Project Management
Project Management covers how open source projects are governed, planned, released, and kept legally clean - the processes around the code, not the code itself.
Roles and governance
Contributors submit changes; reviewers or committers approve them; maintainers set direction and hold merge rights. Governance ranges from BDFL (one decisive leader) through meritocracy to foundation-hosted projects (Apache Software Foundation, Linux Foundation), where a neutral body holds trademarks and assets. Decisions usually run on lazy consensus or an RFC process and are recorded publicly; the ultimate check on any decision is a fork.
Planning and releasing
- A roadmap states direction; a release plan states dates and scope. Issues move through triage, acceptance, work, and closure, grouped by milestones.
- Semantic Versioning: MAJOR.MINOR.PATCH - a breaking API change bumps MAJOR, a backward-compatible feature bumps MINOR, a bug fix bumps PATCH. Pre-1.0 releases make no stability promise.
- Maintenance branches receive backported fixes; LTS releases publish a support window and an EOL date.
- Quality gates: review before merge, CI tests, documentation, and a curated changelog.
Legal hygiene
Inbound licensing uses either a DCO sign-off (the contributor certifies the right to submit under the project license, inbound=outbound) or a CLA (broader rights, including relicensing). Projects also keep SPDX headers, scan dependency licenses, publish a trademark policy, and adopt a Code of Conduct with enforcement contacts.
Worked example
A library at 3.2.1 deprecates a function and later deletes it. Because the public API breaks, the release must be 4.0.0. The deprecation should appear in the 3.x changelog and warn at runtime for at least one minor cycle. Shipping the deletion as 3.3.0 would break every downstream dependency pinned to ^3.3 - a semver violation that costs the project trust.
Traps
- Using version numbers as marketing rather than compatibility signals.
- Assuming maintainers are paid, or that a roadmap is a contract.
- Merging unreviewed changes or accepting patches without provenance checks.
- Deciding in private channels so no public record exists.