Package: pip-rating
pip-ratingAre the 📦 dependencies (and their dependencies) of your project secure and maintained?Toinstall 🔧 pip-rating, run this command in your terminal (in a virtualenv preferably):$pipinstallpip-ratingThis is the preferred method to install pip-rating, as it will always install the most recent stable release.
If you don’t havepipinstalled, thisPython installation guidecan guide you through
the process. 🐍Python 3.8-3.12are tested and supported.More info in the documentation.Pip-rating is a toolto check the security and maintenance of the dependencies of your project. It will check the
requirements of your project andtheir dependencies recursively, and will show you a rating for each of them. The
rating is based on multiple factors, like theirlast release date, thecommunity activity, well-knownsecurity
vulnerabilities& more.The rating for each dependency islimited to the lowest rating of its dependencies. For example, if you have a
package with a rating ofA, but it depends on a package with a rating ofC, the final rating of the package will beC. This principle is based onthe XKCD comic called Dependency.
Read more abouthow pip-rating works.❓ UsageTo check the dependencies of your project (pip-rating will detect your requirements file automatically) run this
command in your project root:$pip-ratingTo check the dependencies of a specific requirements file (pip-rating supports the filesrequirements.txt,requirements.in,setup.py,setup.cfg,pyproject.toml&Pipfile), run this command:$pip-ratinganalyze-file<requirements_file>By default, pip-rating shows the results intext format. You can also get the results in other formats like tree:$pip-ratinganalyze-file--formattree<requirements_file>Pip-rating supports other formats likejsonoronly-rating. You can seemore examples in the documentation.To analyze one or more packages, you can use the commandpip-ratinganalyze-package:$pip-ratinganalyze-package<package_name>[<other_package_name>]⚡ Github ActionPip-rating can be used as aGithub Actionto check the dependencies of your project in every commit and periodically.
To use this github action add a file like this to your project in the path.github/workflows/pip-rating.yml:# .github/workflows/pip-rating.yml# --------------------------------name:Pip-ratingon:push:branches:-masterschedule:-cron:'00**SUN'jobs:build:runs-on:ubuntu-latestpermissions:write-allsteps:-uses:actions/checkout@v2-name:Run pip-ratinguses:Nekmo/pip-rating@masterwith:create_badge:truebadge_style:flat-squarebadge_branch:pip-rating-badgeYou can see the execution of the action in the “Actions” tab of your repository. The badge is generated in thepip-rating-badgebranch, so you can access it as:https://raw.githubusercontent.com/<owner>/<repository>/pip-rating-badge/pip-rating-badge.svgFor more info about the action, see theGithub Action documentation.💡 FeaturesAnalyze the dependenciesrecursively.Report of dependencies withvulnerabilities.Rating according to theage of the projectand thedate of the last release.Use ofstars, number ofcontributors, and other criteria to define acommunity rating.Detect theimpersonalizationof the dependencies using cross references.Support formultiple formats: text, tree, json or only-rating.Read moreabout pip-rating in the documentation.❤️ ThanksThis project developed byNekmo.Pip-rating is licensed under theMIT license.