`validate-project` action is too strict on security advisory URL
- Dominant language
- Go
- Stars
- 31
- Forks
- 36
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 70
Description
The validator requires a GHSA report URL.
For projects like Argo with multiple subprojects, there's no single GHSA report link.
Example failure: https://github.com/argoproj/.project/actions/runs/34403020101/job/102639227931?pr=4
```
Project Validation Report
========================
CHANGED: Argo (file:///home/runner/work/.project/.project/project.yaml)
Previous Hash:
Current Hash: 5f5384962bb42fa4ef84760485890a1fb278a0bc0ce7fe365f65c3558e4a479d
INVALID: Argo (file:///home/runner/work/.project/.project/project.yaml)
- security.contact.advisory_url must be a valid GitHub Security Advisory URL ([https://github.com/{org}/{repo}/security/advisories/new](https://github.com/%7Borg%7D/%7Brepo%7D/security/advisories/new)), got: https://github.com/argoproj/argoproj/blob/main/SECURITY.md#reporting-vulnerabilities
Summary: 1 projects validated, 1 changed, 1 with errors
Error: Process completed with exit code 1.
```
Contributor guide
Assessment
This issue has not been assessed yet.