Create an easier way to track contributions across GitHub and Trac

[desrosj]

A way to Trac contributions across both Trac and GitHub does not yet exist. This makes it difficult to properly compile a list of contributors on release days, and often leads to people accidentally left out or not receiving the proper level of credit.

Compiling the list also requires some work of manually matching WordPress.org and GitHub usernames.

Previously #3885, #4442.

Some ideas have been:

• Add a field to profiles.w.org for GitHub account.
• Create a text file that maps GitHub usernames to .org accounts that can be updated every release and can be used to script this.

[desrosj]

5.0 worksheet: ​https://docs.google.com/spreadsheets/d/1KCrhdKCXpTESHkA0CHfrShmeHnW8J4NCeLlsWd-8798/edit?usp=sharing

5.2 worksheet: ​https://docs.google.com/spreadsheets/d/1zpu0JA6p73khCp0ycO3tn9hgL6cNft-nO7_gOfGKlaw/edit?usp=sharing

[earnjam]

Have their been any thoughts to using props on GitHub? That would allow people who do testing of pull requests, or provide design input, but aren't necessarily the original person who opened the PR, to still get credited as a contributor to a release.

It would require some sort of script to parse commit messages similar to what we do with svn now. We also would still need a way to map it back to wp.org usernames.

[aduth]

Additional ideas:

• An email address is available for any git commit, and could be associated to an equivalent user profile on WordPress.org (​example, see commit.author.email)
• GitHub uses Gravatar as a fallback for user profile images. It could be possible to associate a user by lookup of equivalent Gravatar URL on WordPress.org.
  • From initial observation, GitHub appears to use its githubusercontent.com domain as a proxy to profile pictures, so it may not be possible to retrieve directly their Gravatar URL.
• As ​suggested in Slack by @youknowriad, we could automate a bot to leave a comment for new contributors prompting them to provide their WordPress.org account name
  • e.g. Directing the user to submit to a Google Forms
  • Similar to contributor license agreements (​example)
  • Perhaps an opportunity for using ​GitHub actions recently made available in the WordPress GitHub organization

Have their been any thoughts to using props on GitHub? That would allow people who do testing of pull requests, or provide design input, but aren't necessarily the original person who opened the PR, to still get credited as a contributor to a release.

The workflow wouldn't be too difficult to adopt. For example, merging a pull request provides the opportunity to revise the commit message, which could include a "props" message (​https://cloudup.com/cxeB8bEAQ_j screenshot).

I'm not sure how it addresses the need of the ticket though, since presumably it would need to be specified as their WordPress.org username, which can difficult to determine.

There's also the human element to consider in the opportunity to be overlooked. It's true of SVN, though in that case there's much more thoughtful consideration to the crafting of a commit message than what typically occurs in a merge on GitHub.

The general idea would be good to consider, since credit should be attributed to more than just the author of a pull request. It may be worth considering if this "props" could be automated from GitHub's ​pull request reviews, which aren't strictly limited to code review.

A way to Trac contributions across both Trac and GitHub does not yet exist.

​Mentioned in Slack as well, but there is a document which exists in the Gutenberg repository. However, it is not always reliable, since it requires both that a person knows it exists and that they feel comfortable enough to propose (by pull request) to be included. Therefore, it often lacks entries from irregular contributors.

​https://github.com/WordPress/gutenberg/blob/master/CONTRIBUTORS.md

[melchoyce]

back-end.png​ and front-end.png​ are a quick idea for adding a GitHub field to profiles.

(Pretend that github username on the front-end mockup is underlined)

[jorbin]

1) I would love for the profile change. I think that would be helpful in general and not just in this context.

2) I have some #badcode that looks at all trac activity at any given time which could be modified to look only at tickets closed on a specific milestone and extended to also look at github activity. This could help ensure that if props are missed on a commit, people are also credited. The biggest hangup for combining them is definetly connecting GH username and wporg username.

Here is the #badcode ​https://github.com/aaronjorbin/wp-mac

[talldanwp]

Github has a feature similar to props for co-authorship of a PR:
​https://help.github.com/en/articles/creating-a-commit-with-multiple-authors

There are a couple of negative aspects to the co-author system:

• It relies on knowing the email address of the co-author and using a very specific syntax.
• When a PR is squashed to master, co-authors of commits on the branch are stripped out of the final commit message (seems like this is possibly an unhelpful bug on github). Co-authors would have to be specified manually, or using some kind of automation.

Positives:

• The UI in github is quite nice (multiple avatars are displayed next to the commit).
• Co-authorship is counted as a contribution in github's stats.

[azaozz]

Linking the wp.org profile to the GH profile is best imho, thanks @iseulde (​https://wordpress.slack.com/archives/C18723MQ8/p1557324802058000) and @melchoyce (https://meta.trac.wordpress.org/ticket/4447#comment:5).

Replying to aduth:

An email address is available for any git commit, and could be associated to an equivalent user profile on WordPress.org.

Right, but only if the wp.org and GH email addresses match. Seems that is not true in many cases. Best is to link the GH and wp.org profiles. That also "grants" user consent for linking from one place to the other.

GitHub uses Gravatar as a fallback for user profile images. It could be possible to associate a user by lookup of equivalent Gravatar URL on WordPress.org.

Thinking it would be better to not look at Gravatar hashes. Not very reliable and may bring some "user privacy" concerns.

As ​suggested in Slack by @youknowriad, we could automate a bot to leave a comment for new contributors prompting them to provide their WordPress.org account name

And/or to add their GH user name to their wp.org profile (when this becomes possible). Think this is a good idea.

[azaozz]

Replying to talldanwp:

There are a couple of negative aspects to the co-author system:

• It relies on knowing the email address of the co-author and using a very specific syntax.
• When a PR is squashed to master, co-authors of commits on the branch are stripped out of the final commit message (seems like this is possibly an unhelpful bug on github). Co-authors would have to be specified manually, or using some kind of automation.

Would it be possible to "extract" all user names or emails of the co-authors before the PR is squashed (or branch is deleted) and post them in a ...special comment. Then can probably look for these comments and give everybody credit as deserved.

[desrosj]

Are we concerned at all with verification of ownership? For example, nothing stops me from using @aduth's GitHub username on my .org profile.

Maybe there could be a verification step where an email is sent to the user's GitHub email for confirmation.

[talldanwp]

Would it be possible to "extract" all user names or emails of the co-authors before the PR is squashed (or branch is deleted) and post them in a ...special comment. Then can probably look for these comments and give everybody credit as deserved.

I'm not 100% sure what's possible with automation on github. If we did have a way to automate it, I also wonder if it'd be possible to 'extend' the co-author format to mention usernames as well. Currently it's:
Co-authored-by: name <name@example.com>

I wonder whether something like the following might still work in github, but also allow us to specify and scrape github and/or WordPress.org usernames as well:
Co-authored-by: name <name@example.com> (github:username, wp.org:username)

One downside of using a commit message is that once that commit is in master, it can't easily be changed.

[dd32]

Replying to desrosj:

Are we concerned at all with verification of ownership? For example, nothing stops me from using @aduth's GitHub username on my .org profile.

Maybe there could be a verification step where an email is sent to the user's GitHub email for confirmation.

The "simple" solution for that is using something like "Link my Github account" instead of a plain-text field, we'd then do an OAuth flow to ​allow access for either user:email or [no scope] (allows access to public data only). That would then be able to provide an authenticated dd32 on WordPress is Github:dd32 scenario which can then populate that profile field.

[dd32]

Today I added a Link your github account section to profiles.wordpress.org, following @melchoyce's mockups above.

To link an account, which uses a GitHub application, simply go to your ​profile edit screen and go through the oAuth flow (It grants read-only access to your public information).
(edit: Just to add - Please suggest string changes if you feel it's needed)

The GitHub application remains Authorised on the GitHub account, just with next-to-no-permissions. Delinking the GitHub from your WordPress.org profile also removes the GitHub authorisation. Revoking access to the app from within GitHub also removes it from your WordPress.org profile.

It's been live for a few hours, and a handful of users have already used it seemingly without problem, so I'm now posting here.

Here's ​My profile https://profiles.wordpress.org/dd32/ as an example.

Remaining here, is still a way to link that into the props toolings, I'm not sure what the best option there is, but lets now focus on that part of this ticket.

We could also look into ingestion of GitHub Issues/Commits/PRs/etc into the profiles activity stream.

[SergeyBiryukov]

​https://make.wordpress.org/core/2020/03/19/associating-github-accounts-with-wordpress-org-profiles/

[schlessera]

Once discussion is started to add props detection from GitHub repositories, I'd love for this to include the ​https://github.com/wp-cli organization for CLI team props.

Right now, contribution badges have to be manually assigned by having the contributor request access to the team.

Also, in a slightly unrelated matter, I'd like to know if there's a public API I can use to query the GitHub username for a given WordPress profile or vice-versa. When I write release-notes for WP-CLI, I always have to correlate the GitHub usernames manually to WP.org profile names so that they get properly linked to when publishing the release notes on the make.wp.org/cli blog.

[dd32]

Replying to schlessera:

Also, in a slightly unrelated matter, I'd like to know if there's a public API I can use to query the GitHub username for a given WordPress profile or vice-versa

There currently isn't, although that's something that's been requested by a few people.

I don't feel great about the idea of creating an API for this, even though it's public data, but quite happy to see an internal tooling made for it.
Currently the process for syncing Gutenberg contributions is to do an export of the database and compare usernames, which isn't something that scales..

[dd32]

Replying to dd32:

Replying to schlessera:

Also, in a slightly unrelated matter, I'd like to know if there's a public API I can use to query the GitHub username for a given WordPress profile or vice-versa

There currently isn't, although that's something that's been requested by a few people.

I don't feel great about the idea of creating an API for this, even though it's public data, but quite happy to see an internal tooling made for it.

Just noting that I'll put together a public wp-json API endpoint to return a WP user details for a given Github username to aid in automating the prop lookups, Can also be used by a future Github bot to prompt users to link their accounts after contributions.

[dd32]

In dotorg15863 I've added a rest api endpoint:

https://profiles.wordpress.org/wp-json/wporg-github/v1/lookup/$github_user

eg:

$ curl https://profiles.wordpress.org/wp-json/wporg-github/v1/lookup/dd32 -s | jq
{
  "slug": "dd32",
  "profile": "https://profiles.wordpress.org/dd32"
}

$ curl https://profiles.wordpress.org/wp-json/wporg-github/v1/lookup/dd321 -s | jq
{
  "code": "user_not_linked",
  "message": "Github Account not linked.",
  "data": {
    "status": 404
  }
}

The HTTP Status code is set to 200/404 depending on if it's linked or not.

Let me know if I should slim it back to just the slug (ie. "dd32" as the entire response) or if other details are needed.
(cc @schlessera)

[aduth]

Replying to dd32:

Can also be used by a future Github bot to prompt users to link their accounts after contributions.

This is now active in the Gutenberg repository:

​https://github.com/WordPress/gutenberg/pull/21221

A few examples of how it looks:

• ​https://github.com/WordPress/gutenberg/pull/21240#issuecomment-607504789
• ​https://github.com/WordPress/gutenberg/pull/21364#issuecomment-608168765

As can be observed in the "Files Changed" of the pull request, it uses this new endpoint. Thanks for making it available!

[desrosj]

Related: #5361.

[dd32]

In 11270:

Profiles: Display GitHub activity on profiles.

This is implemented through a WordPress GitHub organization webhook, which parses pushed events and stores it in a table for later querying.
This is how Trac/SVN (and now GitHub) activity is inserted into the profiles activity stream.

Issues created & closed, Pull Requests submitted & merged, and pushes to repositories are supported.

Activity is only recorded against a WordPress.org profile if their GitHub profile is linked to WordPress.org, but will show up once that's done.

This is still a work in progress, and we may want to import older history as well.

See #4447, #5592.

[desrosj]

It's been ~3 years since discussion about solving the problem has taken place, and this is still an issue with every release. I've published a proposal on the Making WordPress Core blog with a suggestion to add a line to merge commit messages where the merging contributor compiles a list of props manually: ​https://make.wordpress.org/core/2022/01/31/ensuring-proper-attribution-for-contributions-to-wordpress-on-github/.

I'm also halfway through a GitHub Action that will get:

• A list of all contributors that have commented on the current PR and all issues attached.
• A list of all contributors that have engaged in review related discussion on the current PR.
• A list of all contributors that made commits to the current PR's branch.
• A list of all contributors that have commented on linked tickets (either manually, or with ​GitHub's keyword linking).

The idea is that these lists will be posted in a comment on the PR, and it will be updated periodically to contain the most up to date contributor lists, similar to how the github-actions ​user updates the comment with performance details for the PR.

This should alleviate some of the burden on the Gutenberg maintainers when it comes time to merge a pull request, but the list should still be manually reviewed to filter out anyone that did not actually contribute.

The idea is that the current w.org props script that parses a git log for wordpress-develop can be adjusted to also consume the git log for gutenberg, and using the behind the linked GH profile feature added above, the GH usernames can be replaced with w.org ones, and the props more accurately calculated (and less manually).