Proposal: invite contributors to the LibreSign organization after their first merged PR

Context

We would like to discuss a simple policy to recognize contributors and make it easier for them to feel part of the LibreSign community.

Proposal

After a human contributor has their first pull request merged in any official LibreSign repository, LibreSign would invite them to join the GitHub organization as a regular member.

Organization membership would represent participation in the community.

It would not automatically grant:

• write or merge permissions;
• CODEOWNERS status;
• membership in the maintainers team;
• repository administration permissions.

Privileged access would continue to be managed separately through teams and repository roles.

Membership can also make it easier to grant specific responsibilities later, such as participating in reviewer teams or receiving repository permissions, when appropriate. These permissions would still require a separate decision and would not be granted automatically with organization membership.

Bots and automated accounts would be excluded.

Implementation

If accepted, this should be implemented once for the organization, not independently in every repository.

The automation should:

PR merged
   ↓
human contributor?
   ↓
already a member or has an active pending invitation?
   ↓
invite as organization member

The implementation should follow least privilege and avoid distributing powerful credentials across repositories.

The technical implementation should be handled in a separate issue or pull request after this policy is accepted.

Documentation

If accepted, the canonical policy should be documented on docs.libresign.coop.
Repository CONTRIBUTING.md files should remain useful as entry points, but organization-wide contributor and governance policies should link to the canonical documentation instead of being duplicated across repositories.

Community consultation

Please use reactions on this issue:

• 👍 if you support the proposal;
• 👎 if you do not support it.

If you disagree with part of the proposal, see a risk, or prefer another approach, please leave a comment explaining why.

Reactions will help us understand community sentiment, but this is not intended to be a simple majority vote. Important technical, security, governance, and maintainability concerns should also be considered.

This consultation will remain open until September 25, 2026.

After that period, maintainers should publish a short summary of the discussion and the final decision.

Questions

We would especially like feedback on:

1. Is one merged pull request a good threshold for organization membership?
2. Should membership represent community participation while maintainer permissions remain separate?
3. Should this apply to every official LibreSign repository?
4. Should this policy and related contributor documentation live primarily on docs.libresign.coop?

Start with the proposal and its consultation questions in issue #8360, then review the reactions and any discussion before the September 25, 2026 deadline. Done means maintainers publish the discussion summary and final decision, with the accepted canonical policy documented on docs.libresign.coop; technical automation is explicitly deferred to a separate issue or pull request.