Update project landscape

[mindthegab]

The FINOS landscape is based on a very old version of the now much updated CNCF landscape (https://landscape.cncf.io/).

It would be important as a part of this task to:

• Update landscape to be based on upstream (either as a dependency or as a fork periodically updated)
• Embed the landscape on the FINOS website
• Add FINOS labs projects in a separate tab of the landscape

Thoughts @maoo @TheJuanAndOnly99 @opoupeney @finos/toc ?

[maoo]

We investigated this a while ago (q3 2024), together with the v1 and v2 maintainers, and we were advised to wait, since the new version was not stable enough; I'm supportive of this, as it would probably make our life easier, while delivering a better results in terms of UI/UX.

Commenting on your points...

Update landscape to be based on upstream (either as a dependency or as a fork periodically updated)

I guess you mean to switching to v2, right?

Embed the landscape on the FINOS website

Agreed. When you say "embed", I guess you mean an iFrame (with clickable content) rather than a JPG/PDF rendering, correct?

Add FINOS labs projects in a separate tab of the landscape

Agreed, but this relies on the contents of https://github.com/finos/finos-landscape/blob/master/landscape.yml , which is currently manually edited by @TheJuanAndOnly99 whenever is needed. FINOS Labs would add a lot of manual operations, if we keep using this approach, and I don't think it would be feasible, unless we only select some finos labs repos/projects to expose.

Questions here are:

• Do we want to integrate the landscape with LFX PCC in order to avoid any manual maintenance/syncing between landscape and PCC ?
• Do we want to use PCC also for labs projects? Or do we want to manually manage the labs entries of the landscape?

In general, I think it would help a lot to know who from LF can help us navigating the feasibility of this; maybe it would be a good start to open an issue on https://github.com/cncf/landscape ?

[jmertic]

I can certainly help with the LFX PCC integrations; we have tools used across many of our projects that immensely help here.

[mindthegab]

@maoo I'll let you figure out the internal implementation details (recommend to continue that conversation internally). I think you need to sync with @opoupeney first and foremost because you have outdated information on our LF contacts and approach.

And your questions, again, please come back to this issue only with updates relevant to the community on this issue, while we can discuss internally best path forward.

For the record, by embed I ideally would mean something like that https://www.cncf.io/projects/ (not sure if it's an iframe, but doesn't look like) - i.e. single sourcing given that we have a machine readable description of our projects. Again, let's look at internal best practices.

[opoupeney]

As all projects are under the same organization, it is today not possible to define repositories at the project level. A support ticket has been submitted to request the change (there is a property that let a project to share the org to child projects but this does not work). Once the bug will be corrected, the project landscape automation will be able to be setup.

[eddie-knight]

@opoupeney would it help if you harnessed security-insights.yml files to allow projects to manage their own documentation of repo locations for this?

The file is already required for LFX Insights Security & Best Practices scans, which we'll be using as part of TOC health checks later this year (they even provide a helper form for filling in the details).

The schema has a field for documenting the sources for multi-repo projects. Here's an example: https://github.com/ossf/security-insights/blob/main/examples/example-multi-repository-project.yml#L23-L30