Code quality score factors

Code quality scores provide a view of code quality and adherence to best practices in a repository. Code quality information is based on metadata gathered from a code hosting and version control system such as GitHub and from the source code in the repository.

The following factors have a positive contribution to the code quality score:

  • Activity from bot accounts shows that the project is using automation for some development tasks
  • The repository has reached 1.0 release status indicating the first major release milestone and is a sign of maturity
  • The project includes test code.
  • Attaching labels to issues allows for better tracking of issue activity in the project
  • The repository has multiple files that cover basic operational aspects of the project and this shows a strong emphasis on best practices
  • A large fraction of the commits in this repository are verified; this shows that security best practices are followed
  • Pull requests from dependency management bot accounts indicate that the project is using automation to keep its dependencies up to date
  • Attaching labels to pull requests helps organize the development activity in the project
  • Pull requests from bot accounts indicate that the project is using automation for development tasks
  • A large faction of the commits in this repository is associated with a pull request; this shows that development best practices are followed
  • The repository has released signed artifacts which is a sign of mature security operations
  • The use of continuous integration is a sign of good developer practices
  • Using GitHub templates to manage issues shows that the development work in the repository is well-organized
  • The repository includes badges.
  • Displaying the Code Coverage badge means that the repository is using code coverage tools in its development process
  • Displaying the Core Infra Best Practices badge means that the repository has met a number of best practices requirements
  • The repository includes documentation making it easier to understand and use.
  • The repository has files that cover basic operational aspects of the project and this shows an emphasis on best practices
  • The repository uses CI and a high fraction of commits pass the CI checks which is a sign of good code quality
  • Displaying the OSSF scorecards badge means that the repository strives to meet the OSSF scorecard checks

The following factors have a negative contribution to the code quality score:

  • This package has a large number of instances of likely incorrect code that is associated with coding issues and potential bugs
  • This package has a large number of instances of questionable code warnings that are associated with coding issues and potential bugs
  • This project has a high number of indirect dependencies compared to the number of direct dependencies; this additional code increases the cost of building the project and its supply chain risk.
  • The repository has many major releases in a short amount of time, this is a sign of high churn and potential instability
  • Packages where the package manager license information does not agree with the license information found in the code require additional review
  • Packages with multiple licenses require extra effort to determine their exact license status
  • Multiple unpinned dependencies can significantly increase the risk of a codebase since packages can be updated at any moment
  • Many unreachable direct dependencies unnecessarily increase the size of the codebase and the cost of building it
  • The project does not have an automated build system.
  • The repository does not have any of the files that typically explain the basic operational aspects of the project, this may be an indication that the project is not well-maintained
  • Packages or source code without license information or a restrictive license can create operational risk
  • This release is old and has been superseded by multiple newer releases, it should not be used
  • The repository has releases that do not follow the SemVer standard, this goes against best practices
  • When a repository contains binary files it is harder to analyze and assess its functionality and risks
  • Lack of access to the source code of the project dramatically limits visibility in its quality and adherence to best practices
  • The repository has an unusually fast first release.