docker/compose audit

Delivery risk audit on GitHub · Analysed 11 Aug 2026 · GitHub

This delivery risk audit analyses the last 90 days of public commit history for docker/compose. It identifies files that concentrate bug-fix activity, measures revert frequency as a signal of release instability, and maps contributor spread to highlight knowledge concentration risk. The risk score weights bug-fix commits and reverts for each file, with higher scores indicating files that have required the most corrective attention in the analysed period.

Top Risk Files

File	Risk	Bug Commits	Reverts	Commit touches
.github/workflows/scorecards.yml	50	5	0	—
go.mod	40	4	0	—
go.sum	40	4	0	—
cmd/compose/config.go	30	3	0	—
pkg/compose/executor_test.go	20	2	0	—
pkg/e2e/config_test.go	20	2	0	—
pkg/e2e/env_file_test.go	20	2	0	—
.github/workflows/ci.yml	10	1	0	—
.github/workflows/docs-upstream.yml	10	1	0	—
.github/workflows/pr-review.yml	10	1	0	—
.go-version	10	1	0	—
cmd/compose/completion.go	10	1	0	—
cmd/compose/config_test.go	10	1	0	—
cmd/compose/scale.go	10	1	0	—
cmd/compose/watch.go	10	1	0	—
Dockerfile	10	1	0	—
internal/oci/resolver_test.go	10	1	0	—
internal/oci/resolver.go	10	1	0	—
pkg/bridge/convert_test.go	10	1	0	—
pkg/bridge/convert.go	10	1	0	—

Other audited repositories

• facebook/react
• tlsnojokes-sudo/DPH-Classifieds_audit
• LiberoNuvola/PRE-RICH-scratch-and-win-game
• kubernetes/kubernetes
• denoland/deno
• opentofu/opentofu
• apache/kafka
• cilium/cilium
• helm/helm
• argoproj/argo-workflows
• istio/istio
• ansible/ansible

All audited repositories →