Tried a public repo but it asked for a personal access token? No thanks. Otherwise great idea, but why should I give a personal access token for something that's publicly available, it really does not inspire confidence.
never pay for something yourself when you can have someone else pay for it. it's a useful concept that can be used in many many cases. the 1%ers love this concept
This should come with a heavy caveat: it’s based on heuristics, and heuristics can be wrong (at best) or maliciously gamed (at worst).
I wish companies would take a simpler approach: stop intermediating your open source interactions through middlemen, and work directly with your upstreams. You might discover that you have too many to work with, in which case you’ve laid the problem bare rather than obscuring it with metrics and policies.
If you have a dependency that is simple and stable, it could appear unmaintained since it doesn't have a lot of recent commits, bug reports, comment history, etc.
If a library author wants to make their package "look" maintained for some reason, they could generate superfluous commits and open and close fake bug reports. This could be a "good" signal to the heuristic, but has no real world benefit or worse-case could be used to lend credibility to a package with known vulnerabilities.
We actually check from how many different organization the last committers belong to and analyze if the most recent commits have be done by bots (like renovate or dependabot)
https://docs.github.com/en/site-policy/github-terms/github-t...
I wish companies would take a simpler approach: stop intermediating your open source interactions through middlemen, and work directly with your upstreams. You might discover that you have too many to work with, in which case you’ve laid the problem bare rather than obscuring it with metrics and policies.
If a library author wants to make their package "look" maintained for some reason, they could generate superfluous commits and open and close fake bug reports. This could be a "good" signal to the heuristic, but has no real world benefit or worse-case could be used to lend credibility to a package with known vulnerabilities.