Improve GitHub Autolink: Embed GitHub Information

Darkle

IanM A bit off-topic, but some time ago, I had an idea related. Could GitHub Autolink (https://discuss.flarum.org/d/21856-friendsofflarum-github-autolink) display embedded READMEs so that the OPs of extension discussions always stay updated?

IanM

Darkle it's possible yeah, but we'd have to be careful on how it's parsed. Wouldn't want a readme file to be a potential attack vector, even if it's just a hidden url or such.

I think actually what we need is a very related idea I had a while back - an extension showcase extension where readme's, changelogs, screenshots, issues, new releases and so on are all presented in a uniform way. Tie that in with extiverse/next and that would be a powerful tool imo

GreXXL

Darkle i like this idea but would be very sceptical about the usage on platforms like discuss. Basically it's an uncontrolled embed of information. Even if not used maliciously it still could provide unwanted information with an integration into a moderation workflow - that can be changed at all times.

Darkle

GreXXL You're right about that, I hadn't thought of it. The only thing I can think of is making the embeds work only for a specific role, but that doesn't seem feasible as it would require something like 'verifying' extension creators... What Ian mentioned sounds really cool. The ultimate goal is to provide more information with less effort, as there are many outdated OPs compared to their GitHub versions, which is understandable since it's easy to forget.

clarkwinkelmann

Just as a suggestion for implementation: I would advocate for this to be a standalone extension.

The "GitHub Autolink" extension does not actually interact with GitHub API at all, it's completely "client-side" (or maybe rather "flarum-side"). Therefore I don't think it makes sense to add interactive features unless there are plans to do much more with the extension by retrieving rich previews for every links or something like that.

Incidentally, my Rich Embeds extension already has a GitHub integration that retrieves dynamic data from GitHub API for posted links. It shouldn't be very difficult to add the README content to the preview that's already being generated for links.

The potential issue I see is with licensing. You might not be allowed to embed a README file content. So you need a way to moderate and redact specific READMEs, and/or maintain a whitelist of allowed repos. Even if allowed to copy the README, the extension might need to also parse the repo license (luckily, I think GitHub already provides this information in their API) so you can display the license alongside the content.

Then of course there's the matter of refreshing the content. Do you fetch it only on request and cache it for a given time, or store a permanent copy that's updated from a scheduled task? The shorter the refresh rate and the greater the number of README links, it could quickly require a lot of server resources.

rafaucau

Perhaps consider creating a reusable GitHub Action that automatically updates the first post based on README.md and posts information about updates on extension releases in the extension discussion? This action could be configured optionally by extension developers who wish to automate this process. Flarum allows the creation of developer tokens (the Flarum team would just need to enable permissions on this forum), which can be added to repository secrets.
This ensures that the security level is equivalent to what is already allowed for user posts.

If there were permissions on this forum to create developer tokens, I can create such an action because I like automating everything that can be automated.