Prompt file imported from future-architect/uzomuzo-oss (.github/prompts/oss-select.prompt.md). Copyright stays with the author.

OSS Select — OSS Health Evaluation and Selection Support with uzomuzo

Support adoption decisions for new OSS packages, or scan the health of existing dependencies.

S1 Mode Detection

Determine the mode from the user message:

S2 Package Evaluation

S2.1 Run uzomuzo

# When PURLs are directly specified
GOWORK=off go run . <purl1> [purl2 ...]

# Scan mode: generate PURL list from go.mod and evaluate in batches
GOWORK=off go list -m -f '{{.Path}}' all | python3 -c "
import sys
for line in sys.stdin:
    path = line.strip()
    if not path:
        continue
    if path.startswith('github.com/vuls-saas/') or path.startswith('github.com/future-architect/'):
        continue
    print(f'pkg:golang/{path}')
" > /tmp/oss-select-purls.txt
# Use xargs to avoid shell argument-length limits on large projects
cat /tmp/oss-select-purls.txt | xargs GOWORK=off go run .

S2.2 Read CSV Data

In batch (file) mode, uzomuzo writes detailed results to scorecard.csv. Read this CSV for structured indicator data when generating evaluation reports.

S3 Evaluation Report Output

S3.1 Single Package Evaluation (evaluate mode)

Output in the following format:

## pkg:golang/modernc.org/sqlite

| Indicator | Value | Verdict |
|-----------|-------|---------|
| Lifecycle | Active | ✅ |
| Scorecard | 5.3/10 | ⚠️ |
| Maintained | 10/10 | ✅ |
| Code-Review | 2/10 | ⚠️ |
| Vulnerabilities | 0 | ✅ |
| Stars | 5,000+ | ✅ |
| Last Release | 18 days ago | ✅ |
| License | BSD | ✅ |
| Archived | No | ✅ |

### Overall Verdict: Approved
- Strengths: Actively maintained, no vulnerabilities, pure-Go (no CGO required)
- Concerns: Single maintainer (bus factor=1), low Code-Review score

S3.2 Compare Mode (compare)

Present candidates side by side:

## Comparison: SQLite Drivers

| Indicator | modernc.org/sqlite | mattn/go-sqlite3 |
|-----------|--------------------|------------------|
| Lifecycle | Active | Active |
| Scorecard | 5.3 | 6.1 |
| CGO Required | No | **Yes** |
| Stars | 5,000 | 8,000 |
| ... | ... | ... |

### Recommendation: modernc.org/sqlite
Reason: No CGO requirement simplifies CI configuration. Scorecard is slightly lower but Maintained=10 indicates active development.

S3.3 Scan Mode

Summary of all dependencies + highlight problematic packages:

## Dependency Health Report

| Status | Count |
|--------|-------|
| ✅ Active | 8 |
| ⚠️ Stalled | 3 |
| ❌ EOL | 1 |

### Action Required
| Package | Status | Action |
|---------|--------|--------|
| Masterminds/semver v1 | EOL | Migrate to semver/v3 |

### Watch
| Package | Status | Reason |
|---------|--------|--------|
| google/uuid | Stalled | Maintained=0, but managed by Google with no vulnerabilities |

S4 Adoption Criteria

Apply the following criteria for automatic verdicts:

Additional Checks (beyond uzomuzo output)

• Transitive dependency count: Check with go mod graph | wc -l. Flag if excessive
• CGO dependency: Check with go list -deps for cgo usage
• Alternative packages: For EOL/Stalled packages, suggest Active alternatives with equivalent functionality

S5 Notes

PURL Version Paths

For Go modules with major version suffixes (/v2, /v3, etc.), always evaluate with the suffix-included PURL.

❌ pkg:golang/github.com/Masterminds/semver     → evaluates v1 (EOL)
✅ pkg:golang/github.com/Masterminds/semver/v3  → evaluates v3 (Active)

The safest approach is to convert go.mod require paths directly to PURLs.

Scan Mode Execution

• Exclude internal packages (vuls-saas/*, future-architect/*)
• Check all dependencies including // indirect (indirect dependencies are also attack targets)