January 17, 2022 Community Retrospective

[adambkaplan]

This week's community meeting will be different than our typical "open agenda" format.

Now that 2021 has come to a close and 2022 has begun, the Shipwright community would like to reflect on the past year and think about what we would like to accomplish this year. The meeting will take the form of a round-table discussion, with each participant briefly providing their thoughts and reflections (3-4 minutes). If you would like to join the conversation, please add a comment to this issue below on any of the following topics:

• What did we do well last year?
• What could we improve this year?
• What changed this year? Should we focus on something different in light of these changes?

[adambkaplan]

• Last year we took a big step forward to make this a truly open, community-driven project. Moving to the Continuous Delivery Foundation was one piece of the puzzle. Even though most of the contributors are from IBM or Red Hat, we doing our best to consider what is best for the community overall. We have also made strides to improve our release infrastructure, automating the publication of container images and release notes with GitHub Actions. As a result, I fell like we've gotten better at delivering new features with each release.
• This year I would like us to continue growing our existing contributors and encourage the sharing of ideas through the SHIP process. Like Tekton, we should try and adopt SLAs with respect to when pull requests and SHIPs are reviewed. We have also seen Shipwright be used outside of IBM + Red Hat - we should proactively reach out to those communities and try to grow them from end-users to community partners.
• The biggest change to hit our niche of open source this year was SolarWinds/Sunburst, and the urgency of organizations to adopt best practices for supply chain security. I feel that Shipwright can be an important tool in this space by securely building auditable container images. This goes beyond just making sure that our code is secure - it means that we make it simple for developers to adopt supply chain best practices that allow images to be analyzed and audited. Integration with Tekton Chains and features that support SBOM generation/distribution are two items that I have in mind on this front.

[SaschaSchwarze0]

• 2021 was a year where Shipwright made steps forward on various paths: as an open source community joining a foundation; organizational in our work together in ships and slack and meetings and with many new contributors that contributed smaller or bigger pieces; and feature-vise in various places. We have areas where we could have done better. We often have pull requests started but do not get them completed in a reasonable time, we did not do a release for some months in summer, and we have some not too complex but very helpful things outstanding for a long time that would help us and our users (documentation sync, package manager for cli, eliminating the service account).
• In 2022, I wish that sometimes things go a little smoother - but am also realistic as we are not Shipwright employees but Shipwright is just one of the responsibilities in our jobs.
• Project-wise, I want Shipwright to play out its focus in building container images by providing capabilities out-of the box which today can only be done by strategy authors: this includes simple things like the verification of image push permission before even starting a build, to more complex things like vulnerability scanning before pushing, or signing the pushed image. Edge goal would be to rebuild images automatically when they become vulnerable or the base image was updated.
• I also want Shipwright to be able to build more images. This requires us to add or complete features such as extended parameters and volume support.

[adambkaplan]

Additional minutes from the meeting:

• @gabemontero: would like to know where we are heading with the Image project. On a personal level, would like to budget more time to Shipwright.
• @HeavyWombat: would like us to improve the smoothness of operations. Ensure that PRs are reviewed in a timely manner, there are replies/feedback from the community.
• @otaviof: we seem to have a full plate of features for this year. We should set priorities on these so we can focus and execute.
• @sbose78: we should "be more like a startup" and drive new feature work. SHIPs should be time bound. When it comes to specific tooling (ex cosign), we need to balance neutrality with taking an opinionated stance. Finally, we should consider end-user experience around supply chain security.

[adambkaplan]

Discussion for next steps is happening here: #51