reporemedy 0.1.18

Project:

Package:

Development:

Contents

• Overview
• Installation
• Development
• Additional Information
• License

Overview

RepoRemedy aims to lower the barrier to applying software engineering best practices in open-source software (OSS) repositories.

Who is the target audience?

RepoRemedy is targeted towards two main audiences:

1. OSS maintainers who are interested to have an interactive and batched approach to fixing best practices issues in their repos. RepoRemedy allows for interactive exploration of common improvements as well as automated issue and PR generation to apply common "remedies" to a repository.
2. OSS auditors who are interested in investigating and potentially applying fixes to multiple repositories. This audience might be an organizational or academic Open Source Program Office (OSPO) or a maintainer who manages a larger number of repositories. RepoRemedy allows for easier management and potentially replication of common fixes across repositories.

How to use RepoRemedy

RepoRemedy has three steps where each step is a separate command. Only the last step makes changes to a GitHub repository.

Reports come from RepoAuditor and Scorecard; see generating input reports. Use --interactive to run all three steps in one terminal session for a single repository.

1. Inspect

inspect reads an existing report and writes normalized findings and source provenance as JSON.

RepoRemedy inspect scorecard_report.json --report-type ossf-scorecard --repo gt-csse/reporemedy-live-fixture
RepoRemedy inspect report.txt --report-type repoauditor --repo https://github.com/gt-csse/reporemedy-live-fixture

Use RepoRemedy inspect --help for inspection options and RepoRemedy --version for the installed version. For GitHub Enterprise, use an HTTPS URL or HOST/OWNER/REPO.

2. Propose

propose gathers context and creates concrete remedy proposals from an audit report:

RepoRemedy propose report.json --report-type ossf-scorecard --repo gt-csse/reporemedy-live-fixture > proposals.json

propose will read the audited commit and branch used for a input report but can also use main. Use --ref main or a full commit SHA to select a revision explicitly. It resolves catalog inputs and renders an issue or an eligible draft PR, including file contents and diffs. Missing inputs and blocked proposals remain visible. propose makes no GitHub changes.

See repository context for authentication, collected context, maintainer inputs, PR guards and the saved proposal contract.

3. Publish

Publish only reviewed selections, with explicit confirmation:

RepoRemedy publish proposals.json --repo gt-csse/reporemedy-live-fixture --select security-policy \
  --receipts publication-receipts.json --confirm

See publishing remedies for permissions, stale-content checks, duplicate prevention and receipt recovery.

Interactive mode

To select and review remedies interactively for one repository, add --interactive. The session saves your selections to a plan file:

RepoRemedy inspect report.txt --report-type repoauditor --repo gt-csse/reporemedy-live-fixture --interactive
RepoRemedy inspect --resume remedy-plan.json
RepoRemedy publish --plan remedy-plan.json

publish --plan takes the plan file saved by an interactive session whereas publish proposals.json takes the output of propose run without an interactive session or other flags.

The interactive workflow supports bulk selection, input forms, issue/PR previews, save/resume and confirmed publication. Without --interactive, inspect prints findings as JSON to stdout and writes no file.

Several repositories

Generate proposals for several repositories using report-path templates:

RepoRemedy propose-batch demo/batch.json --output batch-results

The batch workflow uses the same remediation behavior as propose, preserves each repository's bundles and summary, and continues after input failures. Exit code 3 identifies partial failure; output directories must be new.

Installation

Verifying Signed Artifacts

Artifacts are signed and verified using py-minisign and the public key in the file ./minisign_key.pub.

To verify that an artifact is valid, visit the latest release and download the .minisign signature file that corresponds to the artifact, then run the following command, replacing <filename> with the name of the artifact to be verified:

uv run --with py-minisign python -c "import minisign; minisign.PublicKey.from_file('minisign_key.pub').verify_file('<filename>'); print('The file has been verified.')"

Development

Please visit Contributing and Development for information on contributing to this project.

Additional Information

Additional information can be found at these locations.

License

RepoRemedy is licensed under the MIT license.