Required checks passing
42%
8 of 19 scored
Failing
11
required checks
Unreadable
0
needs more permissions
CellRank: dynamics from multi-view single-cell data
- Default branch
main- PyPI
- cellrank 2.3.3
- Read the Docs
- cellrank
Template
| Check | Tier | Detail | Fix | |
|---|---|---|---|---|
| ✗ |
Uses cookiecutter-scverse
template/cruft — .cruft.json exists and names the scverse template |
required | No .cruft.json — repo was not generated from the template |
open |
| – |
Template up to date
template/up-to-date — .cruft.json commit matches the latest cookiecutter-scverse release |
required | Does not apply to this repository | |
| ✓ |
src layout + hatchling
template/src-layout — Builds with hatchling from a src/ layout |
recommended | hatchling, src layout | open |
| ✗ |
pre-commit.ci enabled
template/pre-commit-ci — pre-commit.ci runs on pull requests |
recommended | No pre-commit.ci check run on the default branch | open |
| ✗ |
codecov configured
template/codecov — A codecov config or a codecov check run exists |
recommended | No codecov config file and no codecov check run | open |
| ✓ |
Default branch is main
template/default-branch — The default branch is called main |
recommended | Default branch is main |
open |
| – |
Listed in packages.json
template/packages-json — Listed in scverse.org's ecosystem index, under a category the dashboard knows |
informational | Not listed in packages.json |
Documentation
| Check | Tier | Detail | Fix | |
|---|---|---|---|---|
| ✓ |
.readthedocs.yaml present
docs/readthedocs-yaml — A .readthedocs.yaml build config is committed |
required | .readthedocs.yaml present |
open |
| ✗ |
RTD project points here
docs/rtd-linked — The Read the Docs project of the same slug builds *this* repository |
required | RTD cellrank builds https://github.com/theislab/cellrank, expected https://github.com/scverse/cellrank.git |
open |
| ✗ |
≥2 core devs on RTD
docs/rtd-core-devs — At least two scverse core devs can administer the RTD project |
required | 0 of 2 maintainers are core devs; at least 2 required | open |
| ✗ |
Docs on *.scverse.org
docs/scverse-domain — Documentation is served from <package>.scverse.org, not readthedocs.io |
required | Docs served from cellrank.readthedocs.io | open |
| ✓ |
Stable RTD build passed
docs/rtd-build — The most recent build of the stable version succeeded |
recommended | stable built from 17fee14 on 2026-09-16 |
open |
Packaging
| Check | Tier | Detail | Fix | |
|---|---|---|---|---|
| ✓ |
PyPI project owned by scverse
packaging/pypi-org — ownership.organization on PyPI is the scverse org |
required | Owned by the scverse PyPI organization |
open |
| ✓ |
Trusted publishing
packaging/trusted-publishing — The latest release carries PEP 740 attestations naming this repo's workflow |
required | 2.3.3 published by scverse/cellrank/.github/workflows/release.yaml |
open |
| ✓ |
Release workflow hardened
packaging/release-workflow — Publishes via pypa/gh-action-pypi-publish with id-token: write, no password, in an environment |
required | .github/workflows/release.yaml publishes via OIDC from an environment |
open |
| ✗ |
SPEC 0 minimum Python
packaging/spec0-python — requires-python has dropped the Python versions SPEC 0 has dropped |
required | requires-python = ">=3.12" still allows 3.12; SPEC 0 is at 3.13 |
open |
| ✓ |
Immutable releases enabled
packaging/immutable-releases — The repository has immutable releases turned on |
required | Immutable releases enabled | open |
| ✗ |
Recent releases immutable
packaging/releases-immutable — The last few published releases are actually marked immutable |
recommended | 4 of the last 5 are mutable: v2.3.2, v2.3.1, v2.3.0 and 1 more | open |
| ✗ |
`pypi` environment protected
packaging/pypi-environment — A deployment environment named pypi exists and has protection rules |
recommended | No pypi environment (found: deployment) |
open |
| ✓ |
Tag matches PyPI version
packaging/version-sync — The newest GitHub release tag matches the newest PyPI version |
recommended | GitHub v2.3.3 == PyPI 2.3.3 |
open |
Supply chain
| Check | Tier | Detail | Fix | |
|---|---|---|---|---|
| – |
Integration tests passing
integration/upstream-tests — This package's test suite passes in scverse/integration-testing against upstream core packages |
required | Does not apply to this repository | |
| ✗ |
Actions pinned to SHA
security/actions-pinned — Every uses: names a full 40-character commit SHA |
required | 15 of 15 unpinned: actions/checkout@v7, actions/upload-artifact@v7, astral-sh/setup-uv@v7 and 4 more | open |
| ✗ |
pre-commit revs pinned
security/precommit-pinned — Every rev: in .pre-commit-config.yaml is a commit SHA |
recommended | 4 of 4 on tags: [email protected], [email protected], [email protected] and 1 more | open |
| ✗ |
zizmor audit is clean
security/zizmor-clean — A zizmor audit of every workflow, action and Dependabot config reports no findings |
required | 29 findings in 4 files, online: artipacked, cache-poisoning, dependabot-cooldown and 2 more | open |
| ✗ |
Dependabot configured
security/dependabot — .github/dependabot.yml covers both the github-actions and pre-commit ecosystems |
required | Missing ecosystem: pre-commit | open |
| ✓ |
No open Dependabot alerts
security/dependabot-alerts — No unresolved Dependabot security alerts |
recommended | No open Dependabot alerts | open |
| ✓ |
Secret scanning + push protection
security/secret-scanning — Secret scanning and push protection are both enabled |
recommended | Secret scanning and push protection enabled | open |
| ✓ |
Private vulnerability reporting
security/private-vuln-reporting — Researchers can report vulnerabilities privately |
recommended | Private vulnerability reporting enabled | open |
| ✗ |
Minimal workflow permissions
security/workflow-permissions — Every workflow declares a top-level permissions:, and the repo default is read-only |
required | 3 of 3 lack permissions:: build.yaml, release.yaml, test.yaml |
open |
| ✗ |
checkout without credentials
security/persist-credentials — actions/checkout steps set persist-credentials: false (zizmor artipacked) |
recommended | 5 of 5 keep credentials: build.yaml:package, release.yaml:release, test.yaml:get-environments and 2 more | open |
| ✓ |
No unsafe pull_request_target
security/dangerous-triggers — pull_request_target does not check out untrusted PR code (zizmor dangerous-triggers) |
recommended | No workflow uses pull_request_target |
open |
| ✗ |
SECURITY.md
security/security-md — A security policy exists, in this repo or via the org's .github repo |
recommended | No security policy | open |
Branch protection
| Check | Tier | Detail | Fix | |
|---|---|---|---|---|
| ✓ |
Default branch protected
branch/protected — Neither force-pushes nor deletion are allowed on the default branch |
required | Force-push and deletion blocked (classic) | open |
| ✗ |
Requires a pull request
branch/requires-pr — Changes to the default branch must go through a pull request |
required | No pull-request requirement | open |
| ✗ |
Requires ≥1 approving review
branch/requires-review — A pull request needs at least one approving review to merge |
required | Pull requests are not required, so neither are reviews | open |
| ✓ |
Requires status checks
branch/status-checks — At least one status check must pass before merging |
recommended | 2 required: docs/readthedocs.org:cellrank, All tests pass | open |
Governance
| Check | Tier | Detail | Fix | |
|---|---|---|---|---|
| ✓ |
OSI license
governance/license — The repo carries a recognised OSI-approved license |
required | BSD-3-Clause | open |
| ✓ |
GPL-free dependencies
governance/gpl-free — No runtime dependency, direct or transitive, is GPL-licensed, unless the repo is GPL itself |
required | None of 61 runtime dependencies is GPL | open |
| ✗ |
Description, homepage, topic
governance/description-topics — The repo has a description, a homepage and the scverse topic |
recommended | Missing scverse topic |
open |
| ✓ |
Actively maintained
governance/maintained — Pushed to within the last year |
informational | Last push 19 days ago | open |