The default branch should require a reviewer

[plehegar]

In the spirit of avoiding unchecked changes to specifications, we should push our Groups to require reviews for Pull Requests.

[plehegar]

Note: we have around ~175 repositories where the default branch protection don't enforce a reviewer

[foolip]

Do you have a list of repos without branch protection? Perhaps asking ten of them at random would help inform what the impact of this would be?

[plehegar]

Very few specs are without protection now in WGs:
https://w3c.github.io/validate-repos/report.html?grouptype=workinggroup&filter=unprotectedbranch
We still need to chase CGs, in particular WICG.
We don't have the list of repos without reviewers., but the info has been added to
https://raw.githubusercontent.com/w3c/validate-repos/master/report.json
so, getting the list is a matter of adding 2/3 lines of code I think. Will get to it by Monday. I mentioned this to all team contacts to go after.

[foolip]

From blink-dev discussion it sounds like @marcoscaceres and @yoavweiss wanted to move in this direction for WICG. However, just like for everything else, asking the people it will affect first would be a good idea :)

[marcoscaceres]

Definitely want to start enforcing this.

[foolip]

Could this same code base be used to WICG?

[foolip]

@dontcallmedom would it be possible for me to have write access to this repo in order to experiment with access to the necessary GitHub token?

[plehegar]

@foolip sure, but I'll let the WICG Chairs step-in.

@marcoscaceres @travisleithead @yoavweiss
you can find the list of repositories with unprotected branches using
https://www.w3.org/PM/Groups/chairboard.html?gid=80485

If a repo is improperly listed, its w3c.json needs to be updated.

Note that the underlying data is (hopefully) regenerated every 24 hours, so it's NOT a live dashboard.

[travisleithead]

Per https://www.w3.org/PM/Groups/chairboard.html?gid=80485 I fixed the two repos without w3c.json files. I'm 👍 for enabling required reviewer protections for PRs.

[foolip]

Thanks all!

One thing that's missing from this repo to make it work for checking WICG branch protection is changing the condition for when branch protection is required. Right now its "any spec published from this repo is on the Rec track". What should the condition be for WICG? If it could simply be required for all repos that'd certainly be the easiest, but is it risky?

[plehegar]

to make sure I understand, you're suggesting to fix:
https://w3c.github.io/validate-repos/report.html?filter=unprotectedbranch%2Cmissingashnazghook&grouptype=communitygroup
which doesn't say anything about branch protection despite the option. Correct?

[dontcallmedom]

@foolip I think one test you could rely on is if the w3c.json data includes for repo-type cg-report (which would allow to ignore repos that used for administrative purposes, testing, etc)

[foolip]

@plehegar yes, that's right, I'd like to list missing branch protection for more things than currently require ash-nazg. The rule that @dontcallmedom suggested might work, I'll see what the code changes would look like.