coreinfrastructure / best-practices-badge

🏆Open Source Security Foundation (OpenSSF) Best Practices Badge (formerly Core Infrastructure Initiative (CII) Best Practices Badge)
https://www.bestpractices.dev
MIT License
1.22k stars 202 forks source link

`contribution_requirements` perhaps needs an N/A? #2040

Closed ljharb closed 1 year ago

ljharb commented 1 year ago

On https://bestpractices.coreinfrastructure.org/en/projects/6288, the author wrote:

At this point we aren't expecting any contributions, this project is perfect if it doesn't change any more. It is also mentioned on the website "Just use Array.isArray directly, unless you need to support those older versions.", marking this as a legacy compatibility project. I wouldn't know what kind of contributions to write documentation for.

What should a project do here when it's "done"? Note that this is a success state for a project, and it doesn't seem super useful to add a CONTRIBUTING.md that says "no contributions". What do you recommend?

david-a-wheeler commented 1 year ago

To me, having a CONTRIBUTING.md file that says "We don't expect to accept contributions because XYZ" is really useful! If I was thinking about contributing to a project, I'd check the CONTRIBUTING.md file early on, and that information would give me really important information. I think others would do the same.

So I think a CONTRIBUTING.md file that says that they do NOT expect to accept contributions is still useful and thus isn't really an N/A.

What do you think?

ljharb commented 1 year ago

I suppose that's a viable option; I'll run it by the author.

juliangruber commented 1 year ago

I agree that setting expectations can't harm. I had thought having no contributing.md is doing that as well, however being explicit about it is more useful.

TonyLHansen commented 1 year ago

To me, the lack of a contributing.md file indicates that they haven't really thought through how to accept contributions. So yes, to me, an explicit contributing.md file saying the project is done is much better.

ljharb commented 1 year ago

Thanks, sounds like this is answered.