Plugins & Indicators

This page is auto-generated from src/resqui/plugins/ during docs build.

An indicator is a measurable property of a software repository. resqui maps each indicator to a plugin method that performs the check automatically.

Plugins

Click a plugin name to see its description and the checks behind each indicator.

Plugin Version ID Requires Indicators
ASTMetrics 0.43.1 https://w3id.org/everse/tools/ast-metrics - maintainability_index_ok
CFFConvert 2.0.0 https://w3id.org/everse/tools/cffconvert - has_citation
Gitleaks 8.24.2 https://w3id.org/everse/tools/gitleaks docker has_no_security_leak
HowFairIs 0.15.0 https://w3id.org/everse/tools/howfairis github_token has_license, software_has_license_for_file_types
OEBFAIR 0.2.2 https://w3id.org/everse/tools/fairsoft-evaluator docker, github_token unique_identifier, has_package, has_license, has_documentation, has_releases, descriptive_metadata, listed_in_registry, versioning_standards_use, version_control_use, software_has_tests, repository_workflows, archived_in_software_heritage
OpenSSFScorecard v5.6.0 https://github.com/ossf/scorecard docker, github_token has_ci_tests, human_code_review_requirement, has_published_package, dependency_management, uses_fuzzing, no_critical_vulnerability, static_analysis_common_vulnerabilities, project_is_active, has_no_binary_artifacts, uses_tool_for_warnings_and_mistakes
PySCN 1.30.0 https://w3id.org/everse/tools/pyscn - cyclomatic_complexity_ok, code_duplication_ok, coupling_between_objects_ok, internal_cohesion_ok
RSFC 0.2.0 https://w3id.org/everse/tools/rsfc docker persistent_and_unique_identifier, requirements_specified, has_releases, software_has_citation, software_has_license, software_has_documentation, descriptive_metadata, versioning_standards_use, version_control_use, has_active_contributors, support_issue_tracking, codemeta_completeness, software_has_tests, repository_workflows, archived_in_software_heritage, has_contribution_guidelines, software_is_containerized, archived_in_scholarly_repository, has_active_communication_channels
Rsmetacheck 0.3.6 https://github.com/SoftwareUnderstanding/rsmetacheck - metadata_is_up_to_date
SuperLinter 8.7.0 https://w3id.org/everse/tools/superlinter docker has_no_linting_issues

Plugin details

Indicators are matched to the EVERSE indicator vocabulary by exact name. Some plugins use internal aliases or plugin-specific extensions that don't match a vocabulary abbreviation exactly (for example has_license vs. the vocabulary's software_has_license, or SonarQube's code_quality_grade, which has no vocabulary equivalent) — these show - in the W3ID column rather than a guessed link.

ASTMetrics

Static code metrics with ast-metrics.

Languages: Python, Go, PHP, TypeScript, Rust, Java, C#.

Source file: astmetrics.py

Indicator What it checks W3ID
maintainability_index_ok Measures maintainability index using ast-metrics. maintainability_index_ok
CFFConvert

Validates the CITATION.cff file with cffconvert.

Languages: language-independent.

Source file: cffconvert.py

Indicator What it checks W3ID
has_citation Searches for a 'CITATION.cff' file in the repository root and validates its syntax. -
Gitleaks

Scans the repository history for committed secrets (API keys, tokens, passwords) with Gitleaks.

Languages: language-independent.

Source file: gitleaks.py

Indicator What it checks W3ID
has_no_security_leak Searches for security leaks in the full repository history. -
HowFairIs

Checks the repository against the FAIR software recommendations with howfairis.

Languages: language-independent.

Source file: howfairis.py

Indicator What it checks W3ID
has_license Searches for a file named 'LICENSE' or 'LICENSE.md' in the repository root. -
software_has_license_for_file_types Checks whether the repository is compliant with the REUSE specification using HowFairIs. Reference: https://fair-impact.github.io/RSMD-guidelines/6.Reuse_legal/ software_has_license_for_file_types
OEBFAIR

Evaluates FAIRness with the OpenEBench FAIRsoft evaluator.

Languages: language-independent.

Source file: oebfair.py

Indicator What it checks W3ID
unique_identifier - -
has_package - -
has_license - -
has_documentation - -
has_releases - has_releases
descriptive_metadata - descriptive_metadata
listed_in_registry - listed_in_registry
versioning_standards_use - versioning_standards_use
version_control_use - version_control_use
software_has_tests - software_has_tests
repository_workflows - repository_workflows
archived_in_software_heritage - archived_in_software_heritage
OpenSSFScorecard

Runs security and best-practice checks with the OpenSSF Scorecard.

Languages: language-independent.

Source file: openssfscorecard.py

Indicator What it checks W3ID
has_ci_tests Checks if there are PRs checked by CI-Tests -
human_code_review_requirement Checks if at least half of the changesets in the repository are approved human_code_review_requirement
has_published_package Checks if there are workflows for package releasing (i.e PyPI) has_published_package
dependency_management Checks if there is a dependency update tool in the repository dependency_management
uses_fuzzing Checks if the project integrates fuzzing uses_fuzzing
no_critical_vulnerability Checks if there are vulnerabilities in the repository no_critical_vulnerability
static_analysis_common_vulnerabilities Checks if there are commits checked with a SAST tool static_analysis_common_vulnerabilities
project_is_active Checks if there are commits and issue activity in the last 90 days project_is_active
has_no_binary_artifacts Checks if the project contains binary artifacts has_no_binary_artifacts
uses_tool_for_warnings_and_mistakes Checks whether the project uses a static analysis tool to detect code quality errors or common mistakes. A low Scorecard Static Application Security Testing (SAST) score does not necessarily mean that the project does not use SAST, since Scorecard may not detect all possible SAST setups. Documentation: https://github.com/ossf/scorecard/blob/main/docs/checks.md#sast uses_tool_for_warnings_and_mistakes
PySCN

Code quality analysis of Python projects with pyscn. Returns indeterminate when less than 20% of the repository files are Python.

Languages: Python.

Source file: pyscn.py

Indicator What it checks W3ID
cyclomatic_complexity_ok Measures cyclomatic complexity of Python functions and classes cyclomatic_complexity_ok
code_duplication_ok Detects duplicated code in the Python project code_duplication_ok
coupling_between_objects_ok Measures the coupling between objects (CBO) of the Python classes coupling_between_objects_ok
internal_cohesion_ok Measures internal cohesion (LCOM4) of Python classes internal_cohesion_ok
RSFC

Runs the Research Software FAIRness Checks with RSFC.

Languages: language-independent.

Source file: rsfc.py

Indicator What it checks W3ID
persistent_and_unique_identifier - persistent_and_unique_identifier
requirements_specified - requirements_specified
has_releases - has_releases
software_has_citation - software_has_citation
software_has_license - software_has_license
software_has_documentation - software_has_documentation
descriptive_metadata - descriptive_metadata
versioning_standards_use - versioning_standards_use
version_control_use - version_control_use
has_active_contributors - has_active_contributors
support_issue_tracking - support_issue_tracking
codemeta_completeness - codemeta_completeness
software_has_tests - software_has_tests
repository_workflows - repository_workflows
archived_in_software_heritage - archived_in_software_heritage
has_contribution_guidelines - has_contribution_guidelines
software_is_containerized - software_is_containerized
archived_in_scholarly_repository - archived_in_scholarly_repository
has_active_communication_channels - has_active_communication_channels
Rsmetacheck

Source file: rsmetacheck.py

Indicator What it checks W3ID
metadata_is_up_to_date - metadata_is_up_to_date
SuperLinter

Lints the code base with Super-Linter.

Languages: Python, Java, C, C++, JavaScript, SQL, JSON, YAML and more.

Source file: superlinter.py

Indicator What it checks W3ID
has_no_linting_issues Searches for linting errors. has_no_linting_issues

Interpreting results

Each indicator produces a CheckResult with:

Field Meaning
output The EVERSE assessment schema defines this as true / false / indeterminate. Most plugins (OpenSSFScorecard, SuperLinter, RSFC, OEBFAIR) follow that; a few don't yet and emit their own strings instead — valid/invalid (CFFConvert, HowFairIs, SonarQube), secure/insecure (Gitleaks). Treat those as known drift from the schema, not an intentional per-plugin vocabulary. missing is the CheckResult default before a plugin sets it, not a value plugins return on purpose.
status A Schema.org action status IRI. schema:CompletedActionStatus means the check ran to completion — not that it passed; the schema's own example uses it for both a passing and a failing check. Check output/success, not status, to know whether an indicator passed.
evidence Human-readable finding from the underlying tool

A failing indicator does not abort the run — all configured indicators are always attempted.

Status IDs

Status IRI Meaning
schema:CompletedActionStatus The check ran to completion — used for both pass and fail outcomes
schema:FailedActionStatus The check itself failed to run or complete (e.g. an exception during the check), not a normal "indicator not satisfied" result
missing CheckResult default before a field is set; not typically emitted by plugins