Plone Foundation Board Minutes May 29, 2025

Present: Brian Davis, João Henrique Gouveia, Mikel Larreategi, Martin Peeters, and Guido Stevens
Excused: Rafahela Bazzanella and Eric Brehault

May 15, 2025: Brian motions to approve. Guido seconds. All in favor. Gouveia abstains.

Mikel: Recent discussions included creating a checklist about what to do as a company in the Plone community as a way of self-grading.
Martin: There are strict rules that we cannot be involved in promoting companies for tender, but we can promote companies that do serve Plone well.
Martin: The gamification of a checklist could be problematic because there are small companies that would be on the bottom of that criteria. Small companies should be elevated to further growth within the Plone community.
Guido: Minimal approach should be binary. ie: Are you a Foundation member? Are you a Sponsor?
Martin: The rule is that sponsors only have a link on plone.org if they are also a Plone provider. This is to prevent random companies from using us to improve SEO when they don't actually provide Plone support.
Guido: Is it even relative to be listed on plone.org for tenders? Not necessarily a requirement for verification/validation.
We will continue to follow the discussion and wait for a final proposal.

Mikel: We should re-examine the Sponsorship proposal and think about how it can be improved.

Can we link/merge Foundation Sponsorship & Conference Sponsorship?
There is alot to consider here and we should give it focus within our Board Priorities.

Martin: Let's continue to follow the discussion, be aware of the issues, and wait for a final proposal.

Mikel: With CI/CD, nowadays much of our code is deployed directly from Github. So access to that should be limited.

Problem is that over the years, we have accumulated too many contributors who have access permissions.
There is something like 40 administrators on Github. They don't need to be admins.
But due to the security model, they have access to all of the secrets, regardless of whether they are active or not.

Guido: There are two different issues here: admin rights and commit/membership rights.
Martin: Email is a necessary courtesy. Could send Emeritus members an email:

Thank them for all that they've done.
Let them know that for security reasons, we will be reviewing adminstrator accounts.
Based on their inactivity, their admin access permissions will be removed.

Mikel: Yes, but there is no way to directly contact users. Can only @them in an issue.

The proposal is to restrict to a few number of users: Admin Team, etc.
The plan is to get stats from Github API and see who has been inactive and then make a post/issue.

Something like: "We are doing a permissions cleanup. If we do not hear back from you, we will remove you. This is a necessary cleanup in order to guarantee the secruity of the organization."
Or wording could just say: "For security reasons, if you are not contributing and not part of a team, we will remove you."

Alpine Sprint Budget: No reply yet.
EU/UK Trademark: Renewal is in process.
GSoC: Eric is not here. No new news.
New Treasuer: Martin didn't yet send email to Beth/Steve.
AI Policy: Mikel wrote down some recent examples. Document format will need to be refined/structured.

Goal: To be published on plone.org as a reminder to everyone and should summarize how we see AI being used in the Plone community.
Tone/Wording: Be nice. Be friendly. Offer alternative solutions. "Please do this instead of that."
Should be framed/organized around headings for each area.

Zope Funds: No new news. Mikel to contact EricS and ask if he can contact people.
Plone Conference:

Mikel: Lots of good things are happening at the Beethoven Sprint. Expect a sprint report in the coming weeks.