Skip to content

April advisory board minutes #293

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
May 23, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file added minutes/2023/04/27/2023-04-27-julien.pdf
Binary file not shown.
2 changes: 1 addition & 1 deletion minutes/_posts/2023-01-16-january-16-2023.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ Scala Center website.
## Summary

The following agenda was distributed to attendees:
[agenda](https://github.com/scalacenter/advisoryboard/blob/master/agendas/027-2022-q4.md).
[agenda](https://github.com/scalacenter/advisoryboard/blob/main/agendas/027-2022-q4.md).

Center activities for the past quarter focused on in-person events
(conferences, summits, sprees, meetups, and workshops), online events,
Expand Down
217 changes: 217 additions & 0 deletions minutes/_posts/2023-04-27-april-27-2023.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,217 @@
---
layout: contact
---

# Minutes of the 28th meeting of the Scala Center, Q1 2023

Minutes are [archived](https://scala.epfl.ch/records.html) on the
Scala Center website.

## Summary

The following agenda was distributed to attendees:
[agenda](https://github.com/scalacenter/advisoryboard/blob/main/agendas/028-2023-q1.md).

Center activities for the past quarter focused on Scala 3 maintenance
and evolution, the Scala Improvement Process, Scala.js maintenance and
tooling and tutorials, the Scala Toolkit, the Scala websites, the
Scala Tooling Summit, TASTy-MiMa and TASTy-Query, Metals and BSP,
Scaladex, the Scala 3 Compiler Academy and Compiler Sprees, Google
Summer of Code, Scala Lunches at EPFL, Scala Days, and the
Center's five-year impact report.

Details are below and in the Center's activity report:

* [report](https://scala.epfl.ch/records/2023-Q1-activity-report.html)

Two new proposals were received this quarter:

* [SCP-029](https://github.com/scalacenter/advisoryboard/blob/main/proposals/029-sbt-community-repository.md): Sbt community repository
* [SCP-030](https://github.com/scalacenter/advisoryboard/blob/main/proposals/030-governance-page.md): Governance page

Both proposals were voted on and accepted by the board.

Other business discussed included SCP-027 (Refactoring), the Tooling
Summit, and company overviews for Morgan Stanley and Spotify.

## Date, Time and Location

The meeting took place virtually on Thursday, April 27, 2023 at
15:00pm (UTC).

Minutes were taken by Seth Tisue (secretary).

## Attendees

Officers:

* Chris Kipp (chairperson)
* also board member, representing Lunatech
* Darja Jovanovic (executive director), EPFL
* Julien Richard-Foy (technical director), EPFL
* Seth Tisue (secretary), Lightbend

Apologies:

* Martin Odersky (technical advisor), EPFL

Board members:

* Diego Alonso, 47 Degrees
* Maureen Elsberry, Xebia Functional
* Claire McGinty & Kellen Dye, Spotify
* Krzysztof Romanowski, VirtusLab
* Lukas Rytz, Lightbend
* Daniela Sfregola, Morgan Stanley
* Eugene Yokota, community representative

## Technical report

Julien summarized Scala Center activities since the last meeting.
He presented from these slides, which concisely show what the
Center is working on:

* [slides](./2023-04-27-julien.pdf)

His slides and remarks were based on the Center's more detailed Q1
quarterly activity report:

* [report](https://scala.epfl.ch/records/2023-Q1-activity-report.html)

And the Center's Q2 roadmap:

* [roadmap](https://scala.epfl.ch/records/2023-Q2-roadmap.html)

The following notes do not repeat the content of the report and
roadmap, but only supplement them.

### SCP-027: Refactoring

Julien asked the board about [SCP-027: Refactoring](https://github.com/scalacenter/advisoryboard/blob/main/proposals/027-refactoring.md), which he suggested be marked "dormant", based on what seems to be limited interest from either the board or the community. The proposal was originally submitted by Eugene when he was representing Twitter. In response, Eugene observed that there were multiple talks at Scala Matsuri about refactoring in large monorepos and reaffirmed the proposal's importance, in his opinion (though he acknowledged that resources are always finite). Darja and Julien said let's wait to see if there was any more external feedback, before changing the proposal's status.

## Management report

Darja presented this section. She especially highlighted the following items.

Since the last meeting, the Scala Center published the following
annual roadmap for 2023:

* [roadmap blog post](https://scala-lang.org/blog/2023/01/31/scala-center-2023-roadmap.html)

Scala.js celebrated its 10th anniversary:

* [Scala.js anniversary blog post](https://www.scala-lang.org/blog-detail/2023/02/05/ten-years-of-scala-js.html)

The Scala Center hosted a Tooling Summit at EPFL, with about 40 participants:

* [Tooling Summit blog post](https://www.scala-lang.org/blog/2023/04/11/march-2023-scala-tooling-summit.html)

The Center published its Five Year Impact Report:

* [Five Year Impact Report](https://scala.epfl.ch/records/first-five-years/)

Staffing levels remained constant this quarter, except for interns.
Quentin Bernet's internship with the Center is now complete. Johanna
Reichen and Lucas Nouguier have joined the Center for a limited time.

Darja shared some thoughts and plans around fundraising for the
Center. Some discussion followed.

## Scala 2 report

This was presented by Lukas.

The Scala 2.13.11 and 2.12.18 releases are nearly complete but will
wait for 3.3.0 to happen first. Since the last meeting, we opened the
following Discourse threads for discussion and updates on release
timing:

* [Scala 2.13.11](https://contributors.scala-lang.org/t/scala-2-13-11-release-planning/6088)
* [Scala 2.12.18](https://contributors.scala-lang.org/t/scala-2-12-18-release-planning/6089)

Since the meeting, these threads were updated to include draft release
notes. Themes in these releases including alignment with Scala 3,
linting, JDK 20 and 21 support, `Vector` concatenation, reimplemented
`LinkedHashMap` and `LinkedHashSet`, supported for Java 17's `sealed`,
and more.

## Community report

Eugene said that recurring concerns in the community currently include
Scala 3 adoption, the Akka relicensing, competing library ecosystems,
and the question of what Scala's main use cases or selling points are
perceived to be, going forward.

## Proposals

### SCP-029: Sbt community repository

The text of Eugene's proposal is here:

* [SCP-029](https://github.com/scalacenter/advisoryboard/blob/main/proposals/029-sbt-community-repository.md): Sbt community repository

The proposal was prompted by the recent (April 7) repo.scala-sbt.org
[outage](https://github.com/sbt/sbt/issues/7202). It proposes making
the Scala Center responsible for ensuring the continuance of sbt's
artifact hosting. The repository in question contains both old sbt
plugins and current (and old) Linux installers.

As one board member observed, sbt isn't formally a Scala Center
project, and this proposal, which is limited in scope to binary
hosting, wouldn't change that. But the community doesn't always make
these distinctions around ownership; an sbt outage is damaging to
Scala's image regardless.

Julien said the Center is already investigating options. (Perhaps the
existing hosting is adequate as long as we are better prepared to
respond to outages?)

A suggestion was made to host the Linux installers on GitHub instead.

**Voting**: The proposal was accepted, by unanimous vote of members
present.

### SCP-030: Governance page for Scala

* [SCP-030](https://github.com/scalacenter/advisoryboard/blob/main/proposals/030-governance-page.md): Governance page

Krzysztof presented his proposal. He emphasized that the proposal
isn't to create any new structures or responsibilities, but just to
document what exists. He also said that incremental progress on
documenting governance would be valuable; it doesn't need to happen
all at once.

Seth noted on the pull request that there is already a "Who's behind
Scala?" section on the Community page
[here](https://scala-lang.org/community/#whos-behind-scala), as a
modest starting point.

Darja noted that any such page would need regular updating, and it
would be important for the page not to promise more than the Center
is actually able to provide.

**Voting**: The proposal was accepted, by unanimous vote of members
present.

## Other topics

### Tooling Summit

Since time was running short, Chris kept his remarks about the recent
Tooling Summit very brief. He said that conversation is ongoing about
setting up some ongoing structure for work and communication around
Scala tooling.

Maureen said that the interviews recorded at the summit are still
being edited.

## Company overviews

Daniela gave an overview of Scala usage at Morgan Stanley.

Claire gave an overview of Scala usage at Spotify.

## Conclusion

As was usual through 2019, we hope to hold an in-person board meeting
later this year in conjunction with Scala Days.
1 change: 1 addition & 0 deletions records.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ in the [Projects page]({% link projects.md %}).

### Board meeting minutes

- [April 27, 2023 - Twenty-Eighth SC Advisory Board Meeting](/minutes/2023/04/27/april-27-2023.html)
- [January 16, 2023 - Twenty-Seventh SC Advisory Board Meeting](/minutes/2023/01/16/january-16-2023.html)
- [October 12, 2022 - Twenty-Sixth SC Advisory Board Meeting](/minutes/2022/10/12/october-12-2022.html)
- [June 28, 2022 - Twenty-Fifth SC Advisory Board Meeting](/minutes/2022/06/28/june-28-2022.html)
Expand Down
10 changes: 5 additions & 5 deletions records/2022-Q1-activity-report.md
Original file line number Diff line number Diff line change
Expand Up @@ -49,18 +49,18 @@ the following:
- We have reworked the structure of the Scaladex project by reorganizing the modules folder and simplifying the startup process. We have updated the local projects being indexed to get recent projects and releases. The goal was to simplify the process to develop locally new features and attract new contributors. Finally we have updated the contributing guide of Scaladex. ([link](https://github.com/scalacenter/scaladex/pull/878))
- We have implemented a first admin task: the goal is to automate operations that would improve the maintenance of Scaladex like deleting old releases, or update github information for a particular project. The first one implemented will check for a particular project if any release is missing and then will index it ([link](https://github.com/scalacenter/scaladex/pull/948))

### Github security alerts in sbt projects
### GitHub security alerts in sbt projects

for Scala 2 and Scala 3.

*Keeping the software secure is critically important.
Some major threats like [Log4Shell](https://en.wikipedia.org/wiki/Log4Shell) can happen at any time and impact a large number of organizations and companies.
In June 2020 Github released Dependendabot to help developers keep their dependencies updated and secure.
In June 2020 GitHub released Dependendabot to help developers keep their dependencies updated and secure.
It does not yet support scanning sbt dependencies.*

We collaborated with the Dependabot team at Github to create [sbt-github-dependency-graph](https://github.com/scalacenter/sbt-github-dependency-graph): an sbt plugin that can submit a report of all the dependencies to Github through the experimental Graph Dependency API.
This plugin will be released along with its associated Github action as soon as Github makes the API public.
Thanks to this tool, you will be able to view the [dependency graph](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph) of your sbt projects in the Github UI and you will receive Dependabot alerts on vulnerable dependencies.
We collaborated with the Dependabot team at GitHub to create [sbt-github-dependency-graph](https://github.com/scalacenter/sbt-github-dependency-graph): an sbt plugin that can submit a report of all the dependencies to GitHub through the experimental Graph Dependency API.
This plugin will be released along with its associated GitHub action as soon as GitHub makes the API public.
Thanks to this tool, you will be able to view the [dependency graph](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph) of your sbt projects in the GitHub UI and you will receive Dependabot alerts on vulnerable dependencies.

### Getting started with coursier ([SCP-026](https://github.com/scalacenter/advisoryboard/blob/main/proposals/026-solidify-getting-started-with-coursier.md))

Expand Down
6 changes: 3 additions & 3 deletions records/2022-Q2-activity-report.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,10 +23,10 @@ governance expert.

For Scala 2 and Scala 3.

We are collaborating with the Dependabot team at Github to build support for their security alerts in sbt projects.
The main goal of this project is to harden the security of sbt projects hosted on Github by scanning their dependencies.
We are collaborating with the Dependabot team at GitHub to build support for their security alerts in sbt projects.
The main goal of this project is to harden the security of sbt projects hosted on GitHub by scanning their dependencies.

We built [scalacenter/sbt-github-dependency-graph](https://github.com/scalacenter/sbt-github-dependency-graph), an sbt plugin that can submit all the dependencies to Github, and [scalacenter/sbt-dependency-graph-action](https://github.com/scalacenter/sbt-dependency-graph-action), a Github action that can configure and run the sbt plugin in a Github workflow. Those projects are being validated and are therefore not ready to be used.
We built [scalacenter/sbt-github-dependency-graph](https://github.com/scalacenter/sbt-github-dependency-graph), an sbt plugin that can submit all the dependencies to GitHub, and [scalacenter/sbt-dependency-graph-action](https://github.com/scalacenter/sbt-dependency-graph-action), a GitHub action that can configure and run the sbt plugin in a GitHub workflow. Those projects are being validated and are therefore not ready to be used.

### Scala 3 Expression Evaluation in Metals' Debugger

Expand Down
2 changes: 1 addition & 1 deletion records/2022-Q3-activity-report.md
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ Ideally we would like to be able to also run the tests in the background but thi

For Scala 3 and Scala 2.

We released [`scalacenter/sbt-dependency-submission`](https://github.com/scalacenter/sbt-dependency-submission) a Github action that submits the full graph of dependencies of an sbt project to Github for security scanning.
We released [`scalacenter/sbt-dependency-submission`](https://github.com/scalacenter/sbt-dependency-submission) a GitHub action that submits the full graph of dependencies of an sbt project to GitHub for security scanning.
It is used in more than [50 open repositories](https://github.com/scalacenter/sbt-dependency-submission/network/dependents?package_id=UGFja2FnZS0zMjE3ODc0ODM1).
It can also be used in private repositories.

Expand Down
2 changes: 1 addition & 1 deletion records/2023-Q1-activity-report.md
Original file line number Diff line number Diff line change
Expand Up @@ -222,7 +222,7 @@ the detailed outcomes of the summit in this [blog article](https://scala-lang.or

For Scala 2 and Scala 3.

[scalacenter/sbt-dependency-submission](https://github.com/scalacenter/sbt-dependency-submission) is a Github action that submits all the dependencies of an sbt project to Github for scanning security vulnerabilities.
[scalacenter/sbt-dependency-submission](https://github.com/scalacenter/sbt-dependency-submission) is a GitHub action that submits all the dependencies of an sbt project to GitHub for scanning security vulnerabilities.

We made it possible to submit the dependencies of several sbt builds in the same workflow, in [#93](https://github.com/scalacenter/sbt-dependency-submission/pull/93) and [#96](https://github.com/scalacenter/sbt-dependency-submission/pull/96).

Expand Down