Every ranking is also a list of what it declined to rank. In Porchlamp's snapshot of 14 October 2026, 11,000 projects were sampled and 3,833 earned a score, which leaves 7,167 without one. The counts strip on the live site splits the sample into Rated 3,833 (34.8%), Gated 5,790 (52.6%) and Unrated 1,377 (12.5%). This post takes the reasons behind the last two groups, with their cutoffs.
The reasons and the counts
Each project is recorded under exactly one reason, and the rows add up to the full sample. The two 1,067s are a coincidence: the projects excluded for not being software and the ones left unrated for thin evidence do not overlap.
| Reason recorded | Rule | Projects | Group |
|---|---|---|---|
| ranked (a score) | all rules met | 3,833 | scored |
| stale | D-GATE-4, vitality | 2,475 | excluded |
| black_hole | D-GATE-5 | 1,133 | excluded |
| non_software | D-GATE-1, software project | 1,067 | excluded |
| archived | D-GATE-2, not archived, mirror or fork | 624 | excluded |
| unlicensed | D-GATE-3, licensed | 491 | excluded |
| insufficient_evidence | D-EVID-1, evidence sufficiency | 1,067 | listed unrated |
| no_external_workflow | D-GATE-6, PR workflow | 302, plus 8 routed off-platform | listed unrated |
| total sampled | 11,000 |
That is 5,790 excluded and 1,377 listed unrated.
The gates that exclude
- D-GATE-1, software project (1,067). The repository tree must contain a recognised build or package manifest at depth 2 or less, unless the project is a curated anchor.
- D-GATE-2, not archived, not a mirror, not a fork (624). archived must be false, mirror_url null and fork false. A fork is allowed only if its parent is absent from the universe.
- D-GATE-3, licensed (491). An SPDX id must be present and OSI-approved. If it is undetermined, a search for a LICENSE* file runs before the gate fails. For transparency: Porchlamp's own repository has no LICENSE file, so on this rule it would be excluded too.
- D-GATE-4, vitality (2,475). At least one commit by a non-bot user on the default branch within the trailing window, set by vitality_window_days = 180. This is the largest single reason.
- D-GATE-5, not a black hole (1,133). Detailed below.
The black-hole gate in detail
Gate 5 looks at external pull requests by non-bot authors, opened in the trailing PR window and at least 14 days old (min_age_days 14). A response is a substantive reply or review: any review, or a comment of 40 or more characters, from a non-author, non-bot member, owner or collaborator, or from an account that merged a pull request in the window. A merge, or a maintainer closing the pull request, within the 14-day deadline (response_deadline_days 14) counts on its own. Draft pull requests are excluded until marked ready. So is an author's own self-close without a prior maintainer response, and so are accounts under 90 days old.
The gate then takes the 95% one-sided Wilson lower confidence bound (z = 1.6448536269514722) on the share of those pull requests with no response. It fails the project only if that bound exceeds 0.5 (max_zero_response_share 0.5). Because it is a lower bound, a project is excluded only when even the generous end of the interval sits above one half. At least 10 qualifying pull requests are required (min_n 10); below that, the gate is undecided.
One distinction matters. The 1,133 here is the same 1,133 behind the published headline, but the denominators differ. In this post it is one of the 11,000 sampled projects. In the headline it is 1,133 of the 4,297 projects decided on gate 5, a share of 0.2637, and "decided" is a narrower group than the whole sample.
Listed but unranked
Two more rules leave a project listed without a rank. D-EVID-1 requires composite coverage of 0.60, meaning at least that share of a project's inputs could actually be measured. Below it, the project is unrated for insufficient evidence (1,067). Coverage below 0.80 caps the tier at B and below 0.95 at A, but the score still exists. D-GATE-6 asks for at least one external pull request decided in the trailing 365 days. Without one, the project is unrated for having no external workflow (302).
Undecided is not failed
Silence on GitHub is only evidence of silence on GitHub. Two rules keep a project from being failed on thin or misleading evidence.
Too few pull requests. Gate 5 needs at least 10 qualifying outside pull requests. A project with fewer is undecided, because a handful cannot support a verdict about a pattern. Pull requests younger than 14 days are also left out, since the project has not yet reached its deadline.
Review that happens elsewhere. Gate 6 routes a project off-platform, instead of failing it, when it has at least 5 outside pull requests and at least 50% of them carry a notice such as "has been imported to gerrit for code review", "welcome to gitgitgadget" or "import it to our internal repository for further review". A comment from an account whose login starts with gitgitgadget counts too. Gate 5 is then undecided for that project, never failed. Eight projects are recorded this way.
What this does not tell you
It covers GitHub only. It is a dated snapshot, and it goes stale. Stars are not stored in the snapshot, so nothing here is controlled for project size. Every cutoff above is a choice, and different choices would move the counts. A gate is also not a verdict on people: an archived repository or a missing licence file says nothing about whether the maintainers are doing a good job.
If you think a cutoff is wrong, the repository is the place for it. Open an issue with a project the cutoff treats badly and say why; feature requests and patches go in the same place.
Which of these cutoffs would you move first, and which project would you name as the case for moving it?
Top comments (0)