Check C7 · provenance family · severity HIGH · automatic · one of the 22 checks
The question this check asks: is anyone still looking after this? Has it been archived, has it seen a commit in the last year, and — if it publishes releases at all — has it published one?
The OpenSSF baseline asks for commits within twelve months and a release within twelve months, because a dependency nobody maintains is a vulnerability nobody will fix. The repository vetting standard adds the owner's own requirement — a project you build on with no release in over a year is a support risk even if commits still land — and then says the important thing about the whole group: necessary, nowhere near sufficient. Maintenance tells you what you are taking on. It tells you nothing about what was put there.
C7 reads three fields and produces up to three findings, none of which blocks on its own.
Archived — the repository's archived flag is set. Severity HIGH, 12 points, “repository is archived — unmaintained”. Verdict REVIEW at 88; the default policy warns. Evidence note: “unmaintained”.
Stale — no push in more than 365 days. Severity MEDIUM, 6 points, “no push in N days (OpenSSF: activity within 12mo)”. Verdict REVIEW at 94; warns. Evidence note: “OpenSSF activity window”.
Stale release — the repository uses releases and the latest is more than 365 days old. Severity MEDIUM, 6 points, “latest release is N days old — vulnerability/support risk if you build on it”. Repositories with no releases at all do not fire this; it is only meaningful where releases are the way the project ships. Evidence note:
“owner requirement: no release >1y = support risk”
Both windows are policy parameters (stale_push_days, stale_release_days, 90 to 1,095). Nothing in this check adds points: a recent push is the absence of a warning, not a credit.
Finished software. A small tool that has needed no change for two years is not abandoned, it is done, and archiving is how a careful maintainer says so. The board shows which of the three fired and the number of days, and the decision is yours; a repository you rely on and know to be complete belongs on your allowlist.
Malice, in either direction. Every FakeGit repository was brand new and busy, and passed all three findings by construction. A compromised account's last push was last week, and that push is what you are worried about. A project's activity has no bearing on the release asset it just attached or the devcontainer it just added. This check is the OpenSSF hygiene baseline, scored as hygiene, and it is the reason the group's severities are what they are.
And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, or fetches made by AI agents outside the browser.
Without installing anything: an archived repository carries a banner across the top of its page; the last commit date is beside the branch name; the latest release is in the sidebar. With the GitHub CLI:
gh api repos/OWNER/REPO --jq '{archived, pushed_at, has_releases: (.has_downloads)}'
gh release list --repo OWNER/REPO --limit 1Then decide whether "done" or "abandoned" is the word — and remember that neither one is "safe".
Is an unmaintained repository dangerous? It is a support and vulnerability risk if you build on it, which is different from a lure. Finished software exists, and a tool that has needed no commit for two years may simply be done. That is why archived costs 12 points, a stale push or release 6, and all three warn rather than block: they tell you what you are taking on, not what was done to you.
Why does an active repository not score better? Because activity is the easiest thing in the world to fake and the FakeGit repositories were all brand new and busy. A recent push is the absence of a warning, not a credit. Nothing in this check can raise a score, and nothing about recency distinguishes a maintained project from a fresh lure or a compromised account that just pushed.
Does RepoGates stop git clone? No. Browser-initiated downloads only.
C6 Licence — the third question of the same baseline · C8 OpenSSF Scorecard — process hygiene measured by the OpenSSF itself · C2 Repository age — the other end of the timeline.
Add RepoGates to Chrome Pricing
Numbers on this page: the OpenSSF baseline as cited in the repository vetting standard; thresholds and weights from the product's policy and scoring tables.