Proposal: Community Curation for OpenTofu Registry

[yordis]

Context:

Inspired on Crossplane Contrib and other CNCF projects.

Recent discussions highlighted concerns regarding community-maintained packages and their reliability for professional use, specifically referencing deep merging functionality (isometry/deepmerge, apparentlymart/deepmerge). The current situation reflects common issues in various ecosystems, notably the lack of alignment, trustworthiness, and clear community recommendations.

See #790

Proposal:

Create a dedicated process or team under the OpenTofu project to identify, curate, and promote community-driven packages meeting specific quality and reliability criteria. This could manifest through one of the following mechanisms:

1. Creation of an opentofu-contrib GitHub organization:

   • Distinguishes packages that meet specific community standards.
   • Clearly communicates packages endorsed by OpenTofu.
   • Helps reduce burden on core maintainers.

2. Implementation of a labeling/tagging system in the OpenTofu Registry:

   • Labels such as "Recommended" or "Curated" to signal quality and reliability.
   • Transparent criteria for obtaining such labels.

[apparentlymart]

Hi @yordis!

In the original issue I asked if you could enumerate exactly which "quality and reliability criteria" you'd be wanting this team to check for.

It seems to me that the answer to that is considerably more important than whether the result is represented as a GitHub organization, as additions to the OpenTofu registry, or something else, because it defines the amount of work and type of work this hypothetical new team would be signing up to do, and if that work is too onerous then it'll presumably be hard to persuade people to do it.

Could you either edit your proposal to include that information, or (if you prefer) reply to this thread with some information on that? Thanks!

[yordis]

Could you either edit your proposal to include that information, or (if you prefer) reply to this thread with some information on that? Thanks!

🤦🏻 my apologies, I completely forgot 😓 Let me continue improving the situation over time; let me check with a few things from CNCF that may be worth copying or keeping in mind.

P.S.: I am in the middle of some production issues 😭 my apologies if I am not that responsive or giving the attention I deserve right now.

• For later note: https://github.com/crossplane/crossplane/blob/main/GOVERNANCE.md#policies-for-community-extension-projects

[voidtek]

If I may intervene, in response to your request for specific "quality and reliability criteria" that a dedicated team could assess, here are several key classic factors to consider:

• Code Quality and Maintainability: Ensuring that code is readable, reusable, concise, maintainable, and resilient is crucial. These attributes enhance collaboration among developers, simplify code reviews, reduce bugs, and improve the project's reputation.
  Automated Testing: Implementing comprehensive automated testing practices is essential. This includes unit tests, integration tests, and end-to-end tests to verify that the code functions as intended and to prevent regressions.

• Continuous Integration (CI): Utilizing CI pipelines to automatically build and test code changes ensures that new contributions do not introduce errors. This practice maintains the stability and reliability of the project.

• Code Review Process: Establishing a structured code review process helps identify potential issues early, promotes knowledge sharing among team members, and maintains code quality standards.

• Documentation Quality: Maintaining clear and comprehensive documentation, including code comments and user guides, facilitates understanding and effective use of the codebase by current and future contributors.

• Security Practices: Implementing security measures, such as avoiding the inclusion of sensitive information in the codebase and adhering to best practices for credential management, is vital to protect the project and its users.

By focusing on these criteria, the team can enhance the overall quality and reliability of the OpenTofu project, ensuring its long-term success and maintainability.

In addition, establishing an official GitHub organization for OpenTofu offers significant benefits:

• Enhanced Identity and Credibility: An official GitHub organization provides OpenTofu with a centralized and professional presence on the platform, thereby strengthening trust among users and potential contributors.

• Centralized Resource Management: It enables the consolidation of all repositories, teams, and projects under a single entity, simplifying management and collaboration.

• Permission Control: Organizations offer advanced features to define specific roles and permissions, ensuring secure and structured access management.

• Increased Visibility: An official organization enhances the project's visibility, making it more easily discoverable and attractive to the open-source community.

By establishing an official GitHub organization, OpenTofu benefits from a solid structure that supports the project's quality, reliability, and continuous growth.

[apparentlymart]

I don't mean any urgency in this request on my part, for what it's worth. I'm just trying to guide this discussion toward something actionable that we can understand the full implications of. Of course your work responsibilities take priority over this discussion; let's just discuss asynchronously once you are ready.