BUG: Gitlab Commits Before Date Needs More Logic about scorecard HOT 2 OPEN

By default, GitLab GraphQL returns the most recent merges on a GitLab repo. But we don't guarantee the merge request that brought in a commit on a GitLab repo's main branch is captured by our check - we may undercount - or miss - merge requests in zip if GraphQL and the REST API don't line up. (We use 1 GraphQL query + 1 REST API call instead of 1 REST API call per commit to find the linked Merge Request, which wouldn't scale).

The purpose of using mergedBefore in getMergeRequestDetail is to improve this - "don't give me any merge requests newer than the newest commit I've listed". But, I think you're right that before := commitsRaw[0].CommittedDate may not reflect the commit date of the newest commit (it might be much older, therefore leading to a lower score). We might fix this is to find a better bound commit date in commitsRaw, or by making a single API query to ListMergeRequestsByCommit to get the right date for before.

from scorecard.

Bug affects scoring at the margins

from scorecard.