Open Commitment Issues

Inspiration

Does your open-source dependency have commitment issues?

You’ve built your project around it. You trust it. Then the releases stop, the issues pile up, and your relationship status becomes… complicated.

We built Open Commitment Issues to support the open-source community we depend on. Behind every library is someone maintaining it, often alongside work, school, and other responsibilities. Meanwhile, developers who want to give back face a difficult question: Where do I start?

We wanted to connect projects that need attention with people who want to help. It’s not you, it’s Git.

What it does

We help developers understand which projects may be losing maintenance support, explore security risks, and find opportunities to contribute.

Across the 1,000 popular repositories we track, our dataset contains 3,682 GitHub security advisories. That makes understanding both maintenance health and security risk essential.

Open Commitment Issues helps in two ways:

1. Before you commit: understand the risk. Our autonomous investigation agent examines worrying repositories and produces a maintenance verdict: healthy, watchlist, or at risk. Each assessment includes evidence, and users can inspect the investigation tool by tool. Slower activity needs context, so the agent investigates beyond a simple commit count.

2. Ready to commit: find a way to help. Gemini-powered security scans provide AI fix recommendations and, where available, suggested patches for human review. Contributors can explore the relevant code and follow a private reporting path for potential vulnerabilities.

Everything comes together on an interactive flower map of repositories. Developers can do semantic search, explore project clusters, and open a repository to inspect its maintenance signals, security advisories, and investigation evidence.

The experience connects discovery to action: find a dependency, understand why it deserves attention, then explore a potential contribution. A developer choosing a library can assess maintenance risk, while someone looking to give back can find a project and investigate a concrete security issue.

How we built it

Databricks powers the data and investigation workflow behind Open Commitment Issues, connecting GitHub data collection, maintenance analysis, AI investigations, and repository discovery.

We use Lakeflow and Spark to process GitHub data through bronze, silver, and gold layers, turning raw repository snapshots into structured maintenance signals and health scores. Delta tables store the results, while Unity Catalog governs access to the data and investigation tools and tracks lineage. A daily scheduled workflow collects fresh GitHub data, updates health scores, and runs AI investigations.

Our maintenance investigator uses Llama 3.3 70B served through Databricks, with Unity Catalog functions providing tools to gather repository evidence. This helps the agent investigate whether slower activity signals maintenance risk or reflects a mature, stable project. MLflow records investigation traces and evaluation results, letting us inspect the evidence behind each verdict and compare the agent against our baseline.

For discovery, Databricks Vector Search with GTE embeddings lets users search for repositories by meaning rather than exact keywords. This connects natural-language queries to relevant projects and supports finding similar, healthier alternatives.

Gemini powers our on-demand security reviews, examining selected source files for potential vulnerabilities and generating fix recommendations. It also helps explain how to address known security advisories and, where appropriate, suggests patches for human review. This gives contributors a concrete starting point for helping a project.

We also use Entire to capture AI-assisted development sessions alongside our commits, preserving the context behind code changes. This makes it easier to revisit how a change was developed and understand the work that led to it.

We built the interface with React and TypeScript, supported by a Python FastAPI backend that queries Databricks through a SQL warehouse. Databricks Apps hosts the application, bringing the repository map, maintenance findings, security recommendations, and investigation evidence together.

Challenges we ran into

Distinguishing quiet projects from struggling ones. Low commit activity initially seemed like a useful warning sign, but mature libraries may need fewer updates. We separated the baseline maintenance score from the agent’s contextual assessment, giving the investigator tools to examine release information, repository activity, and other available evidence. Missing data also needed careful handling: an unavailable metric should not automatically become evidence of abandonment.

Making AI findings reviewable. A verdict alone would ask users to trust the model without understanding its basis. We connected findings to supporting evidence and recorded investigations with MLflow, so users can inspect which tools the agent called and what information they returned. This also helps us identify where an explanation goes beyond its evidence.

Working within API and model limits. Limited credits and usage caps constrained development and testing. Our workflow uses bounded investigation budgets, selected-file security reviews, and retry handling to manage those constraints. Scaling coverage while keeping results fresh remains an engineering challenge.

Accomplishments that we're proud of

We built a connected path from repository discovery to contribution. Open Commitment Issues brings an interactive repository map, semantic search, maintenance assessments, investigation evidence, and Gemini-powered security guidance into one application. Users can move from discovering a project to understanding its risks and exploring a potential fix.

We built a data workflow around 1,000 repositories. Databricks connects ingestion, data processing, governed storage, model serving, vector search, and scheduled investigations. Our dataset contains 3,682 GitHub security advisories associated with the tracked repositories, giving users another dimension to explore alongside maintenance health.

We made investigations inspectable. Findings include supporting evidence and tool traces, while MLflow records investigations and evaluations. This makes the system easier to review and gives us a practical way to diagnose failures.

What we learned

We learned that repository health requires context. A slowdown in commits can mean a project is stable, while missing information can leave an assessment inconclusive.

Comparing the agent with a baseline also showed us why evaluation matters. Clear explanations help users understand a verdict, and measured results reveal where the system needs improvement. Our goal is to make it easier to care for the software we all build on, whether that means choosing a dependency thoughtfully or contributing a fix.

What's next for Open Commitment Issues

We want to let developers scan their own open-source projects and bring new repositories and findings into the map. We plan to expand beyond 1,000 repositories, cover more languages, and measure project importance using real dependency data. We’ll add side-by-side comparisons of similar repositories to help users weigh their options and decide where to contribute. We’ll also improve evidence grounding and rate-limit handling to reduce false positives and work toward outperforming our baseline.

Open Commitment Issues. Find a project worth committing to.