Examples

https://www.gnuhealth.org/

https://openmrs.org/

As a heuristic, I look at the commit dates to see if it's still being maintained. And lately I look at the commits themselves for evidence of AI use. Then I'll maybe do a web search for discussions to see what other people/the community has to say about it.

Gnuhealth looks like it may be dead (or at least the repo I found hasn't had a commit in many years).
(Nvm, they moved to codeberg which is a positive signal, IMO).

I look at the number of (hopefully recent) committers and whether they're human or not.

Just to add what others are saying.
Commit dates, see how many maintainers/contributors it has, recent PR, recent open issues, how developers respond to them, visiting their discussion forums. Checking their social media accounts can also be useful, might tell you how they interact with the rest of the community.

test it until something breaks, open a bug report and look at the reaction

Yah I follow a similar approach in addition to doing a simple search for well known malicious commands like rm -rf / and some others as well.

Revenue model. If they have enterprise & community, then how good are the docs for community.

To add to what the other commenters are saying, I also sometimes look at whos responsible for the software. Is it a repo from a big company? Is it a gnu project? Is it just from somebody with a username consisting entirely of numbers? Is it hosted on codeberg or forgejo or some other friendlier server? That stuff also says alot, even if there are few recent commits, if its from reputable people you may still get well maintained software.

Honestly, popularity. If lots of other people use it, chance are somebody did that sort of check already.

i look up reviews and rating on alternativeto.net , search it on openhub and sometimes add projects i might be interested it (openhub reports development activity). i sometimes search for reddit for what people say about it.

There are a bunch of websites for user reviews, but honestly i haven't used them really iirc.