ossf / ossf/scorecard-webapp

GitLab Projects in Subgroups

Open
#511 6 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
HTML
Stars
33
Forks
33
Avg merge
5d 6h
Merged PRs (30d)
5

Description

Hi,

Could I please ask how one would retrieve the scorecard data for projects that exist within GitLab subgroups?

Example:

For project https://gitlab.com/gitlab-org/ruby/gems/gitlab-triage I believe the API URL would be https://api.securityscorecards.dev/projects/gitlab.com/gitlab-org/ruby/gems/gitlab-triage/badge however this results in

{"code":404,"message":"path /projects/gitlab.com/gitlab-org/ruby/gems/gitlab-triage/badge was not found"}

Should this instead return the "invalid repository path" badge like it would for https://api.securityscorecards.dev/projects/gitlab.com/adam-moss/dotfiles/badge?

If I manually use shields.io directly https://img.shields.io/ossf-scorecard/gitlab.com/gitlab-org/ruby/gems/gitlab-triage?label=openssf scorecard&style=flat it seems to work?

Thanks

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the documented API request for the GitLab subgroup project and compare its 404 response with the invalid repository path example. Check the endpoint handling for GitLab repository paths and the Shields.io behavior; done means subgroup projects return the intended scorecard or invalid-path response consistently.

Written by the indexing model from the issue text.

Assessment

Domain
api
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.