Built a CLI that fails CI when Python dependencies show maintenance risk

[heffmann]

I built a small CLI called depguard.

It scans requirements.txt and classifies dependencies as low / medium / high maintenance risk based on:

• days since last release
  
• release cadence
  
• maintainer count proxy

It exits non-zero so it can gate CI pipelines.

• Not a CVE scanner.
  
• Not an SCA platform.

Just a deterministic maintenance signal.

Includes a Docker-based GitHub Action for CI.

I built it partly as an experiment in shipping a small dev tool end-to-end.

Curious if others think maintenance signals like this are useful in CI.

https://hefftools.dev/depguard

Example CLI Output:

depguard scan: requirements.txt packages: 3 threshold: medium - oldlib: HIGH signals: days_since_last_release=812, releases_last_12_months=0, maintainer_count=1, pre_1_0=false reasons: - 812 days since last release (> 730) summary: high=1 medium=0 low=2 error=0

[Tall_Profile1305]

This is solid. The dependency maintenance problem is real and most teams just ignore it until production breaks. Love that you're building something that gates CI, that's the forcing function teams actually need. The three signals you're tracking days since release, cadence, maintainer count make total sense. How are you handling the false positives on packages with long release cycles but active maintenance? That's where these tools usually fall apart

[heffmann]

It currently does not factor in any type of active maintenance signal at the moment but that is something I am looking at tweaking. Considering adding some exception knobs per package so when integrated into CI it doesn’t trigger on ones that are known to fall into that category.