google / google/deps.dev

Explicitly surface cases where the source repository is archived

Open
#99 0 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
443
Forks
54
Avg merge
1d 22h
Merged PRs (30d)
3

Description

Similar to #92 and as suggested in https://github.com/golang/go/issues/68316 is the ability to surface when a package is not officially surfaced as deprecated, but the package's source repository itself is archived, which is a strong indication that the package is no longer maintained.

I've been calculating this metadata using https://ecosyste.ms up until now, but this would also be of worth to surface inside deps.dev too.

We - for the most part - already have this indication for a given package through our OpenSSF Security Scorecards, for instance on https://deps.dev/go/github.com%2Fgolang%2Fmock we see that we pull Scorecard data which can be separately retrieved from the API:

```
curl 'https://api.deps.dev/v3/projects/github.com%2Fgolang%2Fmock'
{
"date": "2024-06-10T00:00:00Z",
# ...
{
"name": "Maintained",
"documentation": {
"shortDescription": "Determines if the project is \"actively maintained\".",
"url": "https://github.com/ossf/scorecard/blob/6d8f701a9d42e9249ac497542886b45abeff09d9/docs/checks.md#maintained"
},
"score": 0,
"reason": "project is archived",
"details": [
"Warn: Repository is archived."
]
},
# ...
```

However, we'd probably need to add some additional handling to either:

- work out if the `Maintained` score is due to the project being archived vs just not having any updates in the last 90 days
- perform the "is archived" check in deps.dev's codebase itself

And then surface this data into the API as a new field `is_source_repo_archived` (or similar)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.