mrkeyoor.com_
Mon 05 Oct 07:11 UTC
Dev Toolsevaluationupdated 05 Oct 2026

github-launch-checklist review

GitHub Launch Checklist is a small Python linter for the public face of a repository. It scores ten signals such as description, topics, README length, license, installation text, community files, and a manually checked social image, then can fail CI below a chosen score.

Verdict

Our GitHub Launch Checklist run installed 36 packages and passed all 26 tests, but code inspection found that its automated score cannot exceed 9.0 even though the README shows 9.5/10. Use it as a five-minute metadata reminder or a narrow regression check in CI. Do not use the number as a launch decision: the tool measures repository presentation with simple string and count rules, not whether the software works.

We ran it

Lab card: what happened when we ran github-launch-checklistScreenshot of github-launch-checklist (buygithub.com/?utm_source=github&utm_medium=readme&utm_campaign=github-launch-checklist)
Install✓ · 22s36 packages · 37 MB
Build✓ · 4s
Tests✓ · 6s26 passed · 0 failed of 26 (pytest)
Known vulns0(pip-audit)
Repo32 files~372 lines of source · 0.3 MB · 4 CI workflows · Dockerfile · tests dir

Answers from our run

Does github-launch-checklist build from source?

Dependencies installed in 22 seconds (36 packages), and the build succeeded in 4 seconds. We cloned commit 201a1a0 into a clean Debian container with 3 CPUs and no project-specific setup.

Do github-launch-checklist's tests pass?

Yes: 26 of 26 passed when we ran the project's own test command (pytest). Some failures need services or credentials a bare container does not have.

Does github-launch-checklist have known vulnerabilities in its dependencies?

pip-audit found none in the dependency tree at the time of our run.

Who should not use github-launch-checklist?

Anyone treating the score as proof that a project is ready: it does not inspect code quality, builds, tests, dependencies, releases, or security controls.

What are the alternatives to github-launch-checklist?

OpenSSF Scorecard, Safe Settings, Repolinter. Our GitHub Launch Checklist run installed 36 packages and passed all 26 tests, but code inspection found that its automated score cannot exceed 9.

Setup5/522-second install, one dependency, and CLI, Action, or Docker paths
Docs3/5Clear usage, but the 9.5 example conflicts with the scoring code
Community2/5379 stars, but one day of code history and no issue activity
Maturity2/5v1.0.1 and 26 passing tests, with shallow hard-coded rules

Who it’s for

Maintainers who want a quick reminder to add common repository metadata before announcing a project.
Teams that want a tiny GitHub Action to prevent a README, license, or issue template from disappearing.
Developers who prefer a JSON report they can wrap in their own launch process.
Public open-source projects that accept simple thresholds as prompts for human review.

Who it’s NOT for

Anyone treating the score as proof that a project is ready: it does not inspect code quality, builds, tests, dependencies, releases, or security controls.
Maintainers who need the advertised 0-10 scale to reach 10: social preview is always manual and receives no point, so the implemented maximum is 9.0.
Teams expecting semantic review: a six-character lowercase name passes as descriptive, and any README containing git clone or a usage heading passes installation.
Projects that need evidence for the README's search-ranking claims: the repository presents fixed topic and word thresholds without supporting measurements.
Mature governance programs that need configurable policy beyond one integer cutoff: the ten checks and their thresholds are hard-coded.

Setup reality

Our fresh Debian sandbox installed commit 201a1a0 in 22 seconds, adding 36 packages and using 37 MB. The build passed in 4 seconds, and all 26 pytest cases passed in 6 seconds. Pip-audit reported 0 known vulnerabilities.

The CLI needs Python 3.9 or newer and network access to GitHub's API. A token is optional for occasional public-repository checks and raises the API allowance for repeated use. The GitHub Action can use the workflow token and fail below a configured integer score.

Docker and a published Action are available. One check, the social preview, cannot be read through GitHub's API and always asks for manual inspection. That implementation caps the automated result at 9.0 even though the README example prints 9.5/10.

Ten checks cover presentation, not software readiness

GitHub Launch Checklist asks whether a repository looks prepared for visitors. It checks the name, description, topic count, README length, license, homepage, installation text, contributing guide, issue templates, and social preview. The command prints a score, emits JSON if requested, and can exit with status 1 below a chosen threshold. That is useful as a memory aid before a public announcement.

The word readiness carries more weight than the code earns. None of the ten checks opens the source, runs the package, examines dependencies, verifies a release artifact, or looks for security policy beyond the license and community profile. A repository can score well while failing to build. Another can lose points for lacking a homepage even when its package and documentation are excellent. Read the result as a presentation checklist, not a product verdict.

The implemented maximum is 9.0, not 10

The social-preview check always returns manual because GitHub's API does not expose that setting. The scoring function gives 1 point to a pass and half a point to a warning, but gives no point to manual. The project's own test calls a repository with all 9 machine checks passing a perfect score and asserts 9.0. There is no input that turns social preview into a pass.

That conflicts with the README in two ways. The tool advertises ten checks scored 0 to 10, while the implementation tops out at 9.0. Its sample output shows 9.5/10 with social preview marked for manual inspection, which the current score() function cannot produce. This is visible in version 1.0.1, not an inference from our sandbox. Users setting --fail-under 10 create a gate that no repository can satisfy.

What happened when we ran it

Our sandbox installed commit 201a1a0 in 22 seconds, adding 36 packages and occupying 37 MB. The build succeeded in 4 seconds. The environment was a fresh unprivileged Debian container with 3 CPUs, 8 GB of RAM, Python 3.12, and no secrets. Pip-audit reported 0 known vulnerabilities.

Pytest completed in 6 seconds with 26 passed and 0 failed. The checkout contained 32 files, about 372 lines of source, and used 0.3 MB before installation. The repository includes 4 CI workflow files, a Dockerfile, and a tests directory. These are strong mechanics for a tool this small. They prove the supplied checks behave as tested, including the 9.0 ceiling; they do not validate the tool's search or launch advice.

String matching makes several passes easy to earn

A repository name passes if it is at least 6 characters, contains a lowercase letter, and is not one of nine generic words. The function does not decide whether the name describes the software or matches a real search. A random lowercase string can receive the same point as a precise name. The output still labels that result descriptive and searchable, which overstates what was checked.

Installation detection is similarly broad. A README passes if its lowercase text contains one of several markers, including git clone, ## usage, or quick start. The command does not verify that the matching section contains a complete or working instruction. README quality is a word count: 300 words passes, 100 to 299 warns, and less than 100 fails. The 5-topic threshold is also fixed, regardless of project type.

These rules can still catch omissions. A missing license, empty About line, absent issue template, or README with no obvious start section is worth fixing. The trouble begins when the detail string turns a cheap proxy into a factual judgment. A better local use is to rename the result in your own process: it is a metadata lint score.

The Action is convenient for preventing regressions

The CLI runs on Python 3.9 or newer and depends on Requests. It accepts owner/repo, an optional GitHub token, JSON output, and either --strict or --fail-under. The composite GitHub Action installs Requests, uses the workflow token by default, and runs the same script. A Docker image provides a third route. Occasional checks of public repositories do not require sign-up.

As a regression gate, the hard-coded checks make more sense. If your project has decided it must keep a license, install section, 5 topics, and issue templates, a score below 8 can flag accidental removal. That still leaves an awkward property: one changed field can be hidden by another field improving. CI systems that care about a specific file should check that file directly instead of relying only on the total.

Version 1.0.1 shipped after one day of repository history

The repository was created and last pushed on September 17, 2026. Release v1.0.1 shipped that day with the GitHub Action, Docker image, and configurable failure threshold. GitHub showed 379 stars, 9 forks, and 0 open issues or pull requests when checked. Zero open items does not demonstrate long-term stability; here it accompanies a project whose visible code history spans one day.

Use GitHub Launch Checklist before announcing a small public repo, especially if you tend to forget the About line or community files. Its 26 passing tests and simple deployment paths make it easy to try. Keep the result in proportion. A 9.0 says nine metadata conditions matched; it does not say users can install the software, that GitHub will rank it, or that the launch is ready.

Alternatives

ProjectWhat it isPick it when
OpenSSF ScorecardA repository assessment focused on supply-chain and security practices.pick this instead when branch protection, dependency updates, dangerous workflows, and security posture matter more than launch copy.
Safe SettingsA GitHub App for applying repository settings from declarative policy.pick this instead when you need to enforce organization settings rather than score ten presentation checks.
RepolinterAn archived but configurable linter for open-source repository standards.pick this instead when custom rules matter and you can accept an archived upstream.

What people are saying

  1. [velocity-scout] repoboost-hq/github-launch-checklist

Sources

  1. GitHub Launch Checklist README
  2. GitHub Launch Checklist source
  3. GitHub Launch Checklist tests
  4. GitHub Launch Checklist v1.0.1

More dev tools reviews

learning-python · blitzstrike · AirCard · github-ranking-audit · gpt_sub_analysis · PythonRobotics · the whole board →