Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124393
Feedback-ID: ia2404087:Fastmail
User-Agent: Cyrus-JMAP/3.11.0-alpha0-568-g843fbadbe-fm-20240701.003-g843fbadb
Precedence: bulk
MIME-Version: 1.0
Message-ID: <5c86a265-5670-4481-a727-5ada4284cd42@app.fastmail.com>
In-Reply-To: <3054c75d-c08a-cd85-0749-c5dc6f39a1e5@php.net>
References: 
 <CADZ9LSVC+xA7DC-Db9FZVojZXhb8phZCoY1r3PqHj9pepeo6pg@mail.gmail.com>
 <3054c75d-c08a-cd85-0749-c5dc6f39a1e5@php.net>
Date: Thu, 11 Jul 2024 09:38:25 -0700
To: "Derick Rethans" <derick@php.net>,
 "Roman Pronskiy" <roman.pronskiy@thephp.foundation>
Cc: "PHP internals" <internals@lists.php.net>
Subject: Re: [PHP-DEV] Website php.net updates and coordination
Content-Type: text/plain
From: jimw@trainedmonkey.com ("Jim Winstead")

On Thu, Jul 11, 2024, at 6:54 AM, Derick Rethans wrote:
> On Wed, 10 Jul 2024, Roman Pronskiy wrote:
>
>> 3. Deployment Process
>> Recently, there was an incident with a code block pushed to the
>> website accidentally: https://github.com/php/web-php/pull/1021. It was
>> promptly reverted, but the case highlighted a potential security risk:
>
> It wasn't an *accident* that I pushed it. Only people with commit access 
> to php-web can push things, and that isn't a large list of people.
>
> It is the RMs: https://github.com/orgs/php/teams/release-managers
> and web-team: https://github.com/orgs/php/teams/web-team
>
> Each has 13 members, but there are some overlaps.

These aren't public. The only public info appears to be the members of the PHP organization on GitHub, and I think something needs to be done to make the teams and roles (owner, moderator, etc) public information. This could probably  be scripted and automated because it looks like it's not just a matter of flipping a switch somewhere on the GitHub side.

Jim