Archives
Contributors
-
Re: Travis security issue
Thanks for caring about this Alexandre. One less thing to worry about after my holidays.> Thank you! I can't believe such errors happen in a great organization like Travis...Apparently the travis core team has left the boat when the company was sold. It looks like it's going downhill...-sbiOn Thu, Sep 16, 2021 at 5:41 PM Pedro M. Baeza (Tecnativa) <pedro.baeza@tecnativa.com> wrote:Thank you! I can't believe such errors happen in a great organization like Travis..._______________________________________________
Mailing-List: https://odoo-community.org/groups/contributors-15
Post to: mailto:contributors@odoo-community.org
Unsubscribe: https://odoo-community.org/groups?unsubscribe
by Stéphane Bidoul - 10:46 - 22 Sep 2021 -
Re: OCA / OCB
Same as Tom hereDe: "Tom" <tom@sunflowerweb.nl>
Para: "Odoo Community Association, (OCA) Contributors" <contributors@odoo-community.org>
Enviadas: Terça-feira, 21 de setembro de 2021 0:22:12
Assunto: Re: OCA / OCBFor me at least it is quite relevant because I am supporting older Odoo versions with bugs, and usually these bugs are fixed in newer versions, then I can backport these in OCB. At least there we have a chance to share, code review, discuss, and possibly merge, without the PR being closed by Odoo.
Furthermore, when I use OCB, I can trust the above process will be followed even without me paying much attention. So I generally run instances on "latest OCB", saving me some bugs to have to think about.
It can be argued if these are good reasons but these are my reasons. Curious to know others opinions.
Sep 21, 2021 04:52:55 Kitti U. <kittiu@ecosoft.co.th>:
Dear community,
I am curious about OCA/OCB. Nowadays, is it still recommended to use OCB over Odoo?
We has made some bug fix and propose to odoo/odoo, but it is not merged easily. Should we propose PR to OCB instead? But then, it will never land to Odoo, right?
What is the practice around OCB today?
Thanks!Kitti U._______________________________________________
Mailing-List: https://odoo-community.org/groups/contributors-15
Post to: mailto:contributors@odoo-community.org
Unsubscribe: https://odoo-community.org/groups?unsubscribe
_______________________________________________
Mailing-List: https://odoo-community.org/groups/contributors-15
Post to: mailto:contributors@odoo-community.org
Unsubscribe: https://odoo-community.org/groups?unsubscribe
by Luis F Miléo - 02:46 - 21 Sep 2021 -
Odoo Experience - volunteers for the OCA Virtual Booth
Hello OCA Contributors,
As you know Odoo Experience is online again this year and we need your help at our virtual exhibitor booth.The opening hours of the virtual booth will be right after the keynotes:- Wednesday Oct 6th - 15:30 - 22:00 (CEST)
- Thursday Oct 7th - 14:30 - 22:00 (CEST)
I've set the schedule/rota up in hourly blocks, any time you can give will be greatly appreciated. We'd love at least 3 or more people each hour to help out.
Schedule: https://docs.google.com/spreadsheets/d/1Jp3MLgtpWx3odR134gO50rW5JY62s5nmNTlbuuMP8Xk/edit?usp=sharingPlease add in your name, company and email address on the schedule with the times you can help out, this way I can get in touch directly etc.The online set-up will be slightly different to the one used in 2020. Once I have the meeting details and how to log in etc I will share with our awesome volunteers.Looking forward to seeing some familiar faces online over the Odoo Experience.Warm regards,Rebecca--Rebecca GellatlyGeneral SecretaryOdoo Community Association
by Rebecca Gellatly - 04:51 - 21 Sep 2021 -
OCA / OCB
Dear community,I am curious about OCA/OCB. Nowadays, is it still recommended to use OCB over Odoo?We has made some bug fix and propose to odoo/odoo, but it is not merged easily. Should we propose PR to OCB instead? But then, it will never land to Odoo, right?What is the practice around OCB today?Thanks!Kitti U.
by Kitti Upariphutthiphong - 04:51 - 21 Sep 2021 -
Re: Reviews
Such fw-port tool exists somehow, but in local, thanks to Sébastien Alix:But theory is one thing, and the other is the reality: most of the fw-ports will fail due to pre-commit and black, different code due to version changes, refactorings... Automating the creation of the PR simply won't work, as if it's not satisfactory, or requires extra work, you won't be able to push to the fw-port created branch.Instead of having a lot of tools, which is not bad, IMO you should instead involve more and more of your people in PSCs and as maintainers inside your organization, or spread the adopt a module campaign for more casual contributors, trying to involve them in this.Regards.
by Pedro M. Baeza - 12:16 - 17 Sep 2021 -
Re: V14, python version
Le ven. 17 sept. 2021 à 08:57, Jairo Llopis <jairo.llopis@tecnativa.com> a écrit :FWIW Odoo is using python 3.8 on their runbots for saas-14.5 and master branches.You just have to go to runbot and search for "Full install_all logs" from the little cog:Examples (links will probably expire soon):All these have lines like:Requirement already satisfied: decorator==4.3.0 in /usr/local/lib/python3.8/dist-packages (from -r odoo/requirements.txt (line 3)) (4.3.0)Which means that they're using python 3.8.Maybe a good option for us is to base our CIs on the same version as they do.FTR with the same technique we can see that they're using py3.6 for Odoo v12 and v13, and py3.8 for v14._______________________________________________
Mailing-List: https://odoo-community.org/groups/contributors-15
Post to: mailto:contributors@odoo-community.org
Unsubscribe: https://odoo-community.org/groups?unsubscribe
by David BEAL - 11:55 - 17 Sep 2021 -
Re: Reviews
Regarding the "smarter bot" ideas: although it's typical for a bunch of programmers to come up with a solution to a problem by throwing more engineering into it, I feel there's something to it, it just needs more crystallization and then a hackathon to make it happen. Maybe a good theme for a team at this year's online code sprint?
As a reminder, OCA Days are coming up, and there will be the usual code sprint.
It would be nice to have a group working on OCABot improvements.
This can be to work both on code or process change proposals.
It has been discussed.A question that popped to my mind yesterday is one for the board - has it ever been considered for OCA to pay people to fulfill maintainer roles within the organisation? Money seems to be something thats available, and the spending of money on OpenUpgrade has been a great things throughout the last years also.
The feeling was that doing so it would work against the volunteer spirit of the community, and could break volunteers motivation.
Investing on better tooling would be better.
For the record, there has been an initiative for bounties, where people could publish a bounty, awarding a payment for a task, but it didn't get traction.
Thanks
Daniel
by Daniel Reis - 10:25 - 17 Sep 2021 -
Re: Reviews
Wow, i must say that everyone comes up with much better ideas than I had originally.
Regarding the "smarter bot" ideas: although it's typical for a bunch of programmers to come up with a solution to a problem by throwing more engineering into it, I feel there's something to it, it just needs more crystallization and then a hackathon to make it happen. Maybe a good theme for a team at this year's online code sprint?
I hope more people keep contributing to this thread since I do think it's a big issue. I'm also interested to know how other open source projects are handling this. And perhaps we can look at the "IT projects LLC" repos for inspiration - even though i dont understand their system, it looks pretty happy with all the icons. A "important bugfix" being represented by an ambulance.
A question that popped to my mind yesterday is one for the board - has it ever been considered for OCA to pay people to fulfill maintainer roles within the organisation? Money seems to be something thats available, and the spending of money on OpenUpgrade has been a great things throughout the last years also.
Thanks all
Sep 17, 2021 09:02:07 Yann Papouin <ypa@decgroupe.com>:
+1 for the bw/fwport bot
- It would be nice to have a new convention to tag a PR with a label like "Review it in 30 seconds" [R30] when it is a basic/simple/quick fix add/fwd that does not require you to soak up the functioning.- It would be nice too that a bot automatically tag an issue/PR with a github label based on the issue/PR name or simply the target branch name : eg: [12.0] ->
--
Yann PAPOUIN, Ingénieur R&D | DEC
Le ven. 17 sept. 2021 à 08:52, Jairo Llopis <jairo.llopis@tecnativa.com> a écrit :
I should add that repos using the template (all AFAIK) can upgrade to the latest version and benefit from https://github.com/OCA/oca-addons-repo-template/pull/63. A bot will warn and close stale PRs/issues.
El jue, 16 de sep de 2021 a las 12:51:48 PM, Sylvain LE GAL <sylvain.legal@grap.coop> escribió:
That's true ! One of the origins is the fast release rate of Odoo, which requires continuous migration of modules that, for many, do not change.
Unfortunately, that situation will not change. Odoo policy seems to be : "a year = a release".
Yep. They do it because they can handle it. The question is: why we can't?
There are many reasons, but the one that I find most important and easiest to fix is that we need a bw/fwport bot.
That will make maintenance pleasing, so we'll have more maintainers._______________________________________________
Mailing-List: https://odoo-community.org/groups/contributors-15
Post to: mailto:contributors@odoo-community.org
Unsubscribe: https://odoo-community.org/groups?unsubscribe
_______________________________________________
Mailing-List: https://odoo-community.org/groups/contributors-15
Post to: mailto:contributors@odoo-community.org
Unsubscribe: https://odoo-community.org/groups?unsubscribe
by Tom Blauwendraat - 09:40 - 17 Sep 2021 -
Re: Reviews
+1 for the bw/fwport bot- It would be nice to have a new convention to tag a PR with a label like "Review it in 30 seconds" [R30] when it is a basic/simple/quick fix add/fwd that does not require you to soak up the functioning.- It would be nice too that a bot automatically tag an issue/PR with a github label based on the issue/PR name or simply the target branch name : eg: [12.0] ->--
Yann PAPOUIN, Ingénieur R&D | DECLe ven. 17 sept. 2021 à 08:52, Jairo Llopis <jairo.llopis@tecnativa.com> a écrit :I should add that repos using the template (all AFAIK) can upgrade to the latest version and benefit from https://github.com/OCA/oca-addons-repo-template/pull/63. A bot will warn and close stale PRs/issues.El jue, 16 de sep de 2021 a las 12:51:48 PM, Sylvain LE GAL <sylvain.legal@grap.coop> escribió:That's true ! One of the origins is the fast release rate of Odoo, which requires continuous migration of modules that, for many, do not change.Unfortunately, that situation will not change. Odoo policy seems to be : "a year = a release".Yep. They do it because they can handle it. The question is: why we can't?There are many reasons, but the one that I find most important and easiest to fix is that we need a bw/fwport bot.That will make maintenance pleasing, so we'll have more maintainers._______________________________________________
Mailing-List: https://odoo-community.org/groups/contributors-15
Post to: mailto:contributors@odoo-community.org
Unsubscribe: https://odoo-community.org/groups?unsubscribe
by Yann Papouin - 09:01 - 17 Sep 2021 -
Re: V14, python version
FWIW Odoo is using python 3.8 on their runbots for saas-14.5 and master branches.You just have to go to runbot and search for "Full install_all logs" from the little cog:Examples (links will probably expire soon):All these have lines like:Requirement already satisfied: decorator==4.3.0 in /usr/local/lib/python3.8/dist-packages (from -r odoo/requirements.txt (line 3)) (4.3.0)Which means that they're using python 3.8.Maybe a good option for us is to base our CIs on the same version as they do.FTR with the same technique we can see that they're using py3.6 for Odoo v12 and v13, and py3.8 for v14.
by Jairo Llopis - 08:56 - 17 Sep 2021 -
OCA Days 2021 - Online - talk proposals
Hi everyone,
I hope you have all had a great week.
We've had some wonderful talks sent through already for the OCA Days 2021 but we NEED MORE.Key areas that we could do with extra talks are:- Trainings and tutorials
- Functional talks
- Specific modules and their awesome features - share your hard work and knowledge
Over the coming weeks you'll see more of these requests from me and we really want to hear from you. We have so many knowledgeable people in our community that put in so much effort on so many different topics. If you have something to share (not just limited to the bullet points above) we want to hear about it.Please send all talk proposals here: https://odoo-community.org/event/oca-days-2021-online-2021-10-28-2021-10-30-128/track_proposalHave a fabulous weekend everyone.Rebecca--Rebecca GellatlyGeneral SecretaryOdoo Community Association
by Rebecca Gellatly - 08:21 - 17 Sep 2021 -
Re: Reviews
Hi Tom,Thanks for bringing this up. I experience the same. May I share opinion as a not so advanced developer side.If I understand correctly, the policy of OCA is to welcome more contributions with maturity levels like alpha. If this is the policy, we will have a lot of PR (with many low quality ones too). I think good / interesting PR are still merged fast, and natural selection will kill the low quality module in the long term anyway.
So, frankly, I don't mind having a lot of new PRs, even unmerged ones. When I got stuck, they also useful.But I like to support some idea mentioned here, which could help balance that.- Easier to mege, but with some quality constraints. I.e., [ADD] modules with full test script, can merged with 1 reviewer.
- Close the inactivity PR very fast, less poison to reviewers
- The [MIG] module should be easier to merge, i.e., if a full test is added no reviewer is required, or maintainer can do the merge himself.
I think we should use Test Coverage as an incentive to contributors if he/she want to get merge faster.Kitti U.PS: Thank you Daniel, for sharing the article. It is interesting and may fit with nature of Odoo nowadays.On Thu, Sep 16, 2021 at 7:51 PM Sylvain LE GAL <sylvain.legal@grap.coop> wrote:Hi,Thanks for the topic.Some response in your email.kind regards.GRAP - Service informatique (Groupement Régional Alimentaire de Proximité)Site Web | FramaSphere | Facebook
3 Grande rue des Feuillants, 69001 Lyon
Standard : (+33) 09.72.32.33.17Service Informatique : (+33) 09.73.79.64.40Astreinte Informatique : (+33) 06.81.85.61.43Member of the OCA (Odoo Community Association)Le jeu. 16 sept. 2021 à 13:51, Tom Blauwendraat <tom@sunflowerweb.nl> a écrit :Hi all, For years, OCA has a big problem with unmerged PR's.
That's true ! One of the origins is the fast release rate of Odoo, which requires continuous migration of modules that, for many, do not change.Unfortunately, that situation will not change. Odoo policy seems to be : "a year = a release".let's put it into perspective a little bit :- maintainers is a quite "new concept" in the OCA. We should continue to promote the concept.- PSC members should be updated. I worked recently to update PSC member for OCA/pos, here removing for exemple a guy that stopped working on odoo 5 years ago... I think it should be generalized.- we generally organize code sprint to merge PRs, but with the covid, it's been two years since there was a "real" event (only online), and I think this has disturbed the processRecently, we have added on the repo homepage, the maintainer icons. This allows to see quickly which modules are not maintained. The result is good.Other recent improvment has been done in the bot and maintainer-tools project. I think that allowing maintainers to merge "[MIG]" PRs could be a great addition.Also, even if there are 2 reviews then PSC's generally don't respond to merge requests.
That depends a lot of PSC and repo. some PSC of some repo are very reactive.The answer has always been "let's review more" or "Let's use gitaggregator and so we can use unmerged PR's". But why don't we try something more radical: - Let's write a script to assign "maintainer" role for all modules to the person who committed the oldest/original version of it
hum. That can be a good idea, if the automation is not total. I mean, if we create a PR, and tag people saying : "The bot want to set you as maintainers for module x, y, are you agree ? please answer" --> it's ok.If we affect automatically people, I think we'll have modules with maintainers that don't maintain modules for real. it's worse than not having maintainers.Some modules are 10 years old, their authors may not work on odoo at all.- If maintainer does not respond to a ping longer than 1 month he loses the maintainer role, which then changes to the default maintainer that is set for the full repo.
Oh, no ! I'm PSC of OCA/pos. I don't want to have my name set to all modules that are unmaintained. We should assume that there are unmaintained modules. That's the reality.- Let's require only 1 positive review from now on. After that the maintainer can merge. --> I don't think that having 2 reviewers is always necessary and it also does not prevent bugs from being merged - this happens anyway. I used to have high trust of merged OCA modules but after seeing some quite ugly bugs and incomplete work being merged I am starting to think that maybe the quality of the unmerged stuff is not that bad as compared to what is actually merged. The maintainer can prevent really bad changes from entering, by just closing the PR.
As said by daniel, that is handled by the current rules, depending on the maturity.Tom
_______________________________________________
Mailing-List: https://odoo-community.org/groups/contributors-15
Post to: mailto:contributors@odoo-community.org
Unsubscribe: https://odoo-community.org/groups?unsubscribe
_______________________________________________
Mailing-List: https://odoo-community.org/groups/contributors-15
Post to: mailto:contributors@odoo-community.org
Unsubscribe: https://odoo-community.org/groups?unsubscribe
by Kitti Upariphutthiphong - 06:51 - 16 Sep 2021 -
Re: Travis security issue
Thank you! I can't believe such errors happen in a great organization like Travis...
by Pedro M. Baeza - 05:41 - 16 Sep 2021 -
Re: Travis security issue
Thanks for the update Alex!And thanks Stéphane for the magic script :)On Thu, Sep 16, 2021 at 4:52 PM Alexandre Fayolle <alexandre.fayolle@camptocamp.com> wrote:Hello everyone, I recently became aware of this issue at Travis https://travis-ci.community/t/security-bulletin/12081 more information available on https://twitter.com/peter_szilagyi/status/1437646118700175360 I just updated the secrets we have on travis for our repositories. In case you notice something strange on Travis builds, please ping me, as it is the first time I use our configure-travis script (kudos to Stéphane Bidoul for this) and I could have make a mistake (such as uploading the wrong token...) Best regards -- Alexandre Fayolle Senior Software Engineer Tel : +33 4 58 48 20 30 Camptocamp France SAS 18 rue du Lac Saint André 73 370 Le Bourget-du-Lac France http://www.camptocamp.com
_______________________________________________
Mailing-List: https://odoo-community.org/groups/contributors-15
Post to: mailto:contributors@odoo-community.org
Unsubscribe: https://odoo-community.org/groups?unsubscribe
--Simone OrsiFull stack Python web developer, Odoo specialist, Odoo Community Board Member, in love with open source.
by Simone Orsi - 05:35 - 16 Sep 2021 -
Travis security issue
Hello everyone, I recently became aware of this issue at Travis https://travis-ci.community/t/security-bulletin/12081 more information available on https://twitter.com/peter_szilagyi/status/1437646118700175360 I just updated the secrets we have on travis for our repositories. In case you notice something strange on Travis builds, please ping me, as it is the first time I use our configure-travis script (kudos to Stéphane Bidoul for this) and I could have make a mistake (such as uploading the wrong token...) Best regards -- Alexandre Fayolle Senior Software Engineer Tel : +33 4 58 48 20 30 Camptocamp France SAS 18 rue du Lac Saint André 73 370 Le Bourget-du-Lac France http://www.camptocamp.com
by Alexandre Fayolle - 04:50 - 16 Sep 2021 -
Re: Reviews
Hi,Thanks for the topic.Some response in your email.kind regards.GRAP - Service informatique (Groupement Régional Alimentaire de Proximité)Site Web | FramaSphere | Facebook
3 Grande rue des Feuillants, 69001 Lyon
Standard : (+33) 09.72.32.33.17Service Informatique : (+33) 09.73.79.64.40Astreinte Informatique : (+33) 06.81.85.61.43Member of the OCA (Odoo Community Association)Le jeu. 16 sept. 2021 à 13:51, Tom Blauwendraat <tom@sunflowerweb.nl> a écrit :Hi all, For years, OCA has a big problem with unmerged PR's.
That's true ! One of the origins is the fast release rate of Odoo, which requires continuous migration of modules that, for many, do not change.Unfortunately, that situation will not change. Odoo policy seems to be : "a year = a release".let's put it into perspective a little bit :- maintainers is a quite "new concept" in the OCA. We should continue to promote the concept.- PSC members should be updated. I worked recently to update PSC member for OCA/pos, here removing for exemple a guy that stopped working on odoo 5 years ago... I think it should be generalized.- we generally organize code sprint to merge PRs, but with the covid, it's been two years since there was a "real" event (only online), and I think this has disturbed the processRecently, we have added on the repo homepage, the maintainer icons. This allows to see quickly which modules are not maintained. The result is good.Other recent improvment has been done in the bot and maintainer-tools project. I think that allowing maintainers to merge "[MIG]" PRs could be a great addition.Also, even if there are 2 reviews then PSC's generally don't respond to merge requests.
That depends a lot of PSC and repo. some PSC of some repo are very reactive.The answer has always been "let's review more" or "Let's use gitaggregator and so we can use unmerged PR's". But why don't we try something more radical: - Let's write a script to assign "maintainer" role for all modules to the person who committed the oldest/original version of it
hum. That can be a good idea, if the automation is not total. I mean, if we create a PR, and tag people saying : "The bot want to set you as maintainers for module x, y, are you agree ? please answer" --> it's ok.If we affect automatically people, I think we'll have modules with maintainers that don't maintain modules for real. it's worse than not having maintainers.Some modules are 10 years old, their authors may not work on odoo at all.- If maintainer does not respond to a ping longer than 1 month he loses the maintainer role, which then changes to the default maintainer that is set for the full repo.
Oh, no ! I'm PSC of OCA/pos. I don't want to have my name set to all modules that are unmaintained. We should assume that there are unmaintained modules. That's the reality.- Let's require only 1 positive review from now on. After that the maintainer can merge. --> I don't think that having 2 reviewers is always necessary and it also does not prevent bugs from being merged - this happens anyway. I used to have high trust of merged OCA modules but after seeing some quite ugly bugs and incomplete work being merged I am starting to think that maybe the quality of the unmerged stuff is not that bad as compared to what is actually merged. The maintainer can prevent really bad changes from entering, by just closing the PR.
As said by daniel, that is handled by the current rules, depending on the maturity.Tom
_______________________________________________
Mailing-List: https://odoo-community.org/groups/contributors-15
Post to: mailto:contributors@odoo-community.org
Unsubscribe: https://odoo-community.org/groups?unsubscribe
by Sylvain LE GAL - 02:51 - 16 Sep 2021 -
Re: Reviews
> Also, even if there are 2 reviews then PSC's generally don't respond to > merge requests. I can tell you why I don't: It has happened quite often in the past that I trusted fellow reviewers' reviews, but afterwards it turned out what I merged was very obviously wrong - just as you mention below we do have quite a bit of substandard code already in the codebase. And I feel responsible for what I merge. So if the existing reviews are not done by (to me) "known good" reviewers, I'll only merge if I reviewed myself too, and that is severely constrained by lack of time. In the survey about PSCs earlier (I haven't seen any results of this, will those be published?), I wrote that I'd like to have some kind of automated triage, this would increase my reviewing/merging output considerably. Very often I spend my weekly OCA-time on clicking through PRs that are in my opinion of such a low quality that a review would be CS 101 plus guided reading of the conventions, and that's simply not what I signed up for. A bot that closes PRs with failing CI for longer than X days would be a start, another bot could close PRs of people who don't play nice (details to be determined), inactive PRs should be closed much earlier. Then I know that what's left is not a waste of time and go reviewing in a much happier mood. -- Your partner for the hard Odoo problems https://hunki-enterprises.com
by Holger Brunn - 02:20 - 16 Sep 2021
