The Problem

This repository lacks a dependency lockfile, making builds non‑reproducible, and static analysis has uncovered 204 code‑health issues (61 high, 143 medium) that affect maintainability, security, and CI reliability. The most pressing risks are un‑pinned GitHub Actions, open‑token permissions, and oversized source files that ripple widely when changed.

What This Does

OpenShot‑qt is a cross‑platform video editor (Linux, macOS, Windows) with ~7500 files under src/. The codebase is primarily Python (218 files) with Django/Flask references and a vector‑store component. Entry points are setup.py, src/classes/app.py, and src/profiles/definitions/manage.py. Build‑related config lives in doc/Makefile, doc/requirements.txt, and images/Makefile. Documentation is generated with Sphinx (make html in doc/). The import graph contains 217 internal modules and 80 import edges with no circular dependencies, but several modules act as hubs: src/windows/views/menu (13 importers, 0 exports) and src/windows/views/timeline_backend/paint/base (12 importers, 0 exports) have the widest blast radius. Six files exceed 600 lines (src/windows/views/timeline_backend/geometry/base.py, src/windows/views/timeline_backend/paint/clip.py, src/windows/views/timeline_backend/qwidget/base.py), and 180 files repeat an 810‑block pattern of duplicated 6‑line logic across the installer directory.

How It Is Wired

  • Entry → workflow – Running python setup.py installs the package; the actual UI starts at src/classes/app.py.
  • Hub modules – src/windows/views/menu and src/windows/views/timeline_backend/paint/base are imported by 13 and 12 modules respectively; changes here affect many downstream screens.
  • Oversized files – src/windows/views/timeline_backend/geometry/base.py (641 lines) and src/windows/views/timeline_backend/paint/clip.py (641 lines) are the longest Python modules; a modification touches many importers.
  • Call graph – 217 modules, 80 edges, instability scores range from 0 (stable) to 1 (src/windows/views/timeline with Ce = 6, Ca = 0). No circular dependencies were found.

How To Use It

Setup

# Clone the repo (exact URL as provided)
git clone https://github.com/moses-y/openshot-qt
cd openshot-qt

# Install the package in development mode
pip install -e .

# Install documentation dependencies (needed for `make html`)
pip install -r doc/requirements.txt

Configuration

  • Documentation builds use doc/conf.py; locale files under doc/locale/ are auto‑generated.
  • CI secrets are managed in .github/workflows/; no .env is committed (detected: none).

Running

  • To launch the editor from source: python -m src.app (the app.py module runs the main window).
  • Tests: pytest discovers 26 test files under the repository root.
  • Generate docs: cd doc && make html.

Real‑World Use

A developer wanting to add a new video transition would edit src/windows/views/timeline_backend/paint/base.py (the hub for paint‑related effects), register the new transition class in the module’s effect registry, and then reference it from the UI definition in src/windows/views/timeline_backend/qwidget/base.py. Because 12 modules import paint/base, the change propagates automatically across the timeline UI without touching other files.

Code Health & Issues

Static analysis (Measured Analysis) identified 204 issues (61 high, 143 medium) across five categories. The Code Health Audit highlights six production‑relevant findings:

  • HIGH – Pin third‑party GitHub Actions to a commit SHA: .github/workflows/label-merge-conflicts.yml references eps1lon/actions-label-merge-conflict@v2.1.0; a tag can move, exposing secrets.
  • MEDIUM – Declare least‑privilege permissions for GITHUB_TOKEN: .github/workflows/ci.yml (and three other workflows) have no permissions declaration, inheriting repo‑wide defaults.
  • MEDIUM – Gate pull requests on a dependency vulnerability scan: no dependency-review-action or osv-scanner is present in CI.
  • MEDIUM – Move large binaries to Git LFS or out of the repo: src/language/openshot_lang.py is a 35.9 MB blob (>5 MB).
  • MEDIUM – Set persist-credentials: false on checkout: .github/workflows/sphinx.yml keeps the token for all later steps.
  • LOW – Add timeout-minutes to workflow jobs: .github/workflows/ci.yml declares no job timeout, risking overlap on a two‑hourly schedule.

All findings carry the recommended fix cited in the audit; no additional issues are invented.

The Bottom Line

The repo is functional and well‑structured for a large open‑source video editor, but it suffers from missing dependency locking, un‑pinned CI actions, and several sizable, highly‑connected modules that increase change‑risk. Teams comfortable with Python/Django‑style codebases and willing to add a lockfile, LFS for large assets, and CI gates will find it manageable; others may need extra engineering effort to stabilise builds and CI pipelines.