My repository health tool gave Chromium a score. It had only seen part of it.

I build a small CLI called : partial scans are surfaced explicitly, the tool says "unknown" when it cannot verify repository visibility, .env loading is gone, GitHub Actions are pinned to full commit SHAs with narrowed workflow permissions, and internal operational identifiers were moved out of tracked files. The fixes were written test-first, and each one became a standing rule in the project's contributor docs — so the lessons outlive my memory of the review.

If you want the honest-coverage behavior in your own CI, it's two lines now:

- uses: 3ssiri/RepoPulse@v1

  with:

    fail-under: "70"

The report lands in your workflow run summary, and score, grade, and truncated come out as step outputs — so your pipeline can distinguish "this repository scored 62" from "this repository scored 62 of the part we could see."

That distinction is the whole article, really.

RepoPulse is MIT-licensed: pip install repopulse-cli (the CLI is repopulse; the unhyphenated PyPI name is an unrelated package). Repo: https://github.com/3ssiri/RepoPulse — false-positive reports from real repositories are the contribution I want most.