We now mirror GitHub PRs into Gerrit. Gerrit is still our upstream Git server. Gerrit is still where we do reviews and press the "Merge" button. (And once merged, it gets mirrored back to GitHub)
But now we have a bot that slurps PRs into Gerrit and syncs comments back and forth and closes PRs when needed. (We'll do more fine-grained comment sync in the future. We just shipped an "MVP" for the Go 1.11 tree opening).
Some more information is at https://golang.org/wiki/GerritBot
Code is at https://github.com/golang/build/blob/master/cmd/gerritbot/ge...
Clarifying that I believe that my personal off work time is valuable to myself. The more time and friction I have to spend putting in a pull request/code review is the less time I get to myself.
I have first hand information from two projects (one of them large) that contribution, apart from drive-by doc fixes, does not increase.
Meaningful contribution decreases, because existing devs leave or become inactive because of GitHub.
A lot of projects moving to GitHub are in the Gervais-principle stage.
For security, mostly. Our isolation is good but not perfect.
We could probably do a smaller set of (secure) builders for all patches, but it hasn't been a priority.
I'm really only a dabbler in Golang, so would appreciate any context.
For instance I was affected by the recent go-bindata owner change[1]. The Github user deleted their account and some random user reregistered the original user's name and recreated the repo (albeit seemingly innocently to help everyone get their CIs running again).
Actually while we're on the subject, Golang's whole package management experience is surprisingly disappointing :/
[1]https://www.reddit.com/r/golang/comments/7vv9zz/popular_lib_...
OG gophers vendor their deps into their repo and avoid creating dependencies on 3rd party code whenever possible. The Go stdlib is very full featured so it is not unrealistic.
The problem with the go-bindata could be avoided by always vendoring/forking your deps and never trust any VCS provider (e.g. GitHub, Bitbucket, source forge) to handle your critical dependency needs.
The Gopkg.toml/Gopkg.lock files in dep are quite similar to Rust's Cargo.toml/Cargo.lock files. I think it's a good move as Rust has probably the best package management story out there.
Also, as the other comment mentioned, github.com is not "special" in any way. Any website with a git repo will work just as well. In fact, some key libraries are served from golang.org/x/<whatever>[2] not github.com.
[1]https://github.com/golang/dep [2]https://github.com/golang/go/wiki/SubRepositories
Anyone who vendored, or at worst kept a local copies of their dependencies littered all over their machine somewhere would have been fine.
Hopefully they can do something about getting rid of Google groups now. It's an extraordinarily poor organ of record. The low-friction Github issue tracker is full to bursting with high-ranking results for things that amount to support requests, but the pat response is a slightly-too-curt "ask this on golang-nuts, closed, kthxbye", and that's where the trail ends.
