# SciPy onboarding of a maintainer

## Welcome!

You are now officially a SciPy maintainer. The goal of this document is to give you some information and more context that can help you navigate our waters with more confidence.

## How does SciPy fit-in

* A bit of history
* So many actors: NumFOCUS - Scientific Python - Tydelift - OpenCollective - CZI -PyData - SciPy conferences

https://opencollective.com/scipy
https://scientific-python.org
https://numfocus.org/programs/small-development-grants
https://chanzuckerberg.com

## Communication

Be kind, open minded and welcoming (CoC)

Be a team player, support each other. We are all in the same team, fighting the same battle. It's difficult enough of a job that we don't need to fight between us.

At the moment, we have a social presence on GitHub, the mailing list, our websites, our Slack channel, Scientific Python's discord, Twitter and Mastodon. When you communicate on these channels, your voice has an additional weight as you are a maintainer.

### Conflicts

It can happen, it will happen. Sometimes it's difficult to see the limit behind a screen and arguments can become heated.

Try to always assume good intents, never be personal and do not escalate things.

If something is wrong, don't hesitate to report it either the CoC committee or another maintainer that you feel comfortable discussing the situation with. The last thing we want for the project is maintainers leaving the project because of some conflicts.

## Expectations

* Don't burn yourself! Life happens (and this is what really matters.)

At the moment there is no specific expectations. Meaning, you have your status of maintainer regardless of how you contribute moving forward. We do hope that you continue being active and this is why we granted you this status.

Be an example. A lot of people are following everything we (SciPy and us) do without being active. We strive to be a welcoming community for everyone and the way we interact has a great impact.

* What do you want or expect? Do you have goals?

## Ethics and morale

At its core, SciPy's mission is to make scientific tools available to the wider scientific community.

It is very important that we stay independent of external pressure and stay true to our mission when making decisions that impact the project.

More and more contributors, maintainers, are getting funding to work on the project. Still, this does not mean that they can do what they want. We are still very much a community and must continue to discuss our goals and vision alltogether.

We are happy if you use SciPy's name to promote your skills. But it should be clear that SciPy is not endorsing any companies or product that you could be representing (besides what we communicate of course.)

### License & Copyright

SciPy is open source under the BSD-3-clause license. It is very important that we ensure this is preserved.

A lot of contributors use things like StackOverflow, look at other implementations in R or Matlab. Most of the time, this is a problem. We can of course use code from other MIT or BSD-3-clause projects. BUT, we need to be sure these projects do have the right to be released under these terms. A lot of contributors don't pay attention to licensing and release their code under something like MIT although they copyied something from some R libraries which could be under GPL... The simple act of having a look at GPL code, is a violation of the clause of GPL and would mean that your code would become GPL.

A note of caution about AI assistant such as CoPilot. There are concerns and lawsuits in progress. Until there is a clear resolution, we must observe caution and ask people to own and have authored their code. Hence, no AI tools can be used to author code that would go into SciPy.

## Security

GitHub is now enforcing 2FA. This is just the tip of the iceberg. As a maintainer, we are in a very sensitive position as have the power to change code affecting millions of users.

It is paramount to be mindful of your GitHub credentials to (i) not get impersonated (which could have an impact on your and the projects' trust) and (ii) not compromise the codebase. Only a handul of people can make a proper release, but some people still rely on our main branch and we could compromise them.

Besides 2FA, some things to think about:

* If you need an API token, restrict it's scope and set a sensible expiry date.
* Know what's in your ENV. Only set tokens there when you need them.
* Protect your ssh keys.
* Use a password manager (e.g. Bitwarden, KeePassXC)
* If you are not on your network, be careful about using your credentials.

## Governance model

The mailing list is king. We officially have a BDFL and a steering commitee, but these are not used in practice.

Some people have clear roles. Important ones being:

* General and last calls - Ralf
* Release manager - Tyler

Besides that, some people contribute more to some part of the repo than others and when we need to make a decision, their vote is supposed to have more weight. All decisions are taken on the mailing list and no answer means yes. All of that being conditional.

## Funding

SciPy is still very much a community project and as such most contributors are not funded to work on SciPy. Still, a few of us get to contribute as part of our jobs. It can either be through an employer allocating hours, grants or models like Quansight who hire maintainers, to continue to be maintainers.

Any maintainer can propose a project to be funded, these are usually discussed and decided on our private mailing list and announced on the public mailing list when we get the funding.

## Vision

We have a roadmap. It is regarded as being in OK-ish shape. And we recently started a wiki page for SciPy 2.0.

SciPy evolves in a continuous improvement fashion. We have around 500 PRs/issues per release which mostly are bug fixes or small adjustments.

Big changes are usually hard to make because of SciPy's intrinsic weight.

We are in a difficult position as we want to support other libraries that build upon us more than take over some space. A lot of newcomers in the Scientific Python community don't know about SciPy eventhough they might use it as a hidden dependency. Still, it's important for the project to live and that we are active and seen. Some part of SciPy are not often being updated and we lack maintainers for all of SciPy. The more we are active and expose SciPy to the wider community, the more our chances to attract new talented maintainers with relevant skills increases.

## Our GitHub organization

We have other repositories! Mainly the org website and the archive ones are of interest. In archive you will find old presentations, proposals, logo, etc.

## Rythme

We make 2 releases a year, one in December/January and another one in July/August. You will see that the development speed is squewed around these periods. In between it's usually quieter.