search

node-red / node-red-dev-cli

Command-line tool for Node-RED Node authors
Apache License 2.0
7 stars 5 forks source link

False 'bugs' verification #22

Open Paul-Reed opened 2 years ago

Paul-Reed commented 2 years ago

Authors appear to be able to 'mislead' the scorecard by providing a generic 'git' url in the package.json such as;

"bugs": { "url": "https://github.com/paul-reed/node-red-contrib-mynode" },

Instead of the 'bug's' url - https://github.com/paul-reed/node-red-contrib-mynode/issues But then disabling issues in the git rep settings, so bugs cannot be reported, but gains a point in the scorecard...

I assume that there is access to the url in the package.json, if so, couldn't a regex determine if the url was suffixed with /issues (or the equivalent gitlab etc suffix). Taking it a step further, maybe a further check could determine in the url actually existed.

Example - https://github.com/Supergiovane/node-red-contrib-tts-ultimate

Paul-Reed commented 2 years ago

PR https://github.com/node-red/node-red-dev-cli/pull/23 adds further verification checks.

hardillb commented 2 years ago

Just to add to this, on GitHub, if issues are dissabled the link 302 rediects to /pulls which would be a useful test

e.g. https://github.com/d0uub/node-red-contrib-puppeteer-new/issues -> https://github.com/d0uub/node-red-contrib-puppeteer-new/pulls.