Recommended changes resulting from automated audit about cake.codecov HOT 11 CLOSED

When I said the follow up, I was talking about the second comment (Wich was posted 3 minutes after the issue was created). No matter though.

oh I see what you mean. That was not intended behavior. I keep having to restart the audit because I create and update so many github issues that I trigger their abuse detection. That's where the second comment came from. I'll make sure I don't keep creating a new "follow up" comment every time I restart the audit.

from cake.codecov.

We performed a follow up automated audit of your Cake addin and found that some (or all) issues previously identified have not been resolved.

We strongly encourage you to make the modifications previously highlighted.

Apologies if this is already being worked on, or if there are existing open issues, this issue was created based on what is currently published for this package on NuGet.

This comment was created by a tool: Cake.AddinDiscoverer version 3.12.1

from cake.codecov.

@Jericho the first task is valid here (Recently opened #24 just for that).
The second task is already implemented though (although, I use a hash in the url to prevent permanent caching of a branch (habit from rawgit)).

Also, isn't the bot a little quick to do a follow up audit 😸

from cake.codecov.

isn't the bot a little quick to do a follow up audit

10 months between the audit and the follow up!!! How much longer should I have wanted 😜

I use a hash in the url to prevent permanent caching

As I understand it, jsDelivr has their own logic to regularly refresh their cache so you shouldn't worry about it.

from cake.codecov.

10 months between the audit and the follow up!!! How much longer should I have wanted ;-)

When I said the follow up, I was talking about the second comment (Wich was posted 3 minutes after the issue was created). No matter though.

As I understand it, jsDelivr has their own logic to regularly refresh their cache so you shouldn't worry about it.

Even though their logic differ from what rawgit used, I personally feel that using a hash is the proper way to go. Is there any way that the bot perhaps could support that?

from cake.codecov.

Is there any way that the bot perhaps could support that?

I'm hesitant and here's why: let's say Cake goes through rebranding at some point in the future and icons are modified. We don't want to ask 200+ addin authors to refresh the URL they use. We want the latest icon to be served "automagically" as soon as jsDelivr's cache is refreshed. If we feel it takes too long to clear a file from cache, jsDelivr offers a way to manually clear a specific file from their cache so one way of another, I feel we have a way to served the latest version.

Is there a scenario you can think of that we haven't considered?

from cake.codecov.

Is there a scenario you can think of that we haven't considered?

Yes, although unlikely. The repo could be re-organized, in these cases you would still need to ask the maintainers to update the icon. By using the hash, this is not needed.

Even though I do understand were the reasoning behind your suggestion, I would still hold on to using the hash myself, and rather monitor the the repo for changes.

IMO, better to have an old icon, than a non-working icon.

from cake.codecov.

The repo could be re-organized

We discussed this scenario and decided that it was less likely to happen than icons getting modified, which itself is not very likely according to @gep13. Besides, we now know that reorganizing the icons repo would be problematic therefore it's up to us to refrain from reorganizing!

from cake.codecov.

oh and one more thing: the URL you are using has a hash AND ALSO the name of a specific folder so I don't even understand how this addresses the "reorganizing" scenario.

from cake.codecov.

We discussed this scenario and decided that it was less likely to happen than icons getting modified, which itself is not very likely according to @gep13. Besides, we now know that reorganizing the icons repo would be problematic therefore it's up to us to refrain from reorganizing!

I guess it just comes down to preference then.

oh and one more thing: the URL you are using has a hash AND ALSO the name of a specific so I don't even understand how this addresses the "reorganizatin" scenario.

Of course it helps. It uses the specific that was available in that specific hash, wish should never change (unless someone overwrites the repo history).
I'll give you an example for files I've re-organized (or rather removed) myself (in a different repo).

Here you have for instance a link using a hash for a file that no longer exist:
https://cdn.jsdelivr.net/gh/cake-contrib/Cake.Transifex@46cfe0047755494fbb15242991ced659ebda9d96/build.cake

The above link will work for all time, until either github or jsdelivr shutsdown.

now lets try the same thing by using the suggested link:
https://cdn.jsdelivr.net/gh/cake-contrib/Cake.Transifex/build.cake

^^ this link will of course not work, as it's no longer in the repository.

from cake.codecov.

My original change to the guidelines in cake-contrib/Home#58 was also including hashes, but opinion was that without hashes is the preferred option. For my addins I probably also will stay with the icon url containing the hash for the same reason @AdmiringWorm stated. So maybe the bot could allow both options?

from cake.codecov.