Open Source Red Flag Checker

This projects evaluates remote repositories by looking for typical red flags like CLAs (Contributor Licensing Agreements) but also indicators for governance, activity or licensing conditions we consider as good.

Table of contents

• Features
• Installation
• Usage
• Caveats
• Similar approaches
• License and copyright

Features

Searched data

The checker looks for the following data in remote repositories:

• CLA (Contributor License Agreement) mentioned in files and pull requests
• DCO (Developer Certificate of Origin) mentioned in files and pull requests
• inbound=outbound mentioned in files
• Existence of LICENSE/COPYING file
• Human and bot contributors to the project (based on Github stats)
• Last commits made by humans and bots

Analysis based on data

Red flags:

• CLA mentioned in README or CONTRIBUTING files
• CLA as part of pull request actions/statuses
• No LICENSE/COPYING file in the repository
• The project only contains contributions by one person
• The last commit is more than 1 year old

Yellow flags:

• The project's main developer made more than 75% contributions than the next 10 most active contributors
• The last human commit is more than 1 year old but there have been newer commits made by bots (like dependabot or renovate)
• The last human commit is more than 90 days old

Green flags:

• DCO mentioned in README or CONTRIBUTING files
• DCO as part of pull request actions/statuses
• inbound = outbound mentioned in README or CONTRIBUTING files
• The project has an acceptable contribition distribution by multiple active developers
• The last human commit is less than 90 days old

Installation

We recommend to run this tool via poetry that takes care of installing the correct dependencies in a clean environment.

• python >= 3.8
• poetry >= 1.1.0

Inside of the repository, run poetry install once and you are ready to go. If you update the repository, run this command again to fetch new versions and dependencies.

Usage

You can find all supported flags by running poetry run ossrfc --help.

Basic examples:

# Check a remote repository
poetry run ossrfc -r https://github.com/hashicorp/terraform
# Cache the cloned repository so subsequent checks are faster
poetry run ossrfc -r https://github.com/hashicorp/terraform --cache
# Return the results as JSON
poetry run ossrfc -r https://github.com/hashicorp/terraform --json
# Do not check for CLAs and DCOs in pull requests
poetry run ossrfc -r https://github.com/hashicorp/terraform -d cla-dco-pulls
# Ignore findings about contribution distribution
poetry run ossrfc -r https://github.com/hashicorp/terraform -i contributions
# Provide a list of repositories to be checked
poetry run ossrfc -f repos.txt

Here's a possible output in both the Markdown view as well as in JSON:

# Report for hashicorp/terraform (https://github.com/hashicorp/terraform)

* 🚩 Licensing: A mention of Contributor License Agreements in the following file(s): .github/CONTRIBUTING.md
* 🚩 Licensing: A check for Contributor License Agreements in at least one status in pull request(s): 33656
* ✔ Contributions: The project has multiple contributors with an acceptable contribution distribution
* ✔ Contributions: The last commit made by a human is less than 90 days old (1 days)

{
  "json_version": "1.0",
  "disabled_checks": [],
  "ignored_flags": [],
  "debug_mode": false,
  "repositories": [
    {
      "url": "https://github.com/hashicorp/terraform",
      "shortname": "hashicorp/terraform",
      "red_flags": [
        "cla",
        "cla"
      ],
      "yellow_flags": [],
      "green_flags": [
        "distributed-contributions",
        "actively-developed"
      ],
      "cla_files": [
        {
          "file": ".github/CONTRIBUTING.md",
          "indicators": [
            "- Contributor License Agreement (CLA): If this is your first contribution to Terraform you will be asked to sign the CLA."
          ]
        }
      ],
      "cla_pulls": [
        {
          "pull_request": 33656,
          "type": "status",
          "url": "https://api.github.com/repos/hashicorp/terraform/statuses/b53d89a08df10c85f6d4c546d2e54d4fab886d67",
          "indicators": [
            "Contributor License Agreement is signed.",
            "license/cla"
          ]
        }
      ],
      "dco_files": [],
      "dco_pulls": [],
      "inoutbound_files": [],
      "licensefiles": [
        "LICENSE"
      ],
      "maintainer_dominance": -2.83,
      "days_since_last_human_commit": 1,
      "days_since_last_bot_commit": 141,
      "analysis": [
        {
          "category": "Licensing",
          "ignored": false,
          "severity": "red",
          "indicator": "A mention of Contributor License Agreements in the following file(s): .github/CONTRIBUTING.md"
        },
        {
          "category": "Licensing",
          "ignored": false,
          "severity": "red",
          "indicator": "A check for Contributor License Agreements in at least one status in pull request(s): 33656"
        },
        {
          "category": "Contributions",
          "ignored": false,
          "severity": "green",
          "indicator": "The project has multiple contributors with an acceptable contribution distribution"
        },
        {
          "category": "Contributions",
          "ignored": false,
          "severity": "green",
          "indicator": "The last commit made by a human is less than 90 days old (1 days)"
        }
      ]
    }
  ]
}

Caveats

Opinionated analysis

The analysis and decisions for how certain indicators are considered red, yellow or green flags is highly opinionated and represents a snapshot about our (DB Systel GmbH's) current thinking.

You are free to use this tool. If certain criteria is not relevant for you, consider using the --ignore or --disable flags.

In the long run, it may be feasible to make the ratings configurable. Contributions are welcome if you are interested in it.

Similar approaches

There are different initiatives that intend to evaluate the health or risks of Open Source projects. All of them have their particular focuses, strengths and weaknesses.

• OpenSSF with a focus on security and their scorecards
• CHAOSS with a focus on metrics about community health and metrics models

License and copyright

The content of this repository is licensed under the Apache 2.0 license.

This repository is REUSE compliant. You can find licensing and copyright information for each file in the file header or accompying files.

The project has been started by DB Systel GmbH. We welcome contributions from everyone.