CLA signing automation

[Oleksandr Porunov]

Hello,

I have a concern about current CLA signing workflow. Currently we need to print a CLA agreement then fill it, then scan it then send it via email and then wait for an unknown amount of time while it is checked then wait while the PR with your signing details is merged into https://github.com/JanusGraph/legal.

It causes very huge delays sometimes more than 1 month. I think it is a big disadvantage for accepting new contributions.

I think we would be able to use either Google form for CLA accepting like this one:

https://docs.google.com/forms/d/e/1FAIpQLSeFFPXTvl4QJ0P-RQJQcRC8V-1JNfYUpGuq3WVmOmFkBN5nNA/viewform?formkey=dGNNVUJEMXF2dERTU0FXM3JjNVBQblE6MQ

Or maybe use some tool for CLA automation like this one:

https://github.com/cla-assistant/cla-assistant

There are a lot of CLA automation tools. I think we could use some.

Can we automate this process to digitally sign CLAs or we need real scanned paper copy?

[Florian Hockmann]

Thanks for bringing this up, Oleksandr. I agree that it's important to make this process easier for contributors as each additional loop they have to jump through could prevent them from contributing to JanusGraph in the first place.

Apparently, Kubernetes has automated its CLA workflow. They are hosted within the Cloud Native Computing Foundation (CNCF) but it seems to use only infrastructure from the Linux Foundation and since the CNCF is also a Linux Foundation project, we should be able to use the same system in general.

They also have docs on how to set up the automation for a new repo. At first glance, it looks like we only need a JanusGraph group for identity.linuxfoundation.org.

While we're at it we could also automate the DCO check with a DCO bot. We currently have to check this manually while reviewing a PR which we tend to forget sometimes.

[Oleksandr Porunov]

Florian,

I like the automation method you suggested. I would go for it.

Do you know who should we contact to setup it? I assume either Jason Plurad or Misha Brukman should have necessary rights?

[Jason Plurad]

+1 I agree that the CLA process needs to be improved.

Currently CLAs are submitted to the janusgraph-cla Google Group which is monitored by Misha and me. A representative from the Linux Foundation is also in the group to observe. The group archive provides the historical record of the signed CLA documents.

I have been a bit removed from the JanusGraph community over the past few months for personal issues, but as a community supported project, the absence of any particular members should not prevent the community from moving forward.

Some steps that I propose we take in the short term:
* All PMC members given access to the janusgraph-cla group so that any PMC member can handle incoming CLAs
* Update the Contributing documentation to help eliminate the common follow up questions around ICLA vs CCLA. This mostly consists of ensuring that an individual contributor has verified that their employer/university/organization is aware of the contributions and will not make any claims on the submitted contributions.

Long term, if we can take advantage of some of the Linux Foundation infrastructure to handle or automate this, that would be fantastic. JanusGraph was created as a "lightweight project", so the support the project has received from the LF has been minimal. My understanding is that the marquee projects (like Kubernetes, CNFC, ODPi) have more sponsor money involved, so they have access to nice things.

Thank you Oleksandr and Florian for starting up this thread. If anybody else is interested in helping to push this topic forward, please reply on this thread.

Thanks,
Jason

[Oleksandr Porunov]

Hello Jason,

Thank you for the replay!

It definitely would be better if more people could handle incoming CLAs right now. 

I don't think that voting is appropriate in the current situation because too little JanusGraph members are involved right now. So, I believe you can give access to all PMC members without voting.

Also, I have some questions about automation.

Do you know where we should contact to ask to open a JanusGraph group for identity.linuxfoundation.org ?

I don't know the internal responsibility structure of JanusGraph. 

I have seen for some time that you were responsible for new releases of JanusGraph, so I assume that you owned nexus keys for deployment. So, my assumption that you have more rights in JanusGraph.

If so, my thoughts are that JanusGraph is under The Linux Foundation. It means that at least some support is provided. Right now we need to automate CLA signing (which isn't hard I think). I don't think that we will be rejected of using a little bit of The Linux Foundation functionality, but I think that someone responsible need to ask for this functionality from The Linux Foundation responsible party. Can you contact that responsible party? If no then can you share any contact where I can ask for?

Best regards,

Oleksandr

[Florian Hockmann]

I searched some more about the infrastructure Kubernetes is using for the CLA automation and found this issue on GitHub which discusses open sourcing of the CLA bot used by Kubernetes to make it accessible to others.

That issue also refers to an email address at the Linux Foundation (LF) for specific questions about this CLA bot. So, I just sent an email to that address to ask the following questions:

• Is it possible for JanusGraph to use the existing (closed source) CLA bot that Kubernetes is already using?
• If not, will the open sourced CLA bot be available for us?
• And if we cannot use either of those, would another CLA automation not based on LF infrastructure (like the CLA assistant from SAP from Oleksandr's first post) be acceptable from the site of the LF?
  

I will of course post anything I'll get back here to keep you posted.

@Jason: I hope it's OK that I reached out to the LF in this matter as I only asked for information.

[Misha Brukman]

I've reached out to The Linux Foundation folks I've previously spoken to about CLA automation (which wasn't implemented yet, as you can tell, and I haven't heard back from for a while). I believe they already have a GitHub bot we can reuse. I'll let you know what I find out.

--
You received this message because you are subscribed to the Google Groups "JanusGraph developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to janusgraph-de...@googlegroups.com.
To post to this group, send email to janusgr...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/janusgraph-dev/d40dbef3-8d4f-474b-9125-e301b37e563b%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Oleksandr Porunov]

I've noticed that it is already about 1 month has gone when `mad` from github send a CLA. Is there any news about including him into janusgraph/legal? Next PRs are stuck because of this:

#1392

#1406

Also, is there any news from The Linux Foundation?

[Florian Hockmann]

Also, is there any news from The Linux Foundation?

From my side, no. The Linux Foundation directed me to two members of the Kubernetes community who I contacted, but haven't heard back from them.

@Misha: Were you more successful?

If we don't hear anything from the LF any time soon, then I suggest that we just go ahead with a 3rd party CLA bot like you (Oleksandr) originally suggested in the first post here.

[Oleksandr Porunov]

I agree. If there is no response, we should go with 3rd party CLA bot.

[Jason Plurad]

I've submitted a PR for the ICLA.

Regarding adding other committers to the CLA Google Group, it doesn't appear that I have authority to do that, only Misha.

I've noticed that I can't see the CLA archive via the Google Group. I do have a record of every email I've received since being added to the group (April 2018), so I have access to only a partial archive.

[Oleksandr Porunov]

Jason, thank you for submitting the PR. 

Also reporting that wangzheng90 from github sent a CLA. Related PR-1456.

Misha, could you please add necessary permissions to Jason?

[Oleksandr Porunov]

Florian, I believe we can move with 3rd party CLA bot now because there is no any news from LF. 

There are contributors who would like to contribute, but CLA verification is taking too much time to accept new contributors. It really slows down the process because most of the time new contributors either don't want to go through the process where they need to print then sign then scan then send CLA or even when they do it they are losing interest after 1+ months of verification.

As for me, I think we should move to automate CLA signing ASAP. I think we can discuss a CLA bot for JanusGraph.

Some possible solutions could be either CLA automation tool like these tools:

https://www.clahub.com/

https://cla-assistant.io/

https://clabot.github.io/

Or signing with Google form like this one:

https://docs.google.com/forms/d/e/1FAIpQLSeFFPXTvl4QJ0P-RQJQcRC8V-1JNfYUpGuq3WVmOmFkBN5nNA/viewform?formkey=dGNNVUJEMXF2dERTU0FXM3JjNVBQblE6MQ

It would be nice to move to automate CLA signing on this or the next week.

[Florian Hockmann]

I agree with you that the CLA process takes too long right now and scares away some possible contributors which is really problematic.

The only problem I see with these tools is that they all only seem to handle individual CLAs (ICLA), but not corporate CLAs (CCLA). Since most of our contributors use a CCLA, we also need to find a solution for that.

Out of the 3 tools you listed, I found two that had issues for CCLAs:

For cla-assistant, closed without a fix: https://github.com/cla-assistant/cla-assistant/issues/15

For CLAHub, open: https://github.com/clahub/clahub/issues/151

[Oleksandr Porunov]

Thanks for pointing to this problem. I didn't think about CCLAs before. We need to investigate it.

[Oleksandr Porunov]

Asking to check CLAs for the next contributors:

- VladimirBogomolov

- wangzheng90

[Florian Hockmann]

I just asked in the issue I linked above whether it will be possible for us to use the CLA bot of the Linux Foundation and got a very promising response from Dan Kohn:

Yes, JanusGraph will be very welcome to use it with the LF managing the CLAbot. We're just a little backed up with the 2 week private beta of CommunityBridge and then we can hopefully move forward with the gRPC CLAbot rollout. https://www.linuxfoundation.org/press-release/2019/03/the-linux-foundation-launches-new-communitybridge-platform-to-help-sustain-open-source-communities/

The gRPC project will beta test the bot and then they want to make it accessible to other projects afterwards.

So, it sounds like we can use this automation in a few weeks / months :-)

[Oleksandr Porunov]

Florian, 

It is great news! I really happy to hear that!

Waiting for the bot :)

[Misha Brukman]

In emailing help...@rt.linuxfoundation.org to open a ticket (which I believe was the process in the past?), I've learned that (a) Linux Foundation no longer supports that email address, and (b) they are now using Jira for their ticket system. I logged in and created an account and found this really old ticket: https://jira.linuxfoundation.org/browse/CL-92 (subject: "get JanusGraph CLA template") which I pinged to get some update on the status.

I've also followed-up on our thread from February (!!) with some folks from The Linux Foundation to set up a meeting to discuss the onboarding to the new CLA process, and we now have a meeting scheduled on Mon, Mar 25 at 11am PDT / 2pm EDT. If any JanusGraph TSC member or committer is interested in joining the call (phone or video call, both are supported), please let me know, and I'll be happy to add you.

Looking forward to getting the CLA process fully automated soon!

To view this discussion on the web visit https://groups.google.com/d/msgid/janusgraph-dev/50813679-4e44-43c3-9890-853f56a402bf%40googlegroups.com.

[Oleksandr Porunov]

Misha,

I really love to hear that! I am happy that there are progress in the CLA automation direction.

Hope it will be implemented soon.

[Chris Hupman]

Hey Misha,

If it's not too much trouble I'd be interested in joining the call. 

Regards,

Chris

[Misha Brukman]

[ bcc: janusgraph-dev ]

No trouble at all, Chris! You're on the invite.

To view this discussion on the web visit https://groups.google.com/d/msgid/janusgraph-dev/3da7826f-f526-4985-9b87-9f2f4e23435e%40googlegroups.com.

[Oleksandr Porunov]

Misha, Jason,

Could you please check if VladimirBogomolov signed a CLA? Looks like he signed it 19 days ago but the CLA PR wasn't been submitted to janusgraph-legal repository still.

Regards,

Oleksandr

[Oleksandr Porunov]

Misha, Jason,

Could you please check if "fufler" signed a CLA? If so, could you create a PR to include him into janusgraph-legal repository?

Regards,

Oleksandr

[Chris Hupman]

I reached out to John Mertic from the linux foundation about the CLA automation tool and was told it is now ready for Prime time. He also said he could help get us onboarded. Would it be easiest if I just add you on the email thread Misha?

[Misha Brukman]

Hi Chris,

Yes, please add me to the thread and I'll take it from there.

Thanks,

Misha

To view this discussion on the web visit https://groups.google.com/d/msgid/janusgraph-dev/9ef27267-52bf-4a24-b0c5-c3134000a67a%40googlegroups.com.