uzomuzo-oss/config.template.env at main · future-architect/uzomuzo-oss · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
# ============================================================================
# Uzomuzo Configuration Template
# ============================================================================
# Copy this file to use as .env
# Each configuration item has appropriate default values set

# ============================================================================
# GitHub API Configuration (Optional)
# ============================================================================
# GitHub API Token (Optional — adds commit history analysis and fork detection; supplements archived repo detection via GitHub API)
# SECURITY WARNING: Never commit your actual GitHub token to version control!
# Set this as an environment variable or use GitHub CLI authentication:
#   export GITHUB_TOKEN=ghp_your_actual_token_here
# Or leave commented out to use GitHub CLI authentication (gh auth login)
# GITHUB_TOKEN=

# Optional: Override base URL (for GitHub Enterprise)
# GITHUB_BASE_URL=https://api.github.com

# GitHub API timeout and retry settings
# Use Go duration format (e.g., 45s, 2m)
GITHUB_TIMEOUT=45s                    # GitHub API timeout
GITHUB_MAX_RETRIES=3                  # Maximum retry count
GITHUB_MAX_CONCURRENCY=20             # Maximum concurrent processing count (increased for better performance)

# ============================================================================
# deps.dev API Configuration
# ============================================================================
DEPSDEV_BASE_URL=https://api.deps.dev  # deps.dev API base URL
DEPSDEV_TIMEOUT=10s                    # Timeout (use Go duration format)
DEPSDEV_MAX_RETRIES=3                  # Maximum retry count
DEPSDEV_BATCH_SIZE=1000                # Batch size (align with defaults)
DEPSDEV_REQUEST_INTERVAL_MS=500        # Request interval for API load reduction (milliseconds)

# ============================================================================
# Maven Mirror Configuration (Optional)
# ============================================================================
# Set this to use a regional mirror for Maven Central (e.g., Japanese mirror).
# Example: https://repo1.maven.org/maven2 (default Maven Central)
#          https://repo.maven.apache.org/maven2
#          https://maven.aliyun.com/repository/central (example of a mirror)
MAVEN_BASE_URL=

# ============================================================================
# Lifecycle Assessment Configuration
# ============================================================================
LIFECYCLE_ASSESS_TYPE=lifecycle
LIFECYCLE_ASSESS_RECENT_STABLE_WINDOW_DAYS=365
LIFECYCLE_ASSESS_RECENT_PRERELEASE_WINDOW_DAYS=180
LIFECYCLE_ASSESS_MAX_HUMAN_COMMIT_GAP_DAYS=180
LIFECYCLE_ASSESS_LEGACY_FROZEN_YEARS=3
LIFECYCLE_ASSESS_EOL_INACTIVITY_DAYS=730
LIFECYCLE_ASSESS_MAINTENANCE_SCORE_MIN=3.0
LIFECYCLE_ASSESS_VULNERABILITY_SCORE_GOOD_MIN=8.0
LIFECYCLE_ASSESS_VULNERABILITY_SCORE_POOR_MAX=3.0
LIFECYCLE_ASSESS_MAX_BOT_COMMIT_RATIO=0.7
LIFECYCLE_ASSESS_RESIDUAL_ADVISORY_THRESHOLD=1
LIFECYCLE_ASSESS_COMMIT_ACTIVITY_WINDOW_DAYS=365

# ============================================================================
# General Application Configuration
# ============================================================================
LOG_LEVEL=info                        # Log level (debug, info, warn, error)
APP_TIMEOUT_SECONDS=14400             # Overall timeout (seconds, 4 hours)
APP_SAMPLE_SIZE=0                     # Sample size (0=all)
APP_OUTPUT_FORMAT=csv                 # Output format
APP_MAX_PURLS=5000                    # Maximum processable PURL count

# Diff-only mode (set by CLI flag; optional to preset here)
# EOL_DIFF_ONLY=0

# ============================================================================
# Usage Examples & Security Best Practices
# ============================================================================
# 1. Copy this file as .env:
#    cp config.template.env .env
#
# 2. Set GITHUB_TOKEN securely (choose ONE method):
#    a) Environment variable (recommended):
#       export GITHUB_TOKEN=ghp_your_actual_token_here
#    b) GitHub CLI authentication (most secure):
#       gh auth login
#    c) In .env file (NOT recommended for production):
#       echo "GITHUB_TOKEN=ghp_your_actual_token_here" >> .env
#
# 3. IMPORTANT SECURITY NOTES:
#    - Never commit your actual GitHub token to version control
#    - Add .env to your .gitignore file
#    - Use environment variables or GitHub CLI for production deployments
#    - Rotate your tokens regularly
#
# 4. Adjust other settings as needed
#
# 5. Run application:
#    ./uzomuzo pkg:npm/express@4.18.2
#    ./uzomuzo input_file.txt