Contributions are welcome! How to encourage more?

[karfau]

What kind of contributions are we talking about?

Everything, there are issues to investigate/clarify, documentation to write, strategic decisions to be discussed, pull requests to review, features to suggest, ...

What is keeping people from contributing?

I believe the main reason currently is uncertainty. About a lot of things.
That's why I created this discussion. We want to collect the topics that keep people from contributing, and at the same time find people that are willing to invest time into these topics, providing their experience, knowledge, opinions, etc.

But there is not even ...!?

• a contribution guideline
• a code of conduct
• a list of all contributors (GitHub only lists "committers" as contributors)
• ... you name it ...

Yes, this discussion can be very "meta" (we need to resolve those step by step, without them being in place), we hope it will be very constructive and fruitful anyways, so the list get's shorter over time and people feel encouraged to contribute right away.

Here is a checklist published by GitHub and how far we are into making this a place that people feel confident to contribute to:
italic text is added by me

1. Repository Settings
   • set appropriate repository visibility (public or private)
   • configure branch protection rules
     requires Automate release process #451 to be solved
2. Repository Contents
   • create an informative README.md
   • add a LICENSE.md file
   • include CONTRIBUTING.md
     this is why I started this discussion
   • set up CODEOWNERS
     most likely only makes sense when there is more then one active maintainer?
   • establish a CODE_OF_CONDUCT.md
3. Automation/Checks
   • implement code linting
   • set up tests / Continuous Integration (CI)
   • configure status checks
   • consider Continuous Deployment (CD)
     see Automate release process #451
   • (enterprises) configure Merge Queues
4. Security
   • assign appropriate roles/permissions
   • manage secrets securely
   • set up scanners for dependencies
   • set up scanners for secrets
   • set up scanners for general vulnerabilities
   • consider Dependabot version updates
   • provide a SECURITY.md
5. Advanced Options
   • add Issue Templates
   • configure GitHub Codespaces
   • define Environments
     not sure how this would help us?
6. Next Steps / Externalities
   • commit to being responsive
     only for security issues so far, needs more (reliable capacity)
   • use GitHub Projects and Issues for project management
     to reflect curent status towards milestones, see https://github.com/xmldom/xmldom/blob/master/docs/RELEASE.md
   • promote your project for visibility
   • engage with your community

Let's try to keep this discussion helpful by creating a single thread per "topic".

Thank you for reading this, we are looking forward to your contribution.

[karfau]

If you want to contribute something to our upcoming security policy, please get involved in #365

[karfau]

I just added issue templates in #442 to avoid more security issues being posted publicly.
The new issue button now leads to https://github.com/xmldom/xmldom/issues/new/choose, which gives an option for bug report, feature request or reporting a security issue.

[karfau]

I just watched https://www.youtube.com/watch?v=Z7ppp_DrxyM which was organized by GitHub and provided the following inspiring resources related to contribution guides:

• https://julialang.org/contribute/
• https://contributing.ropensci.org/motivations.html
• https://www.jonobacon.com/books/peoplepowered/
• https://www.splunk.com/en_us/blog/splunklife/the-product-is-docs.html

[karfau]

For code of conduct I just found out about https://www.contributor-covenant.org/ which seems to be a widely adopted thing for open source and looks like a good "minimum" to have. (PR is welcome)

[karfau]

GitHub just published https://github.blog/2023-08-04-a-checklist-and-guide-to-get-your-repository-collaboration-ready/ and I added the related checklist to the original discussion post.

If you disagree with a status or my additions to it, please raise the topic here or where you think it fit's best.