ER: Remove inactive members from team resources

[JessicaLucindaCheng]

Note: This issue came from the Task List Dev Leads.

Emergent Requirement - Problem

Issue Description

Write an issue to figure out how to remove developers marked inactive in our roster from all team resources.

Update roster

• First, we need to make sure our roster is up to date and mark any developers who are no longer active as inactive in the roster.

Clean up GitHub teams

• Before removing anyone from a team, make sure they are on the website team in GitHub (https://github.com/orgs/hackforla/teams/website) already, which gives them only read access to the repo. This makes sure it doesn't mess up any work they did (issues they were assigned to and completed, prs they opened, etc). In the past, people may not have been added to the website team in GitHub when they joined so that's why we need to check that they are on the website team in GitHub.
• Then do a clean up of teams in GitHub, including
  • Downgrading inactive maintainers to just members on the website team in GitHub (https://github.com/orgs/hackforla/teams/website).
  • Removing inactive members from the following teams:
    • website-write: https://github.com/orgs/hackforla/teams/website-write
    • website-merge: https://github.com/orgs/hackforla/teams/website-merge
    • website-admins: https://github.com/orgs/hackforla/teams/website-admins

Offboard from other resources

• See the Offboard template section of Onboard & Offboard: Junior Developers #3175 for all the other resources junior developers need to be offboarded from
• See the Offboard template section of Onboard & Offboard: Tech Leads and Merge team #2689 for all the other resources merge team members and tech leads need to be offboarded from

Who was involved

• @JessicaLucindaCheng
• @SAUMILDHANKAR

What happens if this is not addressed

Inactive developers maintain a level of access to our repo that they don't need (such as write or admin access) and it may make our repo less secure.

Resources

Recommended Action Items

• Make a new issue
• Discuss with the team
• Let a Team Lead know

Potential solutions [draft]

[ExperimentsInHonesty]

Summary of the items that remain (draft)

• remove the user from the Google Drive (see notes below about tables team scripts)

  • WG: Done as of 2/23: via a Google Apps Script using [email protected] account, removing "Inactive" and unaffiliated members now, scheduled to run once monthly

  • WG: Note: I have been manually updating membership statuses, linking up emails to github handles, and more to clean up the Website Drive, but notice that Rabia is doing the same thing. So as not to waste time duplicating efforts, I have stopped manually updating. Script running/ auto-updates now

• write a GHA if possible and if not a Google app script to update the users status as inactive when the member is removed from the repo.
  • WG: Done as of 2/19: via a Google Apps Script using [email protected] account for the token to access GitHub.
• confirm that the solution does the following:
  • Makes sure the user on the write team, is also on the read team
    • WG: Done please note however: schedule-monthly.yml checks if user is on 'website' team prior to removal and adds them if they aren't.
  • remove the user from the write team
    • WG: Done. schedule-monthly.yml doing this
  • if user has maintainer status on the write team it removes it.
    • WG: Update: discussed at 2/26 meeting: won't use maintainer to block. Automation will completely remove the "Inactive" + "maintainer" from the 'website-write' team.
      • this is a different behavior than what we have been doing. Currently, if user has "maintainer" status they are protected from removal- the automation logs comment that "This inactive member is a 'Maintainer': xxxxxx" and then skips them
  • updates the roster, to make the member be inactive
    • WG: Done as of 2/19. See above also. Script is automatically updating column B on the Roster, once daily (at 9:32 pm for the last several days)
  • close their prework issue
    • WG: This will be incorporated into Edits to contributors-data.js and schedule-monthly.yml #6193
    • WG: I reviewed Project Board and closed all open preworks from inactive members - there are no 'orphans' left
  • unassign them from any open issue they are assigned to and move the issue to ??? and add ??? label
    • WG: Not done as shown
      • 2/25 Current automation will log the inactive member and the number or the open issue to which the inactive member is assigned, so that any may be reviewed. Incorporated into Edits to contributors-data.js and schedule-monthly.yml #6193
      • As an example: if we do this then the bot would be removing 'wanyuguan' & 'n2020h' from 'website-write' and unassigning them from their issues- Is this what we want to have happen?

Things this won't do for now (merge or lead specific)

• addressed by Onboard & Offboard: Tech Leads and Merge team #2689
• Items
  • remove from 1Password
  • Remove from forwarding emails
  • Remove from Slack channels
  • Remove from Figma
  • Remove from Calendar invites
  • Remove them from the team WIKI page
  • Remove from the hack for LA website
  • Remove access to Google Data Studio: Hack for LA Organizational Dashboard
  • Revoke access to Zoom Meeting Setup spreadsheet

[t-will-gillis]

UPDATE 2/11/24:

• Closed all Pre-work Checklists from Inactive members.

Google Sheets 'Roster' file: Up and running as of 2/19

TL;DR Automation is running as of today,

• The working Google Apps Script file and keys are accessible/ editable only through the Gmail account for [email protected] (credentials same as for email).

• The automation runs daily at 9-10 pm, and checks for the list of "Active" users on the 'website-write' team, then logs the list to a Google Sheet inside the bot account.

• The Roster imports this list from the bot account into Column 'B'

• (The automation is purposefully attached to the limited-access hackforla-bot account so that GitHub and Google keys/ secrets are not easily accessible)

• Column 'F/G' "Permissions" is NOT updated, still manual

• See comments above also.

APIs - Have written a Google Apps Script to call GitHub and update members in my repo. Need to transfer script to the Roster, and authorize the script without making the token visible (via an environment variable? if someone know how to do this... ).

• Col B 'Status':

  • Google Apps Script is ready to be transferred to Roster: whose account, hiding access key?
  • From 2/12 meeting: use "GitHub Bot" account
  • Snag is that not all of current "Leads" are "Active" --> should all of these people be leads?

• Col F 'Permissions':

  • Script could update 'Merge Team' easily, but not 'Lead's

• Cols M-Q: Need anything here?

• I mis-stated the above regarding the "Lead" designation for 'Permissions'- my question should be: If someone is marked as a "Lead" on the Roster, should this be tied to some aspect of the Website teams? For example, some people that are identified as "Leads" are gone completely from the website (Alex Stubbs, Harish) and some are normal members with no special status (Isaac Cruz, Saumil).
  - Note I am only asking the question if you would like me to do something. If not, I can ignore also.

Google Drive 'HfLA.org Website' Up and running as of 2/23

• The working Google Apps Script file and keys are accessible/ editable only through the Gmail account for [email protected] (credentials same as for email).

• The automation currently set to run monthly at 3 am on the 2nd.

• The automation runs daily at 9-10 pm, and checks for the list of "Active" users on the 'website-write' team, then logs the list to a Google Sheet inside the bot account.

• The Roster imports this list from the bot account into Column 'B'

• (The automation is purposefully attached to the limited-access hackforla-bot account so that GitHub and Google keys/ secrets are not easily accessible)
  TL; DR: File is partially, manually updated as of today. Can finish manually except need guidance on access settings.

• See previous comment. I am abandoning manual updates to the Drive since Rabia has now also started doing the same thing

• I need to explore further about using scripts to update Drive access. Update from 2/12 meeting: WG given access to Tables. There are GA Scripts for changing/adding members to Drive.

• Are there other members who should have or retain higher level of access? For example:

  • Current "Content manager"s: John Guan, Zoe Zhong, etc. (People that were given this access in the past)
  • Current "Contributor"s: Chelsey Beck, Adam Abundis, etc. (People that are Leads elsewhere)
  • Update from 2/12 meeting: If the person is "Inactive" their access to the Drive should be "Viewer". NOT CORRECT per discussion with Rabia

• Assuming other Google Drive(s) out of scope e.g. the Admin drive

• Assuming that updates to 1Password out of scope

• Assuming that Figma access out of scope

• All correct, see Bonnie's comment above

[ExperimentsInHonesty]

Tables team scripts documentation https://github.com/hackforla/tables/blob/main/dev-docs/app-scripts.md

[t-will-gillis]

See comments below:

• First, we need to make sure our roster is up to date and mark any developers who are no longer active as inactive in the roster.

• WG: accomplished by Fix bug that prevents GHA "Schedule Monthly" from running  #4788 in schedule-monthly.yml

• Before removing anyone from a team, make sure they are on the website team in GitHub (https://github.com/orgs/hackforla/teams/website) already, which gives them only read access to the repo. This makes sure it doesn't mess up any work they did (issues they were assigned to and completed, prs they opened, etc). In the past, people may not have been added to the website team in GitHub when they joined so that's why we need to check that they are on the website team in GitHub.

• WG: also accomplished by Fix bug that prevents GHA "Schedule Monthly" from running  #4788 in schedule-monthly.yml: The GHA checks if member is on the 'website' team before removal from 'website-write', and adds them if not.

• Then do a clean up of teams in GitHub, including
  • Downgrading inactive maintainers to just members on the website team in GitHub (https://github.com/orgs/hackforla/teams/website).
  • Removing inactive members from the following teams:
    • website-write: https://github.com/orgs/hackforla/teams/website-write
    • website-merge: https://github.com/orgs/hackforla/teams/website-merge
    • website-admins: https://github.com/orgs/hackforla/teams/website-admins

• WG: Issue Edits to contributors-data.js and schedule-monthly.yml #6193 adding segment to remove "Inactive" members from 'website-merge' in addition to 'website-write'. It appears removal of 'website-admin' requires admin access for the bot.
• WG: See also Google Sheets to ID Active Members automatically updates Website Team Roster for "Active"/"Inactive" members.
• WG: See also Google Apps Script to Update Website Drive automatically updates Website Team's Google Drive access based on "Active" members, and updates Team Roster.

See comments from Bonnie above regarding other Team Resources