So I started going through the list this morning and there are some problems with the output from this tool:
- The Package.swift file can be anywhere in the repo where for a valid package it must be in the root.
- It finds packages with no products which we reject as part of validation.
- It includes a lot of test/example/experimentation packages.
I started going through manually and removing bad packages that failed with the validation script from it but thatās no good as next time we run this theyāll all come back.
If we want to use this regularly then we should add more validation to this tool, or adapt the validation script to not stop validating after one package has failed.
ā
Then, the tricky one is number 3 on that list above. I think itās best if we draw a parallel with some other package managers, letās take npm and RubyGems as examples. Both require an explicit user action to publish packages. With npm itās a npm publish and with RubyGems itās gem push.
This is my biggest issue with this kind of method of adding packages. Itāll collect all sorts of things that people either didnāt intend to be packages that other people would use or are just not useful as packages because someone was just playing around.
If we align on this point, then we should add more validation or rules to try and weed out this kind of package. I donāt think this additional validation should be on the main validation script as if someone was making an intentional decision to submit a package, no matter how bare-bones it was, we should let it in.
Things I can think of for this kind of validation would be:
- No packages without a significant README should be allowed. If we take this one for example, it a < 50 char README. Maybe we donāt auto-add anything with a README less than 500 characters.
- That wouldnāt catch this package though. For that, we might try removing common words like āExamplesā, āDemoā, āExperimentā, etcā¦ The obvious one thatās going to be problematic here is āTestā.
- Finally, we could have a denylist so that once weāve flagged a package to not be auto-discovered, it wonāt get found again.
- There may be moreā¦