Skip to content

community.docker

Modules and plugins for working with Docker

Health score

82 / 100

Excellent

Strong evidence across everything we could observe.

How bands are set →

  1. Excellent (this collection)
  2. Good
  3. Fair
  4. Poor
  5. Not scored

Observed 8 of 8 signal groups.

Four are needed before a score is published.

4 needed

Category subscores

Security
0%
Trust
100%
Quality
89%
Maintenance
85%
ansible-core compatibility
100%
Every signal we evaluated for this collection
Signals we could observe
security.dependency_boundednessNot met0 of 1 dependencies bounded0 / 1Published artifact
trust.ansible_membershipPassedships in 12 ansible package majors2 / 2ansible-build-data
trust.link_claimsPassed4 of 4 link URLs declared1 / 1Published artifact
quality.docsPartly metreadme, 4 doc files2.55 / 3Published artifact
quality.changelogPartly metchangelog.yaml, 0 fragments1.6 / 2Published artifact
quality.license_qualityPassedSPDX id declared (GPL-3.0-or-later, Apache-2.0)1 / 1Published artifact
quality.testsPassedplugins-only: 38 unit, 425 integration, 12 sanity, 0 molecule3 / 3Published artifact
quality.ciPartly met4 workflow files, 0 other CI files1.6 / 2Published artifact
maintenance.release_recencyPassedlast release 72 days ago3 / 3Galaxy index
maintenance.changelog_recencyPartly met0 unreleased changelog fragments0.4 / 1Published artifact
compat.requires_ansiblePassed>=2.17.03 / 3Published artifact
compat.membership_currencyPassedships in ansible 14 (current is 12)1 / 1ansible-build-data

No repository evidence yet. ansible.care has not read any collection's Git repository, so every signal above was proved from a published artifact or from Ansible’s own build data. Tests and CI in particular can be proved present this way but never proved absent — so when we cannot see them, we leave them out of the score rather than counting them against you.

What is costing points

Each of these is a signal we observed and could not fully credit.

  • security.dependency_boundedness

    Give every collection dependency you declare in `galaxy.yml` an upper or pinned bound — `<`, `<=`, `==` or `~=` — so that installing your collection cannot silently pull in an arbitrary future release of somebody else’s. If your collection declares no dependencies at all this rule already awards full marks and there is nothing here to change. If we reported a dependency we could not read, the fix is the syntax of its version range rather than the dependency itself.

  • quality.changelog

    Ship a `changelogs/changelog.yaml` — the structured form `antsibull-changelog` generates and the `ansible` package consumes — rather than only a hand-maintained `CHANGELOG.md`, and write a fragment into `changelogs/fragments/` as each change lands rather than reconstructing release notes at release time. Both have to be inside the published tarball to be observable: a changelog that lives only in your Git repository is one we cannot read. This is the single highest-leverage change for most collections, because the same missing file is what holds down both changelog rules in this rubric. If you already publish `changelog.yaml` with fragments, this rule is answered.

  • quality.docs

    Ship your README and your `docs/` directory INSIDE the published tarball, not only in your Git repository — we do not read repositories at all yet, so a file that exists only there is a file we cannot see. If your `build_ignore` excludes `docs/`, that exclusion is why we observed nothing. Beyond the README this rule counts documentation FILES, so splitting a long README into per-module and per-role pages is what moves it; adding filler pages to raise a count would satisfy the arithmetic and help nobody.

What would strengthen this score

These signals can only add points in the current scoring version — they are never counted against you.

  • quality.ci

    Publish your CI configuration inside the artifact. `.github/workflows/` is what we count most precisely, and other CI config files earn partial credit when your automation runs somewhere we cannot enumerate as exactly. `build_ignore` commonly strips `.github/`, again on the packaging documentation’s own advice, so an absence here is a gap in what we could read rather than a statement that your collection has no CI. In this scoring version this rule can only add points: an unobserved CI signal leaves your calculation rather than scoring zero, so this is worth doing for the credit and never to avoid a deduction.

Authors

  • Ansible Docker Working Group