Requests for Comment

[kliatsko]

Hello current and former OSI contributors,
@Novartis/contributors

After years on the fence, I merged the old nested "Associates" and "External Collaborator" teams. Policing who was an internal employee vs former employee wasn't worth the manual effort since the group membership has no bearing on individual repo access. It also means that we can finally chat in one place.

This is good because we have things to discuss...

1. Shutting down https://opensource.nibr.com/ - maintenance needs to be minimal so that I can keep up. I intend to update/simplify the OSI guides at the same time
2. Secret scanning - The intent would be to add secret scanning on commit but nothing else. Since code added to OSI is not meant to be actively developed (with a few exceptions), vulnerability scans do not seem valuable.
3. Required reviews from RX - this is something Mark Borowsky is interested in. A member of RX would be assigned to review new submissions on a call with the submitter. Provided that these reviews are lightweight and timely, is anyone here violently opposed?
4. Communication standards with this group - do comments in the Novartis/admin repo work for this type of outreach?

Thank you,
@kliatsko

[margoal1]

Hi Nick, can you clarify what you mean by shutting down https://opensource.nibr.com/? Is this temporary for maintenance?

[mdshw5]

If this means shutting down the landing page that's fine by me, and I understand that it hasn't been updated in a while. I'm hosting my documentation at https://opensource.nibr.com/pisces/ so I would hope that the CNAME will still direct to our Github organization somehow.

[kliatsko]

This would be a permanent shutdown but only for the front-end page (opensource.nibr.com). From the look of things, it hasn't been updated in ~5 years. It either needs a major overhaul or a deletion.

The code is hosted here: https://github.com/Novartis/Novartis.github.io.

[margoal1]

Would this only be the main page opensource.nibr.com, or subpages as well? We actively use / advertise opensource.nibr.com/xgx. If what you're suggesting would disrupt this then I would vote against it.

[kliatsko]

I don't see any issues with keeping existing subpages.

[kliatsko]

It's all dated though. The theming is wrong and some of the links are broken.

[alokito]

1-4 all seem reasonable to me.

[EricJohnMartin]

Hi Nick, I just want clarification that GitHub - Novartis/pQSAR: Massively multitask stacked model for predicting activity of thousands of biological assays<https://github.com/Novartis/pQSAR> would remain. Right? Thanks, Eric From: Nick Kliatsko ***@***.***> Sent: Tuesday, August 27, 2024 3:12 PM To: Novartis/admin ***@***.***> Cc: Martin, Eric ***@***.***>; Team mention ***@***.***> Subject: Re: [Novartis/admin] Requests for Comment (Discussion #48) This would be a permanent shutdown but only for the front-end page (opensource. nibr. com). From the look of things, it hasn't been updated in ~5 years. It either needs a major overhaul or a deletion. The code is hosted here: https: //github. com/Novartis/Novartis. github. io.  ZjQcmQRYFpfptBannerStart This Message Is From an External Sender This message came from outside your organization. ZjQcmQRYFpfptBannerEnd This would be a permanent shutdown but only for the front-end page (opensource.nibr.com). From the look of things, it hasn't been updated in ~5 years. It either needs a major overhaul or a deletion. The code is hosted here: https://github.com/Novartis/Novartis.github.io<https://urldefense.com/v3/__https:/github.com/Novartis/Novartis.github.io__;!!N3hqHg43uw!v5FfmFROv3EnhEGGkpiFgPGJaQQoWjtl92Ils4nkY9trRmAronocd-uA4F0e-5uvS4BLRKpy7_4W4zhMh67bG-rTLFk$>. — Reply to this email directly, view it on GitHub<https://urldefense.com/v3/__https:/github.com/orgs/Novartis/discussions/48*discussioncomment-10468053__;Iw!!N3hqHg43uw!v5FfmFROv3EnhEGGkpiFgPGJaQQoWjtl92Ils4nkY9trRmAronocd-uA4F0e-5uvS4BLRKpy7_4W4zhMh67bZl5dnAQ$>, or unsubscribe<https://urldefense.com/v3/__https:/github.com/notifications/unsubscribe-auth/AGD3L5KBAHJ2PUA6LUGBL2LZTT2R5AVCNFSM6AAAAABNEVL6D2VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTANBWHAYDKMY__;!!N3hqHg43uw!v5FfmFROv3EnhEGGkpiFgPGJaQQoWjtl92Ils4nkY9trRmAronocd-uA4F0e-5uvS4BLRKpy7_4W4zhMh67bMpfymbM$>. You are receiving this because you are on a team that was mentioned.Message ID: ***@***.******@***.***>>

[kliatsko]

@EricJohnMartin - yes. everything in GitHub would remain

[kruscpe1]

A few thoughts:

1. As long as the documentation URLs (opensource.nibr.com/) remain stable I think that would be fine - otherwise some public URL-updating would need to be done).
2. No objections. I may have some follow-up questions on "active development" since e.g. we may need to take pull requests.
3. Some of the code published here comes from development we may be able to help with the reviews of these if needed - happy to discuss.
4. There may be some rules around communication on non-ISRM'd platforms to think about that might make a Teams org preferable.

[kliatsko]

1. This is what I'd like to delete. The documentation URLs would vanish with the main site.

[kliatsko]

I'd likely shut off the GitHub Pages entry and leave the documentation available for retrieval.

[margoal1]

1. This is what I'd like to delete. The documentation URLs would vanish with the main site.

I'm confused. Would subpages such as opensource.nibr.com/xgx still be operational? Or would shutting down the main page opensource.nibr.com also shut down these subpages? If it would shut down all subpages then I vote against it. If it's just the main page, and subpages remain operational I would be fine with that.

[EricJohnMartin]

Nothing should have changed. What would be required to bring it up to date? Eric Martin 510-759-4193

…

________________________________ From: Nick Kliatsko ***@***.***> Sent: Tuesday, September 10, 2024 2:24:51 PM To: Novartis/admin ***@***.***> Cc: Martin, Eric ***@***.***>; Mention ***@***.***> Subject: Re: [Novartis/admin] Requests for Comment (Discussion #48) It's all dated though. The theming is wrong and some of the links are broken. — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned. Message ID: <Novartis/admin/repo-discussions/48/comments/10607341@ github. com> ZjQcmQRYFpfptBannerStart This Message Is From an External Sender This message came from outside your organization. ZjQcmQRYFpfptBannerEnd It's all dated though. The theming is wrong and some of the links are broken. — Reply to this email directly, view it on GitHub<https://urldefense.com/v3/__https://github.com/orgs/Novartis/discussions/48*discussioncomment-10607341__;Iw!!N3hqHg43uw!tLnUAjHCQpHU7HJkwfZhvBCcDLWxmry6rE506Kk5Z_K_uMMiLDxAdjmEIP44R-eEzZ4_0oUvzVw-6XHXKjVvcQAUnlI$>, or unsubscribe<https://urldefense.com/v3/__https://github.com/notifications/unsubscribe-auth/AGD3L5MUMJPL5SFHO35NJ7LZV5PSHAVCNFSM6AAAAABNEVL6D2VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTANRQG4ZTIMI__;!!N3hqHg43uw!tLnUAjHCQpHU7HJkwfZhvBCcDLWxmry6rE506Kk5Z_K_uMMiLDxAdjmEIP44R-eEzZ4_0oUvzVw-6XHXKjVvl9e3UPM$>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[brianrepko]

Hi Nick,

I have similar feedback to Peter Krusche.

1. Shutting down https://opensource.nibr.com/ - maintenance needs to be minimal so that I can keep up. I intend to update/simplify the OSI guides at the same time

This may be ok depending on the content. Many times, R and python code generates package documentation and we need a place to house that. That typically can be the Github pages of the repository and does not need to be part of a separate documentation page. I would suggest that if this information is needed for a given project - that it should be added to a README.md in the project.

2. Secret scanning - The intent would be to add secret scanning on commit but nothing else. Since code added to OSI is not meant to be actively developed (with a few exceptions), vulnerability scans do not seem valuable.

This seems fine and appropriate. This should also be communicated to contributors in a CONTRIBUTION.md file added to a repository.
I personally think any pull requests should go through both secret scanning and vulnerability scans. Particularly if we are bundling software that has known vulnerabilities, it'd be nice to learn that early.

3. Required reviews from RX - this is something Mark Borowsky is interested in. A member of RX would be assigned to review new submissions on a call with the submitter. Provided that these reviews are lightweight and timely, is anyone here violently opposed?

Violently opposed. These repositories, as Peter mentioned, are both from Development and Research. Some are part of the pharmaverse or BioConductor which might have their own standards on contribution processes. It does make complete sense to setup policies related to branch and/or forking and pull requests and who can perform those. It may make sense for PRs to pass automated tests or require approval from multiple people. What we need is, as responsible project maintainers, is to clearly document the contribution process and contact information - even if that is a repository-based email group - eg. [email protected] - which we then maintain on the backend (and add rules around that so that projects don't get abandoned (or are clearly listed as abandoned). There are also ways to tag repositories with their status in terms of needing a maintainer, etc. See rOpenSci and how they work on this. This should all be in a CONTRIBUTION.md file and could even contain a CODE_OF_CONDUCT.md for how PRs are handled to avoid harassment.

RX can have an administrative role in setup of these repositories - and someone may need to be aware of issues related to our code becoming part of larger ecosystems and what that entails. That's a great role for RX. But to review PRs - that's BS.

4. Communication standards with this group - do comments in the Novartis/admin repo work for this type of outreach?

So this is really bad - no one that works on any of the Oncology open-sourced work was aware. I heard about it from one of the engineers that I don't think was even part of one of these - I'm not sure how he got it.

Part of OSI is to help people understand their role as a product maintainer and to help people work through that and document it for others. And part of OSI to oversee the general product maintainer communications. I don't think this Novartis/admin thing is working at all.

Happy to talk through this based on my experience with other open-source projects and the conversations I've tried to have with legal on the contribution process.

[kliatsko]

Thank you to @Novartis/contributors for the comments!

Here's what I have so far (from this thread and from private messages):

1. Under no circumstances should the opensource.novartis.com site be shut down. It needs to be updated with new Novartis theming and with links to ensure a strong image for Novartis Research and Development.
2. Secret scanning is acceptable and admins should add vulnerability scanning. Each of the owners should be notified with a contribution file and flexibility must be given if secret/vulnerability scanning is unacceptable.
3. Hard NO from many angles on reviews (even optional) by RX.
4. More robust documentation is required from the admins regarding contributions, policies, and maintenance expectations. This documentation must be available in Confluence (for current employees) and elsewhere (likely an expansion of OSI) for active contributors no longer with Novartis.
5. Messaging through discussion boards isn't effective or professional. Direct outreach is preferred.