deps-scout

Dependencies Scout

This package aims to provide some insights into the maintainability of a project. It can be used to gather information about a specific library or the entire list of project dependencies, with the objective of identifying potential risks associated with them.

Usage

To use the Dependency Scout, you first have to install it globally using the npm i -g deps-scout command. Then, just run the scout command in your project's root directory to analyze all it's dependencies. If you want to check a single library just use scout <library> <version>. Alternativelly, you can run the package usign npx deps-scout command.

When running in a local project, the scout can evaluate various indicators/metrics by requesting data from different data sources and comparing the obtained values with predefined thresholds. Both the thresholds and the desired indicators are configurable. To do this, simply add a file called scout.config.json to the root folder, an example of the JSON structure is shown below.

{
  "indicators": [
    "is-last-version",
    "is-same-major-version",
    "..."
  ],
  "thresholds": {
    "is-released-frequently": {
      "warningThreshold": 30,
      "alertThreshold": 90
    }
  }, 
  "conditions": {
    "maxAlerts": 2
  }
}

The full list of indicators that can be evaluated, along with their thresholds, is shown below.

Indicator name	Description	Thresholds
is-last-version	Verify whether used version the last released version.	None
is-same-major-version	Verify if the major version matches the last release.	None
is-same-minor-version	Verify if the minor version matches the last release.	None
was-released-recently	Check if the library was released recently according to defined thresholds.	warningThreshold and alertThreshold set the maximum number of days since last release
is-released-frequently	Analyze the average time between releases.	warningThreshold and alertThreshold set the number of days between releases
is-downloaded-frequently	Check the number of weekly downloads that a library has in the public registry.	warningThreshold and alertThreshold set the minimum number of weekly downloads
is-long-living-project	Check the library's creation date to determine if it has been open to the public long enough.	warningThreshold and alertThreshold set the minimum time in days since its creation
is-starred-repo	Look over the number of stars the project repository has in Github.	warningThreshold and alertThreshold set the minimum number of stars
has-open-issues	Look over the number of open issues the project repository has.	warningThreshold and alertThreshold set the maximum number of open issues
has-forks	Consider the number of forks the project repository has.	warningThreshold and alertThreshold set the minimum number of forks
has-enough-observers	Scan the number of observers the repo has.	warningThreshold and alertThreshold set the minimum number of observers
repo-owner-type	Verify the type of owner of the repository, which can be "Organization" or "User"	desiredOwnerType set the repository owner type when one is preferred
is-healthy-repo	Inspect the healt score of the repo based on the Github community profile.	warningThreshold and alertThreshold set the minimum percentage of repo healt score

Besides the indicators and their thresholds, you can configure conditions to stop the analysis of a library. The possible conditions are:

Condition name	Value type	Description
mustBeOk	string[]	All the indicators in the list must be OK, i.e. not Alert nor Warning
shallNotAlert	string[]	The analysis stops if any of the indicators in the list is evaluated as Alert
maxAlerts	number	Number of alerts that trigger the analysis stop condition
maxWarnings	number	Number of warnings that trigger the stop condition

Contributing

Contributions are welcome! If you have any ideas, suggestions, or bug reports, please open an issue or submit a pull request. Make sure to follow the contribution guidelines and abide by the code of conduct when contributing to this project.

License

This project is licensed under the ISC License.