Closed (fixed)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Issue tags:
Reporter:
Created:
6 Apr 2020 at 20:02 UTC
Updated:
27 Apr 2020 at 16:54 UTC
Jump to comment: Most recent, Most recent file
Comments
Comment #2
avpadernoThank you for applying! I added the Git instructions for non-maintainer users and the PAReview checklist link. Reviewers will check the project and post comments to list what should be changed.
If you haven't done it, yet, please check the PAReview report and fix what needs to be fixed. There could be some false positives; verify that what reported is correct, before making any change.
Comment #3
avpadernoThere are some coding standards issues to be fixed in the editor.js, the editor.css, and the README.md files.
Comment #4
shaktikGit errors:
Review of the 8.x-2.x branch (commit 5b5dae8):
hook_help(). See https://www.drupal.org/docs/develop/documenting-your-project/module-docu... .This automated report was generated with PAReview.sh, your friendly project application review script.
Comment #5
avpadernoGiven that the plan is fixing the code to use the machine name of the project where that is used, would not waiting you change/add more code be better? The more edits you do, the better is for this application.
Comment #6
codebymikey commentedThanks @kiamlaluno and @shaktik, I've updated the code to meet the coding standards, added a more appropriate update hook to automate the migration process, as well as an appropriate change record for it.
The current module code is more or less stable now, with the only change left to make is removing the
admin_cssmodule from the code to free up the https://www.drupal.org/project/admin_css name.I was planning to make that change after receiving the security advisory coverage, and pushing it as the final stable release for the foreseeable future.
Comment #7
rksyraviHi @codebymikey,
Thank you for contribution!!!
Please make sure to change the status, after you made the fixes. Then only the reviewer can give you the feedback for any other changes.
Comment #8
avpadernoTo make it clear: These applications are for giving users the Drupal role that allows them to opt into security coverage for every project they created or they will create. With another user who made 12 commits, we cannot give that Drupal role to a single user, nor do we give that Drupal role for more than one user and for the same project.
That's why I said that the more code you commit the better is for this application.
Comment #9
codebymikey commentedThanks @rksyravi, forgot to update it.
@kiamlaluno, I wasn't aware of the amount of commits limitation, and thought it was solely on the quality of the contributions themselves.
How would you suggest we move forward as the module itself is now feature complete and uses all the appropriate APIs; also once this issue is closed, does that mean I can no longer apply?
I do have work on other projects that I just haven't had time to clean up and push up yet that might be used to gauge my ability to write stable code.
One being a major refactor the Gutenberg module and the other a bug-fix and coding standards update for Commerce Secure Hosting.
Is my thinking correct:
Because damodharan is also a maintainer and doesn't currently have the role, I can't apply under the project? Also wasn't aware of this limitation.
I was under the impression that the application was solely for me, and I'd be the one to specify whether the release/code was stable rather than him.
Comment #10
avpadernoThe purpose of these applications is reviewing the code written from a user to check what that user understands about writing secure code that follows the coding standards and that correctly uses the Drupal API.
In this project, the only changes you have done are for using the project machine name where that should be used, which is fine, as that means you understand that aspect of Drupal programming, but it doesn't say much about the rest, as the code has been written by another user.
Many users misunderstand this: These applications aren't about projects, but users. We give users a Drupal role that allows them a higher participation on Drupal.org. It's similar to become webmasters on Drupal.org. Everybody can ask for that Drupal role, but they are given the role of webmasters for their activity on drupal.org, not another user's activity on drupal.org.
If these applications were for projects, we would not give any Drupal role to users, but we would change the settings for each project used in the applications. This is what we do when the code has been written from more than a user, or when the project contains few code lines, but these are exceptions to what these applications serve.
Comment #11
rohitrajputsahab commentedyou need to flush CSS cache after saving your configuration. Because supposed I'm enabled " Aggregate CSS files". Your config CSS is not reflecting. Please check it.
Comment #12
rohitrajputsahab commentedComment #13
codebymikey commentedHi @rohit-rajput-sahab, that's a good spot. I thought I had tested for that scenario, but I guess I must've had
$config['system.performance']['css']['preprocess'] = FALSE;in my localsettings.local.phpor something.I've pushed a new commit addressing the issue. It now adds the appropriate cache tags so that the anonymous page cache is cleared when the CSS on the config page is changed.
Hi @kiamlaluno,
Thanks for the clarification.
For the Admin CSS module, the main changes made was migrating the module name as well as adding Ace Editor integration, while enforcing Subresource Integrity.
I've now pushed a couple new commits up on various projects that might be a better judge of my ability to write secure code:
DrupalPracticecoding standards until pareview.sh, I just always usedDrupal.If that still isn't enough, then what's your recommended suggestion moving forward?
Comment #14
codebymikey commentedComment #15
klausiThe code of the module looks good! Then I looked at other drupal.org commits by codebymikey and they also look good and indicate that they have a good understanding how to write Drupal code. Even the admincss commits are quite substantial on their own. Therefore I think we can directly promote codebymikey.
Thanks for your contribution, codebymikey!
I updated your account so you can opt into security advisory coverage now.
Here are some recommended readings to help with excellent maintainership:
You can find lots more contributors chatting on Slack or IRC in #drupal-contribute. So, come hang out and stay involved!
Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.
Thanks to the dedicated reviewer(s) as well.
Comment #16
codebymikey commentedHi @klausi,
I appreciate it, and have given the linked articles a read.
Unfortunately I don't think I have the
may opt into security advisory coveragerole as this is the option I see when trying to create a new release and opt my Commerce Secure Hosting module in for coverage:Comment #17
avpadernoComment #18
klausi@kiamlaluno: hm, why did you add the "PAReview: single application approval" again? Please don't undo my approvals without giving a reason. As I said in #15: I looked at other drupal.org commits by codebymikey and they also look good and indicate that they have a good understanding how to write Drupal code. Even the admincss commits are quite substantial on their own. Therefore I think we can directly promote codebymikey.
Any reason why we should not grant codebymikey the security coverage role?
Comment #19
avpaderno@klausi Then you should do the same with my reviews.
None of the points you mentioned change the result of an application, since:
The right question would be: Why should codebymikey get the role when users who wrote alone a project that contained less code don't get it?
Comment #20
codebymikey commented@kiamlaluno
Do you mind responding to my point on #13?
What's your recommended suggestion moving forward as the Admin CSS module is now stable and feature complete.
Comment #21
avpadernoThe module is already set to opt into security coverage, as the project page says.
Comment #22
codebymikey commentedYes I'm aware of that, I'm actually talking about the Drupal role itself, and what the necessary steps are to move forward with that.
Comment #24
klausi@kiamlaluno
To answer your question: codebymikey should get this role because they have enough meaningful contributions and understand how to publish a module on drupal.org. Other users that write a module alone have no disadvantage because of that, we will also approve them. In fact we will approve anybody that demonstrates their knowledge in this process.
Setting this back to RTBC to get feedback from kiamlaluno.
Comment #25
avpadernocodebymikey already has the vetted role, since he created a new application and got it.
Comment #26
avpadernoComment #27
klausiAh, even better. Thank you!