django-typer

[williln]

Hi @django-commons/django-typer! I wanted to take a moment and check in with you about how the transition to Django Commons has been.

• Have you run into any friction having your project in Django Commons, if so, can you describe them?
• Is there anything we can do to help your team or repo out?
• Do you have any questions or concerns for us?

If you'd like to chat with us privately, our email is [email protected]. Thanks!

[bckohan]

• Have you run into any friction having your project in Django Commons, if so, can you describe them?

It's been smooth! I tweaked some of the base GA scripts a little. I have one that checks to see if the CoC has updated once a week and if it has it opens a PR to pull in the new CoC. I did this because if it changes I wanted some automatic notification as to what the changes were. I also tweaked the release GA a bit but gave up trying to get it to do what I want it to do which is run my tests first and only publish if everything passes. There seems to be some conditional flow control limitations wrt to how a GA can run other workflows.

• Is there anything we can do to help your team or repo out?

Not anything urgent! It'd be nice if the CoC check could be a push (webhook) instead of a pull but ¯\(ツ)/¯

• Do you have any questions or concerns for us?

I'm self conscious about how long the CI runs on this repo (~20 minutes). There's no way to avoid starting up a bunch of python subprocesses to test this library because of what it is. Every time this happens all the pytest/coverage stuff has to bootstrap which takes awhile so there's not much more efficiency I can wring out of it. I'm worried it might be an unnecessarily large hog on the actions quota. I'm not sure how concerned I should be about this. I'm considering disabling CI on commits and only running it on PRs.

[tim-schilling]

if the CoC check could be a push (webhook) instead of a pull

That's an interesting idea! I do hope that if we make a change to the CoC there'd be a discussion post here tagging all members. But we haven't run into that use case, so I'm not sure we can promise that.

I'm worried it might be an unnecessarily large hog on the actions quota

For now, this isn't a problem. Public repos don't have quotas as far as I know. But it's nice to reduce run-times for the environment 💚

[cunla]

if the CoC check could be a push (webhook) instead of a pull

I noticed that GitHub workflow, it is very cool! However, I think it is a bit of overkill, a simple link to the django-commons CoC would suffice.

[bckohan]

I thought about just linking, but I'm a pedant and not having the full CoC available when clicking the CoC tab bothered me. And also, I wanted an automagic notification with a nice diff to see when and what any updates were. Not because I don't trust the updates, mostly because I figure if there is an update it was precipitated by something and I'd like the push to figure out what that was.

[bckohan]

@cunla @williln @tim-schilling

Just ran into an issue, but it may be user error. I'm trying to create a fine grained access token for django-typer but it seems I do not have the permissions to do so. Usually the way I do this for a repo owned by an organization is Profile -> Organizations -> django-commons -> settings, but the settings link is not available to me for django-commons. And django-typer is not available to me in the token drop down under my own profile's settings.

Am I missing something?

[cunla]

Ni @bckohan, what about if you go to: https://github.com/settings/personal-access-tokens/new

Can you create PAT with access to django-typer there?

[bckohan]

no, I no longer own the repo so it doesnt show up in the drop down

[cunla]

above you have resource owner... you can't select django-commons?

[tim-schilling]

To clarify, further up on the screen there's a resource owner dropdown. It defaults to you. It would need to be django-commons which should then show django commons repo's you're an admin for (which includes django-typer).

[bckohan]

!! thankyou! what a terrible UI haha

[tim-schilling]

Hi @django-commons/django-typer, we're circling back around 💫 We want to ask Lacey's original questions to see if there's any update. We're also looking into how can we improve the new contributor experience with the overall goal of helping find regular contributor and more maintainers for projects.

• Meet and greets
• Project introduction videos

If any of that sounds interesting to you, feel free to engage on the discussions or here.

[tim-schilling]

I approved the token requests that grants access to django-typer and django-enum repos you requested @bckohan. No response needed. This is more for traceability
cc: @django-commons/admins

[bckohan]

@tim-schilling @django-commons/admins What token requests? My GitHub account was compromised as part of the nx supply chain attack that hit vscode via the NX Console app. Was this request made between Tuesday and Thursday?

If these were the OSSF Scorecard tokens - that was me.

[Stormheg]

@bckohan the request was indeed for the OSSF Scorecard. Looks like you made the request around Friday.

[tim-schilling]

Sorry, I revoked the token out of an abundance of caution. There were no other actions taken that would indicate it wasn't something valid. If you'd like that token recreated, please re-request it again.

Audit log from the time it was granted:

[bckohan]

Thanks! I will re-request. I should have notified the django-commons admin group last week, but I was so busy putting out other fires I didn't get to it. There was more than a single vector, but if you happened to be one of the 2 million vscode users that had NX Console installed last week and restarted within the 5 hour exploit window, at the very least your github CLI token was leaked (if you were lucky it was just that).