Why is the reviewer/moderation capacity so limited, and why can't the community help more?

[Kirill638849776 [EscapetheCats] (Kirill638849776)]

Hi everyone,

I've submitted a few PRs recently and noticed that the review and merge process can be quite slow. I understand this is a massive repository and the team is small, but after reading the moderation docs and previous discussions, I have a few questions:

1. Why are there so few active reviewers/admins? I saw a discussion from earlier this year mentioning that only a handful of people have merge rights, and that weekends are especially quiet. Is this still the case, and is there a plan to expand the team?

2. Why not use bots more actively? I know there's already automated validation and wingetbot, but could bots handle simple cases (like version-only updates) so humans can focus on complex packages?

3. Why is it so hard to become a reviewer? Moderation.md says it's by nomination only, "like becoming an MVP," and there's no application process. I get that quality matters, but it feels like there's no clear path for community members who want to help reduce the backlog.

I'm not complaining about any specific PR — I genuinely want to understand the reasoning behind these decisions and see if there's a way the community can contribute more effectively. Thanks for any insights!

[KarbitsCode (KarbitsCode)]

2. Why not use bots more actively? I know there's already automated validation and wingetbot, but could bots handle simple cases (like version-only updates) so humans can focus on complex packages?

Well, that's what Stephen Gillie (@stephengillie) is, he is basically a half-bot half-human account and he's already dealing and merging new version updates ( New-Manifest The pull request adds new manifest content to the repository. PRs) quite fast as long as no hiccups from the validation pipeline. The New-Package The pull request adds the first version of a package to the repository. PRs are the ones that have to be a bit more manual as far as I know.

I've also noticed that there seem to be more New-Package The pull request adds the first version of a package to the repository. PRs lately than ever before, so it might be why it keeps piling up to >4k now.

[Stephen Gillie (stephengillie)]

With 2427 "Greenlit" New-Package The pull request adds the first version of a package to the repository. PRs, of 4419 total packages, the repo is about 57% these:

(edit: typo)

[Demitrius Nelon (denelon)]

We're actively working on additional automation. Several new workflows have been added to detect issues, and to post comments on PRs. Those are mostly known points of failure. The real challenge is evaluating new submissions to make sure they align with our repository policies. Some of this can be automated in a way to help make it more effective. Some of it still requires human interaction.

1. There is a difference between "merge rights" (Microsoft team) and "moderation rights" (Moderators). As our moderators are all volunteers it's up to them to determine how much time they are willing to spend. I'd love to have more help on both sides. The hard choice is whether to have folks from Microsoft either work on automation or manual validation. Until the "known classes of problems" have all been addressed, I've been indexing on the automation side of things.

2. I use bots extensively as well as many other folks, but as we all know they aren't perfect. It takes time to run through enough iterations to build and tune them to behave more like a heuristic algorithm. I've found them particularly effective at going through larger amounts of data / web search to validate URLs and compare descriptions and source code against a manifest. That helps reduce the human time, but at the end of the process, it's still a judgment call. We will be adding more of this type of workflow to the process.

3. We welcome community assistance. Helping PRs get ready for "moderation" is the best way to signal interest and help out. Generally speaking, when a PR only has "Azure-Pipeline-Passed" and "Validation-Completed" along with the "New-Package" or "New-Manifest", it's ready for moderation. Those labels are the result of automated validation with a success result. When we see folks joining in to help with the problem, we notice. When those folks have demonstrated a sufficient understanding of the product and our processes (and they have demonstrated alignment with our Code of Conduct), we start considering them for moderation. Plenty of folks have the technical ability. Not as many understand the impact of a sub-optimal installer, or the blast radius associated with creating range overlaps, duplicate package entries, intellectual property violations, etc.

I truly appreciate the willingness to help, and I just went through our documentation and noticed there isn't something documenting a path. I'll reach out to a few of our moderators to see what we can come up with.