Repository navigation
Licensing, code of conduct, and contributing guide - #205
Merged
Merged
Conversation
DZPM
force-pushed
the
pr/10-github-handles
branch
from
October 7, 2026 09:54
59906f8 to
14c88d9
Compare
GitHub reads the code of conduct from CODE_OF_CONDUCT.md at the root of the repository, never from the website, and the community profile counts it as missing. The text was in content/pybcn_association/coc.md, which is the published page. A second copy at the root is two places for one legal text to drift apart. The text moves to CODE_OF_CONDUCT.md, and the page now renders that file through a new shortcode, repo-markdown, with os.ReadFile. The front matter of the page stays, so the menu entry, the hero image and the /coc alias do not change. The rendered page is byte identical to the copy it replaces. The shortcode checks the file name against an allowlist, so content cannot read an arbitrary file of the repository into a page, and it drops the leading H1, which the file carries so that it stands on its own on GitHub. The text leaves /content/pybcn_association/, which CODEOWNERS owns, for the root, which it did not, so the file gets its own rule. It also leaves content/, which is all that bin/check-html-safety scanned, so the file joins the default scan. The attribution to PyLadies and the CC BY-SA 3.0 notice stay at the end of the text, which is what the share-alike clause requires.
GitHub links CONTRIBUTING.md from the issue and pull request forms, and the community profile counts it as missing. The steps to make a change were in the Collaborate section of the README, which a person opening a pull request from the form does not see. The section moves to CONTRIBUTING.md as it was, and the README points at it, so there is one description of the process. A guide that is only a link gets skipped, which is why the steps move and not a pointer. The README keeps the detail of each check, which is for the people who maintain them, and the guide links to those sections. The Publishing process paragraph of the README still said to push new commits to edition directly, which the Collaborate section and the branch protection both contradicted. It points at the guide too. The guide also says what the README did not: that the code of conduct applies to contributions, that edition is the branch to target and master holds the built site, how to add a person, a sponsor or an event without writing code, and that a change to a path in CODEOWNERS waits for a review from the web team, which the branch protection requires.
The code of conduct was adapted from the PyLadies one and carried its CC BY-SA 3.0 Unported notice, so it was the one text in the repository on a different version of the licence than the rest of the content, which LICENSING.md puts under CC BY-SA 4.0. Two versions of one licence family is one more thing for a reader to work out, for no gain. The licence of the original permits the move. Section 4(b) of the CC BY-SA 3.0 legal code says an Adaptation may be distributed under "(ii) a later version of this License with the same License Elements as this License", and the elements of both versions are Attribution and ShareAlike. The same section requires the notices that refer to the licence of the original to stay intact, so the file keeps the attribution to PyLadies and the mention of CC BY-SA 3.0, and adds the 4.0 licence it is now under. The text of the code of conduct itself does not change. LICENSING.md moves the file from the paths no licence covers to the content under CC BY-SA 4.0, and says which clause allows it. The README sentence that said the file keeps 3.0 goes with it.
These documents were written on a branch that had moved further than edition: it had the people and sponsor fields documented in the README, a data/ directory and assets/xsl/. On edition none of those exist yet. LICENSING no longer lists assets/xsl/ or data/ under the MIT licence, because there is nothing there to license. The contributing guide describes the person fields instead of linking to a README section that does not exist on this branch, and keeps the links that do resolve. Checked: every path LICENSING names exists, and every README anchor the guide links to resolves.
mesejo
reviewed
Oct 8, 2026
| bin/hugo --minify -D -d public && bin/check-rendered | ||
| ``` | ||
|
|
||
| Pillow is only needed for the black and white photo check. Without it the |
Contributor
There was a problem hiding this comment.
Should this be updated after the merge of #206? After all, Pillow is needed for the fit-sources script
Member
Author
|
Good catch, and yes. I would rather not have this pull request depend on the order the two merge in, so: if #206 goes in first I add the line here, and if this one goes in first I add it in #206. Either way the guide ends up saying that the two image scripts need |
# Conflicts: # README.md
The contributing guide was written for someone who wants to change the site. The people most likely to need something from it are the ones the site is about, and for them the answer is an email, not a pull request. Three sections say so. What is on a card, which is a name, a role, the events computed from the pages that list the person, and nothing else unless they gave it. How to change it, which is an email to the association or the pencil icon on GitHub, with no identity document asked for. And how to have it removed, with what removal can and cannot do on a public repository: the card goes from the site and from the build, and we ask the search engines and the Internet Archive to drop their copies, but the Git history keeps it and so does anyone who already copied it. Whoever is not happy with that should tell us before we publish, and we would rather not publish a card than publish one we cannot withdraw. The text comes from a draft written for the Archive, where every person was going to have a page of their own at a URL. They do not: config.toml cascades render = "never" over content/people, so a person file builds no page. The draft also named a short_bio field that no longer exists, a content/talks section that was never created, and a privacy policy at a path the site does not serve. All of that is rewritten to the site as it is.
A file for AI coding agents, beside the contributing guide for people. It holds what an agent gets wrong that a human would not, and what this repository does differently from a stock Hugo site: the pinned binary at bin/hugo and why not to pip install hugo, the TOML key that lands inside the last table and silently does nothing, merge.ff = only, unsafe = true in the Goldmark renderer and the two content files that still carry raw HTML, images under assets rather than static, and master being the built site rather than a source branch. The draft was written on 2026-10-03 and four of its facts had gone stale, so each one was checked against the tree before this commit: - The page count was 310. A clean build gives 317: 261 from Hugo and 56 copied from static/archives. The line now says to recount rather than trust it. - It said resources/_gen is tracked in Git and that a build dirties the tree. Both it and docs/ are gitignored now, so the line says what a dirty tree there actually means: a branch from before that change. - It named the two files that need unsafe raw HTML without saying what guards them. bin/check-html-safety and bin/check-rendered do, on every pull request, and both are now in the file. - bin/serve takes no port: it runs Hugo's own default. The table of paths gains data/ and a table of the three checks, which are what a pull request has to pass.
It said 317, which was true when the file was written and stopped being true the moment #202 merged: that pull request stopped publishing the 206 person and sponsor pages, so a clean build is 109 pages now, 53 from Hugo and 56 copied from static/archives. The line already told a reader to recount rather than trust it. It now also says what happened, because a figure that went stale in a day is the best argument for recounting.
This repository explains itself in the file that carries the decision: the cascade comment in config.toml says why a person file builds no page, the comment in nav.html says why the menu is not an ARIA menu, LICENSING.md argues the licence. That is the right place, because the reason is then in front of whoever is about to change the thing. The cost is that the reasons are scattered and only findable by someone who already knows where to look. So this is an index and not a copy: a table of seven decisions and the file that argues each one. Every path in it was checked against the tree. One of them has no file, because it is a decision not to act: the heavy image blobs stay in the Git history. That one is written out here in full, because a decision not to do something is the kind that gets forgotten and redone. It says what the repository weighs, that the blobs are reachable from edition and not from master, what a filter-repo would cost everyone, and what would have to be true before it is worth doing. Not an ADR folder. Seven decisions and three people do not need one, and a document beside the code is a second place for a reason to go stale in.
mesejo
self-requested a review
October 11, 2026 13:28
mesejo
approved these changes
Oct 11, 2026
Contributor
|
The board is on board! |
34 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This one waits for the board, and it is the only pull request in this cleanup that does.
@mesejo: this is yours. Take it to the board, discuss it there, and approve it here when they are happy. There is no hurry. If anything is unclear or you disagree with any of it, tell me and we change it.
The rest of you are welcome to review, and please do, but for this one only Daniel's approval counts, and I will do the merge myself once it is there. That is a rule I am setting, not something GitHub enforces: the point is that we can look back later and see who signed it off.
It comes off
editionand depends on nothing else: eight commits, nine files, +418 and -70 lines. It was written on top of #204 and retargeted once that stack settled, so an early reader may remember it showing #204's changes as well. It no longer does.Why it needs a sign-off at all
The repository has no licence today, which means nobody has permission to reuse anything in it, not even to fork it. Choosing one is not a technical decision, and it says things on behalf of the association, so it should not be one person's call on a Tuesday.
The licence
LICENSEis MIT and covers the code: the templates, the stylesheets, the scripts, the workflows and the configuration.LICENSING.mdsays the content is CC BY-SA 4.0, and lists what neither licence covers, with the reason for each: the photographs, the person pages, the sponsor logos, our own logos, the vendored libraries and the archived sites.The reason for that last list is the part worth reading. We cannot license what we do not own. People sent us their own photograph and wrote their own text so that we would publish them here, and whoever did not want a photo did not send one. The copyright in a photograph belongs to whoever took it, and the permission we were given is to show it on this site, which is narrower than a CC licence, which would let a stranger reuse and adapt someone's face commercially and for ever. That permission can also be withdrawn, and a licence cannot.
The same goes for the text on a person's page: they wrote it.
The code of conduct
The text we already publish moves to
CODE_OF_CONDUCT.mdat the root, because that is where GitHub looks for it, and the page at /pybcn_association/coc/ now renders that file instead of holding its own copy. One text, two places, no chance of them drifting apart.The last commit moves it from CC BY-SA 3.0 to 4.0, so the whole repository is on one version. Section 4(b)(ii) of the 3.0 licence allows it, and the credit to PyLadies and the mention of their 3.0 licence stay, because that same section requires it.
The contributing guide
CONTRIBUTING.mdsays how to open a pull request, which branch to target, how to add a person, a sponsor or an event without writing code, and what each check is for. GitHub shows it to whoever opens a pull request or an issue, which the README is not.One thing to flag
.github/CODEOWNERSgains a rule forCODE_OF_CONDUCT.md. The text is moving out ofcontent/pybcn_association/, which the web team owns, to the repository root, which nobody owned. Without the rule, our code of conduct could be edited with one ordinary approval.What this does not do
It does not add a privacy policy or a legal notice. We publish 138 person pages and have neither, which matters more than this does. That is next, and it is a bigger conversation.