Add log of mainatiner level changes to project pages and provide notice when the Project Ownership queue adds/promotes a user

Relevant quotes from https://drupal.slack.com/archives/C2AAKNL13/p1715712783335239:

Is there a message on the project page that displays when a maintainer has switched? If not, perhaps a "the maintainers of this module has changed recently" message could be helpful.

-- Joe GL

Or more sophisticated approach - maintainers history - where all maintainers changes will be logged and displayed (with dates, etc). And you can easily check, when someone was added, removed, changed permissions and so on.

-- Juraj Nemec

FWIW each project has

https://git.drupalcode.org/project/diff/activity

And all projects master feed:

https://git.drupalcode.org/groups/project/-/activity

Click Teams tab at the top of each

Data is also available on the API

I will agree that the GitLab activity feed provides some data.

I will note a couple activities that are the GitLab API may not provide data for:
Change of a maintainer to owner will not report a permission change as they hold the same level in GitLab.
Adding a new user to owner will report the same as adding a maintainer.
There is no easy way to determine if it was Project Ownership that added the user except to assume if its one of the 'known' queue admins that performed the action (and that they joined/left the project in rapid succession) that it may have been project ownership queue.

Not to complexly discount it, the activity stream is useful, there are just a few edge cases it may not be able to capture.

IMHO, the peer review of the code committed to a project is much more important to discover supply chain attacks than the proposed highlighting the log of maintainer level changes.

Of course, implementing this highlighting wouldn't do any harm, but resources is always in short supply, and any benefit this proposed measure might bring will probably not be worth the expense of implementing it.

But if anyone wants to donate resources to implement what is sought here, please go ahead!

It has been an ongoing regret that when I very first implemented the project level permissions and maintainers tab on d.o, that I didn’t build this into it from the beginning. 😢 Completely aside from the supply chain aspects and whether end users would care to see it, simply for the benefit of d.o site admins to figure out WTF is going on in various conflicts and disagreements that have come up, it would have been incredibly handy.

Also note that while issues are planned to migrate to GitLab, AFAIK, the long term plan is to keep both project nodes and releases on d.o. So the fact GitLab has a feed for some useful things doesn’t solve that the historical view of changes to the “maintainership” is lacking and would be useful, even outside the scope of the parent meta.

There’s probably an issue somewhere in the GitLab migration family of issues about how to keep project-level permissions in sync between the two worlds, but I don’t have a handy link. And yeah, the two have different models and not all perms cleanly map back and forth. It’s an unfortunate situation. If only 17 years ago me knew what I know now. 😂