►
From YouTube: Scorecards Biweekly Sync (January 26, 2023)
A
B
B
B
B
A
Yeah,
don't
need
a
big
discussion
here,
but
I
wanted
to
call
it
out
that
I've
been
working
on
a
contributing.
Md
I
saw
that
we
didn't
have
the
code
of
conduct
in
All
Star,
so
I
copied
that
from
another
open,
ssf
repo,
so
I
got
that
there
as
part
of
the
contributing
MD
links
to
the
slack
Channel
and
things
like
that,
and
then
the
other
main
thing
is
the
contributor
ladder.
A
So
this
was
a
headed
as
a
proposal
for
a
while,
and
we
had
some
discussion
on
the
issue.
Actually
I
didn't
link
the
issue
PR.
Let
me
do
that
now
and
then
yeah
just
wanted
to
to
put
that
out
there
for
any
comments.
Leave
it
on
the
issue
other
than
that
I'm
working
on
some
quick
start
updates
and
some
other
documentation
updates
that
we've
identified
that
we
want
to
make
sure
is
up
to
date,
like
our
changelog
or
you
know,
what's
new
things
like
that.
B
B
Things
like
that
so
sort
of
sat
down
and
checked
more
of
the
scorecard
documentation,
whether
that's
the
readme,
the
scorecard
action,
the
scorecard
web
app
or
the
website
contents
itself.
So
I
can
make
an
issue
about
some
of
these
stale
docs.
We
found
and
sort
of
plans
to
freshen
them
up
so
that
new
contributors
are
able
to
see
the
documentation
without
any
of
the
knowledge.
That's
just
gained
through
time
kind
of
thing.
C
E
C
A
Yeah
welcome
Jeremy
I
mean,
as
you
can
see.
Normally
this
meeting
we
have,
you
know,
updates
for
core
Cardinal
star,
like
project
updates,
and
then
agenda
is
usually
if
we
need
a
discussion
item
for
maybe
a
bug
or
feature
that
you
know
we
want
to
achieve
consensus
on
or
you
know
if
people
have
proposals
for
new
checks
or
new
best
practices.
A
B
But
there
was
a
PR
where
right
now
we
run
all
the
sort
of
light
and
heavy
tests
on
every
commit
and
running
into
like
big
great
limiting
issues.
So
if
we
just
look
at
the
action
tabs
right
now,
there
comes
a
point
where,
like
a
lot
of
these
are
failing-
and
these
are
all
API
failures
and
things
like
that.
B
And
yeah
we
had
to
roll
it
back
a
little
where
certain
triggers
don't
have
access
to
repository
secrets.
So
this
is
still
a
CI
CD
Improvement
I'd
like
to
see-
and
there
are
a
few
ways
to
do
it.
So
just
something
to
play
around
with
any
comments
on
the
issue
are
great
yeah,
just
sort
of
wanted
to
bring
it
up.
I,
don't
really
think
it's
something
that
would
be
a
great
discussion
topic,
but
seams
are
always
limited
on
our
CI
CD
pipeline.
D
B
D
Yeah
I'll
I'll
check
in
as
well
I
just
wanted
to
I
just
wanted
to
let
the
conversation
settle
out
a
little
bit.
I
think
you
know
I'm
still
of
the
mind
around
the
the
serif
formatting
like
that.
It
would
be
good
to
get
something
that
is
minimum,
viable
serif
but
I
mean
especially
in
you
know,
in
the
face
of
potentially
introducing
yet
another
format
to
consider
it.
D
B
B
Yeah,
but
it
is
a
very
expressive
standard
that
overlaps
a
lot
with
what
we're
trying
to
do
so
I
think
at
the
very
least,
even
if
we
do
sort
of
have
our
next
version
of
Json
format
like
if
that's
the
V3
format
or
the
extended
Json,
or
something
like
that,
having
these
rule-based
results
can
be
used
to
augment
the
existing
serif.
We
have.
C
B
Know
there's
some
sort
of
information
about
when
and
what
it's
being
run
on
and
how
and
then
sort
of
these
checks
is
where
the
individual
rules
would
be
in
our
format
and
all
of
these
have
a
corresponding
serif
output.
Whether
that's
you
know
the
start
time
of
the
invocation,
just
a
miscellaneous
property
bag
to
handle
everything
that
serif
doesn't
necessarily
do
when
we
were
talking
about
scorecard
specific
stuff,
so
the
commit
and
sort
of
describing
the
scorecard
used
binary
used
to
do
the
check
their
objects
that
talk
about
the
tool.
B
Doing
the
analysis
in
serif
yeah.
The
checks
with
laurent's
example
just
live
overlap
between
the
rules,
so
yeah
a
lot
of
people
still
out
this
meeting
so
I'm
not
sure
how
much
discussion
can
be
had.
But
I
know
this
week.
I'm
gonna
try
to
finalize
some
of
my
thoughts
on
it
and
get
a
review
out
there
and
sort
of
see
if
we
can't
merge
it
in
and
get
a
consensus.
D
D
Yeah
yeah,
a
lot
of
this
just
looks
like
package
refactoring,
I,
think
yeah
I,
think
you
know
as
long
as
as
long
as
what
we're
getting
out
of
the
other
side
is
still
close
enough
to
what
we
have
today.
I'm
I'm,
pretty
fine
with
it,
but
if
it
would
be
great
if
if
what
we
were
outputting
before
it
gets
kind
of
massaged
for
GitHub
was
just
Cyrus
or
some
minimal
stuff
yeah
I
do
I
do
need
to
sit
down
and
dig
through
that
one.
D
D
Because
I
would
say,
arguably
we
you
know
in
an
ideal
State,
we
just
have
all
the
docs
in
one
place
right.
Okay,
here
go
generate
the
website
based
on
this
folder
or
I.
I
know
that
there
are
some
revisions
to
the
website
that
I
I
know.
It
doesn't
quite
pick
up
off
of
the
content
from
me.
So
how
can
folks
help.
B
So
I
think
the
best
way
would
it
be
to
take
a
look
at
the
issue
whenever
this
gets
posted
I'll
work
with
Kara
to
get
some
of
the
notes
from
that
sync
posted
in
terms
of
these
are
what
we've
identified
as
stale,
Docs
and
sort
of
from
that
point.
You
know
people
can
pick
up
what
needs
to
be
freshened.
D
B
E
B
D
Think
yeah
I
think
figuring
out
like
what
is
what
freshness
means
to
us
and
how
we
can
kind
of
like
guard
against
staleness
in
the
first
place.
Talking
about
that
as
a
group
and
and
I
think
you
know
at
least
starting
with
the
outputs
of
of
that
meeting,
that
can
be
shared
publicly
and
then
maybe
a
I
I
think
I.
D
Think
six
months
sounds
like
the
right
target
to
to
check
in
again,
if
we've
got
kind
of
actionable
actionable
things
falling
out
of
that
out
of
this
issue,
but
hopefully,
but
hopefully
like
we're.
You
know
what
we're
focusing
on
in
that
six
months
is:
is
guarding
against
illness
as
opposed
to
planning
the
next
check-in.
B
B
D
I
feel
like
this
is
I
I've
been
bumping
into
this
in
a
few
other
projects
too,
where
it's
like.
Where
do
we
put
our
docs?
Where
do
we
put
the
contributing
dogs
where
we
put
the
developing
dogs,
and
should
we
have
some
script
that
runs
between
these
repos
to
generate
the
site
and
yada
yada?
It
would
be
great
if
it
was
I
feel
like
in
in
ways
there
are.
D
D
C
D
D
If
anyone
is
heading
out
to
that,
I
will
be
and
that'll
be
on
scorecard,
I
mention
it
in
the
scorecard
meetings
and
I'll,
be
speaking
at
Philly.
Emerging
Tech
in
April
I
believe
also
on
scorecard
I'm
gonna
take
I'm
gonna
try
to
to
break
it
down
from
the
the
perspective
of
someone
who
might
be
evaluating
a
project
for
for
outbound,
open
source
contribution
say
like
you've,
got
an
opto
or
something
you're
doing
a
review.
D
D
D
B
D
D
E
E
We
don't
change
the
way
that
scores
are
calculated,
but
we
don't
have
like
guarantees
around
either
of
these,
so
was
gonna
propose
that
maybe
we
like
think
about
this
and
like
how
how
how
we
yeah
like
how
we
version
this
this
stuff
and
like
maybe
maybe
just
like,
put
a
statement
about
like
scoring
staying,
consistent
or
inconsistent
within
a
particular
version.
So.
D
D
A
So
you
mean
yeah
just
turning
out
there,
so
the
the
code
that
All-Star
Carl
calls
as
a
library.
It
doesn't
need
to
be
like
I'm,
fine
with
it
not
being
centered
I
think
the
discussion
was.
Do
we
want
the
API
and
the
results
to
be
simpler
and
not
worry
about
the
the
library
that's
being
exposed
to
All-Star.
E
D
C
A
D
A
E
If,
if
I
were
to
like
give
my
quickest
pitch
for
what
it
should
be,
it
would
just
be
any
change
to
Raw
results
or
scoring
that
isn't
like
a
bug
fix
like
it's,
not
like
you're
scoring
something
like
that
who
you
know
like
like
like
like
like
like
a
scoring
change.
That
would
require
a
change
of
documentation
or
something
either
of
those
should
trigger
a
minor
version
bump.
D
B
So,
like
one
thing
that
I'm
thinking
of
during
this
discussion
is
like,
we,
we
had
Scott
improve
sort
of
the
security
policy
where
before
it
was,
is
the
file
there
and
now
it's
is
the
file
there
and
like?
Is
there
an
email
and
does
it
mention
like
more
than
just
the
email
so
like
some
sort
of
quality
check
right.
C
D
I
would
do
that
as
a
I
would
do
that
as
a
major
honestly,
so
because
you're,
if
you're,
if
you're
changing
how
the
the
quality
of
the
check
is
determined,
ultimately
you're
changing
the
output
right,
so
I
would
consider
you
know,
like
we
say
across
x,
amount
of
checks.
We've
decided
that
you
know
you
know
the
the
our
policy
needs
to
be
relaxed,
and
these
you
know
in
these
kind
of
axes
right.
D
This
is
a
major
version
bump
all
you
know
well
additional
changes
to
these
policies.
Maybe
you
know,
maybe
tweaking
of
you
know
the
tweaking
of
like
the
the
scale
of
severity,
for
you
know
for
reporting
or
something
but
but
I
I
think
you
know
being
able
to
say
consistently
like
Hey
we're
changing
this
to
to
be
a
bit
more,
be
better,
be
a
bit
more
relaxed
and
the
resulting
and
the
results
reporting
I.
C
D
C
C
D
A
Yeah
I
think
a
way
I
mean
when
you
get
more
mature
a
way
to
counteract
that
is
to
have
like
a
new
check.
B
not
be
like
in
a
beta
or
something
like
that.
So
yeah,
you
could
have
checks
that
are
okay
to
change
the
value
or
change
the
the
calculation
as
they're
being
developed
and
still
being
released.
D
And
yeah
and
I
think
you
know
definitely
check
out
this.
This
issue,
because
I
talk
about
some
of
that,
we
do
have
feature
Flags
sort
of
right,
I,
don't
think
we're
necessarily
consistent
about
when
things
get
into
them
when
we
drop
those
those
environment,
variables
or
or
something
that
when
this
is
like
a
core
you
know
like
this
is
core
functionality.
Now
we
we're
not
really
consistent
about
that,
so
so
yeah
overall
I
think
we
need
to
make
a
decision
here.
D
Calfer
is,
is
completely
fine
by
me
in
in
some
way.
If
we,
if
we
say
like
okay,
you
know
it's,
we
know
that
you
know
maybe
we're
doing
a
quarterly
quote-unquote
major
right
and
and
that's
when,
although
the
fun
stuff
is
coming
in
or
yeah,
we
I
mean.
Ultimately,
we
just
need
a
a
way
of
like
whatever
the
versioning
system
looks
like
as
long
as
we
have
a
lay
of
gardening
against
potential.
Potentially
hazardous
changes.
B
Yeah
I
think
that
discussion
is
easy
for
something
like
the
scorecard
just
CLI
and
gets
really
complicated
for
the
API
that
uses
you
know
either
the
crowdsourced
scorecard
action,
or
you
know
just
the
the
Quran
job
where,
like
it
starts
becoming
unmaintainable
to
run.
You
know,
like
10
different
API
versions
at
the
same
time,
on
a
million
repos
and
things
like
that.