Skip to content

docs(wrap-up): add REUSE, pre-commit, OSV-Scanner, Copier as next-stop resources #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jt14den wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs(wrap-up): add REUSE, pre-commit, OSV-Scanner, Copier as next-stop resources #15

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion episodes/wrap-up-reflect.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,7 +150,7 @@ There is no single right answer; the artifact is the point. A strong playbook na

### Going further: the next layer

Citable and discoverable is the foundation, not the finish line. Once a project has a license, a citation file, and a DOI, the next questions are about *project health*: is it secure, maintained, and safe to build on? [OpenSSF Scorecards](https://securityscorecards.dev/) scores a repository against those practices and is becoming a common signal across the open-source ecosystem, though it is a separate skill from what we covered here. On the credit side, the [FORCE11 Software Citation Principles](https://doi.org/10.7717/peerj-cs.86) are the standard the `CITATION.cff` work in this lesson rests on. Both are good next stops for anyone building out an academic OSPO's teaching.
Citable and discoverable is the foundation, not the finish line. Once a project has a license, a citation file, and a DOI, the next questions are about *project health*: is it secure, maintained, and safe to build on? [OpenSSF Scorecards](https://securityscorecards.dev/) scores a repository against those practices and is becoming a common signal across the open-source ecosystem, and [REUSE](https://reuse.software/) does the same specifically for license and copyright compliance — both are a separate skill from what we covered here. On the credit side, the [FORCE11 Software Citation Principles](https://doi.org/10.7717/peerj-cs.86) are the standard the `CITATION.cff` work in this lesson rests on. All three are good next stops for anyone building out an academic OSPO's teaching.

::::::::::::::::::::::::::::::::::::::::::::::::

Expand All @@ -164,6 +164,11 @@ Citable and discoverable is the foundation, not the finish line. Once a project
- **Zenodo**: <https://zenodo.org>
- **Pixi**: <https://pixi.sh>
- **Choose a License**: <https://choosealicense.com>
- **OpenSSF Scorecard**: <https://securityscorecards.dev/>
- **REUSE**: <https://reuse.software/>
- **pre-commit**: <https://pre-commit.com/>
- **OSV-Scanner**: <https://google.github.io/osv-scanner/>
- **Copier**: <https://copier.readthedocs.io/>

### UC-Specific Resources *(for UC campus learners)*
- **UC OSS Chart**: <https://security.ucop.edu/files/documents/resources/oss-chart.pdf>
Expand Down
24 changes: 24 additions & 0 deletions learners/reference.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,9 @@ CFF (Citation File Format)
CODE Beyond FAIR
: A 2026 research software roadmap (Di Cosmo et al., *Scientific Data*) that extends FAIR principles for software. The CODE pillars are: **C**ollaborate, **O**pen, **D**ocument, **E**xecute. Recommends Software Heritage archiving alongside DOI-based citation.

Copier
: A template engine for scaffolding a new repository from a reusable project template (tests, CI, documentation, licensing, community files) and reapplying template updates to existing repos later. Used by research-software templates such as the Netherlands eScience Center's Python template.

DataCite
: The DOI registration agency for research data and software. When you mint a DOI on Zenodo, DataCite registers it. DataCite metadata is harvested by library catalogs, OpenAlex, and other scholarly discovery systems.

Expand All @@ -31,15 +34,27 @@ Link rot
Lockfile
: A file generated by an environment manager (e.g., `pixi.lock`, `conda-lock.yml`) that records the exact version of every dependency, including transitive dependencies. A lockfile enables byte-for-byte environment reproducibility across machines and time.

OpenSSF Scorecard
: A tool from the Open Source Security Foundation that scores a repository against security and maintenance best practices — CI presence, code review requirements, pinned dependencies, and more. Runnable locally or as a GitHub Action; a common signal for assessing whether a project is safe to build on.

ORCID
: Open Researcher and Contributor ID. A persistent identifier for individual researchers, analogous to a DOI for people. Including ORCIDs in `CITATION.cff` and Zenodo metadata ensures author credit is unambiguous regardless of name changes or institutional affiliations.

OSV-Scanner
: A command-line tool from Google's Open Source Vulnerabilities (OSV) project that scans a repository's dependency lockfiles and manifests for known security vulnerabilities.

pixi
: A modern, cross-platform environment manager supporting Python, R, and other languages. Uses `pixi.toml` to declare dependencies and generates a `pixi.lock` file for reproducibility. See also: conda, mamba, pip/venv, renv (R).

pre-commit
: A framework for managing and running git hooks (formatting, linting, secret scanning) across multiple languages from a single `.pre-commit-config.yaml` file per repository.

Research software
: Software created or used in a research context — including analysis scripts, data processing pipelines, simulation models, and tools that support research workflows. Distinct from general-purpose software in that it is often created by researchers rather than professional software developers, and its outputs are part of the scientific record.

REUSE
: A specification and command-line tool (`reuse lint`) from the Free Software Foundation Europe for machine-readable license and copyright compliance, based on SPDX identifiers. Catches missing or inconsistent license headers.

Semantic versioning (SemVer)
: A versioning convention using `MAJOR.MINOR.PATCH` (e.g., `v1.2.0`). MAJOR increments signal breaking changes; MINOR signal new features; PATCH signal bug fixes. Starting at `0.x.x` indicates the software is in initial development.

Expand Down Expand Up @@ -110,6 +125,15 @@ Zenodo Sandbox
- Keep a Changelog (changelog format guide): <https://keepachangelog.com/>
- GitHub community health documentation: <https://docs.github.com/en/communities/setting-up-your-project-for-healthy-contributions>

### Project Health & Security

- OpenSSF Scorecard: <https://securityscorecards.dev/>
- REUSE: <https://reuse.software/>
- pre-commit: <https://pre-commit.com/>
- OSV-Scanner: <https://google.github.io/osv-scanner/>
- Copier (research-software template engine): <https://copier.readthedocs.io/>
- NLeSC Python template (example Copier template): <https://github.com/NLeSC/python-template>

### Metadata and Discoverability

- DataCite Metadata Schema: <https://schema.datacite.org/>
Expand Down
Loading