Shields: CodeClimate badges for private repos

[gretzky]

Thanks for the great work all.

Has anyone has been able to get shields' CodeClimate badges working for private repos? I've tried a couple different ways to config the URL, but none work. I know CC has their own badges, but I'm not a fan of them and want all the badges I have to match, style-wise.

[PyvesB]

Hello @gretzky ,

Even though I have never actually used CodeClimate, I recently rewrote all the badges relating to this service (see #1387 and #1368), so I may be able to shed some light on the issue and possibly work on a solution. The API documentation mentions that a token should be provided for authenticated calls. I'm guessing that doing so would probably allow to retrieve the relevant data from private repositories. With the current implementation, Shield's CodeClimate badges do not support providing a token, hence why all your attempts have failed so far.

Some other services such as CircleCI or CodeCov seem to have an optional token parameter that can be inserted in the badge's URL, I'm guessing we could add similar support for CodeClimate. We would need to have a look at what CodeClimate's token model is and how finely you can tune the token settings, as we wouldn't want sensitive information to be accessible by anyone looking at the badge's URL. :wink:

Cheers,

Pyves

[gretzky]

Hey @PyvesB, thanks for the response. I found the CircleCI implementation, which is what I started digging into. I'd be happy to do some more further digging-- I'll make a fork and see if I can pull anything off.

[paulmelnikow]

Passing secrets to the shields server is not a great idea. While we try to keep things secure, we don't guarantee it, and would like not to put other people's data at risk. The circle handling is an anomaly. Is is possible we could accomplish this use case through self-hosting, as we do for github?

[paulmelnikow]

The codeclimate badge still needs to be refactored, though we've got a good pattern in place for secrets config now, so once that is done, it should be fairly easy to add support for this in self-hosted environments.