reporemedy 0.1.16

Project:

Package:

Development:

Contents

• Overview
• Installation
• Development
• Additional Information
• License

Overview

RepoRemedy aims to lower the barrier to software engineering best practices in open-source repositories. It will turn RepoAuditor text and OpenSSF Scorecard JSON findings into reviewable issues and pull requests.

How to use RepoRemedy

Read an existing report and write normalized findings and source provenance as JSON:

RepoRemedy inspect report.json --report-type ossf-scorecard --repo acme/demo
RepoRemedy inspect report.txt --report-type repoauditor --repo https://github.gatech.edu/sse-center/sse-resources

Use RepoRemedy inspect --help for inspection options and RepoRemedy --version for the installed version. OWNER/REPO means GitHub.com; use an HTTPS URL or HOST/OWNER/REPO for GitHub Enterprise. Enterprise hosts are retained in the output and Scorecard scan matching, including non-default HTTPS ports.

Gather context and create concrete remedy proposals from an audit report:

RepoRemedy propose report.json --report-type ossf-scorecard --repo OWNER/REPO > proposals.json

propose reads the audited commit when recorded, otherwise main. Use --ref main or a full commit SHA to select a revision explicitly. It resolves catalog inputs and renders an issue or an eligible draft PR, including file contents and diffs. Missing inputs and blocked proposals remain visible. propose makes no GitHub changes. Publish only reviewed selections with explicit confirmation:

RepoRemedy publish proposals.json --repo OWNER/REPO --select security-policy \
  --receipts publication-receipts.json --confirm

See publishing remedies for permissions, stale-content checks, duplicate prevention and receipt recovery.

See proposing remedies for authentication, collected context, maintainer inputs, PR guards and the saved proposal contract.

Generate proposals for several repositories using report-path templates:

RepoRemedy propose-batch demo/batch.json --output batch-results

The batch workflow uses the same remediation behavior as propose, preserves each repository's bundles and summary, and continues after input failures. Exit code 3 identifies partial failure; output directories must be new.

Installation

Verifying Signed Artifacts

Artifacts are signed and verified using py-minisign and the public key in the file ./minisign_key.pub.

To verify that an artifact is valid, visit the latest release and download the .minisign signature file that corresponds to the artifact, then run the following command, replacing <filename> with the name of the artifact to be verified:

uv run --with py-minisign python -c "import minisign; minisign.PublicKey.from_file('minisign_key.pub').verify_file('<filename>'); print('The file has been verified.')"

Development

Please visit Contributing and Development for information on contributing to this project.

Additional Information

Additional information can be found at these locations.

License

RepoRemedy is licensed under the MIT license.