# Repository health checklist

A fifteen-minute audit of one repository. Each item is a yes/no you can check from the
repository's Settings, its `.github/` directory, or one command. Items are grouped by the
incident they prevent. Free lesson links throughout.

*Modern Git Engineering Toolkit — Free Edition. https://moderngitacademy.com/*

## Default branch

- [ ] Force pushes to the default branch are blocked (ruleset or branch protection).
- [ ] Deletion of the default branch is blocked.
- [ ] A pull request is required to merge; direct pushes are not possible.
- [ ] Administrators are **not** exempt, or the exemption has a written break-glass procedure.
- [ ] Release or long-lived branches (`release/*`) have the same protection.

Lessons: [Branch protection](https://moderngitacademy.com/github/pull-requests/branch-protection/) ·
[Rulesets](https://moderngitacademy.com/github/pull-requests/repository-rulesets/)

## Review

- [ ] At least one approval is required.
- [ ] Stale approvals are dismissed when new commits are pushed.
- [ ] A `CODEOWNERS` file exists, is ordered general-to-specific, and every owner has write access.
- [ ] Code-owner review is *required* for the directories that matter, not just requested.
- [ ] A pull request template exists and asks how to verify the change.

Lessons: [CODEOWNERS](https://moderngitacademy.com/github/pull-requests/codeowners/) ·
[Required reviews](https://moderngitacademy.com/github/pull-requests/required-reviews/)

## Checks

- [ ] CI runs on every pull request and is a **required** status check.
- [ ] CI runs what developers run locally (same commands, pinned tool versions).
- [ ] Every workflow declares `permissions:`; the repository default is read-only.
- [ ] Third-party actions are pinned to a commit SHA, not a tag.
- [ ] No workflow on `pull_request_target` checks out or executes the pull request's code.

Lessons: [Least-privilege permissions](https://moderngitacademy.com/github-actions/security/least-privilege-permissions/) ·
[Pinning actions](https://moderngitacademy.com/github-actions/security/pinning-actions/) ·
[Workflow security](https://moderngitacademy.com/github-actions/security/workflow-security/)

## Secrets

- [ ] Secret scanning is enabled; push protection is enabled.
- [ ] Production credentials live in an **environment** with required reviewers, not in repository secrets.
- [ ] Cloud authentication from CI uses OIDC; no long-lived cloud keys are stored.
- [ ] `.gitignore` excludes `.env`, key files and local config; `git log --all -p -S 'BEGIN PRIVATE KEY'` is empty.

Lessons: [Push protection](https://moderngitacademy.com/security/secrets/push-protection/) ·
[OIDC](https://moderngitacademy.com/github-actions/security/oidc/) ·
[Remove secrets from history](https://moderngitacademy.com/security/secrets/remove-secrets-from-git-history/)

## Dependencies

- [ ] Dependabot (or equivalent) is enabled for the ecosystem *and* for GitHub Actions.
- [ ] Dependency review runs on pull requests.
- [ ] The lockfile is committed and CI installs from it (`npm ci`, `pip install -r` with pins, etc.).

Lessons: [Dependency review](https://moderngitacademy.com/security/code/dependency-review/) ·
[Node CI lab](https://moderngitacademy.com/labs/nodejs-ci-pipeline/)

## Hygiene

- [ ] `README.md` says what the repository is, how to run it, and how to contribute — in that order.
- [ ] Issue templates exist and blank issues are disabled (`.github/ISSUE_TEMPLATE/config.yml`).
- [ ] Stale branches are deleted: `git branch -r --merged origin/main | grep -v main` is short.
- [ ] The repository's visibility and fork settings are deliberate, not defaults.

Lessons: [Repository setup](https://moderngitacademy.com/github/fundamentals/) ·
[Visibility and forking](https://moderngitacademy.com/enterprise/governance/visibility-forking-policies/)

## Score

Count the unticked items. **0–2:** healthy. **3–6:** fix the Default branch and Secrets sections
first. **7+:** run the [team readiness assessment](https://moderngitacademy.com/for-teams/readiness-assessment/)
— the repository is probably not the only one.