fair-software / howfairis-github-action Goto Github PK

A suggested @jspaaks to better fit purpose or repo.

let action use docker image from https://hub.docker.com/r/fairsoftware/howfairis/tags?page=1&ordering=last_updated for better speed and more predictable behavior. Also, use a tagged version as opposed to latest/bleeding edge.

https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/sarif-support-for-code-scanning

In the long run, it would be good if we have a pip-installable command line tool which runs all check scripts and produces a badge (url for the badge).

Currently we're doing 2 things in this repo. We should split off the howfairis package into its own repo, preferably while retaining github history. I've done that before, so i can do it, but let's first see what PRs we need to merge before splitting.

To reproduce:

howfairis https://github.com/hexatomic/hexatomic

See https://github.com/hexatomic/hexatomic, which is an open repository :).

I would expect to get a checkmark for that.

On https://github.com/fair-software/badge#for-developers it says you can use

# (from project root directory)
docker build -t howfairis .

However this gives a error:

url: .
AssertionError: url should start with https://

Can the documentation be updated to have commands that work?

If Zenodo were added to the list of registries to check against, this would cover an awful lot of "generic" software releases, e.g., those that don't go into any of the language/packaging registries, e.g., if it's distributed as binary/zip.

As far as I can see, there are two ways to achieve this:

1. Check for a Zenodo badge in the README. Cheap but may be imprecise (could additionally check if the record exists and has an isSupplementTo record for this repo).
2. Do an inverse search for records on Zenodo that contains the repo in the JSON. Expensive but precise:

"metadata": {
                "related_identifiers": [
                        {
                            "identifier": "https://github.com/this/repo/tree/v1.1",
                            "relation": "isSupplementTo",
                            "scheme": "url"
                        }

Registries listed https://github.com/NLeSC/awesome-research-software-registries need to be (magically) available in a machine readable format.

At the moment all checking scripts run independently, but the results from them need to be integrated into a single object.

We should build a Class which calls the different scripts and integrates the results.

Noticed it here https://github.com/sequgen/sequgen/runs/2182605029?check_suite_focus=true

Apparently, the github action is looking at main branch'es README.rst, because it was deleted on the feature branch and yet it says

 It seems you have not yet added the fair-software.eu badge to your README.rst. You can do so by pasting the following snippet: