spinframework / spinframework/spin
Audit action maintenance and ownership
@michelleN is already working on this.
Since Sep 25, 2023.
- Dominant language
- Rust
- Stars
- 6.5k
- Forks
- 310
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 24
Description
The "Run Rust audits" action has been failing for several weeks now. It currently reports 78 unvetted dependencies.
We should figure out a way to ensure that the vetted list is maintained, and that one or more maintainers "own" it in the sense of being notified about failures and driving the resolution of those failures.
#1246 and https://github.com/fermyon/spin/pull/1240#issuecomment-1460692706 discuss switching the audit action to block PRs, but the latter rejects it on the basis that "We usually have non-maintainers contributing to the code base, and for the audits, we would like to keep them to just maintainers. Besides trusting audits from external people, we would also add an extra burden to someone submitting a PR." (Which I completely agree with.)
Can we find a happy medium?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.