Teams role / permissions

[aubertc]

Hi!

Since you seem to be in the process of re-structuring the website & this repo, can I make a feature request: could you please add roles (teams, in github terminology) or another mechanism with more fine-grained permissions?
As of now, as a chair of the ICE workshop, I can edit the whole site, and would prefer to have fewer rights.

I know it's a hassle to implement (since it probably require to create a different repo. with different access rights, etc.) using teams, but maybe having a team that cannot commit directly, but has to go through a pull request, would be simpler to implement?

Thanks!

[Alystrasz]

A way to do that would be to give "Read" role to new contributors by default; this is configurable only by repo admins, though.

[aubertc]

[Branch protection rules](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule) may be a good option too, possibly less intrusive. It could be used to forbid pushing on main directly.

[basvdheuvel]

Working with pull requests is a possibility, but it significantly increases the workload for the site maintainers, so I'm not necessarily a fan.

It would require more work, but we could think about creating separate repositories for the different pages.
We then include those repos as submodules.
It is then easy to divide permissions in a fine-grained way.
However, I'm not sure if we can set this up so the main repo updates automatically when a submodule is updated.

[basvdheuvel]

I think the best, relatively easy to setup and maintain way is to setup a CODEOWNERS file (https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners).
This file designates users as "owners" of specific files (the syntax allows for a enough pattern matching).
We can then setup the master branch in such a way, that PR's must be approved by changed files' code owners.
Typically, we will set this up so that, e.g., Clément is code owner of 2025/ice.md, has to make a PR to publish a change, but can approve and merge the PR himself. If Clément were to update 2025/README.md (the main page), he would also have to make a PR, but could not approve it.

We also have to think about who will be the code owner of which file. For example, do we only want Clément to own 2025/ice.md, or do we also want the site's other admins to be owner and to be able to approve changes?

@sbliudze I want to involve you in the discussion, because setting this up will further change the workflow for organization members. There may also be a bit more latency for updating the site: best case, there is the extra step of approving and merging the PR, worst case, you have to wait for one of the code owners.

@Alystrasz Would you have time to implement this?

EDIT: see also https://stackoverflow.com/a/63144296.

[aubertc]

However, I'm not sure if we can set this up so the main repo updates automatically when a submodule is updated.

I've looked around a bit, there may be ways of doing this, bit they seem burdensome.

An issue with CODEOWNERS is that you can't add files (the pdf to the pre-proceedings, for example), but I don't think it's a big issue: workshop organizers should find ways of hosting those files somewhere else. It's probably the best option as of now.

do we also want the site's other admins to be owner and to be able to approve changes?

I think discotec's organizers should have edits rights on all the website (bus factor).