oss-hygiene

What problem does it solve?

oss-hygiene brings a public GitHub repository up to baseline community and supply-chain standards by scaffolding missing community health files, enabling key security workflow assets, and performing a safety audit of existing workflows so contributors and reviewers have clear guidance and automated checks.

Core Features & Use Cases

• Community Standards scaffolding: Adds Contributor Covenant code of conduct, contributing, security policy, issue templates (forms), and a PR template, while surfacing gaps like missing or project-specific license without silently generating one.
• OpenSSF Scorecard supply-chain posture: Writes Dependabot version-update configuration, dependency review and CodeQL workflows when applicable, and provides badge registration guidance by reading the README and printing the correct registration snippet.
• Security hardening via read-only audit: Detects risky GitHub Actions patterns including missing or overbroad permissions: (Token-Permissions) and dangerous pull_request_target + checkout behavior (Dangerous-Workflow), then reports findings without auto-editing.

Quick Start

Run oss-hygiene on your public repo by telling your AI harness: "Set up OSS hygiene for the GitHub repository at https://github.com/<owner>/<repo>, using safe defaults and asking before overwriting any existing community files."