Skip to content

Expand and document PSRT coordination process#1769

Merged
willingc merged 9 commits intopython:mainfrom
sethmlarson:psrt-process
Apr 16, 2026
Merged

Expand and document PSRT coordination process#1769
willingc merged 9 commits intopython:mainfrom
sethmlarson:psrt-process

Conversation

@sethmlarson
Copy link
Copy Markdown
Contributor

@sethmlarson sethmlarson commented Mar 19, 2026

This PR defining the coordination process more concretely. Here are the changes:

  • Changes the process to automatically assign a Coordinator after a period of idleness. The exact selection process isn't defined, at this stage I am looking for reviews on whether this change to the process is acceptable to PSRT members.
  • The coordinator role per-ticket is explicit within GHSA using the "Credit: Coordinator" feature.
  • Separates the Triage, Remediation, Advisory sub-processes more clearly. This intended to be helpful for non-PSRT members that are involved in the remediation process to know what to expect.
  • Documents how the PSRT bot operates so coordinators know what to expect and how to take advantage of the automation.

cc @python/psrt

@read-the-docs-community
Copy link
Copy Markdown

read-the-docs-community bot commented Mar 19, 2026

Documentation build overview

📚 CPython devguide | 🛠️ Build #31990451 | 📁 Comparing ecf801b against latest (d5194a0)


🔍 Preview build

Show files changed (6 files in total): 📝 4 modified | ➕ 2 added | ➖ 0 deleted
File Status
index.html 📝 modified
_static/psrt-coordinator-report.html ➕ added
_static/psrt-coordinator-triage.html ➕ added
developer-workflow/index.html 📝 modified
core-team/team-log/index.html 📝 modified
developer-workflow/psrt/index.html 📝 modified

@sethmlarson sethmlarson marked this pull request as ready for review March 19, 2026 21:23
Comment thread _static/psrt-coordinator-triage.svg Outdated
Comment thread developer-workflow/psrt.rst Outdated
Comment thread developer-workflow/psrt.rst Outdated
Comment thread developer-workflow/psrt.rst Outdated
Comment thread developer-workflow/psrt.rst
Comment thread developer-workflow/psrt.rst Outdated
Comment thread developer-workflow/psrt.rst Outdated
Comment thread developer-workflow/psrt.rst Outdated
Comment thread developer-workflow/psrt.rst Outdated
Comment thread developer-workflow/psrt.rst Outdated
Comment thread developer-workflow/psrt.rst Outdated
Comment thread developer-workflow/psrt.rst Outdated
Comment thread developer-workflow/psrt.rst
sethmlarson and others added 3 commits March 20, 2026 18:28
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
@hugovk
Copy link
Copy Markdown
Member

hugovk commented Mar 21, 2026

The diagram lines are hard to read in dark mode, can we adjust them?

Details image

@sethmlarson
Copy link
Copy Markdown
Contributor Author

@hugovk Done in 8332acd

@sethmlarson sethmlarson requested a review from hugovk March 25, 2026 22:18
Copy link
Copy Markdown
Member

@hugovk hugovk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please could you add a note in the PR how you generated Mermaid -> SVG?


Also a number of the boxes are clipped on the right, I don't know if it's possible to increase the margin. Not the biggest problem in the world :)

Image Image Image Image

Comment thread developer-workflow/psrt.rst Outdated
Comment thread developer-workflow/psrt.rst
Comment thread developer-workflow/psrt.rst Outdated
Comment thread developer-workflow/psrt.rst Outdated
Comment thread _static/psrt-coordinator-triage.mermaid Outdated
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
@sethmlarson
Copy link
Copy Markdown
Contributor Author

@hugovk I'm coming to the unfortunate conclusion that maybe Mermaid is more work than it's worth. I remember this language and the tooling around it being so much nicer in the past :/ Oh well.

I think I'm going to instead use an ASCII diagram unless there's a better method for diagramming you know of?

@sethmlarson
Copy link
Copy Markdown
Contributor Author

Here is how the graph would look as an ASCII diagram, light and dark modes included:

Screenshot from 2026-03-26 12-25-07 Screenshot from 2026-03-26 12-25-20

Copy link
Copy Markdown
Collaborator

@willingc willingc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @sethmlarson. Good stuff. 🌻 I'm going to merge as is.

Any additional suggestions or needed changes can be covered in a future PR.

@willingc willingc merged commit 5e1f59d into python:main Apr 16, 2026
5 checks passed
@StanFromIreland
Copy link
Copy Markdown
Member

Should we hold a vote for the process change (automatically assigning people)?

@sethmlarson sethmlarson deleted the psrt-process branch April 16, 2026 16:08
@sethmlarson
Copy link
Copy Markdown
Contributor Author

sethmlarson commented Apr 16, 2026

Thank you for the review and merge @willingc 🙏

@StanFromIreland Auto-assigning coordinators to idle issues and whether this process was clear and easy to follow was the feedback I was hoping for in this thread. I have not received any feedback beyond the reviews here despite multiple reminders to PSRT and admins.

I can open a separate thread on this specific point: I want folks to be okay with being assigned tasks to do (and I acknowledge it feels different than picking up tasks yourself) but it is the mission of the team to coordinate vulnerability reports.

@StanFromIreland
Copy link
Copy Markdown
Member

FYI PSRT: a thread was opened in the Discord.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants