docs: Document Isso Project Infrastructure

[ix5]

Checklist

• All new and existing tests are passing
• (If adding features:) I have added tests to cover my changes
• (If docs changes needed:) I have updated the documentation accordingly.
• I have added an entry to CHANGES.rst because this is a user-facing change or an important bugfix
• I have written proper commit message(s)
  

What changes does this Pull Request introduce?

Try to codify the new reality of the project since Martin stepped down and make sense of all the informal or mostly-one-off processes we are currently running.

I've also created isso-demo-config and isso-marketing-material as well as linked ansible-role-isso to coincide with this PR.

Why is this necessary?

Brought about by recent events, I thought about the nature of maintainership a bit and realized that we have a) a pretty significant bus factor and b) our infra could be a bit opaque to newcomers. Collecting all the information and writing it down in one place also might help highlight a few blind spots and areas for improvement.

[jelmer]

Deleted

[posativ]

LGTM, I just checked PyPi and @blatinier has the Maintainer role, do we need to change this? Is there any point to making an organization on PyPi?

[jelmer]

LGTM, I just checked PyPi and @blatinier has the Maintainer role, do we need to change this? Is there any point to making an organization on PyPi?

I think organizations are still an experimental feature that needs to be requested and are hard to get.

[ix5]

LGTM, I just checked PyPi and @blatinier has the Maintainer role, do we need to change this? Is there any point to making an organization on PyPi?

Mainainer role is sufficient for releases afaics. Also seems that Benoit is no longer much (if at all) involved with the project.

I think organizations are still an experimental feature that needs to be requested and are hard to get.

Yes, also I don't immediately see the added benefit of that feature for us.

We might investigate using the "Publish from GitHub" feature (direct link: "Trusted Publisher Management" for isso). That might simplify releasing new versions further, since we already publish docker images on any git tag.

OpenID Connect (OIDC) provides a flexible, credential-free mechanism for delegating publishing authority for a PyPI package to a trusted third party service, like GitHub Actions.

PyPI users and projects can use trusted publishers to automate their release processes, without needing to use API tokens or passwords.