Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 19 additions & 4 deletions docs/promotion.md
Original file line number Diff line number Diff line change
Expand Up @@ -37,10 +37,25 @@ board is the GNU General Public License version 3, so that is what the code
carries out and the receiving side inherits terms rather than finding none.
This repository declares the same licence to the checks that read one, and
[docs/decisions/0018-the-licence-of-this-board.md](docs/decisions/0018-the-licence-of-this-board.md)
is the answer both of them come from. Entry three of issue #46 asks who may
place a contributor's work under another board's terms and carries no answer,
so a hand-over of somebody else's work still cannot be completed, and writing
anything else into this line would be inventing permission nobody gave.
is the answer both of them come from.

The contributor's consent, where the receiving board's terms differ from that
licence.
[docs/decisions/0020-consent-to-promote-under-other-terms.md](decisions/0020-consent-to-promote-under-other-terms.md)
decides that a result leaves under different terms only with the contributor's
explicit consent, given at promotion time rather than agreed in advance, and
written as a `Consent:` line in the promotion section naming who consented and
the terms they consented to. A hand-over resting on a conversation is one
nobody can check afterwards, and the moment it gets checked is the worst one
there is. Where the receiving board carries the same licence there is nothing
to consent to and this item is not asked for.

Nothing in this repository refuses a promotion section that names no consent.
The check that reads the section holds it to the four things record `0005`
names, and adding a fifth is a change to the record format that goes through
[docs/decisions/0013-how-the-record-format-changes.md](decisions/0013-how-the-record-format-changes.md).
Record `0020` says as much of itself, and what stands behind this item until
that lands is whoever does the hand-over and whoever reads the change.

What would have to change for this to be production code, written by whoever
did the work. They know and nobody else does. An experiment is allowed to cut
Expand Down
27 changes: 17 additions & 10 deletions docs/supply-chain.md
Original file line number Diff line number Diff line change
Expand Up @@ -120,10 +120,12 @@ person follows here and no machine enforces it.
`project has 0 contributing companies or organizations -- score normalized to 0`

Accepted, and outside this repository's control. The check counts the
organisations that the accounts contributing here belong to. Nothing a change in
this tree can do moves it, and whether this board takes contributions from
outside at all is an open question on issue #46 rather than something to score
against.
organisations that the accounts contributing here belong to, which the line
above says is none. Nothing a change in this tree can do moves it, and who may
contribute here is answered rather than open:
`docs/decisions/0024-who-may-run-an-experiment-here.md` decides that this board
takes experiments from anybody. An open door and a count of organisations are
different things, and only the second is scored.

### Dangerous-Workflow, 10

Expand Down Expand Up @@ -204,10 +206,13 @@ rather than a finding. It will start reporting on its own.

`packaging workflow not detected`

Did not apply, and whether it ever should is an open question. Entry four on
issue #46 asks whether this board publishes downloadable artefacts at all. If the
answer is no, this check stays at `-1` permanently and that is the correct
outcome rather than a gap.
Did not apply, and the question this row rested on is answered.
`docs/decisions/0021-what-this-board-publishes.md` decides that this board
publishes downloadable artefacts and that they are signed, so the outcome this
row used to name as correct - a permanent `-1` because nothing is ever
published - is not available. What the check looks for is a packaging workflow,
which a workflow publishing a release is not necessarily, so re-read this row
against a scored run once a release exists rather than predicting it here.

### Pinned-Dependencies, 10

Expand Down Expand Up @@ -270,8 +275,10 @@ the deduction stays.
`no releases found`

Did not apply, and it cannot pass until there are releases. Accepted now, reopened
by the release milestone. Whether artefacts are published and whether they are
signed are both entry four on issue #46.
by the release milestone. Both halves are decided rather than open:
`docs/decisions/0021-what-this-board-publishes.md` says this board publishes
downloadable artefacts and that they are signed, so what this row waits on is a
release rather than an answer.

### Token-Permissions, 10

Expand Down
Loading