> 
> Configuration just requires creation of a ".github/lockdown.yml" file
> which provides the friendly message to add to the merge requests. This
> can be either done per-repository, or a special repo can be created
> called ".github" and this will apply to all repos within the project.
> 
> Ideally each repo would have a CONTRIBUTING.md file created too, since
> both GitHub and GitLab will direct users to this file for guidelines
> on how to contribute.
> 
> I don't have time right now to do this for QEMU, so consider this email
> a friendly suggestion for some other interested person to do for QEMU...

Ping Alex and Paolo, who have access to github.com/qemu.

Stefan

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: FYI GitHub pull request / issue tracker lockdown bot

[Paolo Bonzini]

[-- Attachment #1.1: Type: text/plain, Size: 1872 bytes --]

On 22/04/20 18:01, Stefan Hajnoczi wrote:
> On Fri, Apr 03, 2020 at 03:22:13PM +0100, Daniel P. Berrangé wrote:
>> QEMU, like libvirt, has a github.com project which contains automated
>> read-only mirrors of QEMU repositories.
>>
>>   https://github.com/qemu/
>>
>> An unfortunate side effect of this is that some users will try to open
>> pull requests against these mirrors. These get ignored until eventually
>> someone notices and closes the request. QEMU has had about 90 prs opened
>> over the years.
>>
>>   https://github.com/qemu/qemu/pulls
>>
>> The same applies to the issue tracker, but fortunately github lets
>> projects disable this feature, which QEMU has done.
>>
>> I have recently discovered that there is a nice 3rd party bot for github
>> which can autorespond to pull requests with a friendly comment, close the
>> request, and then lock it to prevent further comments.
>>
>>   https://github.com/apps/repo-lockdown
>>
>> I'm setting this up for libvirt and it was suggested QEMU can probably
>> benefit from it too as an example see:
>>
>>   https://github.com/libvirt/test/issues/2
>>   https://github.com/libvirt/test/pull/3
>>
>>
>> Configuration just requires creation of a ".github/lockdown.yml" file
>> which provides the friendly message to add to the merge requests. This
>> can be either done per-repository, or a special repo can be created
>> called ".github" and this will apply to all repos within the project.
>>
>> Ideally each repo would have a CONTRIBUTING.md file created too, since
>> both GitHub and GitLab will direct users to this file for guidelines
>> on how to contribute.
>>
>> I don't have time right now to do this for QEMU, so consider this email
>> a friendly suggestion for some other interested person to do for QEMU...

Philippe did it on April 6!

Thanks,

Paolo



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]