Grant permissions for others to cut libp2p releases

[mxinden]

Today I am the only person with crates.io permissions to all libp2p-* crates. Thus I am the only person that can cut rust-libp2p releases.

On crates.io "Owners" of a crate can be both individual GitHub accounts as well as GitHub teams.

I suggest I add the rust-libp2p Maintainers GitHub team to all libp2p-* crates and thus allow everyone in the team to cut releases.

@galargh any objections / alternative suggestions from a GitHub permission management perspective?

@MarcoPolo @jxs @thomaseizinger @elenaf9 as members of the rust-libp2p Maintainers team, any objections / alternative suggestions?

[thomaseizinger]

Sounds good to me although some work will be required if you ever want to add someone to the maintainers team that shouldn't have publish access.

Maybe it is better to make a separate team so the privileges can be allocated explicitly.

[thomaseizinger]

How do other teams within libp2p handle this?

[mxinden]

I am not familiar with the release processes of other teams. Maybe @MarcoPolo can expand how this is done for go-libp2p? Maybe @galargh is familiar with the release process of other (rust) teams within the company?

[mxinden]

Friendly ping @MarcoPolo or @galargh? Any insights from other teams here? If none, or no objections, I will go ahead with the above, namely to grant publish access to the rust-libp2p maintainers team.

Maybe it is better to make a separate team so the privileges can be allocated explicitly.

While I understand that one can do more harm with publish access on crates.io vs push access on libp2p/rust-libp2p, I would argue that we should never grant someone access to either, in case we don't trust them with both.

[galargh]

I'm not familiar with Rust release process... yet. I'd love to change that. If you have a doc that describe yours or you could ping me when you're performing it next, that'd be great.

Having said that, no objections on my side. Sounds reasonable. Whether it's one team or two, no strong feelings but I'd agree with Max on how it should be treated.

One suggestion I have is that you can leave a comment around your team definition in GitHub Management to let people know that it comes with crates.io access. We have one for github-mgmt stewards team for example, https://github.com/libp2p/github-mgmt/blob/79410de947bb821c237f1f0990cee11b5ebe7fd2/github/libp2p.yml#L4442

[mxinden]

Status update:

• Added note to our management repository docs(rust-libp2p): Document crates.io access github-mgmt#100.
• Added github:libp2p:rust-libp2p-maintainers to all crates in github.com/libp2p/rust-libp2p apart from libp2p-request-reponse.
• Reached out to @romanb for permissions on libp2p-request-response.
• Got permissions to libp2p-request-response and added rust-libp2p-maintainers.

[mxinden]

I'm not familiar with Rust release process... yet. I'd love to change that. If you have a doc that describe yours

Release process is documented here.

or you could ping me when you're performing it next, that'd be great.

Cool. Let's pair for the next release @galargh!