Code Reviews

• sentinel - PR Test, review, and merge workflow bot.
• pull-review - Assign pull request reviewers intelligently, inspired by mention-bot.
• pull-request-size - Automatically adds GitHub labels based on the size of a pull request.
• Pullie - GitHub App that helps with pull requests (requests reviews, links Jira tickets, reminds users about missing required file changes e.g., changelog entries).
• PullApprove - Allows for fancier rules on how pull requests are approved.

Content License

• ![License: CC BY-SA 4.0 - sa/4.0/) © Contributors 2016-2021

Continuous Integration / Continuous Delivery

• GitHub Actions - Automate your workflow from idea to production.
• Jenkins - Open source automation server that provides hundreds of plugins to support building, deploying and automating any project.
• Jenkins X - Open source CI/CD solution for modern cloud applications on Kubernetes.
• Ortelius - Provides a central catalog of services with their deployment specs, application teams can easily consume and deploy services across cluster.
• Screwdriver - Open source build platform designed for Continuous Delivery.
• Spinnaker - Multi-cloud continuous delivery platform for releasing software changes with high velocity and confidence.
• Tekton - Powerful and flexible open source framework for creating CI/CD systems, allowing developers to build, test, and deploy across cloud providers and on-premise systems.
• Travis CI - A hosted continuous integration service used to build and test software projects hosted at GitHub and Bitbucket.

Contributor License Agreements / Developer Certificate of Origins

• CLA Assistant - Streamline your workflow and let CLA assistant handle the legal side of contributions to a repository for you. CLA assistant enables contributors to sign CLAs from within a pull request.
• Dr CLA - GitHub bot for dealing with Contributor License Agreements.
• DCO Bot - GitHub App that enforces the Developer Certificate of Origin (DCO) on Pull Requests.
• EasyCLA - A Contributor License Agreement (CLA) service used in the Linux Foundation's LFX platform which lets project contributors read, sign, and submit contributor license agreements easily.

GitHub Management

• Steampipe GitHub Plugin - Query GitHub Repositories, Organizations, and other resources with SQL.
• hubcommander - A Slack bot for GitHub organization management.
• Copybara - A tool for transforming and moving code between repositories.
• github-org-scripts - Some helper scripts to manage GitHub organizations via API.
• github-org-mgmt - A few scripts for managing a GitHub organization.
• Automated GitHub Organization Invites - Host a webpage to allow people to click and receive an invite to your GitHub Organization.
• Pepper - A tool for performing actions on GitHub repos or a single repo.
• Grit - A tool to mirror monorepo subtrees to GitHub.
• Sheriff - Controls and monitors organization permissions across GitHub, Slack and GSuite.
• Mariner Issue Collector - Identify open issues across all of your dependencies.
• (Corporate) Git Proxy - Scan outgoing attempts to push to public repository and raise compliance/info-sec friendly checks before allowing the push to complete.
• Stale Repos Action - Get a regular report of inactive repositories in your organization so that you can choose to archive or revive.
• Powerpipe GitHub Sherlock Mod - Interrogate your GitHub resource configurations to identify improvements based on best practices.
• opensource-management-portal - Microsoft's Open Source Portal for GitHub is a tool to help large organizations with GitHub management operations, onboarding and more. It is implemented in Node.js.
• GitHub Settings - Uses .github/config.yml as the source of truth, and any changes to that file in the default branch will update GitHub.
• Forker - A GitHub Action that can automate the creation of fork repositories.

GitHub Metrics and Dashboards

• osstracker - An application that collects information about a GitHub organization and aggregates the data across all projects within that organization into a single user interface to be used by various roles within the owning organization.
• devstats - A toolset to visualize GitHub archives using Grafana dashboards used by the Cloud Native Computing Foundation and Kubernetes.
• MeasureOSS - A contributor relationship management system.
• GrimoireLab - Software development analytics platform supporting more than 30 different data sources, part of CHAOSS Software project from The Linux Foundation.
• Project Portal - Lists all InnerSource (or Open Source) projects of a company in an interactive and easy to use way. Can be used as a template for implementing the "InnerSource portal" pattern by the InnerSource Commons community.
• Issue/PR/Discussion Metrics - A GitHub Action that searches for pull requests/issues/discussions in a repository or organization and measures several available metrics like time to close and time to first response. It calculates the metrics and writes the metrics to a Markdown file. The issues/pull requests/discussions can be filtered by using a search query.
• Augur - A software suite for collecting and measuring structured data about OSS communities.

Governance

• Minimal Viable Governance - Currently in beta - is a repository-based approach for putting lightweight governance into free and open source projects that are run in version control systems. It provides an overall two-tier organizational governance structure for a set of free and open source projects.

In-Kind Donations

• AWS - A program started in 2019 to provide promotional credits to open source projects. Details are in this blog post (Last Updated: April 14, 2021)
• Azure Credits - This program grants Azure credits to open source projects, which developers can use for testing, storage, or other development.

Licensing

• LicensePlist - A command-line tool that automatically generates a Plist of all your dependencies, including files added manually (specified by YAML config file) or using Carthage or CocoaPods.
• ScanOSS - Scan your codebase for snippets and plagerism from large knowledge base of open source projects. Designed to integrate with CI/CD and modern IDEs, to "start left" to do continuous validation instead of one report at the end. Product itself is fully open source.
• Choose A License - Recommends an open source license based on the collaboration style and intended use of a project. The site's appendix provides a helpful birds-eye view of terms across the most common licenses.
• ClearlyDefined - An open source project and a free service that provides a cached copy of licensing metadata for software components through a simple API. Organizations are be able to contribute back any missing or wrongly identified licensing metadata, helping to create a global database that is accurate for the benefit of all, improving compliance and security across the whole software supply chain.
• Licensee - Identify a project's license file.
• askalono - A library and command-line tool to help detect license texts. It's designed to be fast, accurate, and to support a wide variety of license texts.
• License Classifier - A library and set of tools that can analyze text to determine what type of license it contains.
• fossa-cli - Fast, portable and reliable dependency analysis for any codebase.
• dpkg-licenses - A command line tool which lists the licenses of all installed packages in a Debian-based system (like Ubuntu).
• DependencyTrack - An intelligent component analysis platform that allows organizations to identify and reduce risk in the software supply chain.
• SPDX - Set of standards for communicating the components, licenses and copyright associated with a software package.
• LicenseFinder - Find licenses for your project's dependencies.
• ScanCode toolkit - Scan code for licenses, copyright and dependencies.
• OSS Review Toolkit - Enables highly automated and customizable open source compliance checks od the source code and dependencies of a project by scanning it, downloading its sources, reporting any errors and violations against user-defined rules, and by creating third-party attribution documentation.
• Licensed - A Ruby gem to cache and verify the licenses of dependencies.
• TLDRLegal - Summarizes the most common open source licenses in plain English. Provides a quick reference for what a user can, cannot, and must do according to the license terms.
• FOSSology - Scan code for license, copyright and export control information.
• FOSSID - A comprehensive commercial scanner for licenses and vulnerabilities. Knowledgebase covers 78M+ repositories and 600B+ snippets. Includes detailed snippet scanning to detect the license on fragments and copied/pasted code, even if the open source license is not explicitly or correctly declared.

Localization and Internationalization

• zanata - Web-based system for translators to translate documentation and software online using a web browser.
• Respresso - Multiplatform localization converter for iOS (.strings + Objective-C getters), Android (strings.xml) and Web (.json).

Project Quality

• Fosstars - A framework for defining and calculating ratings for open source projects.
• RepoLinter - Lint open source repositories for common issues.
• repo-scaffolding - Scaffolding tools for creating and maintaining projects based on Twitter Open Source standards and best practices.
• Repo Health Check - Analyze a project: How are the maintainers doing?
• Linguist - Identify the programming languages used in a project.
• OpenSSF Best Practices Badge - The Open Source Security Foundation (OpenSSF) Best Practices badge is a way for Free/Libre and Open Source Software (FLOSS) projects to show that they follow best practices. Projects can voluntarily self-certify, at no cost, by using this web application to explain how they follow each best practice. The OpenSSF Best Practices Badge is inspired by the many badges available to projects on GitHub. Consumers of the badge can quickly assess which FLOSS projects are following best practices and as a result are more likely to produce higher-quality secure software.

Security

• Eclipse Steady - Helps to discover, assess and mitigate known vulnerabilities in Java and Python projects. Formerly known as "Vulnerability Assessement Tool" (Vulas).
• DefectDojo - An OWASP flagship DevSecOps platform that streamlines the vulnerability management lifecycle by importing findings from 200+ security scanning tools, deduplicating them, and tracking remediation across products and engagements.

Supply Chain Trust

• OpenChain Conformance - The OpenChain Specification is a way for companies using Free/Libre and Open Source Software (FLOSS) to show that they meet the key requirements for quality compliance programs. Companies can voluntarily self-certify, at no cost, by using this web application.

Websites and Documentation

• VuePress - Vue-based static site generator, optimized for writing technical documentation.
• GatsbyJS - Site generator that allows you to build fast websites and apps with React.
• Docusaurus - React-based static site generator, specifically developed to more easily help create and maintain open source websites.