Pin docproof by commit, which is what its own README tells adopters to do - #47
Merged
Merged
Conversation
…o do Dependabot opened #44 to move this from v0.1.1 to v0.2.2. Two things are wrong with taking it. It is already stale, because docproof is on v0.2.4. And moving between tags is the practice docproof's README argues against, in its own words: a tag is movable, so whoever controls that repository can change what @v0.2.4 means without a diff for anyone to review. Azul's maintainer raised exactly that against docproof itself, and it was fixed there. This repository was still on a tag while the tool it runs tells everyone else not to be. That is the shape of defect docproof exists to find, in the repository that runs it. Pinned to 5798f6a, which is what v0.2.4 resolves to today, with the tag in a trailing comment so a reader can see which release it is. Measured before bumping, not assumed: docproof v0.2.4 on this tree reports 126 claims checked and nothing contradicted, judging 15 of 17 documentation files.
Jules ReviewCOVERAGE: a63765a 1 files SummaryThis PR updates the VerdictVERDICT: approve This review never edits code or force-blocks a merge. No blocking issues were found, so this PR was auto-approved. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #44.
Why not just merge Dependabot's PR
Two reasons.
It is stale. It moves
v0.1.1tov0.2.2; docproof is onv0.2.4.Moving between tags is the practice docproof's README argues against, in its own words: a tag is movable, so whoever controls that repository can change what
@v0.2.4means without a diff for anyone to review. Azul's maintainer raised exactly that against docproof itself, and it was fixed there.This repository was still pinned to a tag while the tool it runs tells everyone else not to be. That is the shape of defect docproof exists to find, in the repository that runs it.
The change
Pinned to
5798f6ac3c0b0aec739c4da135cc6b6c45c96fe5, which is whatv0.2.4resolves to today, with the tag in a trailing comment so a reader can see which release it is. Resolved the way the README says:Measured, not assumed
docproof v0.2.4 on this tree: 126 claims checked, nothing contradicted, judging 15 of 17 documentation files.