Rethinking App Store Guardrails & Developer Tooling for App Submission

đź’» Development
1

I hope these suggestions are helpful, and inspire both conversation and action!

The barrier of entry for creating a Nextcloud app has never been lower. Over the last couple years there has been a massive increase in the number of pull requests (and applications) accepted into the appstore, directly related to wider AI coding availability. Not judging it, so much as acknowledging how offering a standards-compliant platform makes such rapid AI development inevitable. There is no reason to assume this process will ever slow down… which is why app developer support scaffolding must scale up accordingly. My question is:

What is being done to manage submissions, scan for vulnerabilities, confirm API compliance, mitigate redundancies, and protect Nextcloud’s appstore reputation?

An example:

I’ve noticed Nextcloud Social and Euro Office receiving extensive pull requests from AI-assisted Nextcloud developers, but the pull requests are accompanied by huge numbers of tests, linting and code validation. I do not believe it is yet possible for casual developers to actually follow the Nextcloud Code of Conduct requirements through the current testing framework, nor do I believe their AI assistants are even aware of guardrails in regards to generated code. A developer with a failing app can currently receive a 2 year ban from the appstore, but at the rate newly coded apps are being pushed… it is Nextcloud itself that will suffer from future vulnerabilites in 3rd party applications within their ecosystem… I also worry about malicious code injection within the greater platform, weaponized within the large codebase.

What can be done to centralize linting standards and decentralize test execution?

Perhaps official boilerplate that mirrors the test structures of Nextcloud Social, and other core apps, could be made available for developers to test locally (explicitly designed for ephemeral AI reference). Or guidelines for developers to improve their personal CI pipelines. Providing clarification to external developers could at least reduce the volume of mistakes before submission: both for native php and external applications. The “Code of Conduct” could require more extensive “App Publishing Guidelines” that developers must follow, designed as local testing guides for local AI recognition, but also as a boilerplate reference for the AI to then explain to the developer why the code they are generating isn’t acceptable for the Nextcloud appstore and ecosystem.

2

For the moment it’s all the responsibility of the app developers, and then the admins if they trust the apps or not. For new developers, it was always helpful to have good tutorials and starting guides, today it would makes sense that this includes the AI setup, how can you avoid certain mistakes, how can you control your code, …

3

This came up at the conference last week.. the nextcloud team are asking people to be transparent about using AI when they do use it, to not submit large PRs, and to not submit PRs that they would not be able to review or explain themselves.

Have you seen the developer course under development? That would be a good place for Nextcloud to explain how AI is expected to be used.

Love how they are also leaning into peertube and mastodon, like this short intro video about the course:

I share your concerns about the app store.. there seems too be to much emphasis on the number of apps and encouraging admins to install and try out all the various apps available. That is a highly risky approach, imho, and it reminds me of the early wild west days of wordpress plugins! Not everyone has a sandbox nextcloud to play on.

Here’s a tip I was given on the nextcloud developer chat for disabling the “+ App Store” button on the main pulldown nav. I don’t think it belongs there in the first place.

Hello, thank you for the feedback. Regarding the app store link: from 34.0.4 you can use the following occ command to disable the button:

occ config:app:set core appstore_link_shown --value=false --type=boolean

This will hide the “+ App store” button for all non-admins.