PHP RFC: Migrating to GitHub Issues
- Date: 2021-11-01
- Author: Nikita Popov nikic@php.net
- Status: Accepted
Introduction
This RFC proposes to use GitHub Issues on the PHP repository in place of our own bugs.php.net bug tracker.
Currently GitHub issues are already used for documentation issues, as well as website issues on the respective repositories. This RFC expands usage to the PHP implementation itself.
Motivation
The primary motivation for this change is that bugs.php.net has many known deficiencies and is not actively maintained. Some of the main problems are:
- Maintenance: bugs.php.net is essentially unmaintained. Making it fit for continued usage would require implementation effort beyond simple cosmetic changes. It must be emphasized that this is not just a matter of finding a motivated person to implement changes, it also requires someone to review them and to perform any necessary infrastructure updates, such as database migrations. There is generally very little interest in these things and it can take a lot of time to get things done.
- Stability: For years now, bugs.php.net regularly hangs or slows down to unusable levels. We “fix” this with a server restart, but nobody has found the motivation to find out what the actual problem is.
- Spam: We receive a lot of link spam. While comments are nominally captcha-protected, the captcha is very weak. On normal days, it is necessary to delete a handful of spam comments. On bad days, a mass deletion in the database is necessary. A better captcha and/or a ban on links to domains other than php.net, github.com and 3v4l.org might address this.
- Hostile comments: Because there is no account requirement, bugs.php.net has effectively no moderation capabilities and suffers from hostile user comments. A particularly well-known quantity is Reindl Harald, who regularly insults bug reporters in comments, damaging the reputation of the PHP project.
- Impersonation: Apart from
@php.netaccounts, bug reporters and comments can specify an arbitrary email, ownership of which is not validated. This makes it trivial to impersonate another person. This capability is also used for hostile comments. On a related note, reporters are sometimes unhappy with the fact that bugs.php.net displays their email address in plain text. - Accessibility: Nowadays, most open-source projects manage issues on GitHub and users will look there first. Submitting an issue on a home-grown bugtracker comes with additional friction to learn a new bug reporting workflow and its associated quirks (and bugs.php.net is on the quirkier side there).
- Management of reported bugs: For bug reporters without a php.net account, managing their reported bugs is very inconvenient. Editing a bug requires a per-bug password, and you can't easily track all the bugs you have reported.
- Mentions: It's not possible to mention another php.net team member on bugs.php.net. The only way to ask someone's opinion on an issue is to assign it to them, and there can only be one assignee.
- Moving issues: We are currently in an in-between state where implementation bugs are on bugs.php.net, while documentation bugs are on GitHub. It is common that an issue originally reported as an implementation bug turns out to be a documentation problem. We currently cannot easily transfer such an issue to GitHub. It is valuable to have the issues for all sub-projects on one platform to allow this kind of seamless movement. (Of course, this problem did not exist before documentation started using GitHub issues.)
- References: We already host our source code repositories on GitHub and make heavy use of pull requests there. Hosting issues on the same platform makes it easier to cross-reference issues, pull requests and commits. While commits closing a bug are automatically linked from bugs.php.net, other references (e.g. from pull requests) are not visible on bugs.php.net unless they are manually added.
- Labels: Bugs only support specifying a single package, there is no capability to apply multiple labels. For example, we have no way to mark beginner-friendly issues (the “probably easy” label on GitHub).
- Check boxes: bugs.php.net does not support check boxes, or edits to the bug description. This makes it impossible to use bugs.php.net for tracking issues which consist of multiple sub-tasks.
Proposal
The issue tracker on GitHub will be located on the php/php-src repository. The necessary configuration and actions for the setup described in the following are available in a test repository.
Issue Creation Flow
Using a custom issue configuration, creating an issue will display three possible options:
Bug reports and feature requests are filed on GitHub with custom issue forms. Security issues point to bugs.php.net instead, because GitHub currently does not support private issue reports. Additionally, we could add a fourth option for general questions that points to our support page.
If the “bug report” option is chosen, the following form is displayed:
It requires an issue title, description and PHP version, and optionally accepts the used operating system. The description suggests (but does not require) providing a script with actual and expected output. Additionally, the labels “bug” and “Status: Needs Triage” are automatically applied.
The corresponding form for feature requests only accepts an issue title and description, as PHP version and operating system are usually not relevant in this case. The labels “feature” and “Status: Needs Triage” are automatically applied.
Triage and Categorization
Issues labeled with “Status: Needs Triage” should be reviewed by a member of the php-src team to check whether they are valid (at first glance) and properly categorize them. When the issue is triaged, the “Status: Needs Triage” label is removed and replaced by one or more categorization labels. There are three sets of these:
- “Extension: ext_name” correspond to bundled PHP extensions. For most extension-related issues, just adding the label for the corresponding extension is sufficient, e.g. “Extension: curl” for curl-related issues.
- “SAPI: sapi_name” correspond to bundled SAPIs. These should be added if the issue is directly related to the SAPI, e.g. “SAPI: fpm” should be used for FPM-related bugs. It should not be added if the reporter just happens to use this SAPI, but there is otherwise no direct relation.
- “Category: category_name” exists for categories that correspond either to a subset of an extension (e.g. “Category: JIT”) or represent cross-cutting concerns (e.g. “Category: Build System”). These might be applied in addition to or in place of an extension label.
The full set of initially proposed labels is given in the following, but additional labels can easily be added after the fact:
- Extension: bcmath
- Extension: bz2
- Extension: calendar
- Extension: com_dotnet
- Extension: ctype
- Extension: curl
- Extension: date
- Extension: dba
- Extension: dom
- Extension: enchant
- Extension: exif
- Extension: ffi
- Extension: fileinfo
- Extension: filter
- Extension: ftp
- Extension: gd
- Extension: gettext
- Extension: gmp
- Extension: hash
- Extension: iconv
- Extension: imap
- Extension: intl
- Extension: json
- Extension: ldap
- Extension: libxml
- Extension: mbstring
- Extension: mysqli
- Extension: mysqlnd
- Extension: oci8
- Extension: odbc
- Extension: opcache
- Extension: openssl
- Extension: pcntl
- Extension: pcre
- Extension: pdo (core)
- Extension: pdo_dblib
- Extension: pdo_firebird
- Extension: pdo_mysql
- Extension: pdo_oci
- Extension: pdo_odbc
- Extension: pdo_pgsql
- Extension: pdo_sqlite
- Extension: pgsql
- Extension: phar
- Extension: posix
- Extension: pspell
- Extension: readline
- Extension: reflection
- Extension: session
- Extension: shmop
- Extension: simplexml
- Extension: snmp
- Extension: soap
- Extension: sockets
- Extension: sodium
- Extension: spl
- Extension: sqlite3
- Extension: standard
- Extension: sysvmsg
- Extension: sysvsem
- Extension: sysvshm
- Extension: tidy
- Extension: tokenizer
- Extension: xml
- Extension: xmlreader
- Extension: xmlwriter
- Extension: xsl
- Extension: zend_test
- Extension: zip
- Extension: zlib
- SAPI: apache2handler
- SAPI: cgi
- SAPI: cli
- SAPI: cli_server
- SAPI: embed
- SAPI: fpm
- SAPI: fuzzer
- SAPI: litespeed
- SAPI: phpdbg
- Category: Arrays
- Category: Build System
- Category: Engine
- Category: Filesystem
- Category: JIT
- Category: Math
- Category: Streams
- Category: Strings
- Category: Windows
Members of the php-src team can adjust labels directly when submitting an issue, so they can bypass “Status: Needs Triage” and directly categorize the issue as appropriate.
Issue Statuses and other labels
GitHub only supports “open” and “closed” issues, so additional status information is handled through a number of labels:
- Status: Needs Triage. As discussed above, this is the starting state for all new issues. The label is removed after triage by a team member.
- Status: Needs Feedback. This label can be placed if additional feedback from the reporter has been requested. The label is automatically removed if the issue reporter adds a comment. If no comment is added within 14 days, the issue is automatically closed. This functionality is implemented using GitHub Actions workflows.
- Status: Verified. Indicates that a bug report has been reproduced and confirmed to be an actual bug.
- Status: Duplicate / Invalid / Won't Fix. These indicate that an issue has been closed without fixing it, because it is a duplicate of another issue, not a bug or will not be fixed/implemented.
GitHub has announced that they will add support for indicating whether an issue has been closed because it has been fixed or because it is in some way invalid. Once this functionality is rolled out, the need for the last set of status labels may go away.
Finally, the standard “good first issue” label can be used to indicate issues that are probably friendly to new contributors.
Referencing issues
Issues on GitHub can be referenced as #123 in the same repository or php/php-src#123 from a different one. A problem with the #123 notation is that it creates an ambiguity between the issue's ID on GitHub and old issue IDs on bugs.php.net, which can and will clash. This is not a problem for references in comments (where it is understood that #123 always refers to a GitHub issue or pull request, and references to bugs.php.net should be made with an explicit link), but is a problem for commit messages: Fixes #123 could refer to two different issues.
For this reason, it it proposed that GitHub issues should be referenced using GH-123 from commit messages, as well as the NEWS file, while bugs.php.net references should continue to use bug #123.
# NEWS file - Core: . Fixed GH-12345 (GitHub issue title). (Author) . Fixed bug #12345 (bugs.php.net bug title). (Author) # Commit messages Fixed GH-12345: GitHub issue title Fixed bug #12345: bugs.php.net bug title
The use of “Closes GH-12345” is already standard practice to close the associated pull request when manually merging.
A redirect from https://php.net/GH-12345 to https://github.com/php/php-src/issues/12345 should be set up as well, to make it easier to look up issues by GitHub ID.
Other
GitHub supports saved replies, which can be used to remember commonly used responses. Unfortunately, saved replies can only be configured per-user, it is not possible to specify a set of default responses for a repository. This may still be individually useful for people commonly performing triage.
GitHub also supports milestones, which we currently use to loosely track pull requests that should go into a certain PHP version. It would be possible to add all issues reported against a certain PHP version to the appropriate milestone, which would make the issues more reliably filterable by version. I do not propose to do this, because many issues are not version specific and their “affected version” is a moving target (usually lowest supported). However, release managers may find it useful to track issues relating to a new minor version in the pre-release phase.
Issues can be transferred to a different repository in the same organization, so it is possible to move issues between php/php-src and php/doc-en, if bugs or documentation problems are reported in the wrong place.
Migration of existing issues
Existing issues on bugs.php.net will not be migrated to GitHub issues under this proposal. While new (non-security) issues on bugs.php.net will not be accepted, commenting on old bugs will continue to be allowed for the time being, and bug reports should be made available in read-only form indefinitely.
If a bug is reported on GitHub issues which already has a report on bugs.php.net, then the bugs.php.net report should be closed as a duplicate of the GitHub issue and any valuable information from it briefly summarized there. Over time, bugs that still exist and are still relevant will converge to GitHub issues.
We do not attempt to perform a mass migration for two primary reasons: First, the vast majority of old bug reports are not relevant to active development. It is important that historical reports remain available, but importing a copy of them into GitHub is not particularly helpful, especially as references in commits and tests will use the bugs.php.net ID, not the GitHub issues ID. It might make some sense to import open bugs only, though even there a large fraction will not be relevant to active development.
Second, there are large mismatches in capabilities and usage between bugs.php.net and GitHub issues, so that imported issues tend to have cluttered presentation and timelines. For example, this is how an imported issue in the Go repository looks like: https://github.com/golang/go/issues/1691
bugs.php.net
Per the above, bugs.php.net will remain active for the following purposes:
- Reporting of security issues against PHP.
- Commenting/updating on existing issues.
However, the following will no longer be accepted:
- Reporting documentation problems. (Already disabled.)
- Reporting of issues against PECL extensions. (Extensions should have their own issue tracker. Most of them already track issues on GitHub, not bugs.php.net.)
- Reporting non-security issues against PHP.
It may be possible to migrate security issues to GitHub as well, by making of use of the security advisories feature. However, larger changes to the handling of security issues should be decided within the security response group, and as such are considered out of scope of this proposal.
Alternatives
The switch to GitHub issues has two primary disadvantages:
- It binds the PHP project more firmly to the GitHub platform. We already host our repositories there and make use of pull requests, but this would take additional functionality “out of our control”. Of course, that is also kind of the point: We are bad at maintaining critical infrastructure ourselves and would rather someone else took care of it. Someone for whom it is part of their core business, rather than just a necessary annoyance.
- GitHub issues is not a particularly sophisticated issue tracker solution. While it offers many useful features that bugs.php.net does not, it is also less customizable. For example, there is no support for custom metadata on issues beyond standard features like labels or milestones (though there probably will be in the future).
The three possibilities going forward are essentially:
- Keep using bugs.php.net, but invest significant effort into improving it. I expect that at a minimum we would have to require account registration to use bugs.php.net (for reporting or commenting).
- Migrate to GitHub issues as proposed by this RFC.
- Migrate to a different issue tracking solution.
Of course, the suggestion to use GitHub issues in particular is not an accident:
- We already host repositories there and use pull requests (and use it for documentation issues). Having everything on one platform allows everything to integrate smoothly. Cross-references work everywhere out of the box. Other platforms will likely not be able to offer the same level of integration.
- GitHub has become the industry standard for open-source projects. Anyone with involvement in open-source is very likely to have an account there and be familiar with the main workflows. Using a different platform will likely require people to create a new account, learn the quirks of yet another issue tracker and have one more place to check for progress on reported issues.
The requirement for an alternative would be that a) it is hosted (i.e. the PHP project does not need to maintain infrastructure for it), b) has good GitHub integration and c) is “sufficiently better” than GitHub issues to make it worth using a separate product. As PHP does not have a particularly sophisticated issue tracking workflow, I'm doubtful that the tradeoff will be worthwhile. The biggest “advantage” of using a separate product is likely that it will make reporting bugs significantly harder for the casual user, which might make low-quality submissions less likely.
Vote
Voting started 2021-11-20 and ends on 2021-12-04.