RFC: Convert to monorepo & meta stuff (tidelift)

[tunnckoCore]

Convert to monorepo (multi-package repo)

Why?

1. I could move koa-better-body for integration testing. It has extensive test suite and can be great testing for what is happening when changes comes.
2. Also, plugins/parsers can be separate packages, and with separate tests
3. Invite other third party parsers/plugins in future
4. Better code quality and structure

• try yarn v2 eventually

Joining Tidelift network

Due to joining and aligning with Tidelift agreements, we need to enforce 2FA on NPM (and in GitHub). Plus security & other policies, code of conduct (contributor covenant 1.4) ✔️ and etc.

Currently there are too many that have rights on the npm package and I guess it's fair to remove them and make it with 2FA requirement - me, @felixge and @GrosSacASac (and probably one more for fallback if something happens to me, probably @kornelski). Others are welcome to be active again and can be discussed further. @xarguments and @kornelski done much job too. Kornel is an owner in the org, Xargs (and others) doesn't accepting the invitation for a long time. I guess we can close #412 too.

I don't want to take full control or credits. It's just the situation now that it seems I'm the lead recently and in forseeable future. Just want to move forward.

I'm excited for v2 which will include all the things and bugfixes from the tons of previously opened issues and PRs, plus new Streams (#531 by @GrosSacASac) and Plugins API (#545 by me).

Currently we have 2M downloads a week, but I'm not yet sure from where they come. I'll investigate more on that topic and will be able to come up with some plan for the v1 roadmap, future support, security fixes (probably?) and more.

/cc @felixge @charmander @xarguments @quantumsheep @GrosSacASac @kornelski

---

edit(Feb 12, 2020): removed the npm rights for all non-active people, except @kornelski, @felixge and me.

[tunnckoCore]

@GrosSacASac I'm also talking with Tidelift for joining the network. I suppose you are okay with that. We can get some benefits from this. :)

[GrosSacASac]

Sorry I forgot about this RFC, yes and yes.
I was about to propose the monorepo as well.

[tunnckoCore]

Okay, great. Updated OP.

[felixge]

My two cents:

• Removing inactive contributors is fine as long as it's clearly communicated and anybody who feels wronged by it has a chance to regain their commit bits without too much fuzz.
• Moving to a mono repo is also fine by me.
• I don't know Tidelift but have no issues with corporate support this project in general. I would however ask for discussion if there are any plans to register trademarks or turn the README into an advertisement of some kind.

Thanks for all your work on this project @tunnckoCore

[tunnckoCore]

as it's clearly communicated and anybody who feels wronged by it has a chance to regain their commit bits without too much fuzz.

Sure. I think they are notified when they're removed from npm/github, I don't know. If not, when they realize it they will probably come up in the issues and we can discuss it, for sure.

I don't know Tidelift but have no issues with corporate support this project in general. I would however ask for discussion if there are any plans to register trademarks or turn the README into an advertisement of some kind.

https://tidelift.com - they are helping to market given package, ensure high security & quality, handling security disclosures, help with maintenance/licensing and connect with (enterprise) clients. It's a platform that allows those who want stability or professional support to connect with with those managing the given project getting better/priority support, or for example, LTS releases and etc.

In general, The Lifter Agreement that I just signed and which should be signed by everyone who wants to split the received income, which by automated estimates currently is like for few cup of coffees (at least that is showing the site). We will see in future and will be discussed with anyone who want, for sure.

About turning README into an advertising place, no. Or it would be utmost to a degree that's generally acceptable and can be seen in other big projects that are using Tidelift or OpenCollective, or other sponsoring channels - nothing too much or aggressive, definitely.

[GrosSacASac]

Tidelift requires a single sentence that the project is on tidelift. Not too aggressive in my opinion.

[felixge]

@tunnckoCore thanks for clarifying. This all sounds good to me. A small note in the README as suggested by @GrosSacASac is fine. No need to notify the current commiters when removing them beyond what GH might do automatically.

I initially thought you were going to join a company named Tidelift as an employee. If they're just some sort of way to crowdfund open source, then I don't have much concerns. I'm happy if there are any opportunities for those working on node-formidable to get some compensation for it.

I've just had bad personal experiences with corporations taking over open source projects in the past, including node.js itself ; ). But I trust you to make the right decisions.

Thanks again for continuing to maintain this package!

[tunnckoCore]

I initially thought you were going to join a company named Tidelift as an employee

Good point, my fault in wording.

I've just had bad personal experiences with corporations taking over open source projects in the past, including node.js itself ; )

True. But sponsoring/paying for Open Source is needed. The Tidelift model is a good one because every party is winning (in any sense) and has the motivation to continue doing their job as best as possible.

Thanks again for continuing to maintain this package!

Thanks too :) I'm here for already 2-3 years, but @GrosSacASac was the trigger for me, haha.

[felixge]

True. But sponsoring/paying for Open Source is needed.

Agreed!

The Tidelift model is a good one because every party is winning (in any sense) and has the motivation to continue doing their job as best as possible.

Sure, looking forward to see how it works out.

[tunnckoCore]

Removed the npm rights for all non-active people, except @kornelski, @felixge and me.
Plus, enabled my 2FA for auth and publish.

We are also already and officially part of the Tidelift Subcription covering all the requirements, as other 1880 packages is doing.

[GrosSacASac]

maybe we should switch to ES imports instead of requires for v2

[GrosSacASac]

(Joke)
From the readme

This README is for the upcoming (end of February) v2 release!

February 2030 😂😂😂

[tunnckoCore]

maybe we should switch to ES imports instead of requires for v2

agree

February 2030

yea, exactly hahahaha... how time pass... dang. It will happen this February though, for sure. :D

[GrosSacASac]

Can this issue be closed or is there something to do still @tunnckoCore ?

[tunnckoCore]

Yea.. i think we can close. There's other issues for that too 😆