docs: update governance to allow long-term contributors to be nominated as committers and captains

[bjohansebas]

This is my attempt to make nominations more sustainable and to give Express a less bureaucratic and time-consuming process. For example, this could apply to jshttp packages or others with low activity, or cases where a package captain is somewhat inactive but another community member wants to help.

The rationale is that there are already people outside the TC who have been involved in the project for a long time (some are package captains, others are committers) and they’ve already demonstrated both their technical ability and their capacity to collaborate. This would help keep Express relevant, ensure packages continue to be maintained, and avoid everything falling on just a few TC members.

cc: @expressjs/express-tc

[ctcpip]

I think we should do something stronger than this, and create a new role that is a level above committer. "Collaborator" maybe?

Regardless of what we call it, the idea would be that collaborators would have write access across all repos.

I am less comfortable with the current language of the proposed change to be eligible for captain of a package. To have someone that has not contributed at all to a package suddenly become a captain seems somewhat odd to me. However, the approval is still gated by the TC, so perhaps is ok. I would also feel better about it if the approval requirement was strengthened, e.g. requiring actual TC consensus rather than it simply being gated on a PR. (This is something that maybe should change regardless.)

[bjohansebas]

I think we should do something stronger than this, and create a new role that is a level above committer. "Collaborator" maybe?

I like that, but I’ll handle it in another PR since it’s different from what I’m proposing.

To have someone that has not contributed at all to a package suddenly become a captain seems somewhat odd to me.

Would it also be considered odd if a TC member wanted to become a captain of a package they haven’t contributed to? For example, if I wanted to be a captain/committer of the router, would that be strange even though I’m a committer on the Express package and the router is directly tied to Express, so I naturally understand how it works?

I would also feel better about it if the approval requirement was strengthened, e.g. requiring actual TC consensus rather than it simply being gated on a PR

Doesn’t that already exist? If we wait to discuss it in a meeting, it’s going to take quite a while, we already wait at least two weeks. If after two weeks not everyone from the TC has been able to review it, but some members have and they’re okay with it, then why wait for the rest? Let’s avoid the bus factor and trust each other.

I understand that with all the supply chain attacks there’s concern about granting access to npm packages, but many people who are no longer in the TC already have access to important parts of the project, like the website or security reports.