The repository defines an automated test suite and the command that runs it
The rules before this one govern where checks run, never whether the repository has any tests to run, so a repository with none passes the whole area while its CI verifies nothing. This rule asks only that a suite exist, because once it does R-CI-02 makes CI run it, and a gate clause here would restate that rule.
Observable check
the repository contains automated tests and a defined command that runs them, whether that is a test script in the package manifest, a task-runner target, or the layout the ecosystem's standard test runner discovers. The command is not a placeholder whose whole body is an echo, a bare true, or an exit 0, which is what a scaffolded manifest ships before anybody replaces it. A repository shipping no executable code falls outside this rule rather than failing it.
Where this comes from
Last read against these sources on 2026-07-30.
OpenSSF Best Practices badge Passing, criterion 'test', MUST: 'The project MUST use at least one automated test suite that is publicly released as FLOSS (this test suite may be maintained as a separate FLOSS project). The project MUST clearly show or document how to run the test suite(s) (e.g., via a continuous integration (CI) script or via documentation in files such as BUILD.md, README.md, or CONTRIBUTING.md).' The second sentence is why this rule asks for the command and not only the tests. OSPS-QA-06.01, Maturity 2-3, which R-CI-02 already cites, presumes a suite exists rather than requiring one: 'Prior to a commit being accepted, the project's CI/CD pipelines MUST run at least one automated test suite to ensure the changes meet expectations.' Two halves of the check have no upstream and are this project's own position. Neither source excuses a repository that ships no executable code, so that clause copies the applicability shape R-SEC-09 already uses, and it retires if a repository holding no executable code is ever expected to carry tests. Neither source rules out a placeholder either, and a scaffolded test script whose whole body is an echo, a bare true, or an exit 0 satisfies the badge criterion while verifying nothing; the body is readable without running it, which is why the clause is checkable at all. That clause retires when a scaffolded manifest stops shipping such a script.