Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

.project/ files written by darnit do not conform to the upstream CNCF dot-project schema

Open
  • Is something wrong?
#498 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
38/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python, yaml
Domain
tooling

Research direction

Start with packages/darnit/src/darnit/context/dot_project.py, packages/darnit/src/darnit/config/context_storage.py, and the OSPS-DO-02.01 entry in packages/darnit-baseline/src/darnit_baseline/openssf-baseline.toml; compare their behavior with the referenced upstream SCHEMA.md and validator. The issue lists five compatibility gaps and proposed directions; check related issues #468, #469, and #463 before defining a bounded change. Done means the agreed changes are covered by tests and written fixtures validate against the upstream schema.

Written by the indexing model from the issue text.

Description

module-baseline module-core

Summary

.project/ is darnit's primary mechanism for project metadata, but the files darnit writes do not conform to the upstream CNCF dot-project schema (cncf/automation utilities/dot-project, SCHEMA.md version 1.0.0 at commit fb391624922b, 2026-09-24):

  1. Schema version. New project.yaml files are seeded with schema_version: "1.4.0" (https://github.com/darnitdevorg/darnit/blob/032493b8bc9d6ef810ecd639e515042371465c37/packages/darnit/src/darnit/context/dot_project.py#L65, used at #L998). The upstream validator's SupportedSchemaVersions is ["1.0.0"].
  2. security.contact shape. Upstream defines security.contact as an object (email / advisory_url). darnit writes a bare string there (https://github.com/darnitdevorg/darnit/blob/032493b8bc9d6ef810ecd639e515042371465c37/packages/darnit/src/darnit/config/context_storage.py#L381-L386).
  3. Unknown and relocated fields. The upstream decoder rejects unknown fields and the Project struct has no extension field; some upstream fields (e.g. slug, project_lead, package_managers, landscape) are read into or written from .project/darnit.yaml instead of project.yaml.
  4. Wrong locator. OSPS-DO-02.01 ("Document bug reporting process") uses project_path = "security.policy" (https://github.com/darnitdevorg/darnit/blob/032493b8bc9d6ef810ecd639e515042371465c37/packages/darnit-baseline/src/darnit_baseline/openssf-baseline.toml#L1421), so remediation and lookup treat the security policy as the bug-reporting process.
  5. Non-CNCF projects. maturity_log is required upstream and CNCF-specific, so a project outside the CNCF cannot produce a valid project.yaml.

Impact

Files darnit creates or edits may fail upstream validation and CNCF tooling, and values can be read back with the wrong meaning. Since .project/ is the primary store, darnit should round-trip it faithfully.

Suggested direction

  • Pin darnit to the upstream schema version it actually implements, and add a CI check that validates darnit-written fixtures with the upstream validator.
  • Write security.contact in the upstream object form and read both forms.
  • Keep upstream fields in project.yaml; limit darnit.yaml to darnit-specific keys.
  • Fix the DO-02.01 locator.
  • Propose upstream changes where .project/ cannot express what non-CNCF projects need (making CNCF-only required fields optional, a sanctioned extension mechanism), rather than diverging locally.

Related: #468, #469, #463.

Dominant language
Python
Stars
22
Forks
27
Avg merge
2d 28m
Merged PRs (30d)
40

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from darnitdevorg/darnit

All issues in darnitdevorg/darnit

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.