--- title: "What’s Next: Open Source Programs, Docs, and SBOMs" date: 2026-08-17 author: "Courtney Robertson" featured_image: "https://courtneyr.dev/wp-content/uploads/2026/08/Open_Source_Advocacy_Professional_Portfolio-scaled.png" categories: - name: "WordPress" url: "/category/wptips.md" tags: - name: "developer relations" url: "/tag/developer-relations.md" - name: "instructional design" url: "/tag/instructional-design.md" - name: "open source program management" url: "/tag/open-source-program-management.md" - name: "SBOM" url: "/tag/sbom.md" - name: "wordpress" url: "/tag/wordpress.md" --- # What’s Next: Open Source Programs, Docs, and SBOMs July 24 was my last day at GoDaddy. I would rather write about what comes next than about what ended, so that is what this post does. I spent five years at GoDaddy. I directed the WordPress open-source program there from its start, decided which foundations and projects received the company’s open-source funding, and built developer and customer enablement content around both. I am grateful for that run, and for the colleagues who made it work. Now I am looking for the next role. My [resume](https://courtneyr.dev/about-courtney-robertson/courtney-robertson-resume/) has the full picture. ## What I directed at GoDaddy My job sat at the seam between product teams and the open source projects they depend on. Concretely: - **Sponsored contribution at scale.** I stood up GoDaddy’s [Five for the Future pledge](https://wordpress.org/five-for-the-future/pledge/godaddy/) and ran it for its whole life. As of the company’s January 2025 [announcement](https://aboutus.godaddy.net/newsroom/news-releases/press-release-details/2025/GoDaddy-Donates-500K-to-Support-WordPress-Community/default.aspx), the program sponsored 46 contributors across 17 WordPress teams, with 255 pledged hours per week — the second-largest contributor by people in the program and third by pledged hours. - **Funding decisions.** I chose which projects and foundations received GoDaddy’s open-source funding, then made the case internally to keep it funded. That included $520,000 to [The WPOCC](https://thewpocc.org/), $40,000 to the [W3C](https://www.w3.org/), $24,000 to the [PHP Foundation](https://thephp.foundation/), $12,000 to [PHP\_CodeSniffer](https://opencollective.com/php_codesniffer), support for the [OpenJS Foundation](https://openjsf.org/), and annual live captioning for the [WordPress Accessibility Meetup](https://equalizedigital.com/wordpress-accessibility-meetup/). I wrote the [resources post](https://www.godaddy.com/resources/news/supporting-open-source-contributors-and-wordpress) that announced it. - **Release readiness with the infrastructure team.** When WordPress core needed hosts to test features at scale, I identified what needed testing and put it in front of GoDaddy’s site reliability engineers. For [WordPress 7.0](https://www.godaddy.com/resources/news/wordpress-7-0-real-time-collaboration-arrives-in-core), our load testing of real-time collaborative editing fed straight back into core, and that host feedback was part of why the feature was held out of the release rather than shipped and then rolled back. I later turned that approach into a public method, [wp-release-audit-method](https://github.com/courtneyr-dev/wp-release-audit-method), so anyone can test a Beta or RC in a way that produces evidence rather than a shrug. - **Customer advocacy inside the company.** I carried WordPress customer problems to the people who could fix them across product, support, and hosting, instead of letting them sit in a forum thread. - **Enablement content.** I wrote and produced the WordPress material GoDaddy customers actually read at release time, including the 7.0 coverage linked above. I also wrote and hosted the Airo AI Builder video tutorials on the Inside Airo AI Builder channel — for example, [How to Replace, Upload, and Manage Images in Airo AI Builder](https://www.youtube.com/watch?v=uXK9w7qUq5Y) — and built a [prompt library](https://promptlibrary.c36.airoapp.ai/) that teaches Airo users how to prompt well, because a tool that takes natural language is only as good as what people know to ask it for. ## Open source programs are where I do my best work Four strengths show up in every role I have held, going back to my classroom years. ### I connect people I introduce maintainers to sponsors, learners to mentors, and product teams to the contributors who will tell them the uncomfortable truth. That work rarely lands in a dashboard, so I learned to measure it instead: contributor retention, sponsorship renewals, and how often a conversation turns into merged code. ### I direct open source programs Running a program means handling four things at once: contributor time, sponsorship dollars, project governance, and the reporting that keeps the first two funded. I am a co-founding board member of [The WPOCC](https://thewpocc.org/), formerly The WP Community Collective, and I contribute to [FAIR.pm](https://fair.pm/) at the Linux Foundation on cross-CMS translation and documentation infrastructure. Governance is not a side interest for me. It is the part most companies skip until it hurts. ### I work on software supply chain transparency I contributed to the CISA community white paper [Software Transparency in SaaS Environments](https://www.cisa.gov/resources-tools/resources/software-transparency-saas-environments-0), produced through the SBOM Cloud and Online Applications working group. The paper maps SBOM concepts onto software you subscribe to rather than install, which is the case where you cannot inspect the build yourself. That problem lies at the intersection of dependency management, procurement, and security documentation, and I want to spend more time on it. ### I design instruction for developers Before developer advocacy, I taught computer science and business in inner-city, rural, vocational, and bootcamp settings. I was the WordPress Training Team representative when [Learn.WordPress.org](https://learn.wordpress.org/) launched, which moved the project from no official training at all onto a pathway toward certification. I build curriculum the way I build docs: define the outcome, sequence the practice, then check whether anyone actually learned it. ## What I build on my own time I care about an open web where people own what they publish, so that is what I build when nobody is asking me to. [Outpost](https://github.com/courtneyr-dev/outpost) is a mobile-first progressive web app composer for IndieWeb POSSE publishing. It runs on Micropub and IndieAuth, which means you can post to your own site from your phone without handing authentication to a third party. Three smaller plugins work with it, and Outpost detects them at runtime and adds composer modes as you turn them on: [Post Kinds for IndieWeb in Block Themes](https://github.com/courtneyr-dev/post-kinds-for-indieweb/), [Post Formats for Block Themes](https://github.com/courtneyr-dev/post-formats-for-block-themes/), and [Link Extension for XFN](https://github.com/courtneyr-dev/link-extension-for-xfn/). None of them is large. Together they let a block theme handle the post shapes [IndieWeb](https://indieweb.org/) people actually publish. ## Why supply chain transparency comes next Three things converged while I was doing this work, and together they explain where I am aiming. First, the regulatory clock started. The EU Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities and severe incidents [beginning September 11, 2026](https://digital-strategy.ec.europa.eu/en/policies/cra-reporting), with an early warning within 24 hours and a full notification within 72 hours. Broader conformity obligations follow in December 2027. You cannot report what you cannot see, so SBOM practice stops being theoretical this fall. Second, the same problem arrived for models. [CycloneDX now represents models, datasets, and their dependencies](https://cyclonedx.org/capabilities/mlbom/), so teams can review provenance and training data the way they already review packages. Procurement teams are starting to ask vendors for that inventory by name, and the OWASP AIBOM work is pushing toward a common shape for it. Third, open source projects absorb the paperwork. Volunteer maintainers now field compliance questions from enterprises shipping their code. Somebody has to write the documentation, teach the practice, and sit in the working groups where the rules get set. That is a documentation job, a curriculum job, and a governance job at once. I have done all three. ## What I am looking for I am open to full-time roles, and available for contract work while I search. Titles that fit: - Open source program lead or OSPO director - Developer educator, instructional designer, or technical curriculum lead - Technical writer or documentation lead, especially where docs serve both people and retrieval systems - Developer relations, community, or program director The environments where I do my best work: hosting and developer tool companies, foundations and nonprofits, higher education, and any team whose users are more comfortable in a CMS than a terminal. I am in Chambersburg, Pennsylvania, on Eastern time, and I work well remotely. I travel for work roughly 15% of the time, and I am comfortable holding that pace. ## How you can help 1. **Make an introduction.** If your company or one you trust is hiring in the areas above, I would rather start with a name than an application form. 2. **Share this post.** A repost from someone who has worked with me carries more weight than anything I say about myself. 3. **Tell me what is missing.** If you read my [resume](https://courtneyr.dev/about-courtney-robertson/courtney-robertson-resume/) and something does not land, say so. I would rather fix the pitch than keep sending it. [Contact me](https://courtneyr.dev/contact/), or find me on [LinkedIn](https://linkedin.com/in/courtneyr-dev/). I am still contributing to open source in the meantime, because that work does not stop when a job does.