Maintainer
This page should contain:
- information about CI/bots/services.
- How releases are handled.
- How versions are handled.
Critical repositories¶
This applies to repositories that fall into these categories:
- It's designed to steal your data (authentication tokens and similar).
- It's designed to harm your system and/or network.
HACS is prepared to handle those, and this is the flow of it:
- The repository is marked as dangerous/has security issues, by someone opening an issue in the HACS repository using the "Flag" issue template.
- The issue is reviewed if the repository is considered to be of a critical character:
- A PR is opened to add the repository to https://github.com/hacs/default/blob/master/critical
- That PR will have a description of why, and extra steps you need to take.
- When it's merged, HACS will know about it during the next scan (30min or Home Assistant restart.)
- HACS receives an updated critical file.
If the repository is downloaded with HACS¶
- The repository files are removed.
- The repository is removed from HACS.
- Home Assistant is restarted to make sure it's not loaded anymore.
- When Home Assistant starts up, you will have a
criticallog entry, and a persistent notification telling you to open the HACS panel. - When you open the HACS UI, you will see this card:
If you click the "More info about this incident" button you will be taken to the PR that added that to the critical file.
If you click the "Acknowledge" button, you will not see that message anymore.
If the repository is not downloaded with HACS¶
- The repository is removed from HACS.
That's it, since it was not downloaded, no further action from HACS is necessary