Verification · Supply chain · Dependency risk assessment
Project health scoring
Score a dependency's repository practices (branch protection, signed releases, CI).
How to build it
- Run a repository health scan on each new dependency and record the score.
- Set a score threshold below which a reviewer must sign off.
- Re-run the scan when the dependency is upgraded.
Signals in a repository
- A scorecard or ossf/scorecard-action step in a workflow.
- A dependency review file that lists scores or required sign-offs.
- A written reviewer rule that names the score threshold.
In practice
No scanned repository runs a tool for this check. The steps above are the only guidance.