coreinfrastructure / best-practices-badge

🏆Open Source Security Foundation (OpenSSF) Best Practices Badge (formerly Core Infrastructure Initiative (CII) Best Practices Badge)
https://www.bestpractices.dev
MIT License
1.22k stars 202 forks source link

Badge status not updating on GitHub #2053

Closed Jbranadev closed 1 year ago

Jbranadev commented 1 year ago

About 3 days ago my project got the approval badge, this in my project displays as in progress image

whereas if I display it in a .html file, if it displays that it has the this passing

image

Jbranadev commented 1 year ago

The badge is

OpenSSF Best Practices

david-a-wheeler commented 1 year ago

I'm very sorry about this problem. Can you give me more information so I can track it down? In particular, What is the URL of the badge icon link that is NOT getting properly updated? Does it use https://bestpractices.coreinfrastructure.org/projects/7791/badge or https://www.bestpractices.dev/projects/7791/badge?

When I directly view it through: https://www.bestpractices.dev/projects/7791/badge I see the correct status (100% passing). That doesn't mean there's no problem. In fact, someone else reported the same problem after we moved domains. In their case a forced reload fixed it, but that's not a proper fix.

For context: We use Fastly as our CDN; we expressly tell Fastly about updates, and they are remarkably fast about doing the update. We just switched domains. That shouldn't matter, but the list of things that "shouldn't matter but do anyway" is very long. I suspect that Fastly is somehow not getting the update. Any info you could give me to help track down the problem would be greatly appreciated.

Jbranadev commented 1 year ago

Hi, I use https://www.bestpractices.dev/projects/7791/badge, I hadn't considered using https://bestpractices.coreinfrastructure.org/projects/7791/badge, but I see that there are projects like apache commons lang that use the latter, I think I could update my Readme.md using the latter and check if it updates correctly

david-a-wheeler commented 1 year ago

Hi, I use https://www.bestpractices.dev/projects/7791/badge, I hadn't considered using https://bestpractices.coreinfrastructure.org/projects/7791/badge ...

You're using the recommended URL https://www.bestpractices.dev/projects/7791/badge. We're also redirecting https://bestpractices.coreinfrastructure.org/projects/7791/badge for people who use the older URLs. Both should work. However, knowing which one doesn't reliably work helps me debug.

Thank you very much for reporting this. I'm hoping it'll be easy to diagnose and fix. It's probably trivial to fix once diagnosed, but diagnosis can sometimes be tricky. Stay tuned, I guess :-). If you have a hypotheses or more info I'm always happy to hear them!

david-a-wheeler commented 1 year ago

Hmmm, I think I've found it. I think it's a race condition that only matters if we also have problems sending an email. Well that is annoying. I will need to do a short guru meditation. We probably should probably be more gracious in general when we have problems sending an email.

Jbranadev commented 1 year ago

Thank you very much for following up, I will be attentive to your updates, I thank you in advance for the support provided and I am sorry if perhaps my vocabulary is not so fluent, English is a little difficult for me.

I updated my Readme.md file and I was able to see what it mentioned in the first comment you made, I will update it again with the new link that you recommend and I will be attentive to your updates, thank you very much

david-a-wheeler commented 1 year ago

I know what needs doing but it will take a little time to fix.

In the meantime, I've temporarily lowered the CDN badge cache time to 10 minutes (BADGE_CACHE_MAX_AGE=600) instead of 10 days. That way, even if the badge is not updated in our CDN cache (as it should be), it will be updated 10 minutes later. That should significantly reduce the impact of the bug until we fix it.

david-a-wheeler commented 1 year ago

By the way, please do use https://www.bestpractices.dev/projects/7791/badge. The ".dev" domain is our new domain and we'd like people to use it!

david-a-wheeler commented 1 year ago

The badge configuration has changed so failed emails don't cause failures on badge updates. We also fixed the failing emails in the first place.

I've changed BADGE_CACHE_MAX_AGE=86400 - so if all else fails, obsolete badge images will update in 1 day.

I'm calling this fixed.