diff --git a/minutes/2023/04/27/2023-04-27-julien.pdf b/minutes/2023/04/27/2023-04-27-julien.pdf new file mode 100644 index 00000000..04a50480 Binary files /dev/null and b/minutes/2023/04/27/2023-04-27-julien.pdf differ diff --git a/minutes/_posts/2023-01-16-january-16-2023.md b/minutes/_posts/2023-01-16-january-16-2023.md index 6d8b4719..8f710eaa 100644 --- a/minutes/_posts/2023-01-16-january-16-2023.md +++ b/minutes/_posts/2023-01-16-january-16-2023.md @@ -10,7 +10,7 @@ Scala Center website. ## Summary The following agenda was distributed to attendees: -[agenda](https://github.com/scalacenter/advisoryboard/blob/master/agendas/027-2022-q4.md). +[agenda](https://github.com/scalacenter/advisoryboard/blob/main/agendas/027-2022-q4.md). Center activities for the past quarter focused on in-person events (conferences, summits, sprees, meetups, and workshops), online events, diff --git a/minutes/_posts/2023-04-27-april-27-2023.md b/minutes/_posts/2023-04-27-april-27-2023.md new file mode 100644 index 00000000..e78c1d4b --- /dev/null +++ b/minutes/_posts/2023-04-27-april-27-2023.md @@ -0,0 +1,217 @@ +--- +layout: contact +--- + +# Minutes of the 28th meeting of the Scala Center, Q1 2023 + +Minutes are [archived](https://scala.epfl.ch/records.html) on the +Scala Center website. + +## Summary + +The following agenda was distributed to attendees: +[agenda](https://github.com/scalacenter/advisoryboard/blob/main/agendas/028-2023-q1.md). + +Center activities for the past quarter focused on Scala 3 maintenance +and evolution, the Scala Improvement Process, Scala.js maintenance and +tooling and tutorials, the Scala Toolkit, the Scala websites, the +Scala Tooling Summit, TASTy-MiMa and TASTy-Query, Metals and BSP, +Scaladex, the Scala 3 Compiler Academy and Compiler Sprees, Google +Summer of Code, Scala Lunches at EPFL, Scala Days, and the +Center's five-year impact report. + +Details are below and in the Center's activity report: + +* [report](https://scala.epfl.ch/records/2023-Q1-activity-report.html) + +Two new proposals were received this quarter: + +* [SCP-029](https://github.com/scalacenter/advisoryboard/blob/main/proposals/029-sbt-community-repository.md): Sbt community repository +* [SCP-030](https://github.com/scalacenter/advisoryboard/blob/main/proposals/030-governance-page.md): Governance page + +Both proposals were voted on and accepted by the board. + +Other business discussed included SCP-027 (Refactoring), the Tooling +Summit, and company overviews for Morgan Stanley and Spotify. + +## Date, Time and Location + +The meeting took place virtually on Thursday, April 27, 2023 at +15:00pm (UTC). + +Minutes were taken by Seth Tisue (secretary). + +## Attendees + +Officers: + +* Chris Kipp (chairperson) + * also board member, representing Lunatech +* Darja Jovanovic (executive director), EPFL +* Julien Richard-Foy (technical director), EPFL +* Seth Tisue (secretary), Lightbend + +Apologies: + +* Martin Odersky (technical advisor), EPFL + +Board members: + +* Diego Alonso, 47 Degrees +* Maureen Elsberry, Xebia Functional +* Claire McGinty & Kellen Dye, Spotify +* Krzysztof Romanowski, VirtusLab +* Lukas Rytz, Lightbend +* Daniela Sfregola, Morgan Stanley +* Eugene Yokota, community representative + +## Technical report + +Julien summarized Scala Center activities since the last meeting. +He presented from these slides, which concisely show what the +Center is working on: + +* [slides](./2023-04-27-julien.pdf) + +His slides and remarks were based on the Center's more detailed Q1 +quarterly activity report: + +* [report](https://scala.epfl.ch/records/2023-Q1-activity-report.html) + +And the Center's Q2 roadmap: + +* [roadmap](https://scala.epfl.ch/records/2023-Q2-roadmap.html) + +The following notes do not repeat the content of the report and +roadmap, but only supplement them. + +### SCP-027: Refactoring + +Julien asked the board about [SCP-027: Refactoring](https://github.com/scalacenter/advisoryboard/blob/main/proposals/027-refactoring.md), which he suggested be marked "dormant", based on what seems to be limited interest from either the board or the community. The proposal was originally submitted by Eugene when he was representing Twitter. In response, Eugene observed that there were multiple talks at Scala Matsuri about refactoring in large monorepos and reaffirmed the proposal's importance, in his opinion (though he acknowledged that resources are always finite). Darja and Julien said let's wait to see if there was any more external feedback, before changing the proposal's status. + +## Management report + +Darja presented this section. She especially highlighted the following items. + +Since the last meeting, the Scala Center published the following +annual roadmap for 2023: + +* [roadmap blog post](https://scala-lang.org/blog/2023/01/31/scala-center-2023-roadmap.html) + +Scala.js celebrated its 10th anniversary: + +* [Scala.js anniversary blog post](https://www.scala-lang.org/blog-detail/2023/02/05/ten-years-of-scala-js.html) + +The Scala Center hosted a Tooling Summit at EPFL, with about 40 participants: + +* [Tooling Summit blog post](https://www.scala-lang.org/blog/2023/04/11/march-2023-scala-tooling-summit.html) + +The Center published its Five Year Impact Report: + +* [Five Year Impact Report](https://scala.epfl.ch/records/first-five-years/) + +Staffing levels remained constant this quarter, except for interns. +Quentin Bernet's internship with the Center is now complete. Johanna +Reichen and Lucas Nouguier have joined the Center for a limited time. + +Darja shared some thoughts and plans around fundraising for the +Center. Some discussion followed. + +## Scala 2 report + +This was presented by Lukas. + +The Scala 2.13.11 and 2.12.18 releases are nearly complete but will +wait for 3.3.0 to happen first. Since the last meeting, we opened the +following Discourse threads for discussion and updates on release +timing: + +* [Scala 2.13.11](https://contributors.scala-lang.org/t/scala-2-13-11-release-planning/6088) +* [Scala 2.12.18](https://contributors.scala-lang.org/t/scala-2-12-18-release-planning/6089) + +Since the meeting, these threads were updated to include draft release +notes. Themes in these releases including alignment with Scala 3, +linting, JDK 20 and 21 support, `Vector` concatenation, reimplemented +`LinkedHashMap` and `LinkedHashSet`, supported for Java 17's `sealed`, +and more. + +## Community report + +Eugene said that recurring concerns in the community currently include +Scala 3 adoption, the Akka relicensing, competing library ecosystems, +and the question of what Scala's main use cases or selling points are +perceived to be, going forward. + +## Proposals + +### SCP-029: Sbt community repository + +The text of Eugene's proposal is here: + +* [SCP-029](https://github.com/scalacenter/advisoryboard/blob/main/proposals/029-sbt-community-repository.md): Sbt community repository + +The proposal was prompted by the recent (April 7) repo.scala-sbt.org +[outage](https://github.com/sbt/sbt/issues/7202). It proposes making +the Scala Center responsible for ensuring the continuance of sbt's +artifact hosting. The repository in question contains both old sbt +plugins and current (and old) Linux installers. + +As one board member observed, sbt isn't formally a Scala Center +project, and this proposal, which is limited in scope to binary +hosting, wouldn't change that. But the community doesn't always make +these distinctions around ownership; an sbt outage is damaging to +Scala's image regardless. + +Julien said the Center is already investigating options. (Perhaps the +existing hosting is adequate as long as we are better prepared to +respond to outages?) + +A suggestion was made to host the Linux installers on GitHub instead. + +**Voting**: The proposal was accepted, by unanimous vote of members +present. + +### SCP-030: Governance page for Scala + +* [SCP-030](https://github.com/scalacenter/advisoryboard/blob/main/proposals/030-governance-page.md): Governance page + +Krzysztof presented his proposal. He emphasized that the proposal +isn't to create any new structures or responsibilities, but just to +document what exists. He also said that incremental progress on +documenting governance would be valuable; it doesn't need to happen +all at once. + +Seth noted on the pull request that there is already a "Who's behind +Scala?" section on the Community page +[here](https://scala-lang.org/community/#whos-behind-scala), as a +modest starting point. + +Darja noted that any such page would need regular updating, and it +would be important for the page not to promise more than the Center +is actually able to provide. + +**Voting**: The proposal was accepted, by unanimous vote of members +present. + +## Other topics + +### Tooling Summit + +Since time was running short, Chris kept his remarks about the recent +Tooling Summit very brief. He said that conversation is ongoing about +setting up some ongoing structure for work and communication around +Scala tooling. + +Maureen said that the interviews recorded at the summit are still +being edited. + +## Company overviews + +Daniela gave an overview of Scala usage at Morgan Stanley. + +Claire gave an overview of Scala usage at Spotify. + +## Conclusion + +As was usual through 2019, we hope to hold an in-person board meeting +later this year in conjunction with Scala Days. diff --git a/records.md b/records.md index b12f791e..a732ba50 100644 --- a/records.md +++ b/records.md @@ -34,6 +34,7 @@ in the [Projects page]({% link projects.md %}). ### Board meeting minutes +- [April 27, 2023 - Twenty-Eighth SC Advisory Board Meeting](/minutes/2023/04/27/april-27-2023.html) - [January 16, 2023 - Twenty-Seventh SC Advisory Board Meeting](/minutes/2023/01/16/january-16-2023.html) - [October 12, 2022 - Twenty-Sixth SC Advisory Board Meeting](/minutes/2022/10/12/october-12-2022.html) - [June 28, 2022 - Twenty-Fifth SC Advisory Board Meeting](/minutes/2022/06/28/june-28-2022.html) diff --git a/records/2022-Q1-activity-report.md b/records/2022-Q1-activity-report.md index 6742b3a1..999fede2 100644 --- a/records/2022-Q1-activity-report.md +++ b/records/2022-Q1-activity-report.md @@ -49,18 +49,18 @@ the following: - We have reworked the structure of the Scaladex project by reorganizing the modules folder and simplifying the startup process. We have updated the local projects being indexed to get recent projects and releases. The goal was to simplify the process to develop locally new features and attract new contributors. Finally we have updated the contributing guide of Scaladex. ([link](https://github.com/scalacenter/scaladex/pull/878)) - We have implemented a first admin task: the goal is to automate operations that would improve the maintenance of Scaladex like deleting old releases, or update github information for a particular project. The first one implemented will check for a particular project if any release is missing and then will index it ([link](https://github.com/scalacenter/scaladex/pull/948)) -### Github security alerts in sbt projects +### GitHub security alerts in sbt projects for Scala 2 and Scala 3. *Keeping the software secure is critically important. Some major threats like [Log4Shell](https://en.wikipedia.org/wiki/Log4Shell) can happen at any time and impact a large number of organizations and companies. -In June 2020 Github released Dependendabot to help developers keep their dependencies updated and secure. +In June 2020 GitHub released Dependendabot to help developers keep their dependencies updated and secure. It does not yet support scanning sbt dependencies.* -We collaborated with the Dependabot team at Github to create [sbt-github-dependency-graph](https://github.com/scalacenter/sbt-github-dependency-graph): an sbt plugin that can submit a report of all the dependencies to Github through the experimental Graph Dependency API. -This plugin will be released along with its associated Github action as soon as Github makes the API public. -Thanks to this tool, you will be able to view the [dependency graph](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph) of your sbt projects in the Github UI and you will receive Dependabot alerts on vulnerable dependencies. +We collaborated with the Dependabot team at GitHub to create [sbt-github-dependency-graph](https://github.com/scalacenter/sbt-github-dependency-graph): an sbt plugin that can submit a report of all the dependencies to GitHub through the experimental Graph Dependency API. +This plugin will be released along with its associated GitHub action as soon as GitHub makes the API public. +Thanks to this tool, you will be able to view the [dependency graph](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph) of your sbt projects in the GitHub UI and you will receive Dependabot alerts on vulnerable dependencies. ### Getting started with coursier ([SCP-026](https://github.com/scalacenter/advisoryboard/blob/main/proposals/026-solidify-getting-started-with-coursier.md)) diff --git a/records/2022-Q2-activity-report.md b/records/2022-Q2-activity-report.md index c363931d..ea80d036 100644 --- a/records/2022-Q2-activity-report.md +++ b/records/2022-Q2-activity-report.md @@ -23,10 +23,10 @@ governance expert. For Scala 2 and Scala 3. -We are collaborating with the Dependabot team at Github to build support for their security alerts in sbt projects. -The main goal of this project is to harden the security of sbt projects hosted on Github by scanning their dependencies. +We are collaborating with the Dependabot team at GitHub to build support for their security alerts in sbt projects. +The main goal of this project is to harden the security of sbt projects hosted on GitHub by scanning their dependencies. -We built [scalacenter/sbt-github-dependency-graph](https://github.com/scalacenter/sbt-github-dependency-graph), an sbt plugin that can submit all the dependencies to Github, and [scalacenter/sbt-dependency-graph-action](https://github.com/scalacenter/sbt-dependency-graph-action), a Github action that can configure and run the sbt plugin in a Github workflow. Those projects are being validated and are therefore not ready to be used. +We built [scalacenter/sbt-github-dependency-graph](https://github.com/scalacenter/sbt-github-dependency-graph), an sbt plugin that can submit all the dependencies to GitHub, and [scalacenter/sbt-dependency-graph-action](https://github.com/scalacenter/sbt-dependency-graph-action), a GitHub action that can configure and run the sbt plugin in a GitHub workflow. Those projects are being validated and are therefore not ready to be used. ### Scala 3 Expression Evaluation in Metals' Debugger diff --git a/records/2022-Q3-activity-report.md b/records/2022-Q3-activity-report.md index 13a864fb..7b5097bc 100644 --- a/records/2022-Q3-activity-report.md +++ b/records/2022-Q3-activity-report.md @@ -71,7 +71,7 @@ Ideally we would like to be able to also run the tests in the background but thi For Scala 3 and Scala 2. -We released [`scalacenter/sbt-dependency-submission`](https://github.com/scalacenter/sbt-dependency-submission) a Github action that submits the full graph of dependencies of an sbt project to Github for security scanning. +We released [`scalacenter/sbt-dependency-submission`](https://github.com/scalacenter/sbt-dependency-submission) a GitHub action that submits the full graph of dependencies of an sbt project to GitHub for security scanning. It is used in more than [50 open repositories](https://github.com/scalacenter/sbt-dependency-submission/network/dependents?package_id=UGFja2FnZS0zMjE3ODc0ODM1). It can also be used in private repositories. diff --git a/records/2023-Q1-activity-report.md b/records/2023-Q1-activity-report.md index 1607fbdc..7b56ddb3 100644 --- a/records/2023-Q1-activity-report.md +++ b/records/2023-Q1-activity-report.md @@ -222,7 +222,7 @@ the detailed outcomes of the summit in this [blog article](https://scala-lang.or For Scala 2 and Scala 3. -[scalacenter/sbt-dependency-submission](https://github.com/scalacenter/sbt-dependency-submission) is a Github action that submits all the dependencies of an sbt project to Github for scanning security vulnerabilities. +[scalacenter/sbt-dependency-submission](https://github.com/scalacenter/sbt-dependency-submission) is a GitHub action that submits all the dependencies of an sbt project to GitHub for scanning security vulnerabilities. We made it possible to submit the dependencies of several sbt builds in the same workflow, in [#93](https://github.com/scalacenter/sbt-dependency-submission/pull/93) and [#96](https://github.com/scalacenter/sbt-dependency-submission/pull/96).