search

ossf / scorecard

OpenSSF Scorecard - Security health metrics for Open Source
https://scorecard.dev
Apache License 2.0
4.62k stars 503 forks source link

Scorecard doesn't detect OpenSSF Best Practices badge #4413

Closed ivanoblomov closed 1 week ago

ivanoblomov commented 1 week ago

Describe the bug Scorecard doesn't detect the OpenSSF Best Practices badge for the project https://github.com/FoveaCentral/hit_counter.

Reproduction steps

  1. The project scores 0/10 even though the README has the badge and the Best Practices site has its report.

Expected behavior The project should get a 5/10 because it has a passing badge.

Additional context I don't think the case-sensitivity issue noted in https://github.com/ossf/scorecard/issues/3466#issuecomment-1756357077 is related since in this case all results are going to the camel-cased https://scorecard.dev/viewer/?uri=github.com/FoveaCentral/hit_counter and nothing ever went to the lowercased https://scorecard.dev/viewer/?uri=github.com/foveacentral/hit_counter.

As another data point, the badge is correctly detected for the sister project https://github.com/FoveaCentral/vaccinesignup since it has the expected score of 5.

The most obvious delta between the two projects is that the working one's default branch is main while the other is master. I had similar results with another project with a master branch.

spencerschrock commented 1 week ago
  1. The project scores 0/10 even though the README has the badge and the Best Practices site has its report.

Did you rename your repo? The bestpractice metadata has this for the project URL (which is different from github.com/FoveaCentral/hit_counter):

https://github.com/ivanoblomov/hit_counter

ivanoblomov commented 1 week ago

@spencerschrock that's right. To enable 2FA, GitHub required us to move the repo to an organization.

spencerschrock commented 1 week ago

Once you update the metadata in Best Practices, it should be detected.

ivanoblomov commented 1 week ago

Doh, completely forgot that was user editable. That worked, cheers @spencerschrock!