Add microcks - Governance Review

[krol3]

The governance review required in the issue#2035
Draft notes here: https://hackmd.io/@krol/SJLahh_9Wg

/closes #2035

[angellk]

@krol3 please fix so the governance review isn't under the security reviews folder

[krol3]

@krol3 please fix so the governance review isn't under the security reviews folder

Thank you. It was fixed.

[joshgav]

@krol3 can you remove the changes within the "security-assessment" folder? Then I think this is ready for merge.
Did you have any additional comments @yada or @angellk?

[yada]

@joshgav, all good on our side. We’ll refer back to this review as we address its recommendations. Thank you.

Update — September 7, 2026: Following the approval of the governance review, we are now starting the follow-up work. We’ll add a separate comment to this PR for each suggested improvement once it is completed.

[joshgav]

I fixed so the PR doesn't touch the security-assessment folder anymore.
With that I think we are good to merge.
Thank you @krol3!

[brandtkeller]

lgtm - great governance review for Microcks.

[brandtkeller]

Agree with this and the overlays it has for vendor neutrality - there may need to be provisions for number of votes allowed per organization to obtain the supermajority acceptance.

[yada]

✅ Organization-balanced voting implemented

Thanks @brandtkeller for the recommendation. Microcks has adopted organization-balanced voting for formal governance decisions, using one vote per affiliation regardless of Maintainer
headcount.

Routine technical decisions remain under lazy consensus and individual Maintainer authority. Formal governance decisions now require a two-thirds majority of all eligible organizational
votes, ensuring that no single organization can control the project’s governance alone.

The change was approved by all three current Maintainers, representing both Postman and AXA France:

• Vote result: 3 of 3 Maintainers — 100% approval
• Implementation: docs: adopt organization-balanced governance voting microcks/.github#93
• Merge commit: microcks/.github@10a7fda
• Governance policy: https://github.com/microcks/.github/blob/main/GOVERNANCE.md#decision-making-and-voting
• Maintainer affiliations: https://github.com/microcks/.github/blob/main/MAINTAINERS.md

Following the merge, GOVERNANCE.md and MAINTAINERS.md were successfully replicated across all Microcks repositories where these organization-wide governance files apply:

https://github.com/microcks/.github/actions/runs/34251534743

[yada]

Following the approval of the governance review, we are now starting the follow-up work. We’ll add a separate comment to this PR for each suggested improvement once it is completed.

[yada]

✅ Secure vulnerability reporting

Addressed in Microcks .github PR #94.

The updated security policy now requires private reporting through security@microcks.io, establishes acknowledgement within five business days, defines a 90-day coordinated-disclosure
target, and clarifies remediation and Security Team responsibilities.

Final policy: https://github.com/microcks/.github/blob/main/SECURITY.md
Replication: https://github.com/microcks/.github/actions/runs/34286520276

The policy was successfully replicated to the Microcks repositories where it is needed and relevant.

[yada]

✅ Completed the Code of Conduct escalation update in microcks/.github#95.

The Maintainer vote passed, the PR was merged, and the updated CODE_OF_CONDUCT.md and GOVERNANCE.md files were successfully replicated to Microcks repositories where needed and relevant:
https://github.com/microcks/.github/actions/runs/34543115542

[yada]

✅ Project and repository inventory

Completed in microcks/.github#96.

The organization-balanced Maintainer vote passed, and the PR was merged. SUBPROJECTS.md now provides the canonical inventory of Microcks repositories, including their scope, lifecycle, ownership, and CLOMonitor coverage.

Canonical inventory: https://github.com/microcks/.github/blob/main/SUBPROJECTS.md
Governance reference: https://github.com/microcks/.github/blob/main/GOVERNANCE.md
Successful replication: https://github.com/microcks/.github/actions/runs/34591435051

The updated GOVERNANCE.md was successfully replicated to Microcks repositories where needed and relevant. SUBPROJECTS.md remains centralized in the .github repository.

[yada]

✅ Objective contributor ladder and governance review cadence

Completed in microcks/.github#98.

The governance policy now defines measurable eligibility criteria for Maintainers and Code Owners, requires promotion nominations to include public supporting evidence, and recognizes equivalent asynchronous community participation.

GOVERNANCE.md also includes a last-reviewed date and requires a public governance review at least once every twelve months.

The organization-balanced Maintainer vote passed, the PR was merged, and the updated governance file was successfully replicated to Microcks repositories where needed and relevant.

Final policy: https://github.com/microcks/.github/blob/main/GOVERNANCE.md
Replication: https://github.com/microcks/.github/actions/runs/34856733045

[yada]

✅ Community meeting documentation and recordings

Completed through microcks/community#142 and commit microcks/community@21d2601.

The community documentation now provides consistent meeting schedules and direct links to the publicly available recordings:

• https://www.youtube.com/@Microcks/streams
• https://www.youtube.com/@Microcks/videos

Significant decisions and follow-up actions are recorded through durable public GitHub issues, pull requests, and discussions. Written minutes are not currently published for every meeting, but recordings remain publicly accessible.

Meeting documentation: https://github.com/microcks/community/blob/main/JOIN-OUR-MEETINGS.md

[yada]

🔄 Maintainer diversity — ongoing

We acknowledge the governance review’s observation that two of the three current Microcks Maintainers are sponsored by Postman. This recommendation remains open and requires continued community and Maintainer development rather than a documentation-only change.

As immediate governance safeguards, Microcks has adopted organization-balanced voting and objective, publicly verifiable promotion criteria:

• docs: adopt organization-balanced governance voting microcks/.github#93
• docs: add objective contributor ladder criteria microcks/.github#98

These measures prevent a single organization from controlling formal decisions through Maintainer headcount and provide a transparent path for contributors from additional organizations to become Code Owners and Maintainers.

We will continue developing and promoting independent Maintainers, with the objective that no single organization holds a majority of Maintainer seats before Microcks applies for CNCF Graduation.

[yada]

@joshgav @brandtkeller @krol3, the Microcks follow-up is now complete for all actionable governance and documentation recommendations.

The individual updates above cover secure vulnerability reporting, Code of Conduct escalation, the consolidated project inventory, objective contributor-ladder criteria, governance review cadence, and community meeting documentation.

Maintainer diversity is explicitly acknowledged as an ongoing objective, with a target of removing single-organization majority representation before applying for CNCF Graduation.

Could you please provide the final validation and merge this governance review?

One older Auto Label Issues and PRs check remains failed because its pull_request_target workflow refused to check out code from the fork. DCO passes, and the PR is otherwise mergeable. Please let us know if a repository Maintainer needs to rerun or override that check.