← Back to scan
File as GitHub Issue repo: openmrs/openmrs-core

Push this scan report to openmrs/openmrs-core

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

Code quality scan: 30 findings (C, 69/100)

Issue body (markdown)

Hi @openmrs, an automated scan of this repository surfaced **30 code-quality findings** that may be worth a look. 
Full details, severity filters, and per-file context are at the link below — feel free to close this issue if it isn't useful to you.

## Full interactive report

**https://repobility.com/scan/beef9e59-2b65-4ca8-b71d-75f2aef97c23/**

![Live scan page](https://repobility.com/scan/beef9e59-2b65-4ca8-b71d-75f2aef97c23/report.png?v=1778929124)

## At a glance

- **Score**: `69/100`  •  **Grade**: `C`
- **Scanned**: `2026-05-16 10:58 UTC`
- **Lines of code**: 73,588
- **Total findings**: 30
- **Security-tagged**: 1
- **Credential / secret patterns**: 0

## Top issues, with file & line

_These are deterministic rule-based findings — the file paths and line numbers below are real and can be verified in your tree._

1. **[critical]** Compose service contains a literal secret environment value — `docker-compose.yml`
   _Literal secrets in Compose files are committed to source and exposed through container inspection._
2. **[high]** No test files found
   _Add a test directory (tests/ or __tests__/) with unit tests for core functionality. Use pytest (Python), Jest (JS/TS), or go test (Go). Start with tests for critical business lo…_
3. **[high]** Dockerfile copies the entire context without .dockerignore — `Dockerfile:55`
   _COPY . or ADD . sends the full build context to Docker. Without .dockerignore this can include secrets, git history, and local artifacts._
4. **[low]** Dockerfile installs recommended OS packages — `Dockerfile:17`
   _Installing recommended packages often pulls in unnecessary runtime surface area._
5. **[low]** Dockerfile installs recommended OS packages — `Dockerfile:66`
   _Installing recommended packages often pulls in unnecessary runtime surface area._

See all 30 findings, with severity filters and AI fix prompts: **https://repobility.com/scan/beef9e59-2b65-4ca8-b71d-75f2aef97c23/**

---

**What is this?** [Repobility](https://repobility.com) is a research project that scans public repositories with a multi-layer static analyzer (rule-based, no AI hallucinations) and learns code-quality patterns across a broad cross-repo corpus. This is **not a sales pitch** — there's no paywall, no signup required to view the report, and no payment ask. If the findings aren't useful, please close this issue and we won't post again.

**To re-run after fixes land:** paste your repo URL at [repobility.com](https://repobility.com) — fresh scan, free.

_Issue filed via the public Repobility report at https://repobility.com/scan/beef9e59-2b65-4ca8-b71d-75f2aef97c23/._
Premium account
This scan was submitted by a Enterprise-tier account. Premium accounts have full outreach control â Repobility doesn't pre-fill the 'file as GitHub issue' button for paid users. You can still file the issue manually using the markdown body above (Copy markdown), or contact us if you'd like batch-filing enabled for your account.
I read the warnings â override Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.