OpenSSF Best Practices Evidence
August 20, 2026 ยท View on GitHub
This register tracks the Gold assessment for this repository.
The official entry is bestpractices.dev project 13737.
Assessment date: 2026-07-23.
Eligibility
This active, public PHP SDK qualifies for the OpenSSF Best Practices badge.
Verified Technical Controls
| Area | Evidence |
|---|---|
| License | Apache-2.0 and REUSE 3.3 metadata |
| Contribution process | DCO sign-off and independent review rules |
| Governance | Public roles, decisions, releases, and continuity policy |
| Security reporting | Private reporting, response targets, boundaries, and threat model |
| Runtime compatibility | PHP 8.1 and 8.2 syntax and production dependency checks |
| Functional tests | PHP 8.3, 8.4, and 8.5 |
| Executable line coverage | ./scripts/coverage enforces 90% |
| Branch coverage | ./scripts/coverage enforces 80% |
| Static analysis | PHPStan level max and PHP CS Fixer |
| Dependency review | Dependabot, Composer audit, and a license allowlist |
| Licensing gate | Pinned REUSE action checks every repository file |
| Reproducibility | 2 normalized Composer archives must have identical bytes |
| CI | Pull requests and pushes run pinned, least-privilege workflows |
| Two-factor authentication | The Xquik-dev organization requires 2FA |
The suite runs 247 tests with 689 assertions and 7 intentional skips.
It covers 3,887 of 4,052 executable lines, or 95.93%.
It covers 1,059 of 1,282 branches, or 82.61%.
Dynamic coverage includes the client, runtime core, and service facades.
Generated DTO boilerplate does not inflate the dynamic coverage score.
PHPStan checks every generated DTO at its strictest level.
The loopback service suite also parses generated response models.
REUSE validates license metadata for all 962 repository files.
Verified Release Provenance
Release v0.13.2 provides an attested Composer archive and Sigstore bundle.
Its tag targets commit 66eb960e5324007f28792e5b4e5c99456005ece3.
GitHub verifies the archive against the release workflow and hosted-runner policy.
Outstanding Gold Blockers
Human and organizational evidence remains incomplete.
Do not claim Gold while any mandatory criterion remains unmet.
| Gold Requirement | Current Evidence | Required Action |
|---|---|---|
| Access continuity | Public evidence does not prove 2 release-capable maintainers | Grant and verify another maintainer's access |
| Bus factor | Git history shows one significant contributor | Add another significant contributor |
| Unassociated contributors | Fewer than 2 qualifying contributors are independent | Accept qualifying external contributions |
| Independent review | History does not prove 50% qualifying review coverage | Require and record independent reviews |
| Human security review | No completed review exists within 5 years | Commission and publish a scoped review |
Gold eligibility still requires review by a different human.
Maintenance
Run these evidence commands before releases:
./scripts/lint
./scripts/test
./scripts/coverage
./scripts/audit
reuse lint
./scripts/check-reproducible
gh attestation verify ARCHIVE \
--repo Xquik-dev/x-twitter-scraper-php \
--signer-workflow Xquik-dev/x-twitter-scraper-php/.github/workflows/release-provenance.yml
Reassess the register before every major release.
Update bestpractices.dev only with public evidence.
Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.