Chris Tankersley

Drupal's Code Review is Incredibly Frustrating

Posted on 2014-08-10

Despite me doing a ton of Drupal development, I don't actually have much contributed to the Drupal module ecosystem. That seems like an oversight on my part, especially since I'm doing more and more talking about Drupal, and at php[world] will even be doing a tutorial class on modern Drupal development. I had a project that we worked on at The Brick Factory that was an excellent candidate for releasing to the masses. It is small module that allows site themers to customize their sharing icons. Nothing major, and a good first short.

I got the approval to release the code, and spent some time cleaning it up a bit to make it a bit more fit for release. I removed name spaces, made sure everything was documented, removed dead code, etc. A good spit shine. As I read more into the process for releasing code I ran into the need to get access to publish code. No big deal, since it was well documented. I pushed the code to my sandbox, wrote my project application ticket, and went from there.

Drupal has every developer go through a Code Review process to make sure they understand the Drupal coding style, how things work, and what is expected of them. The idea is to point developers in the right direction and release better code as a result. Once a developer has been approved they can release more projects without this, as they have gone through the process. The review process makes sure that modules don't get released using PHP 4 coding styles or have obvious security issues. It is a noble idea and purpose, especially in the PHP ecosystem where many people throw their projects up on Github without anyone looking at it.

That was two months ago. I'm still not approved, and have no idea when, or if, I ever will be.

The Journey

Right away I got a message from the PA robot, saying that my code had issues. Drupal has a specific code style and a documented Code Sniffer package that everything needs to conform to. That's fine, so I went through and cleaned it up. Most of it was indentation issues, or unclear requirements for the docblock. Nothing that was offputting so it was quickly fixed. I even reviewed a few modules to get myself put into the high priority list.

I eventually got a human to review my code, and he had some good things that I did indeed overlooked. I quickly patched those as they really were stuff I just plain missed. Again, not a big deal, as that's the entire point of the process - making sure that code is released to the wild that is in the best possible shape. A second person reviewed my code and had a few more suggestions which I implemented. The third review was even shorter.

I then got knocked down out of the high priority list because of an issue with the GPL header I had in my files. Drupal enforces a GPL 2 license on all the code, and I had accidently added a GPL 3 header to all of my files. Despite the GPL page saying to put a header on all the files, I removed the GPL 3 header instead of modifying it to say GPL 2. I'm fine with that change since the build process on Drupal.org will take care of adding the license file. I was just trying to follow what the GPL site said to do. That review also had the most in-depth recommendations, which were implemented.

That was a month ago.

Stalled

Since then nothing has come from the project. One review mentioned some missing links in my .info file, and missing permissions, which had actually been taken care of a while ago. I responded to the reviewer, and got nothing back. A second person reviewed the code, and gave me the same code sniffer issues that had been fixed over a month ago. I ran PA Review myself and got a different set, which corresponded to the code that was sitting in the repo. So I have no idea, but both of those knocked my back into "Needs Work" status each time.

And that's where it is sitting. Frankly, the entire situation has soured me on releasing code on Drupal.org. Some of the requirements I only came across because someone linked to them. The tools are dependent upon what versions reviewers have installed, so one person can submit a code sniffer report that gives one result, and another reviewer can get a different result. These results can be different than the automated tools that run. I'd run the tools locally and get different results as well.

Since I'm at the mercy of the community I can do little other than sit and wait for someone to review my module. Even when I was in the High Priority list I was waiting weeks for someone to just look at the code. The entire process seems to penalize code that doesn't sound interesting, since I saw other projects pop up, get immediately reviewed, have back-and-forths, and get launched while mine sits and stagnates. The last review I had mentioned issues during the installation completely unrelated to my module, but because of that I get penalized and knocked down to "Needs Work" status again. Five minutes of work later I've resolved some issues (completely unrelated to the ones that knocked me down, because they haven't existed for a month), and I'm back in the waiting game.

I'm Not Sure I Care Anymore

It sounds like I'm whining, and partially I am. I'm frustrated with the process, especially since there isn't anything I can do. Sure, I can review some more modules myself and get back into the High Priority list, but why? The first time did nothing for me as I still waiting weeks between reviews, which the High Priority list was supposed to help with. So here I am, two months into a project that just sits there, waiting for someone to look at, like some puppy that has grown just too large for people to want to buy.

And lest one think this is an outlier, this wasn't the first time I had tried to release code on Drupal.org. A few years ago I wrote a stripped down module for interfacing with Facebook because the "fb" module on Drupal.org was incredibly bloated. Drupal.org has many projects that duplicate functionality, you just have to justify why yours is different. I didn't even get to the point of committing my code because my Facebook project was immediately shot down by someone. Since I couldn't log into that Drupal.org account anymore (I must have used an e-mail that I no longer have access to), I started fresh. And here I am again, stuck without the power to do anything meaningful but sit here.

I went into this process looking forward to finally releasing something on Drupal.org and see how well the process works. Now that I'm in it, I'm not even sure I care anymore. Yes, this is a one time thing and once I'm approved I can release other projects without this hassle but the damage has already been done. This process has taken over two months and I have nothing to show for it.


Comments