mrdbourke / zero-to-mastery-ml

Copies a prompt for a coding agent. It has 9 tasks for the maintainers of mrdbourke/zero-to-mastery-ml.

Improve the Health Facts of the GitHub repository mrdbourke/zero-to-mastery-ml.

AwesomeRepos measures facts about how a repository is maintained, released, secured, and documented. Its page for this repository is https://awesomerepos.com/mrdbourke/zero-to-mastery-ml. A change to the repository can improve each of the 9 items below. Each item gives the measured fact or score, and a task.

The Scorecard result is from 2026-11-02: https://scorecard.dev/viewer/?uri=github.com/mrdbourke/zero-to-mastery-ml

1. A release in the last 365 days
   Fact: No GitHub release (read on 2026-11-08).
   Rule: The newest published GitHub release (a pre-release counts; a draft does not) is 365 days old or less. A repository that publishes only tags, or only to a package registry, has no GitHub release. The release refresh reads the 10 newest releases after each push to the repository, and at least each 30 days. The index refresh reads the date of the last push each day.
   Task: Prepare a release, but do not publish it. Find the changes since the newest release, propose the next semantic version and the release notes, and ask me to publish the GitHub release. If nothing changed since the newest release, skip this item. If the project publishes only to a package registry, add a CI step that also makes a GitHub release for each version tag.

2. A changelog file at the root
   Fact: No changelog file at the root (GitHub, 2026-11-09).
   Rule: The root of the default branch has a file named CHANGELOG, CHANGES, HISTORY, NEWS, RELEASE, or RELEASES, with no extension or with .md, .markdown, .rst, .txt, or .adoc. Release notes on GitHub releases do not count.
   Task: Add CHANGELOG.md at the root of the default branch. Write one section for each published release, newest first, from the GitHub releases, the Git tags, and the commit history. Do not invent changes. If the project uses a release tool (for example Changesets, release-please, or semantic-release), configure it to update this file for each release.

3. A security policy
   Fact: GitHub finds no security policy (GitHub, 2026-11-09).
   Rule: GitHub finds a security policy (SECURITY.md in the repository or in the owner's .github repository).
   Task: Add SECURITY.md at the root or in .github/. Say which versions get security fixes and how to report a vulnerability privately. If GitHub private vulnerability reporting is on, point to it. Ask me for the contact; do not invent one.

4. A licence
   Fact: GitHub finds no licence.
   Rule: GitHub finds a licence file. When GitHub cannot name the licence, the fact says so.
   Task: Ask me which licence to use. Do not choose one yourself. Then add the standard licence text as LICENSE at the root, so that GitHub can name the licence. Do not change the terms. Fill in only the fields of the template (for example the year and the copyright holder), and ask me for a value that you cannot verify.

5. A contributing guide
   Fact: GitHub finds no contributing guide (GitHub, 2026-11-09).
   Rule: GitHub finds a CONTRIBUTING file in the repository or in the owner's .github repository.
   Task: Add CONTRIBUTING.md at the root, in docs/, or in .github/. Tell a contributor how to set up the project, run the tests, and propose a change. Use the real commands of this repository (package scripts, Makefile, CI workflows).

6. A code of conduct
   Fact: GitHub finds no code of conduct (GitHub, 2026-11-09).
   Rule: GitHub finds a code of conduct in the repository or in the owner's .github repository.
   Task: Add CODE_OF_CONDUCT.md at the root with the Contributor Covenant 2.1 text. Change only the contact method. Ask me for the contact; do not invent one.

7. OpenSSF Scorecard Pinned-Dependencies: 0 of 10
   Scorecard says: dependency not pinned by hash detected -- score normalized to 0
   Task: Pin each GitHub Action in .github/workflows to a full commit SHA, with the version in a comment. Pin container base images by digest. In CI, install from the lockfile with the frozen install command.

8. OpenSSF Scorecard SAST: 0 of 10
   Scorecard says: no SAST tool detected
   Task: Add a workflow that runs static analysis on each pull request, for example GitHub CodeQL for the languages of this repository.

9. OpenSSF Scorecard Token-Permissions: 0 of 10
   Scorecard says: detected GitHub workflow tokens with excessive permissions
   Task: In each workflow in .github/workflows, set permissions: contents: read at the top level. Give a job more permissions only where it needs them.

Rules for this work:
- Each file must be true for this project. Do not copy text that does not apply to it.
- Do not choose a licence, a contact, or a release version for me. Ask me.
- Do not publish a release, change a repository setting, or push to the default branch. Make the changes on a new branch.
- Keep each change small, and run the checks of this repository before you finish.
- At the end, list each item as DONE, SKIPPED (with the reason), or NEEDS A DECISION (with the question).

AwesomeRepos reads these facts again in its next scan. The definitions of the checks: https://awesomerepos.com/health-facts