cncf / cncf/automation

`validate-project` action is too strict on security advisory URL

Open
#671 0 comments 0 reactions 1 assignee Claimed by @ahmadqasembader View on GitHub
area/dot-project needs-group needs-kind needs-priority needs-status needs-triage
Dominant language
Go
Stars
31
Forks
36
Avg merge
1d 6h
Merged PRs (30d)
70

Description

The validator requires a GHSA report URL.

For projects like Argo with multiple subprojects, there's no single GHSA report link.

Example failure: https://github.com/argoproj/.project/actions/runs/34403020101/job/102639227931?pr=4

```
Project Validation Report
========================

CHANGED: Argo (file:///home/runner/work/.project/.project/project.yaml)
Previous Hash:
Current Hash: 5f5384962bb42fa4ef84760485890a1fb278a0bc0ce7fe365f65c3558e4a479d
INVALID: Argo (file:///home/runner/work/.project/.project/project.yaml)
- security.contact.advisory_url must be a valid GitHub Security Advisory URL ([https://github.com/{org}/{repo}/security/advisories/new](https://github.com/%7Borg%7D/%7Brepo%7D/security/advisories/new)), got: https://github.com/argoproj/argoproj/blob/main/SECURITY.md#reporting-vulnerabilities

Summary: 1 projects validated, 1 changed, 1 with errors
Error: Process completed with exit code 1.
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.