Audit of the current infrastructure, tooling, and credentials

[jaimergp]

📌 Summary

The goal is to audit and document existing conda-forge's infrastructure.

This will be done in public.
We need to ensure no critical security details such as credentials are exposed.

📝 Background

To propose technical debt reduction measures and ensure the long-term viability of the project and its growing ecosystem, we first need to understand and document the current status of the platform.

Expected challenges:

• Large number of moving parts across services and platforms
• Several accounts and credentials key to the normal operating conditions
• Lack of documentation for each part
• Scattered institutional knowledge

🚀 Tasks / Deliverables

Preview Give feedback

1. Choose / create repository to store WIP documentation #27
   area: documentation 📖 mission: infra 🛠 team: quansight-labs type: task +4
   
2. RST to MD in Docusaurus, permanently, with git history preservation if possible: Freeze Sphinx content to Markdown conda-forge/conda-forge.github.io#2084
3. Document existing infrastructure #31
   3 of 3
   funding: czi mission: infra 🛠 team: quansight-labs +3
   
4. Migrate content from cf-infra-docs to conda-forge.org (maybe iteratively) #55
   4 of 4
   area: documentation 📖 funding: czi mission: infra 🛠 team: quansight-labs type: task +5
   
5. Document security model #37
   area: security 🔐 funding: czi mission: infra 🛠 team: quansight-labs type: task +5
   
6. Improve infrastructure diagrams #42
   area: documentation 📖 funding: czi mission: infra 🛠 type: task +4
   
7. Access control: on- and off-boarding core members #3
   4 of 5
   area: documentation 📖 funding: czi mission: infra 🛠 team: quansight-labs +4
   
8. Compile an audit report with suggestions and best practices #56
   area: documentation 📖 funding: czi mission: infra 🛠 team: quansight-labs type: task +5

📅 Estimated completion

This task should be finished in the first six months.

ℹ️ References

• conda-forge's Security and Systems Sub-Team
• conda-forge's Bot Sub-Team
• conda-forge repositories that are not regular feedstocks
• regro/cf-scripts documentation
• Talks about conda-forge (some cover infrastructure)
• regro.github.io