Sustainability & Governance asks whether a project will survive its people. Most open-source risk is not technical: it is a lone maintainer burning out, an issue tracker going quiet, a package abandoned on its registry while the repository still looks alive. This category measures the structures that make a project durable.
It is the heaviest category — 24% of the overall health index — a deliberate statement that continuity risk outweighs any single technical signal.
Metrics in this category
| Metric | Weight in category | Weight in overall |
|---|---|---|
| Maintainer resilience | 30% | 7.2% |
| Responsiveness | 25% | 6.0% |
| Stewardship | 25% | 6.0% |
| Package maintenance | 20% | 4.8% |
Maintainer resilience measures the bus factor and contributor concentration. Responsiveness reads how issues and pull requests are actually handled. Stewardship examines who stands behind the repository — organization or personal account, verified domain, track record. Package maintenance checks that the published package is current and not deprecated, because registry upkeep is distinct from GitHub activity.
Reading the category value
- This category is where organization backing influences the index: an organization signals shared, accountable stewardship that can outlive any single person. The lift is deliberate, documented, and auditable — see stewardship.
- A strong Vitality with weak Sustainability describes a productive project one departure away from stalling — the classic single-maintainer profile.
- Metrics with no observable data (no issues yet, no published package) are excluded and renormalized, never counted as zero.
Improving Sustainability & Governance
- Grow the maintainer circle: review rights and merge rights for more than one person move the bus factor — the single heaviest component.
- Keep the issue tracker decided: triage, close, or merge; unresolved volume reads as risk.
- Move flagship projects from personal accounts to an organization, and verify the organization's domain.
- Keep registry releases current and never leave a deprecated latest version standing without a successor.
Related: organization assessment · the health index