Code review for security advisory coverage applications

This is part one of a four-part post. The rest of the proposal can be found at the following links:

• Part 1: Today's Project Application Process
• Part 2: Where the Existing Process Breaks
• Part 3: The Proposal
• Part 4: Sanity Check - Wait a Minute Here ...

The 'Coles Notes' summary of the actual proposal can be viewed HERE.

Or, if you prefer, download a copy of the entire proposal in Word format.

This is part one of a four-part post. The rest of the proposal can be found at the following links:

• Part 1: Today's Project Application Process
• Part 2: Where the Existing Process Breaks
• Part 3: The Proposal
• Part 4: Sanity Check - Wait a Minute Here ...

The 'Coles Notes' summary of the actual proposal can be viewed HERE.

Or, if you prefer, download a copy of the entire proposal in Word format.

Hi,

(My apologies if there is already a discussion / page about this - haven't found it after searching).

I have been doing some application reviews once in a while, dating back to the CVS era. Back then all feedback was given in the application issue.

This wiki page has been set up to continue the 'Automated Coder' discussion initially started at http://groups.drupal.org/node/155084#comment-517764.

Webchick was digging around in the Project Applications database tables on d.o last night, so I asked her to give us a dump of the 'needs review' applications ... here are the results.

For future reference (and updating), the query is as follows:
SELECT n.nid, n.title, FROM_UNIXTIME(n.created) FROM node n INNER JOIN project_issues pi ON pi.nid = n.nid WHERE pi.pid = 1025112 AND pi.sid = 8 ORDER BY n.created;

Note: As these are reviewed, please update this wiki page to indicate that the review has been completed; so that we can track progress.

Purpose

This page is intended as a tool for reviewers (or applicants) to request a second opinion with regards to any issues, conflicts, or differences of opinions which may arise during the code review process.

Process

Recently, I've been periodically finding moments in the project review process in which I feel that it would be best to get a second opinion. And to my knowledge there was no specific place to turn (IRC is not so reliable with few people in the group). So, I thought it would be great to have a discussion for getting second opinions from more experienced reviewers or even in cases where a question requires specific expertise. This may even further promote and encourage less skilled reviewers as they will have a place to turn when they feel overwhelmed.

I don't know if this has really been discussed yet, so I apologize if I missed it somewhere else.

Throughout our discussions, there have been some talk of a code review 'nirvana', where we automate various portions of the code review process, eliminating the need for manual intervention/attention.

Im still a newby and would love some feedback on my post on a recent project application. I began a review of the application at http://drupal.org/node/1183226 and found that the applicant admitted that his module was a duplicate of a D6 module. He mentioned trying to contact the maintainer of that module unsuccessfully. Did I handle it right in my response to the applicant by suggesting that he apply for maintainership of the project and return to the project application queue once it is received? My response was formatted around a similar issue I had seen recently.

I'm new to the group and just poking my way around, hoping to contribute a little for a variety of reasons.

In searching the queue for a project application to review, I find several that appear to have been abandoned for one reason for another. What happens to these zombies?

<

ul>

A number of related initiatives aimed at reducing the full project applications backlog are currently being discussed. The backlog is now approaching seven weeks. These initiatives include:

• Using multiple people to complete a review, instead of having a single reviewer complete the whole thing. The objective is to allow people to participate in the process, even though they may not feel qualified to do a full technical review.

This page is intended as a collection point to list the major thrusts and related initiatives underway within the Code Review Group.

My plan for expedited applications has two goals:

1. To reduce the backlog in the Project Application issue queue (now up to six weeks) by getting more people involved in the Code Review process.
2. To give people an incentive to get involved.

There has been some discussion recently about modifying the process to allow for less experienced people to get involved in the code review process. I've been thinking about this and so I thought I would set out what I believe are the pitfalls of this approach.

This is a proposal for an update to the current 'Project Application' issue page, which would add the ability to flag statuses to individual components of an application.