ACTS

All first-parent commits in 12 months came from PRs and 98.8% of merged PRs were reviewed; the main ruleset requires the policy-bot: main check, which demands one approval from the reviewers team, and review expectations are documented in CONTRIBUTING.md and the PR template.

Builds, unit, integration, Python and downstream-project tests run on every PR, merge-queue entry and push across Ubuntu, LCG (GCC 15, Clang 19), Clang 22 and macOS, with merge-sentinel requiring them before merge; 50 of 50 recent default-branch runs succeeded.

Boost.Test unit tests, integration tests and pytest example runs execute in CI, the physmon job compares reconstruction performance with reference histograms, coverage is measured and published on SonarCloud, and 40.2% of merged PRs touch test files.

pre-commit (clang-format, black, gersemi, codespell, license and include checks) runs as a required lint check, clang-tidy runs on changed files of every PR and fails on findings, and CI presets build with -Wall -Wextra -Wpedantic -Wshadow and CMAKE_COMPILE_WARNING_AS_ERROR.

C++20 code is split into Core, Plugins, Fatras, Alignment and Examples with separate namespaces, an exported ActsConfig.cmake is consumed by a downstream test project in CI, and the public API and repository architecture are documented.

A hosted guide, the pip install pyacts and Spack routes, a build-option table and a quick-start script run in CI exist, but the documented minimum versions are lower than those CMakeLists.txt enforces, and Geant4, Pythia8 and pybind11 have no versions.

Gaps to the next level

• building_acts.md lists Boost 1.71, Eigen 3.3.7, DD4hep 1.11, HepMC3 3.2.1 and ROOT 6.20; CMake requires 1.78.0, 3.4.0, 1.26, 3.2.4 and 6.28.04.
• Geant4, Pythia8, pybind11, CUDA and libtorch are listed without versions.
• Hosted docs are not versioned per release (versions.json at acts-project.github.io lists no versions).
• No eic-shell route is described for EIC users.

Actions

• medium S Generate the Prerequisites list in docs/pages/contributing/building_acts.md from the _acts_*_version variables in CMakeLists.txt (as the cmake_options pre-commit hook already does for options), covering every optional dependency.

Public headers carry Doxygen comments, the docs build fails on undocumented members and warnings, CI deploys the Doxygen site for main and tags, and algorithm pages (track fitting, GSF, vertexing, propagation) cite references from docs/references.bib.

CONTRIBUTING.md covers the PR process, coding style and review expectations, the docs cover container-based setup, building and running the pytest suite, and PR and issue templates exist; no newcomer label exists.

Gaps to the next level

• No good first issue or equivalent newcomer label exists in the repository.
• Running the C++ unit tests (ctest) is not documented; only enabling them is.
• The .devcontainer/ setup is not mentioned in CONTRIBUTING.md or the docs.

Actions

• medium S Create a good first issue label, apply it to at least five open issues, and link it from CONTRIBUTING.md.
• low S Add a "Development environment and tests" section to CONTRIBUTING.md covering .devcontainer/, cmake --preset dev and ctest --test-dir build.

Median first response is 1.34 days and 64.6% of new issues are labeled, but 84 of 108 open issues are older than one year, more than half.

Gaps to the next level

• 84 of 108 open issues (78%) are older than one year; the stale workflow labels but never closes (days-before-close -1).
• 16.9% of issues opened in 12 months received no response.

Actions

• medium M Review the 84 open issues older than one year and close, milestone or label each, bringing the share below 50%.

87 authors from 11 e-mail domains committed in 24 months with 39 new authors in 12 months, but only 4.1% of merged PRs came from outside the maintainer group, below 20%.

Gaps to the next level

• 4.1% of merged PRs in 12 months came from contributors outside the maintainer group (needs 20%).

Actions

• medium M Label newcomer issues and announce them on the acts-developers e-group and Mattermost to raise the external PR share.

Bus factor is 2 with 23 reviewers and 7 mergers, and releases are automated and documented, but the bus factor is below 3 and CODEOWNERS names owners only for Detray, Traccc, GNN, GSF, GX2F and Covfie, mostly one person each.

Gaps to the next level

• Bus factor (50%) is 2; level 3 needs 3.
• Core/, Fatras/, Alignment/, Examples/ and most Plugins/ have no named owner; README calls CODEOWNERS non-binding and under evaluation.

Actions

• medium S Add CODEOWNERS entries naming at least two owners each for Core/, Fatras/, Alignment/, Examples/ and every Plugins/ subdirectory.

Reviewers can be identified (reviewers team, CODEOWNERS) and meetings are listed in an Indico category, but no document states who decides, how decisions are made, or how one becomes a reviewer or maintainer.

Gaps to the next level

• No documented decision process or path to reviewer or maintainer.
• The Indico link appears only in the legacy docs/old tree, not in the current docs.

Actions

• medium S Add GOVERNANCE.md naming the core-maintainers and reviewers teams, how decisions are made and recorded, and how to join the reviewers team; link the Indico category.

The repository adopts the CERN Code of Conduct, which names the Ombud office and HR as routes, and documents Mattermost, an e-group and GitHub Discussions for help; no enforcement procedure for non-CERN contributors is documented and the last Discussions question is from 2025-11.

Gaps to the next level

• No project-specific reporting contact or enforcement procedure is documented.
• Activity of the documented support channels is not publicly verifiable for the last 6 months.

Actions

• medium S Add to CODE_OF_CONDUCT.md an ACTS reporting contact and the enforcement steps that apply to contributors outside CERN.

The pyacts wheel on PyPI provides the latest release 48.1.0 and ACTS ships in eic-shell and upstream Spack, but both are at 46.8.1, four months and 12 releases behind.

Gaps to the next level

• Upstream Spack and eic-shell lack every release from v47.0.0 (2026-07-14) to v48.1.0.

Actions

• medium S Add versions 47.0.0 through 48.1.0 to the acts recipe in spack/spack-packages with each release.
• medium M (EIC side) Update eic/containers to an ACTS 48.x release once EICrecon builds against it.

61 SemVer releases in 24 months have generated notes with a breaking-changes section, made by an automated release workflow, but there are no migration notes and no documented deprecation policy.

Gaps to the next level

• Release notes list breaking changes without migration instructions.
• No deprecation policy is documented in docs/pages/versioning.md.

Actions

• medium S Add a deprecation policy (deprecated in N, removed in N+1) and a migration-notes section per major release to docs/pages/versioning.md.

Dependencies are declared with minimum versions in CMakeLists.txt, CI installs pinned Spack lockfiles, Dependabot covers Actions and pre-commit, and all action refs are SHA-pinned; there is no SECURITY.md and no CI job at the declared minimum versions.

Gaps to the next level

• No SECURITY.md or other vulnerability reporting route.
• No CI job builds against the declared minimum versions (e.g. Boost 1.78, ROOT 6.28.04, DD4hep 1.26).

Actions

• medium S Add SECURITY.md with a private vulnerability reporting route and enable GitHub private vulnerability reporting.
• low M Add a CI job that builds and tests against the minimum versions set in CMakeLists.txt.

CI installs dependencies from versioned Spack lockfiles at a pinned Spack commit inside tagged containers, container use is documented, and example workflows set explicit seeds; container tags are not tied to releases and outputs carry no version or configuration metadata.

Gaps to the next level

• Container tags (e.g. ubuntu2604:90) and lockfile tags are not recorded per ACTS release.
• Example writers do not store the ACTS version, commit or configuration in output files.

Actions

• medium M Write the ACTS version, commit hash and sequencer configuration into the metadata of ROOT and EDM4hep outputs in Examples/Io.

CI builds and tests GCC and Clang on Linux and on macOS (arm64), runs CUDA tests on GPU runners, and ACTS ships in eic-shell, which ePIC distributes through the OSG CVMFS image for batch use.

ACTS reads geometry through DD4hep and GeoModel plugins and does event I/O through podio/EDM4hep and HepMC3 rather than custom code, its examples framework is documented as internal test tooling, and EICrecon and other EIC packages build on ACTS.

ACTS converts tracks to and from EDM4hep through podio, reads and writes HepMC3, requires minimum EDM4hep and podio versions, versions and validates its material-map JSON format, has EDM4hep conversion round-trip tests, and its ROOT outputs are read with uproot in CI.

ACTS CI builds ACTS and then EICrecon inside ghcr.io/eic/eic_ci_without_acts:nightly on every PR, eic/containers builds ACTS through its documented Spack environment, and EICrecon CI tests against nightly and stable eic-shell; the ACTS job runs no tests and has no pinned stable release.

Gaps to the next level

• The external_eic-shell job runs no tests and its EICrecon build step is continue-on-error.
• ACTS's own CI uses only the nightly eic image, not a pinned stable eic-shell release.
• ACTS documentation does not mention eic-shell.

Actions

• medium S Add a matrix entry to external_eic-shell in .github/workflows/builds.yml for a pinned eic_ci_without_acts stable tag next to nightly, and run ctest after the ACTS build.

Minimum versions (DD4hep 1.26, podio 1.0.1, EDM4hep 1.0, Geant4 11.1.3, ROOT 6.28.04, HepMC3 3.2.4) are below what eic-shell ships, CI builds daily against the eic nightly stack and Key4hep nightlies with warnings as errors, and no compatibility issues with these components are open.

MPL-2.0 is detected, stated in pyproject.toml, and a license notice in every source file is enforced by pre-commit; the notices are not SPDX identifiers and no contribution terms (DCO or inbound=outbound) are documented.

Gaps to the next level

• Source headers carry the MPL notice but no SPDX-License-Identifier.
• No documented contribution terms (DCO or inbound=outbound).

Actions

• low S Add SPDX-License-Identifier MPL-2.0 to the header template enforced by CI/check_license.py and state inbound=outbound terms in CONTRIBUTING.md.

CITATION.cff, .zenodo.json and AUTHORS exist, every release receives a Zenodo DOI under concept DOI 10.5281/zenodo.5141418, and a CSBS paper describes the project, but CITATION.cff and .zenodo.json still state v45.1.0.

Gaps to the next level

• CITATION.cff and .zenodo.json are not updated with each release (both state v45.1.0).

Actions

• medium S Have CI/release.sh update version and date-released in CITATION.cff and run CI/sync_citation_metadata.py on every release.

ACTS ships in eic-shell and is a dependency of EICrecon in the ePIC reconstruction chain; outside EIC its CI triggers ATLAS Athena builds and tests Key4hep dependents.

Every source file is copyright "CERN for the benefit of the ACTS project", contributors' institutions are listed in AUTHORS, and CERN hosts the project's chat, mailing lists and CI infrastructure; no multi-institution maintenance commitment or succession plan is documented.

Gaps to the next level

• No funding acknowledgement or documented multi-institution maintenance commitment.
• No succession or transition plan for maintainers.

Actions

• medium S Add a section to the README naming the institutions that commit maintainer effort and what happens when a maintainer leaves.