Code review for security advisory coverage applications

This wiki page is created to keep track of vuil's Project application reviews. As a reviewer I hope to get more advice from more experienced reviewers. Please use the comment field to add your advice, corrections, and observations.

This wiki page is created to keep track of pen's Project application reviews as suggested by klausi . As a reviewer I hope to get more advice from more experienced reviewers. Please use the comment field to add your advice, corrections, and observations.

A plan for incentivizing code review of every project, not just new ones, after the project applications revamp is open for suggestions and feedback.

Hi,

I'm starting to directly approve project applications when I think they are OK from the "needs review" state. I think it is not necessary to do an extra step and let another git admin take a look. It just slows down the approval of applicants yet again and I think we can trust git admins enough to make the decision immediately.

Let me know what you think and if that might be a bad idea.

Hello guys,

After doing some reviews lately.. I saw some contributors using hook_help() getting the existing read me file in the module .. here is an example:


/**
* Implement hook_help().
*/
function dblog_quick_filter_help($path, $arg) {
switch ($path) {
case 'admin/help#dblog_quick_filter':
$output = file_get_contents(drupal_get_path('module', 'dblog_quick_filter') .'/README.txt');
return module_exists('markdown') ? filter_xss_admin(module_invoke('markdown', 'filter', 'process', 0, -1, $output)) : '

'. check_plain($output) .'

';
}
}

This wiki page is created to keep track of ashwin.shaharkar's Project application reviews.

Reviews List:

[D7] S3 Zip Image Upload
https://www.drupal.org/node/2748429#comment-11445953
https://www.drupal.org/node/2748429#comment-11445973

[D7]SMTP with Elysia Cron
https://www.drupal.org/node/2744019#comment-11278195

[D7] Check JS
https://www.drupal.org/node/2742721#comment-11263473

This wiki page is created to keep track of visabhishek's Project application reviews as suggested by klausi . As a reviewer I hope to get more advice from more experienced reviewers. Please use the comment field to add your advice, corrections, and observations.

Some projects have multiple reviews.

Security Issues:

<

ol>

It would be better if we can add a review point system in Drupal code review of Full Project Applications. Normally people are reviewing other application only to get Review Bonus. Once their application/project got approved then they will lose their interest in Reviews.

I know reviewing other application is a best way to learn drupal coding, but there are other ways too. So that I am thinking, it would be better if we can implement a review point method in Drupal Code Review of Full Project Application system.

As most of you know, we have a Git repo policy for the Drupal.org git repo. This policy is also explained in our guidance about 3rd party libraries and content. This is even linked to in the review template, under the heading 3rd party assets/code.

Earlier today, I was browsing the application queue, and I could not help noticing several applications that did not comply with the this requirement:

<

ul>

In particular, deputizing kattekrab— or proposing another person or another approach.

https://www.drupal.org/node/2736981 => Give kattekrab the power to give people the power to approve project applications

But i'm three hours into a stint of just approving RTBC projects (and not yet halfway done?), which should never be our backlog, and after Damien McKenna made a huge dent in that queue yesterday.

The Project Applications Review process revamp is now a community initiative awaiting progress
https://www.drupal.org/node/2666584

After a year of discussion at
https://www.drupal.org/node/2453587

And 5 years of attempting to improve the situation for people wanting to contribute modules to Drupal.org.

While we continue to wait for a solution for the underlying problem, we still have people waiting.

This wiki page is created to keep track of th_tushar's manual reviews of projects in the project application queue. As a reviewer I hope to get more advice from more experienced reviewers. Please use the comment field to add your advice, corrections, and observations.

I think I'm in the minority of cases here but I can't find any discussion anywhere on the topic:

This wiki page is created to keep track of heykarthikwithu's Project application reviews for him to get advice and mentored by Git administrators and anyone else who might have suggestions, advices, etc.

Following are the application I have reviewed till date :

[D8] AdobeAnalytics - https://www.drupal.org/node/2682257#comment-10953989
[D7] Currency Exchanger - https://www.drupal.org/node/2678456#comment-10914917
[D7] Overlay Light - https://www.drupal.org/node/1856530#comment-7673169
[D7] Pay with a Tweet - https://www.drupal.org/node/2009268#comment-7695411
[D7] Extra Columns - https://www.drupal.org/node/2027253#comment-7673249
[D7] Webform Email Reply - https://www.drupal.org/node/2044219#comment-7662731
[D7] Social Timeline - https://www.drupal.org/node/1937044#comment-7727599

This wiki page is created to keep track of pankajsachdeva's manual reviews of projects in the project application queue. As a reviewer, I hope to get more advice from more experienced reviewers. Please use the comment field to add your advice, corrections, and observations.

Reviews List:

<

ol>

Received a question from an applicant per mail:

Hi, I have a question about the project reviews, how come my project is still sandbox and there is people that can create 'projects' with empty code? isn't that against rules or at least ethics?

https://www.drupal.org/project/amp

This wiki page is created to keep track of my project application reviews Reviews and Mentoring

I updated PA Robot to close inactive project applications (in the "needs work" status) after 4 weeks instead of 10 weeks. That way applicants get feedback earlier that the application is blocked on their part in case they forgot to update the status.

Let me know if that causes any issues I have not thought of.