[05/06/2025] Score Community Meeting

[mathieu-benoit]

Community call	Info
Meeting Link	Join via Google Meet or call +49 40 8081618260 (Pin: 599 887 196)
Meeting Time	1:00-2:00pm UTC, every first Thursday of the month
Attendees	@7h3-3mp7y-m4n @astromechza @chris-stephenson @mathieu-benoit

Updates since last meeting:

• New: Examples in the docs: https://docs.score.dev/docs/examples/ (Nginx unprivileged, OnlineBoutique, Backstage, etc.)
• Releases:
  • 2 for https://github.com/score-spec/score-go/releases
  • 1 for https://github.com/score-spec/score-k8s/releases
  • 1 for https://github.com/score-spec/score-compose/releases
  • 2 for https://github.com/score-spec/community-provisioners/releases
  • 1 for https://github.com/score-spec/community-patchers/releases

Community highlights:

• Update: More blog post from the community: https://docs.score.dev/docs/community/
  • https://itnext.io/stop-building-platforms-nobody-uses-pick-the-right-kubernetes-abstraction-with-gitops-64681357690f
  • https://medium.com/@mabenoit/deploy-backstage-with-score-45bb2d7c2d90
• New contributors (thanks!): https://score.devstats.cncf.io/d/52/new-contributors-table?orgId=1

Roadmap:

• "KubeCon NA 2025 Milestone": KubeCon NA 2025 - Facilitating adoptions and contributions
• Big topics:
  • Improve onboarding of new contributors and end users
  • Hub of examples in docs
  • "initContainers"
  • Podman-Compose doc
  • Microcks example
  • More community patchers and provisioners examples

Open To Dos:

• score-aca discussion
• Feat: Add --namespace and --generate-namespace flags for score-k8s generate score-k8s#176
• Support new files|volumes spec with score-go v1.10.0 score-k8s#164
• What is the semantic meaning of the `metadata.name` field? #147

Call for more contributions:

• https://clotributor.dev/search?foundation=cncf&project=score
• https://github.com/score-spec/community-provisioners/issues
• https://github.com/score-spec/community-patchers/issues

[7h3-3mp7y-m4n]

👋 Hello Score Community

I recently noticed that many CNCF projects, such as Notaryproject, Kubestellar, and Brigade, have started adopting GPG-signed commits (git commit -S). While it may seem like a small detail, it’s increasingly becoming a best practice to improve the security posture and authenticity of open-source contributions.

Of course, enabling GPG or SSH signing can be a hurdle for first-time contributors, but teaching best practices is part of what makes open source valuable. We can help newcomers by gently guiding them through the process, rather than enforcing it strictly at the start.

---

💡 Suggestions

Here are a few ideas to help introduce commit signing without blocking contributions:

1. Add a non-blocking check in CI/CD

   • For example, a GitHub Action logs a warning when a commit is not signed. Like [this] (ci: add signed commit check notaryproject/notation#1244).
   • This helps contributors become aware of commit signing early in the process.

2. Enhance the CONTRIBUTING.md file

   • Add a section about GPG/SSH commit signing and its importance.
   • Making CONTRIBUTING.md a little welcoming.
   • Provide helpful copy-paste snippets for setup commands.
   • Make the development process easier to understand by highlighting the use of the Makefile for local development and testing.

3. Improve onboarding through documentation

   • We could also consider adding a dedicated "How to Contribute" section on the Score website, and reference it directly from the CONTRIBUTING.md file. This would offer a more visual and structured onboarding experience for new contributors.

---

Would love to hear what others think!
Thanks for reading and looking forward to your thoughts!

[mathieu-benoit]

Meeting notes:

• Docs/Blog: bigger picture how does it fit in your DevX/Platform Engineering story/journey, not on technical setup (broader mindset) - what are the best practices, where to start, etc.
  • Opportunity also to do a survey to get insights from the community (KubeCon timing-ish)
  • Let's also aligned with the formerly known TAG App Delivery
  • Not just about the landscape positioning like here https://score.dev/blog/score-journey-in-the-cncf-ecosystem/, but more about the story, best practices, etc. "Why Score is really/maybe a better way?" "How to use it efficiently?"
  • Let's iterate, start small with a blog post, and get feedback and iterate from learning.
  • @chris-stephenson volunteered, idea coming from him anyway ;)
• "initContainers"
  • We need to file issue and PR in score-go based on the current PR/branch
  • Same for score-compose
  • Same for score-k8s
• Based on this "Spec versioning" story, then, the question comes about Score spec versioning? Branch, Tag, apiVersion=1b1, etc. --> Opportunity at some point to talk and define what could be an official v1 and what are the expectation and requirements moving forward? Backward compatibility rules/requirements, etc.?
  • Let's learn from the new files/volumes and soon initContainers experience: backward compatibility, etc.
• Let's add these 2 in CLOTributor?
  • https://github.com/score-spec/community-provisioners/issues
  • https://github.com/score-spec/community-patchers/issues
  • @mathieu-benoit volunteered to check.
• Pushing harder/better about the provisioners and patchers?
  • Production grade versus not just example to take inpsiration
  • More highlights on use cases --> Spec+Implementations should just be boring, the most excited stuffs are the provisioners and patchers bringing real life use cases.
• Brought by @7h3-3mp7y-m4n and very aligned with what we want to do/be for KubeCon Atlanta, we need to have better and stronger CONTRIBUTING.md - and really good idea too to have a dedicated doc page in the docs. Thanks for bringing this up, your contributor's eyes will greatly help make improvements here!
  • @7h3-3mp7y-m4n volunteered to start an issue/PR to iterate on this.
• Signing commit with key (discussion above [05/06/2025] Score Community Meeting #149 (comment) brought up by @7h3-3mp7y-m4n) - good idea, very important, but before doing anything, let's see what is the "impact" for new contributors, contributors, and maintainer. Could we start with something as optional first just for Maintainers and a few Contributors and learn from there?