search

node-red / node-red-dev-cli

Command-line tool for Node-RED Node authors
Apache License 2.0
7 stars 5 forks source link

Add tighter criteria for package compliance #23

Closed Paul-Reed closed 2 years ago

Paul-Reed commented 2 years ago

This PR aims to make the following changes to the 'repository', 'bugs url' & 'bugs email' scorecard check.

1) Repository Currently the scorecard only checks if the 'repository' field has own property, but this PR checks that the repo url exists, and that it includes the name of the node, such as https://github.com/Paul-Reed/ 'node-red-contrib-simpletime'. The url format is common amongst github, bitbucket & gitlab, and verifies accordingly.

2) Bugs url This PR checks that the repository property exists, and that the url slug contain 'issues', which is a common format amongst github, bitbucket & gitlab, such as 'https://github.com/Paul-Reed/node-red-contrib-simpletime/ issues'

3) Bugs email As an alternative to 2) above, users can provide a support email address, and this PR checks that the bugs email property exists, and that it passes a basic regex to check it's format.

Scoring changes This PR proposes that the score is not accredited unless 2 conditions are met, the first being the repository link, so that users can see the code used and assure themselves that the node is safe to use, look at what changes have/are being made, and also to contribute to it's development. The second condition as well as the above, is that either the bugs url OR the bugs email is provided, so that the author may be contactable, and issues could be recorded.

https://docs.npmjs.com/cli/v7/configuring-npm/package-json

Although the nodes are not named here, the PR has been tested against a number of nodes where current anomalies exist, and does correct the score. Examples include where non-standard nested properties are being used, and where the repo url is used instead of a bugs url (and issues git disabled). It has also been tested against nodes using github, bitbucket & gitlab.

linux-foundation-easycla[bot] commented 2 years ago

CLA Signed

The committers are authorized under a signed CLA.

Paul-Reed commented 2 years ago

No update or comment?

Paul-Reed commented 2 years ago

Almost 3 months old and still no response, so closing...

knolleary commented 2 years ago

Hi Paul, sorry it hasn't been merged.

Closing it means it never will be, which would be a shame. Once 3.0 is out the way, we can get do some housekeeping across the other parts of the project and get this sorted.

Steve-Mcl commented 2 years ago

@Paul-Reed Paul, any chance you can restore the branch and reopen this?

It will get reviewed but tbh it wasn't on my radar. For whatever reason I didn't spot this but now I'm aware I'll make sure I pick it up.

Please don't be afraid to give us a nudge once V3 is released.