ossf/criticality_score

What it is

ossf/criticality_score (v2), maintained by the OpenSSF Vulnerability Disclosures WG. The summary covers the algorithm and companion tools; what it omits is the data-freshness problem and the concrete run mechanics an engineer needs before relying on this.

Data is stale, not just relocated

The summary frames the GCP shutdown as data "moving to a static data directory." The page is blunter about why that matters: the public infrastructure has not run since May 2026, and the last successful run completed in July 2025. GCS and BigQuery datasets went offline Aug 2026. So the pre-computed scores in the data/ directory (CSV and JSON) reflect the state of the ecosystem as of mid-2025 and are "updated infrequently" going forward. If you need current scores, you must run the tool yourself against live GitHub data — the published list is over a year stale.

Running it

go install github.com/ossf/criticality_score/v2/cmd/criticality_score@latest
export GITHUB_TOKEN=...
criticality_score -gcp-project-id=[your projectID] https://github.com/kubernetes/kubernetes

Note a token-variable inconsistency in the docs: the quickstart uses GITHUB_TOKEN, while the prerequisites section instructs setting GITHUB_AUTH_TOKEN (to dodge GitHub's unauthenticated rate limits). Verify which your build reads. gcloud auth login --update-adc is optional — pass -depsdev-disable to skip the deps.dev signal and avoid needing GCP auth at all.

Scoring is configurable: -scoring-config takes a YAML weight/threshold file, defaulting to original_pike.yml (Rob Pike's original weighting). Copy and adjust it to reweight signals. Output format is set with -format (text, json, csv).

What a score looks like

Running against kubernetes/kubernetes yields default_score: 0.99107, built from raw signals including contributor_count: 3999, commit_frequency: 97.2, org_count: 5, and dependents_count: 454393. Useful as a sanity baseline when validating your own runs against a config change.

Caveats

The maintainers explicitly solicit community input on the default parameters and note "there will always be exceptions to the individual reasoning rules" — treat the score as a triage heuristic, not a ranking to act on unexamined.