Thanks Oleg!

I'd like to avoid making this a moving target by accident as we progress. Like you point out, the incoming changes in https://github.com/cdfoundation/toc/pull/76 add some extra requirements that aren't in the existing https://github.com/cdfoundation/toc/blob/master/PROJECT_LIFECYCLE.md document.

I just opened a PR to add these requirements, the TOC can discuss and vote, and then we can submit a proposal for Jenkins: https://github.com/cdfoundation/toc/pull/79

I think we'll need to quickly get a plan together for security audits at the CDF level.

Dan Lorenc

On Fri, Apr 24, 2020 at 10:42 AM Oleg Nenashev <o.v.nenashev@...> wrote:

Hi all,

As a Jenkins board member, I would be interested in passing through the official CDF graduation checklist and review. From what I see on https://github.com/cdfoundation/toc/blob/master/PROJECT_LIFECYCLE.md the Jenkins project fully meets the "graduated project" criteria though IIUC there are some incoming changes like https://github.com/cdfoundation/toc/pull/76 (CII requirement, 3rd-party security audit, etc.). It would be great to see the final list of requirements before we take it to the Jenkins community and discuss it there.

I also have a question about a 3rd-party security audit defined by Dan Lopez in https://github.com/cdfoundation/toc/pull/76. It may cost a lot for a big project like Jenkins if we want to have a formal security audit by a 3rd party. Just in case, does CDF have budget allocated for such audit in CDF projects? If not, such criteria may become a major obstacle.

Thanks in advance,

Oleg

On Fri, Apr 24, 2020 at 5:29 PM Tracy Miranda <tmiranda@...> wrote:

+1 good to have clarity then dog-food our own processes. 

While it might be strange for some to see Jenkins 'graduate' think it will be good due-diligence and a good example for rest of the projects (not to mention more reasons to celebrate!)

Tracy

On Fri, Apr 24, 2020 at 11:27 AM Dan Lorenc via lists.cd.foundation <dlorenc=google.com@...> wrote:

Hey Everyone,

There's been some confusion around CDF project graduation/incubation statuses and I want to try to clear that up. If I remember correctly, when the initial projects came into the CDF we decided to keep them all at incubation status, even though some were likely to graduate quickly.

The plan was to firm up the graduation criteria, then move the more mature projects through this process as a trial run.

Does that still make sense to everyone? If so, I'd like to take a pass at the graduation criteria, then start to move Jenkins through to make sure the process makes sense and works.

Dan Lorenc