Package: oss-red-flag-checker
Open Source Red Flag CheckerThis projects evaluates remote repositories by looking for typical red flags like CLAs (Contributor Licensing Agreements) but also indicators for governance, activity or licensing conditions we consider as good.Table of contentsFeaturesInstallationUsageCaveatsSimilar approachesLicense and copyrightFeaturesSearched dataThe checker looks for the following data in remote repositories:CLA (Contributor License Agreement) mentioned in files and pull requestsDCO (Developer Certificate of Origin) mentioned in files and pull requestsinbound=outbound mentioned in filesExistence of LICENSE/COPYING fileHuman and bot contributors to the project (based on Github stats)Last commits made by humans and botsAnalysis based on dataRed flags:CLA mentioned inREADMEorCONTRIBUTINGfilesCLA as part of pull request actions/statusesNoLICENSE/COPYINGfile in the repositoryThe project only contains contributions by one personThe last commit is more than 1 year oldYellow flags:The project's main developer made more than 75% contributions than the next 10 most active contributorsThe last human commit is more than 1 year old but there have been newer commits made by bots (like dependabot or renovate)The last human commit is more than 90 days oldGreen flags:DCO mentioned inREADMEorCONTRIBUTINGfilesDCO as part of pull request actions/statusesinbound = outbound mentioned inREADMEorCONTRIBUTINGfilesThe project has an acceptable contribition distribution by multiple active developersThe last human commit is less than 90 days oldInstallationYou must have the following dependencies installed:git>= 1.7.0python>= 3.8pip3You can install the latest release using pip:pip3 install oss-red-flag-checker.The command to run the program afterwards will beossrfc.Install/develop using poetryYou can also run this tool viapoetrythat takes care of installing the correct dependencies in a clean environment. This also makes development very easy. We recommend to have at least poetry 1.1.0. Inside of the repository, runpoetry installonce and you are ready to go. If you update the repository, run this command again to fetch new versions and dependencies.The command to run the programm will bepoetry run ossrfc.UsageYou can find all supported flags by runningossrfc --help.[!NOTE]
It is recommended to provide a GitHub Personal Access Token to avoid low API rate limits.
Either use the--tokenargument or set theGITHUB_TOKENenvironment variable.Basic examples:# Check a remote repositoryossrfc-rhttps://github.com/hashicorp/terraform# Cache the cloned repository so subsequent checks are fasterossrfc-rhttps://github.com/hashicorp/terraform--cache# Return the results as JSONossrfc-rhttps://github.com/hashicorp/terraform--json# Do not check for CLAs and DCOs in pull requestsossrfc-rhttps://github.com/hashicorp/terraform-dcla-dco-pulls# Ignore findings about contribution distributionossrfc-rhttps://github.com/hashicorp/terraform-icontributions# Provide a list of repositories to be checkedossrfc-frepos.txtHere's a possible output in both the Markdown view as well as in JSON:# Report for hashicorp/terraform (https://github.com/hashicorp/terraform)*🚩 Licensing: A mention of Contributor License Agreements in the following file(s): .github/CONTRIBUTING.md*🚩 Licensing: A check for Contributor License Agreements in at least one status in pull request(s): 33656*✔ Contributions: The project has multiple contributors with an acceptable contribution distribution*✔ Contributions: The last commit made by a human is less than 90 days old (1 days){"json_version":"1.0","disabled_checks":[],"ignored_flags":[],"debug_mode":false,"repositories":[{"url":"https://github.com/hashicorp/terraform","shortname":"hashicorp/terraform","red_flags":["cla","cla"],"yellow_flags":[],"green_flags":["distributed-contributions","actively-developed"],"cla_files":[{"file":".github/CONTRIBUTING.md","indicators":["- Contributor License Agreement (CLA): If this is your first contribution to Terraform you will be asked to sign the CLA."]}],"cla_pulls":[{"pull_request":33656,"type":"status","url":"https://api.github.com/repos/hashicorp/terraform/statuses/b53d89a08df10c85f6d4c546d2e54d4fab886d67","indicators":["Contributor License Agreement is signed.","license/cla"]}],"dco_files":[],"dco_pulls":[],"inoutbound_files":[],"licensefiles":["LICENSE"],"maintainer_dominance":-2.83,"days_since_last_human_commit":1,"days_since_last_bot_commit":141,"analysis":[{"category":"Licensing","ignored":false,"severity":"red","indicator":"A mention of Contributor License Agreements in the following file(s): .github/CONTRIBUTING.md"},{"category":"Licensing","ignored":false,"severity":"red","indicator":"A check for Contributor License Agreements in at least one status in pull request(s): 33656"},{"category":"Contributions","ignored":false,"severity":"green","indicator":"The project has multiple contributors with an acceptable contribution distribution"},{"category":"Contributions","ignored":false,"severity":"green","indicator":"The last commit made by a human is less than 90 days old (1 days)"}]}]}CaveatsOpinionated analysisThe analysis and decisions for how certain indicators are considered red, yellow or green flags is highly opinionated and represents a snapshot about our (DB Systel GmbH's) current thinking.You are free to use this tool. If certain criteria is not relevant for you, consider using the--ignoreor--disableflags.In the long run, it may be feasible to make the ratings configurable. Contributions are welcome if you are interested in it.Similar approachesThere are different initiatives that intend to evaluate the health or risks of Open Source projects. All of them have their particular focuses, strengths and weaknesses.OpenSSFwith a focus on security and theirscorecardsCHAOSSwith a focus on metrics about community health and metrics modelsLicense and copyrightThe content of this repository is licensed under theApache 2.0 license.This repository isREUSEcompliant. You can find licensing and copyright information for each file in the file header or accompying files.The project has been started by DB Systel GmbH.We welcome contributions from everyone.