(anonymous) github user commits

classic Classic list List threaded Threaded
8 messages Options
Reply | Threaded
Open this post in threaded view
|

(anonymous) github user commits

rfscholte
This week I was very surprised to see commits from the user call "github" in Jenkins:
https://builds.apache.org/job/maven-box/job/maven-shared-utils/job/master/changes


IMO we shouldn't want these kind of commits.
Based on the most recent activities I had a chat with Sylwester en Elliotte.

The reason is the author of these commits was Elliotte, but the committer Github
https://gitbox.apache.org/repos/asf?p=maven-shared-utils.git&a=commit&h=8ed3e6827885a161a8802100f0f50968555356b0


Elliotte tried to figure it out, and his conclusion was that in case he squashed and merged commits via github, the committer became github.

If this is indeed the case, we should always ask the author to squash his commits so we can track the commit better, and it makes it easier to find possible regressions (and revert them when necessary)

Not sure if this would help, but my WOW is creating a patch from github, and applying it to the gitBOX url. Squashing and merging it from here would at least make me the committer.

It there are other opinions, ideas, please share.

Robert
Reply | Threaded
Open this post in threaded view
|

Re: (anonymous) github user commits

Elliotte Rusty Harold
On Thu, Mar 12, 2020 at 2:46 PM Robert Scholte <[hidden email]> wrote:

>
> This week I was very surprised to see commits from the user call "github" in Jenkins:
> https://builds.apache.org/job/maven-box/job/maven-shared-utils/job/master/changes
>
>
> IMO we shouldn't want these kind of commits.
> Based on the most recent activities I had a chat with Sylwester en Elliotte.
>
> The reason is the author of these commits was Elliotte, but the committer Github
> https://gitbox.apache.org/repos/asf?p=maven-shared-utils.git&a=commit&h=8ed3e6827885a161a8802100f0f50968555356b0
>
>
> Elliotte tried to figure it out, and his conclusion was that in case he squashed and merged commits via github, the committer became github.
>
> If this is indeed the case, we should always ask the author to squash his commits so we can track the commit better, and it makes it easier to find possible regressions (and revert them when necessary)
>

That sounds backwards. Squashing is what makes Github the committer.

Do we care if Github is the committer? Squashing is pretty common. The
developer is still listed as the author. Can we simply look at the
author and ignore the committer?

--
Elliotte Rusty Harold
[hidden email]

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

Re: (anonymous) github user commits

michaelo
In reply to this post by rfscholte
Am 2020-03-12 um 19:46 schrieb Robert Scholte:

> This week I was very surprised to see commits from the user call "github" in Jenkins:
> https://builds.apache.org/job/maven-box/job/maven-shared-utils/job/master/changes
>
>
> IMO we shouldn't want these kind of commits.
> Based on the most recent activities I had a chat with Sylwester en Elliotte.
>
> The reason is the author of these commits was Elliotte, but the committer Github
> https://gitbox.apache.org/repos/asf?p=maven-shared-utils.git&a=commit&h=8ed3e6827885a161a8802100f0f50968555356b0
>
>
> Elliotte tried to figure it out, and his conclusion was that in case he squashed and merged commits via github, the committer became github.
>
> If this is indeed the case, we should always ask the author to squash his commits so we can track the commit better, and it makes it easier to find possible regressions (and revert them when necessary)
>
> Not sure if this would help, but my WOW is creating a patch from github, and applying it to the gitBOX url. Squashing and merging it from here would at least make me the committer.

I highly dislike the squash feature in GitHub because you are out of
control of the process. Only, Maven committers, shall be in the
committer field. Third parties are not trustworthy for me.

Me process for the last couple of years with PRs was

* Request a squash from a submitter
* Pull that branch into my local clone
* Run tests (locally, Jenkins)
* Adjust message
* Merge into master
* Push

This gives me full control before this is written to remote. I simply
don't trust GH, especially not with these ugly merge commits.

M

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

Re: (anonymous) github user commits

Olivier Lamy
I agree we must make it mandatory for the committer (us) to squash it.
But not really mandatory to ask contributor to squash but just only use the
"Squash and merge" option and you will get proper commit on merge:
see this commit
https://github.com/apache/maven-javadoc-plugin/commit/f92b508c26945a0e728fb3b49e87fe216401c9c1




On Sat, 14 Mar 2020 at 01:26, Karl Heinz Marbaise <[hidden email]> wrote:

> Hi,
>
> On 13.03.20 15:58, Michael Osipov wrote:
> > Am 2020-03-12 um 19:46 schrieb Robert Scholte:
> >> This week I was very surprised to see commits from the user call
> >> "github" in Jenkins:
> >>
> https://builds.apache.org/job/maven-box/job/maven-shared-utils/job/master/changes
> >>
> >>
> >>
> >> IMO we shouldn't want these kind of commits.
> >> Based on the most recent activities I had a chat with Sylwester en
> >> Elliotte.
> >>
> >> The reason is the author of these commits was Elliotte, but the
> >> committer Github
> >>
> https://gitbox.apache.org/repos/asf?p=maven-shared-utils.git&a=commit&h=8ed3e6827885a161a8802100f0f50968555356b0
> >>
> >>
> >>
> >> Elliotte tried to figure it out, and his conclusion was that in case
> >> he squashed and merged commits via github, the committer became github.
> >>
> >> If this is indeed the case, we should always ask the author to squash
> >> his commits so we can track the commit better, and it makes it easier
> >> to find possible regressions (and revert them when necessary)
> >>
> >> Not sure if this would help, but my WOW is creating a patch from
> >> github, and applying it to the gitBOX url. Squashing and merging it
> >> from here would at least make me the committer.
> >
> > I highly dislike the squash feature in GitHub because you are out of
> > control of the process. Only, Maven committers, shall be in the
> > committer field. Third parties are not trustworthy for me.
> >
> > Me process for the last couple of years with PRs was
> >
> > * Request a squash from a submitter
> > * Pull that branch into my local clone
> > * Run tests (locally, Jenkins)
> > * Adjust message
> > * Merge into master
> > * Push
> >
> > This gives me full control before this is written to remote. I simply
> > don't trust GH, especially not with these ugly merge commits.
> >
> > M
> >
>
> If I pick a PR from GitHub I simply using the command line instructions...
>
> I do a `git commit --amend` ...(That makes me the committer of the
> change)...sometimes needed to fix the commit message...
>
> Pushing for testing on Jenkins ...and afterwards merging the single
> commit back to master (no merge commits)...
>
>
> Also what happens here several times is this: (Just an example:
> maven-artifact-transfer):
>
> commit 3338744598e195454f4c5ed1187ea192adfbcf97
> Author: Piotrek Żygieło <[hidden email]>
> Commit: Piotrek Żygieło <[hidden email]>
>
>      Remove unused field
>
> So this makes it impossible to check who has integrated that patch into
> the code base...
>
> Or as a different example:
>
> commit a80f5cc026da0e3d98ec720b363728f4509293ff
> Author: Maarten Mulders <[hidden email]>
> Commit: Karl Heinz Marbaise <[hidden email]>
>
>      [MDEP-626] Upgrade struts and xerces due to CVEs
>       o This newer version doesn't depend on struts2-core or xercesImpl.
>       o Upgrade Doxia and add doxia-core
>
>
> That shows exactly who has merged that...and who the committer was...
>
> Just my 2 cents.
>
> Kind regards
> Karl Heinz Marbaise
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [hidden email]
> For additional commands, e-mail: [hidden email]
>
>

--
Olivier Lamy
http://twitter.com/olamy | http://linkedin.com/in/olamy
Reply | Threaded
Open this post in threaded view
|

Re: (anonymous) github user commits

rfscholte
Yes, once confirmed that the branch builds fine on our Jenkins, we should do the "squash and merge". (we should already be happy with a proper PR)
My experience so far was like you describe, but it doesn't explain why Elliotte causes "github" to become the committer.
One possible difference I see is that he's both the author and committer.
I never push my commits via github, but always via gitbox.

Robert

On 14-3-2020 04:14:18, Olivier Lamy <[hidden email]> wrote:
I agree we must make it mandatory for the committer (us) to squash it.
But not really mandatory to ask contributor to squash but just only use the
"Squash and merge" option and you will get proper commit on merge:
see this commit
https://github.com/apache/maven-javadoc-plugin/commit/f92b508c26945a0e728fb3b49e87fe216401c9c1




On Sat, 14 Mar 2020 at 01:26, Karl Heinz Marbaise wrote:

> Hi,
>
> On 13.03.20 15:58, Michael Osipov wrote:
> > Am 2020-03-12 um 19:46 schrieb Robert Scholte:
> >> This week I was very surprised to see commits from the user call
> >> "github" in Jenkins:
> >>
> https://builds.apache.org/job/maven-box/job/maven-shared-utils/job/master/changes
> >>
> >>
> >>
> >> IMO we shouldn't want these kind of commits.
> >> Based on the most recent activities I had a chat with Sylwester en
> >> Elliotte.
> >>
> >> The reason is the author of these commits was Elliotte, but the
> >> committer Github
> >>
> https://gitbox.apache.org/repos/asf?p=maven-shared-utils.git&a=commit&h=8ed3e6827885a161a8802100f0f50968555356b0
> >>
> >>
> >>
> >> Elliotte tried to figure it out, and his conclusion was that in case
> >> he squashed and merged commits via github, the committer became github.
> >>
> >> If this is indeed the case, we should always ask the author to squash
> >> his commits so we can track the commit better, and it makes it easier
> >> to find possible regressions (and revert them when necessary)
> >>
> >> Not sure if this would help, but my WOW is creating a patch from
> >> github, and applying it to the gitBOX url. Squashing and merging it
> >> from here would at least make me the committer.
> >
> > I highly dislike the squash feature in GitHub because you are out of
> > control of the process. Only, Maven committers, shall be in the
> > committer field. Third parties are not trustworthy for me.
> >
> > Me process for the last couple of years with PRs was
> >
> > * Request a squash from a submitter
> > * Pull that branch into my local clone
> > * Run tests (locally, Jenkins)
> > * Adjust message
> > * Merge into master
> > * Push
> >
> > This gives me full control before this is written to remote. I simply
> > don't trust GH, especially not with these ugly merge commits.
> >
> > M
> >
>
> If I pick a PR from GitHub I simply using the command line instructions...
>
> I do a `git commit --amend` ...(That makes me the committer of the
> change)...sometimes needed to fix the commit message...
>
> Pushing for testing on Jenkins ...and afterwards merging the single
> commit back to master (no merge commits)...
>
>
> Also what happens here several times is this: (Just an example:
> maven-artifact-transfer):
>
> commit 3338744598e195454f4c5ed1187ea192adfbcf97
> Author: Piotrek Żygieło
> Commit: Piotrek Żygieło
>
> Remove unused field
>
> So this makes it impossible to check who has integrated that patch into
> the code base...
>
> Or as a different example:
>
> commit a80f5cc026da0e3d98ec720b363728f4509293ff
> Author: Maarten Mulders
> Commit: Karl Heinz Marbaise
>
> [MDEP-626] Upgrade struts and xerces due to CVEs
> o This newer version doesn't depend on struts2-core or xercesImpl.
> o Upgrade Doxia and add doxia-core
>
>
> That shows exactly who has merged that...and who the committer was...
>
> Just my 2 cents.
>
> Kind regards
> Karl Heinz Marbaise
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [hidden email]
> For additional commands, e-mail: [hidden email]
>
>

--
Olivier Lamy
http://twitter.com/olamy | http://linkedin.com/in/olamy
Reply | Threaded
Open this post in threaded view
|

Re: (anonymous) github user commits

Enrico Olivelli
Several Apache project have a script to perform this stuff

I really love this kind of scripts
You can find an example here (1)

Such scripts:
- squash all commits into one
- keep original author
- ask for a meaningful commit message
- interact with JIRA
- set Resolved status and fixVersion
- all is interactive with very sensible defaults

With this kind of script merging a PR is very simple

I am using such tools in Zookeeper and Bookkeeper project but I know that
other projects have it, they are based on an original script, adapted to
the specific rules/habits of a project
I also have adapted such scripts to my company projects

Enrico


(1) https://github.com/apache/zookeeper/blob/master/zk-merge-pr.py

Il Sab 14 Mar 2020, 11:22 Robert Scholte <[hidden email]> ha scritto:

> Yes, once confirmed that the branch builds fine on our Jenkins, we should
> do the "squash and merge". (we should already be happy with a proper PR)
> My experience so far was like you describe, but it doesn't explain why
> Elliotte causes "github" to become the committer.
> One possible difference I see is that he's both the author and committer.
> I never push my commits via github, but always via gitbox.
>
> Robert
>
> On 14-3-2020 04:14:18, Olivier Lamy <[hidden email]> wrote:
> I agree we must make it mandatory for the committer (us) to squash it.
> But not really mandatory to ask contributor to squash but just only use the
> "Squash and merge" option and you will get proper commit on merge:
> see this commit
>
> https://github.com/apache/maven-javadoc-plugin/commit/f92b508c26945a0e728fb3b49e87fe216401c9c1
>
>
>
>
> On Sat, 14 Mar 2020 at 01:26, Karl Heinz Marbaise wrote:
>
> > Hi,
> >
> > On 13.03.20 15:58, Michael Osipov wrote:
> > > Am 2020-03-12 um 19:46 schrieb Robert Scholte:
> > >> This week I was very surprised to see commits from the user call
> > >> "github" in Jenkins:
> > >>
> >
> https://builds.apache.org/job/maven-box/job/maven-shared-utils/job/master/changes
> > >>
> > >>
> > >>
> > >> IMO we shouldn't want these kind of commits.
> > >> Based on the most recent activities I had a chat with Sylwester en
> > >> Elliotte.
> > >>
> > >> The reason is the author of these commits was Elliotte, but the
> > >> committer Github
> > >>
> >
> https://gitbox.apache.org/repos/asf?p=maven-shared-utils.git&a=commit&h=8ed3e6827885a161a8802100f0f50968555356b0
> > >>
> > >>
> > >>
> > >> Elliotte tried to figure it out, and his conclusion was that in case
> > >> he squashed and merged commits via github, the committer became
> github.
> > >>
> > >> If this is indeed the case, we should always ask the author to squash
> > >> his commits so we can track the commit better, and it makes it easier
> > >> to find possible regressions (and revert them when necessary)
> > >>
> > >> Not sure if this would help, but my WOW is creating a patch from
> > >> github, and applying it to the gitBOX url. Squashing and merging it
> > >> from here would at least make me the committer.
> > >
> > > I highly dislike the squash feature in GitHub because you are out of
> > > control of the process. Only, Maven committers, shall be in the
> > > committer field. Third parties are not trustworthy for me.
> > >
> > > Me process for the last couple of years with PRs was
> > >
> > > * Request a squash from a submitter
> > > * Pull that branch into my local clone
> > > * Run tests (locally, Jenkins)
> > > * Adjust message
> > > * Merge into master
> > > * Push
> > >
> > > This gives me full control before this is written to remote. I simply
> > > don't trust GH, especially not with these ugly merge commits.
> > >
> > > M
> > >
> >
> > If I pick a PR from GitHub I simply using the command line
> instructions...
> >
> > I do a `git commit --amend` ...(That makes me the committer of the
> > change)...sometimes needed to fix the commit message...
> >
> > Pushing for testing on Jenkins ...and afterwards merging the single
> > commit back to master (no merge commits)...
> >
> >
> > Also what happens here several times is this: (Just an example:
> > maven-artifact-transfer):
> >
> > commit 3338744598e195454f4c5ed1187ea192adfbcf97
> > Author: Piotrek Żygieło
> > Commit: Piotrek Żygieło
> >
> > Remove unused field
> >
> > So this makes it impossible to check who has integrated that patch into
> > the code base...
> >
> > Or as a different example:
> >
> > commit a80f5cc026da0e3d98ec720b363728f4509293ff
> > Author: Maarten Mulders
> > Commit: Karl Heinz Marbaise
> >
> > [MDEP-626] Upgrade struts and xerces due to CVEs
> > o This newer version doesn't depend on struts2-core or xercesImpl.
> > o Upgrade Doxia and add doxia-core
> >
> >
> > That shows exactly who has merged that...and who the committer was...
> >
> > Just my 2 cents.
> >
> > Kind regards
> > Karl Heinz Marbaise
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: [hidden email]
> > For additional commands, e-mail: [hidden email]
> >
> >
>
> --
> Olivier Lamy
> http://twitter.com/olamy | http://linkedin.com/in/olamy
>
Reply | Threaded
Open this post in threaded view
|

Re: (anonymous) github user commits

Elliotte Rusty Harold
In reply to this post by rfscholte
On Sat, Mar 14, 2020 at 6:22 AM Robert Scholte <[hidden email]> wrote:
>
> Yes, once confirmed that the branch builds fine on our Jenkins, we should do the "squash and merge". (we should already be happy with a proper PR)
> My experience so far was like you describe, but it doesn't explain why Elliotte causes "github" to become the committer.
> One possible difference I see is that he's both the author and committer.
> I never push my commits via github, but always via gitbox.
>

My current hypothesis, based on limiting testing, is that anytime
someone uses the "Squash and Merge" button on Github, then Github is
marked as the committer.

It's possible, as Robert suggests, that this is only the case when the
original committer is doing the "Squash and Merge" and not when
someone else pushes the button but I have not tested that.

--
Elliotte Rusty Harold
[hidden email]

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

Re: (anonymous) github user commits

Slawomir Jaranowski
In reply to this post by rfscholte
Hi,
If I can I want show to you some advantages/disadvantages as I see as
collaborator to external project. Maybe some of them you will like.


I've analyzed some commits what I did to maven-invoker-plugin project.

I used:  git log --graph --show-signature --format=full

*1. commit made manually - without using github ui*
https://github.com/apache/maven-invoker-plugin/pull/13

* commit 808d2d20f16771aa18ee87a53b52e70b031d53a0

| Author: Slawomir Jaranowski <[hidden email]>

| Commit: Sylwester Lachiewicz <[hidden email]>

|

|     [MINVOKER-257] Test code should meet checkstyle requirements

|

|     Closes #13

A:
 - no github user
 - committer and reviewer are known for git history

D:
 - manually work
 - lost my pgp signature -* so commit may have been changed*

*2. probably rebase and merge or squash at github*
https://github.com/apache/maven-invoker-plugin/pull/12

* commit a9e215cded354f25a81c616cd8aa8af767665494

| gpg: Signature made Sun Feb 16 21:55:34 2020 CET

| gpg:                using RSA key 4AEE18F83AFDEB23

| gpg: Good signature from "GitHub (web-flow commit signing) <
[hidden email]>" [ultimate]

| Author: Slawomir Jaranowski <[hidden email]>

| Commit: GitHub <[hidden email]>

|

|     [MINVOKER-256] upgrade parent pom to latest version - 34 (#12)

A:
 - no manually work
 - committer is known from git history

D:
 - reviewer isn't known for git history
 - lost my pgp signature
 - github as commiter
 - pgp signature from github user - maybe advantage - we have some check of
integrity

*3*.* merg pull request at github*
https://github.com/apache/maven-invoker-plugin/pull/9

*   commit 77e3a86e0ff10dd016382621d40a4ca0bbcb7883

|\  gpg: Signature made Sun Nov 17 22:12:29 2019 CET

| | gpg:                using RSA key 4AEE18F83AFDEB23

| | gpg: Good signature from "GitHub (web-flow commit signing) <
[hidden email]>" [ultimate]

| | Merge: a9ce363 bbdaabc

| | Author: Robert Scholte <[hidden email]>

| | Commit: GitHub <[hidden email]>

| |

| |     some log is too verbose in normal run

| |

| * commit bbdaabc1f319335ab8478016a45cdfe93fd0bae4

|/  gpg: Signature made Sun Nov 17 21:22:02 2019 CET

|   gpg:                using RSA key
6636274B2E8BEA9D15A61143F8484389379ACEAC

|   gpg: Good signature from "Slawomir Jaranowski <[hidden email]>"
[ultimate]

|   Author: Slawomir Jaranowski <[hidden email]>

|   Commit: Slawomir Jaranowski <[hidden email]>

|

|       some log is too more verbose in normal run

A:
 - no manually work
 - committer and reviewer are known for git history
 - preserve original commit and pgp signature of commiter - no change to
commit body

D:
 - two commits - but one is merge commit
 - github as commiter in merge commit


#################################

Personally I like and use option 3.
Repository can be configured which option is allowed.

I think, that every author of change should do the most of work as is
possible and reviewer should do review and do one action as easy as
possible.


sob., 21 mar 2020 o 19:53 Benjamin Marwell <[hidden email]> napisał(a):

> Checkstyle builds will fail of there is more than one commit in a PR.
> Not saying I like it, but it's an option.
>
>
>
>
> On Sat, 21 Mar 2020, 16:17 Elliotte Rusty Harold, <[hidden email]>
> wrote:
>
> > So it appears that if I do all squashing and merging locally and then
> > push directly to master, I get listed as committer and author:
> >
> >
> >
> https://gitbox.apache.org/repos/asf?p=maven-shared-utils.git&a=commit&h=4264899a152a6205b0f34a32e9c947edcd9cb1e8
> >
> > Github is no longer listed as the committer. This is what we want.
> >
> > However this is quite cumbersome, and I'm confident I'm going to mix
> > this up, probably sooner rather than later. E.g. I might forget or
> > squash or worse yet push commits into master I didn't want to push.
> >
> > Does anyone have an alternate workflow that lets us use the Github
> > buttons? If not, is keeping Github out of the committer messages
> > critical? It seems Author is still accurate.
> >
> >
> >
> >
> > On Thu, Mar 12, 2020 at 2:46 PM Robert Scholte <[hidden email]>
> > wrote:
> > >
> > > This week I was very surprised to see commits from the user call
> > "github" in Jenkins:
> > >
> >
> https://builds.apache.org/job/maven-box/job/maven-shared-utils/job/master/changes
> > >
> > >
> > > IMO we shouldn't want these kind of commits.
> > > Based on the most recent activities I had a chat with Sylwester en
> > Elliotte.
> > >
> > > The reason is the author of these commits was Elliotte, but the
> > committer Github
> > >
> >
> https://gitbox.apache.org/repos/asf?p=maven-shared-utils.git&a=commit&h=8ed3e6827885a161a8802100f0f50968555356b0
> > >
> > >
> > > Elliotte tried to figure it out, and his conclusion was that in case he
> > squashed and merged commits via github, the committer became github.
> > >
> > > If this is indeed the case, we should always ask the author to squash
> > his commits so we can track the commit better, and it makes it easier to
> > find possible regressions (and revert them when necessary)
> > >
> > > Not sure if this would help, but my WOW is creating a patch from
> github,
> > and applying it to the gitBOX url. Squashing and merging it from here
> would
> > at least make me the committer.
> > >
> > > It there are other opinions, ideas, please share.
> > >
> > > Robert
> >
> >
> >
> > --
> > Elliotte Rusty Harold
> > [hidden email]
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: [hidden email]
> > For additional commands, e-mail: [hidden email]
> >
> >
>


--
Sławomir Jaranowski