Suggestion: allow open source projects not to need an API key about stryker-dashboard HOT 4 CLOSED

Hi Sam,

good to hear that you like the badge! I'm not sure whether I understand your question correctly, but it seems that you want to update the mutation score without an API key?

I'm not sure that's a good idea because the API key is what prevents random people from (accidentally) updating the mutation score. Although it is technically possible to drop it, we feel like it would make the score less reliable. @nicojs what do you think?

Peter

from stryker-dashboard.

Maybe we could do this, yet still allow people to configure an API key. If the key is configured, we don't allow uploads without an API key. If there is no API key we allow anonymous access.

from stryker-dashboard.

I'm curious how CodeCov prevents the whole world of submitting code coverage metrics? I think that one way or another, you'd want some kind of verification that the mutation testing metrics displayed in the badge are valid: i.e., submitted by a process that is controlled by the project maintainer(s).

from stryker-dashboard.

If you allow no keys then you allow anyone to upload a report and potentially completely mess up your project reports.

Why is the key an issue? It's easy to get and allow some level of protection by inserting it as an encrypted environment variable in your build

from stryker-dashboard.