bitwise-media-group/dotty erreicht einen Gesundheitsindex von 67 von 100 und liegt damit im Bereich Mittel. Am stärksten schneidet es bei AI Readiness (95/100) ab, am schwächsten bei Community & Adoption (43/100). Zuletzt vor 1 Tag aktualisiert. Ein einzelner Mitwirkender trägt den Großteil der jüngsten Arbeit.
67
gesamt / 100
Mittel
Software-Gesundheitsindex
Metriken werden auf einer Skala von 1–100 in gewichtete Kategorien gruppiert. Der Gesamtwert beginnt als ihr Mittel; sobald öffentliche Evidenz die Richtlinie für Hochrisikojurisdiktionen auslöst, wird die Bewertung angepasst und erhält die Obergrenze 49 (Gefährdet). AI Readiness liegt außerhalb.
67
Exzellent85-100Vorbildlich; erfüllt im Wesentlichen alle geprüften Kriterien
Gut70-84Gesund; geringfügige Lücken
Mittel50-69Akzeptabel mit deutlichen Lücken; Überprüfung empfohlen
Gefährdet30-49Erhebliche Schwächen; eine Übernahme erfordert Vorsicht
Kritisch1-29Schwerwiegende Probleme (aufgegeben, nur ein Maintainer, keine Hygiene)
Bewertungsprofil
Jede Achse ist eine Kategorie. Die Form zählt mehr als der Durchschnitt — ein gesundes Projekt füllt die gesamte Fläche, während ein Profil aus Spitzen und Kratern bedeutet, dass Stärke in einer Dimension Risiken in einer anderen verdeckt.
Dieses Repository wird von einer Organisation getragen — geteilte, rechenschaftspflichtige Trägerschaft, die jeden einzelnen Maintainer überdauern kann.
Direkte Abhängigkeiten ohne bekannte Advisories — keine direkte Abhängigkeit trägt ein bekanntes Advisory
0/25
Indirekte Abhängigkeiten ohne bekannte Advisories — transitive Menge in diesem Bereich nicht von Entwicklungs- und Test-Abhängigkeiten trennbar
0/40
Keine offenen Advisories — kein Advisory trägt ein Veröffentlichungsdatum
Verwendete Eingangsdaten
source
osv
advisories
0
affected_packages
0
assessed_packages
45
unassessed_packages
0
affected_by_severity
none
direct_affected_packages
0
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): Indirekte Abhängigkeiten ohne bekannte Advisories, Keine offenen Advisories. Die verbleibenden Gewichte wurden renormalisiert. 45 aufgelöste Abhängigkeiten wurden mit OSV abgeglichen. Dieses Repository veröffentlicht kein Paket, das der Index auflöst; bewertet wurde daher der Abhängigkeitsgraph des Repositorys. Dieser Graph vermischt Entwicklungs- und Test-Pins mit ausgelieferten Abhängigkeiten, daher werden nur die deklarierten Laufzeit-Abhängigkeiten bewertet; transitive Befunde werden als Kontext ausgewiesen und fließen nicht in die Bewertung ein. Erreichbarkeit wird nicht analysiert.
Wie gut ist das Repository dafür ausgestattet, mit KI-Coding-Agenten entwickelt und gepflegt zu werden? Ein unabhängiges, experimentelles Badge — Gewicht 0,0, es wird eigenständig ausgewiesen und verändert den Gesamt-Gesundheitswert nicht.
Handhabbare Dateigrößen — 0/218 Quelldateien über 60 KB
Verwendete Eingangsdaten
primary_language
Go
largest_source_bytes
27.093
source_files_sampled
218
oversized_source_files
0
Eckdaten
2GitHub-Sterne
3Mitwirkende
121Commits, letzte 12 Monate
1Tage seit letztem Push
8Releases
1Bus-Faktor
5offene Issues
Go, PyPIPaket-Ökosysteme
Warnungen zur Datenerhebung
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
pypi package 'dotty' points at a different repository (http://scrace.org/software/dotty.html); excluded from ecosystem scoring
Weitere Details
Stern- und Fork-Verlauf 0 ★ / 2 ⇿
0Sterne
2Forks
2Releases
Wann jeder Stern und Fork hinzugefügt wurde, von GitHub erfasst und nach Tagen gruppiert. Das kumulierte Wachstum steht direkt über den täglichen Zugängen, aus denen es besteht, sodass beide gegeneinander lesbar sind: stetiger organischer Zuwachs sieht ganz anders aus als ein abrupter, kurzlebiger Ausschlag. Wo dieser Unterschied messbar ist, wird er als Wachstumsauthentizität ausgewiesen.
Major 0Minor 1Patch 1
OpenSSF Scorecard 8.5 / 10
8.5Gesamtwert
Unabhängige, werkzeugneutrale Sicherheitsbewertung durch das quelloffene OpenSSF Scorecard. Jede Prüfung honoriert eine Sicherheits-Praxis, nicht das Werkzeug eines bestimmten Anbieters. Prüfungen, die Scorecard nicht ermitteln konnte, sind mit k. A. markiert und vom Sicherheitswert ausgeschlossen (nie als null gezählt).Scorecard v5.5.0 · 2026-07-28 07:16 UTC
Vollständig aufgelöster Abhängigkeitssatz aus dem GitHub-Abhängigkeitsgraphen: 9 direkte und 36 indirekte (transitive) Pakete. Die transitive Hülle ist vollständig, wenn das Repository eine Lockfile eincheckt.
Registry
Paket
Version
Beziehung
Go
charm.land/bubbles/v2
v2.1.1
direkt
Go
charm.land/bubbletea/v2
v2.0.8
direkt
Go
charm.land/huh/v2
v2.0.3
direkt
Go
charm.land/lipgloss/v2
v2.0.5
direkt
Go
github.com/sahilm/fuzzy
v0.1.3
direkt
Go
github.com/spf13/cobra
v1.10.2
direkt
Go
github.com/spf13/pflag
v1.0.10
direkt
Go
golang.org/x/term
v0.45.0
direkt
PyPI
zensical
0.0.46
direkt
Go
github.com/atotto/clipboard
v0.1.4
indirekt
Go
github.com/catppuccin/go
v0.3.0
indirekt
Go
github.com/charmbracelet/colorprofile
v0.4.3
indirekt
Go
github.com/charmbracelet/ultraviolet
v0.0.0-20260703014108-f5a850f9c2b7
indirekt
Go
github.com/charmbracelet/x/ansi
v0.11.7
indirekt
Go
github.com/charmbracelet/x/exp/ordered
v0.1.0
indirekt
Go
github.com/charmbracelet/x/exp/strings
v0.0.0-20240722160745-212f7b056ed0
indirekt
Go
github.com/charmbracelet/x/term
v0.2.2
indirekt
Go
github.com/charmbracelet/x/termios
v0.1.1
indirekt
Go
github.com/charmbracelet/x/windows
v0.2.2
indirekt
Go
github.com/clipperhouse/displaywidth
v0.11.0
indirekt
Go
github.com/clipperhouse/uax29/v2
v2.7.0
indirekt
Go
github.com/cpuguy83/go-md2man/v2
v2.0.6
indirekt
Go
github.com/dustin/go-humanize
v1.0.1
indirekt
Go
github.com/inconshreveable/mousetrap
v1.1.0
indirekt
Go
github.com/lucasb-eyer/go-colorful
v1.4.0
indirekt
Go
github.com/mattn/go-runewidth
v0.0.24
indirekt
Go
github.com/mitchellh/hashstructure/v2
v2.0.2
indirekt
Go
github.com/muesli/cancelreader
v0.2.2
indirekt
Go
github.com/rivo/uniseg
v0.4.7
indirekt
Go
github.com/russross/blackfriday/v2
v2.1.0
indirekt
Go
github.com/xo/terminfo
v0.0.0-20220910002029-abceb7e1c41e
indirekt
Go
go.yaml.in/yaml/v3
v3.0.4
indirekt
Go
golang.org/x/sync
v0.21.0
indirekt
Go
golang.org/x/sys
v0.47.0
indirekt
PyPI
click
8.4.2
indirekt
PyPI
colorama
0.4.6
indirekt
PyPI
deepmerge
2.1.0
indirekt
PyPI
dotty
0.1.0
indirekt
PyPI
jinja2
3.1.6
indirekt
PyPI
markdown
3.10.2
indirekt
PyPI
markupsafe
3.0.3
indirekt
PyPI
pygments
2.20.0
indirekt
PyPI
pymdown-extensions
11.0
indirekt
PyPI
pyyaml
6.0.3
indirekt
PyPI
tomli
2.4.1
indirekt
Abhängigkeits-Advisories 0
Dieses Repository veröffentlicht kein vom Index auflösbares Paket, daher wurde sein eigener Abhängigkeitsgraph bewertet – 45 Pakete, darunter auch Entwicklungs- und Test-Pins, die nie ausgeliefert werden: 0 tragen bekannte Advisories, davon 0 direkte.
Keine bekannten Advisories betreffen die bewerteten Abhängigkeiten.
Ein Advisory bedeutet, dass die im Abhängigkeitsgraphen erfasste Version in den betroffenen Bereich eines Advisories fällt. Erreichbarkeit wird nicht analysiert, und der Graph enthält Entwicklungs- und Test-Pins — ein Fund kann das Werkzeug betreffen und nicht die ausgelieferte Software.
JSON-Rohbericht maschinenlesbar
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 962,
"has_wiki": false,
"homepage": null,
"languages": {
"Go": 832749,
"Lua": 30689,
"HTML": 32434,
"Shell": 44748,
"Makefile": 442,
"JavaScript": 1668
},
"pushed_at": "2026-07-26T10:28:29Z",
"created_at": "2026-06-18T19:59:06Z",
"owner_type": "Organization",
"updated_at": "2026-07-26T10:29:05Z",
"description": "A CLI tool for managing system profiles, including dotfiles, security keys, singing keys, packages, and secrets",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": "https://oss.bitwisemedia.uk",
"name": "Bitwise Media Group Ltd.",
"type": "Organization",
"login": "bitwise-media-group",
"company": null,
"location": "United Kingdom",
"followers": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/282673588?v=4",
"created_at": "2026-05-07T18:23:54Z",
"is_verified": null,
"public_repos": 14,
"account_age_days": 81
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.2.6",
"kind": "patch",
"published_at": "2026-07-22T09:00:02Z"
},
{
"tag": "v0.2.5",
"kind": "patch",
"published_at": "2026-07-21T16:07:50Z"
},
{
"tag": "v0.2.4",
"kind": "patch",
"published_at": "2026-07-20T21:22:40Z"
},
{
"tag": "v0.2.3",
"kind": "patch",
"published_at": "2026-07-19T03:05:55Z"
},
{
"tag": "v0.2.2",
"kind": "patch",
"published_at": "2026-07-18T15:14:42Z"
},
{
"tag": "v0.2.1",
"kind": "patch",
"published_at": "2026-07-18T14:18:31Z"
},
{
"tag": "v0.1.1",
"kind": "patch",
"published_at": "2026-07-01T00:39:36Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2026-06-29T22:39:09Z"
}
],
"recent_commits": [
{
"oid": "fa9db18403fcfc450aed862bf8ad949d05f91862",
"body": "Two ways propose lost to a pull request it had not opened itself.\n\nA branch whose PR was opened by hand — or before it joined a stack — has no\ndotty.branch.<name>.pr recorded, so propose took the create path and gh\nrefused: \"a pull request for branch ... already exists\". That aborted the whole\nrun, \n[…]\nPR and carries the title too; PRBodyText becomes\nPRText and reads both, so an edit that would change neither is still skipped.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(git): own the pull request of every branch in a stack",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-26T10:26:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3341663df8f2ffaecd549d3920aa28f7be850de3",
"body": "A layer that lands by fast-forward leaves its branch tip equal to trunk,\nwhich classifies as \"identical\" — indistinguishable in local history from an\nempty layer freshly cut from trunk. Propose therefore kept the dead layer,\npushed it, and failed with \"no commits unique to this layer\"; sync left it \n[…]\nto-merge default is ignored for the run; proposing again without --draft\ntakes the PR out of draft before applying auto-merge.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(git): drop landed layers before proposing, add propose --draft",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-26T09:37:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b65c6a0b7305dfc32f4e917c827c035227e50cea",
"body": "The generated CLI reference had drifted from the command help since the\nimplicit-tap fix; regenerating the whole tree picks it up.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "docs(brewfile): regenerate the add reference after the tap fix",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-26T09:37:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d9e20994ccbd4bd0051a7114c8f47236db3f8c74",
"body": "Grant the scaffolded Claude and Grok agent configs permission to drive the\nSwift toolchain (swift, swiftc, xcodebuild, xcrun, simctl) and mise, and add\n~/Library/Caches and ~/Library/org.swift.swiftpm to both sandbox read/write\nlists so swift build can reach its SwiftPM state and caches.\n\nNo Xcode D\n[…]\nl permission entries are kept for agents\nlaunched unsandboxed.\n\nFollows on from Swift language support in the Neovim template.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(scaffold): allow Swift and mise tooling in agent sandboxes",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-24T12:17:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5cf83c4e1a4596725e0b3e6745ab229cc4d9a54f",
"body": "Bind opt+shift+c/g/x alongside the existing c/g/x agent launchers, opening\nthe same agent with its OS-level sandbox disabled:\n\n claude --settings {\"sandbox\":{\"enabled\":false}}\n grok --sandbox off (built-in profile, bypasses \"dotfiles\")\n codex --sandbox danger-full-access\n\nPermi\n[…]\nd character, and tmux keeps both -- so M-G and M-S-g are\ndistinct key names that never match what the terminal actually sends.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(scaffold): add keybinds to launch coding agents unsandboxed",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-24T12:17:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "68a2fd5e1dd4215d5d5665148b0d56249d03bd50",
"body": "Adds a LazyVim lang plugin for Swift: treesitter grammar, sourcekit-lsp\n(Mason-disabled, toolchain-provided), swift-format via conform, and an\nnvim-dap lldb-dap adapter resolved through xcrun on macOS with a PATH\nfallback.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(scaffold): add Swift language support to the Neovim template",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-24T12:17:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "240f36776b950e50a93bedcb3d9f73c192c84980",
"body": null,
"is_bot": true,
"headline": "chore(main): release 0.2.6",
"author_name": "bitwise-fast-forward-merge[bot]",
"author_login": "bitwise-fast-forward-merge[bot]",
"committed_at": "2026-07-22T08:54:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ca843e3d7fa69932dc363edf12ad1970233e12cc",
"body": "Homebrew 6 stopped installing taps implicitly when a fully-qualified\nname is loaded (Homebrew/brew@2b56e218f7), and brew bundle add loads\neach formula or cask to read its description — so adding a name from an\nuntapped tap failed before the Brewfile was touched, even with the\nformula already trusted\n[…]\n, after the trust flow (installing a tap can\nload its packages, which trips Homebrew's trust gate) and before brew\nbundle add.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(brewfile): tap missing third-party taps before brew bundle add",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-22T03:16:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1d80a4348e2d47bd90703e00fcd6d52a75066266",
"body": null,
"is_bot": true,
"headline": "chore(main): release 0.2.5",
"author_name": "bitwise-fast-forward-merge[bot]",
"author_login": "bitwise-fast-forward-merge[bot]",
"committed_at": "2026-07-21T15:27:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2b782d3d0e32f7288333b2f10769b09aa57cc6b8",
"body": "Bumps [github.com/spf13/pflag](https://github.com/spf13/pflag) from 1.0.9 to 1.0.10.\n- [Release notes](https://github.com/spf13/pflag/releases)\n- [Commits](https://github.com/spf13/pflag/compare/v1.0.9...v1.0.10)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/spf13/pflag\n dependency-versi\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "deps(deps): Bump github.com/spf13/pflag from 1.0.9 to 1.0.10 (#94)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-21T15:27:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ac80160099d6e077d786f82e5caf7938b67a838d",
"body": "Bumps the bitwise-media-group group with 8 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [bitwise-media-group/github-workflows/.github/workflows/add-to-project.yaml](https://github.com/bitwise-media-group/github-workflows) | `6.0.0` | `6.0.1` |\n| [bitwise-media-group/github-workflows/.gith\n[…]\nupdate:semver-patch\n dependency-group: bitwise-media-group\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "build(deps): Bump the bitwise-media-group group with 8 updates (#93)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-21T15:26:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f2b841bd61d22d4fe910aba8ad7ce3da2479d6cd",
"body": "dotty git start and dotty git append now publish the freshly created\nbranch with git push -u <remote> <branch>, so the remote branch and its\nupstream tracking exist from birth. A repo with no push remote skips the\npush; an unreachable remote downgrades to a warning — the branch already\ntracks origin\n[…]\nig pair, so a later bare git push completes\npublication. Append now writes the same track-from-birth config Start\nalready did.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(git): push new stack branches to origin on start/append",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-21T05:16:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e924bbd00bb558f908a7efbc250f39949e5d15c7",
"body": "Set no_equals in the rendered .zshrc so a leading = in a word (e.g.\n--flag=value passed as a bare argument) is not expanded to a command\npath, which errors out when no matching command exists.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(scaffold): disable EQUALS expansion in the zsh template",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-21T05:10:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eeab1afc05606b11e64d36a48f6800ed6f928a61",
"body": null,
"is_bot": true,
"headline": "chore(main): release 0.2.4",
"author_name": "bitwise-fast-forward-merge[bot]",
"author_login": "bitwise-fast-forward-merge[bot]",
"committed_at": "2026-07-20T21:18:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b906b1412949fb0ece3a196228b7c929fbef84a4",
"body": "Flag each proposed PR to merge automatically once its requirements\npass, with an explicit method: --auto-merge=merge|rebase|squash. The\nmode =comment instead posts a /auto-merge comment for repositories\nwhere a merge bot gates merges rather than GitHub's native auto-merge.\nThe flag also reads a pers\n[…]\ning propose stays idempotent: a pending auto-merge\nrequest is left alone and an existing /auto-merge comment is not\nre-posted.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(git): add --auto-merge flag to propose",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-20T21:16:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c9a64e5cf531dd09ede3ccc3c39299a47657ed77",
"body": "Every git verb's flags now pick up persistent defaults from git config:\nflag --<name> on verb <verb> reads dotty.<verb>.<name> (for example\ndotty.propose.browse and dotty.propose.copy). Config supplies defaults,\nnot arguments — an explicit command-line flag always wins, and a\nconfig-sourced value do\n[…]\nn annotation\nwhere a persistent default is destructive (resign --root) or meaningless\n(merge --up, a stack-relative quantity).\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(git): read flag defaults from git configuration",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-20T19:30:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4172f6071195acdedcc47348147853c0324a84c9",
"body": "Open each proposed pull request in the browser with --browse, and put the\nPR URL(s) (one per line) on the clipboard with --copy. Adds a cross-platform\nclipboard helper to internal/cli (pbcopy / clip / wl-copy / xclip / xsel).\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(git): add --browse and --copy flags to propose",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-20T19:09:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4bf4b6afbae4c75f9a39b978ab35fbe651e89db0",
"body": "Files like ~/.gitconfig and ~/.zshrc override or bypass the rendered XDG\nconfiguration (git reads ~/.gitconfig after ~/.config/git/config; the bare\nzsh startup files predate the ~/.zshenv ZDOTDIR redirect) but never occupy\na link site, so conflict resolution never saw them. LinkHome now moves\nthem into the timestamped backup set — restorable with dotty dotfiles\nrestore — and reports them as retired.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(linker): retire legacy files that shadow the rendered config",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-20T18:21:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4a86b41634201b14c24b4e13a8e71033d810caef",
"body": "With SSH_ASKPASS_REQUIRE=force every OpenSSH prompt reaches the ask-pass\nbridge, which treated anything that wasn't a FIDO2 user-presence prompt\nas a PIN request — so the host-authenticity question surfaced as a\npinentry PIN box showing only the prompt's first line.\n\nDispatch on $SSH_ASKPASS_PROMPT \n[…]\n only genuine secrets reach GETPIN. Also percent-escape SETDESC so\nmulti-line prompts no longer truncate at the first newline.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(signing-key): answer ssh yes/no prompts with CONFIRM, not GETPIN",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-20T18:01:02Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cd6423c4de73a11b3dfc610048678c0f417b7864",
"body": "Pin every caller to github-workflows 3636c830f0b00c591f8b27401c45786d08466f18\n(v6.0.0). The v6 release workflow adds container-image publishing (goreleaser\ndockers_v2 -> ghcr) and attestation, so the release caller now also grants\npackages: write -- GitHub validates a reusable workflow permissions ceiling as\nthe union of every job, even skipped ones.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "ci: bump org reusable workflows to v6.0.0",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-20T16:30:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "669c341eec458e58c99f6f2fe9ed254c26b851ed",
"body": "Every third-party tap reference already carries entry-level\ntrusted: true (oh-my-posh, k9s, opencode), keeping exposure scoped to\nthe single formula each tap provides. The first-party tap is ours to\ntrust wholesale, so mark the tap line itself trusted — which also covers\nthe dotty cask it ships without a redundant entry-level flag.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(scaffold): trust the bitwise-media-group tap in core.Brewfile",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-20T13:43:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a538d9b6f796021ace1cd16960e0ea40c2feb9f2",
"body": null,
"is_bot": true,
"headline": "chore(main): release 0.2.3",
"author_name": "bitwise-fast-forward-merge[bot]",
"author_login": "bitwise-fast-forward-merge[bot]",
"committed_at": "2026-07-19T01:35:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a31c87a05405950ee9e0b61931c4a9dfb2c7e501",
"body": "Homebrew 6's `brew bundle add` appends blindly: no duplicate detection\nand no way to emit the `trusted: true` entry option. The latter matters\nbecause `dotty brewfile sync` runs `brew bundle install --force-cleanup`,\nwhich resets Homebrew's trust store to exactly what the Brewfile declares\n— trust g\n[…]\nxcluded from the gate.\n\nThe internal/brewfile -> internal/cli import is new but acyclic;\nscaffold already layers the same way.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(brewfile): dedupe adds and record trusted: true on new entries",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-19T01:29:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "930edf32a8ae4e5b8f6077bd2e603a30bbd4b919",
"body": "runInit tripped gocyclo (24 > 20) once the identity and security-key\nquestions moved ahead of the confirmation; the whole pre-action interview\n— wizard, identity, key plan, summary — now lives in collectInterview,\nleaving runInit with just the actions.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "refactor(init): extract the interview into collectInterview",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T23:52:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "48ccadd87b05018f84effaedb130d2060d43869b",
"body": "- the git-identity and security-key questions (setup choice, allowlist)\n move ahead of the confirmation summary, so no action — render, profile\n creation, brew dump, key enrollment — happens until the wizard's final\n confirm, and backing out of any question leaves the machine untouched\n- a cancel\n[…]\n core Brewfile taps bitwise-media-group/tap and installs the dotty\n cask, so `dotty brewfile sync` keeps dotty itself managed\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(init): finish the interview before acting, and brew dotty itself",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T23:47:54Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c4d8f16d4601ac285f34b057a67a8e4a62284339",
"body": "- `dotty git done` pushes the trunk branch to origin after a successful\n fast-forward, keeping a fork's main in step with upstream\n- `dotty git start` points the new branch's tracking at origin/<branch>\n from birth, so a bare `git push` / `git pull` targets the push remote\n before the first push exists\n- the template git config gains a `done` alias invoking `dotty git done`\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(git): push trunk from done and track origin from start",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T23:47:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8de7008effcacf16db728d7ade464cd49c5bdfbb",
"body": null,
"is_bot": false,
"headline": "docs: add socials to footer",
"author_name": "Tiffany Wang",
"author_login": "tiffanywang3",
"committed_at": "2026-07-18T16:39:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "64d478faf350c601ac97df9de6c6eb1bcd63d12e",
"body": null,
"is_bot": true,
"headline": "chore(main): release 0.2.2",
"author_name": "bitwise-fast-forward-merge[bot]",
"author_login": "bitwise-fast-forward-merge[bot]",
"committed_at": "2026-07-18T15:10:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "16cb6e9a73d90a96555cccac9e61f3a89b5cc1fd",
"body": "The cask used generate_completions_from_executable, which makes Homebrew\nexecute the freshly staged binary at install time. Homebrew installs\ncask artifacts in a fixed type-based order, but GeneratedCompletion is\nmissing from that sort table (brew 6.0, and still on master), so its\nposition falls to \n[…]\nxecuting\nthe binary. The preflight stays: it still clears quarantine so the\ninstalled binary runs without a Gatekeeper prompt.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(release): ship static shell completions in the Homebrew cask",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T15:08:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b8fc971a128b70a46a72052340e793e0e3a64c7d",
"body": null,
"is_bot": true,
"headline": "chore(main): release 0.2.1",
"author_name": "bitwise-fast-forward-merge[bot]",
"author_login": "bitwise-fast-forward-merge[bot]",
"committed_at": "2026-07-18T14:13:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2a2e57e9ce2ae010a4a132314918cf5022c43391",
"body": "Signed-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(build): ignore bin so goreleaer does not detect a dirty branch",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T14:10:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7196c1b32ca11a27be5975aa1a800fd2197def72",
"body": null,
"is_bot": true,
"headline": "chore(main): release 0.2.0",
"author_name": "bitwise-fast-forward-merge[bot]",
"author_login": "bitwise-fast-forward-merge[bot]",
"committed_at": "2026-07-18T14:06:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "38af6e03432c76211cbcab79c6766ad74474da25",
"body": "Bumps [.mise](https://github.com/bitwise-media-group/toolchain) from `ecbb149` to `3a2f989`.\n- [Release notes](https://github.com/bitwise-media-group/toolchain/releases)\n- [Commits](https://github.com/bitwise-media-group/toolchain/compare/ecbb1499b86e94720b0de9d997fec1b9d3f07772...3a2f98941fa50c0c91\n[…]\nd8db27e27b30c4f3b60fbb\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "build(deps): Bump .mise from `ecbb149` to `3a2f989` (#55)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-18T14:05:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b1b8cc02486d40b6d78504427a7f07f85d54012b",
"body": "The stack-versus-trunk view is now dotty git status, matching what it\nshows. stack becomes an alias of dotty git switch, so dotty git stack\nnow opens the layer picker. The scaffolded git alias follows suit and\npoints stack at dotty git switch; there is no git-level alias for the\nstatus view because \n[…]\nHANGE: dotty git stack now opens the switch picker instead of\nprinting stack status; use dotty git status for the status view.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(git)!: rename dotty git stack to dotty git status",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:55:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b775164b8b9f2a8a509d29124c007d148704f608",
"body": "…re HEAD\n\nThree sync behaviour fixes:\n\n- Force-push only the branches the stack rebase actually rewrote. The\n rewritten set is tracked in the persisted rebase state so --continue\n resumes with the branches finished before the conflict; no-op layers\n are no longer pushed at all.\n- Fetch each PR bo\n[…]\nwhen the rebase finishes, resumes via --continue, or aborts.\n propose relies on the same restore instead of its own checkout.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(git): push only rewritten branches, skip current PR bodies, resto…",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:54:42Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d1dab30afe40ae55c955affdc8936d27e8ce20f1",
"body": "A layer with a PR renders as its linked PR number plus the commit\nsubject — the branch name code span next to it was noise. Layers not\nyet proposed keep the branch as their identifier, and a titleless\nunproposed layer no longer prints its branch twice.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(git): drop redundant branch names from the PR stack map",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:42:26Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "16d04363e8361e12bc079d69b601638d4adb5a2a",
"body": "CLAUDE.md points every Go edit at the go-style skill, AGENTS.md\nmirrors it for other coding agents, and .claude/settings.json enables\nthe bitwise workflow plugin alongside golang.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "chore(claude): add agent instructions and enable the workflow plugin",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:42:25Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "96cfaaa9ebae1ecf95ca1131a500a7e828c21caf",
"body": "Signed-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: fix prettier formatting",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:42:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2cf51a1e663ffa1c3bb3285789a514207643a70d",
"body": "Bring DESIGN.md in line with the shipped scaffold, init, dotfiles,\nsecurity-key, worktree, and stacked-git work, reflowed to the\nprettier width.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "docs(design): update the design document",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:41:00Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "9f61eef25c54735c13823284818fc909aafb3e05",
"body": "Allow the pymdownx keyboard element (<leader>) under MD033 — Material\nrenders ++\"<leader>\"+f+s++ as keys, but a CommonMark parser reads the\nplaceholder as inline HTML. Realign the tmux reference tables and rewrap\nprose via make fmt to satisfy MD060 and clear pending prettier drift.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: fix markdownlint MD033/MD060 failures",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:39:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3484709d436d0650885de2a4602b20465d75f0e2",
"body": "Add a multi-page getting-started guide (install, init, signing keys,\nagents and hardening, daily workflow), task guides (profiles,\nBrewfile, credentials, stacked branches, agent worktrees and\nre-signing), and reference pages (layout, macOS defaults, agent\nsandboxing, tmux, Neovim, shell and terminal\n[…]\nust\nstep required by brew v6, and key caps follow the current branding.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: overhaul the documentation site",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:35:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3c1615c0931579c928a4ff2cbb2711890f85686f",
"body": "Signed-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "style(wizard): wrap collectFeatureConfirms signature within line limit",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:35:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "377f2c05b4fd25444e0690e846d1e0580f96cf1f",
"body": "dotty init scaffolds a dotfiles repository from the embedded\ntemplate: a flag-mirrored interview (repos dir, repo path, profile,\nBrewfile seeding, add-ons, agents, hardening, security keys, macOS\ndefaults, wallpaper, and PIV enforcement), confirmation before any\nwrite, the profile rendered into the \n[…]\n with the template-composed\nBrewfile instead of dying after the render.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(init): add the dotty init wizard",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:14:18Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "24157bd489aa6aacdb8cce522401a65632ef4cfe",
"body": "dotty worktree start creates (or reuses) a worktree on an\nagent/<repo>-<suffix> branch at the profile-configured location\n(DOTTY_WORKTREES → active profile answers → the repo-relative\n.worktrees default) and prints its path; end reports uncommitted and\nunpushed work, kills the worktree's tmux sessio\n[…]\nches via\nthe profile's worktrees.gitconfig, ready for dotty git resign.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(worktree): add agent worktree lifecycle commands",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:13:43Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "44ca8955ed85a08117378f21b83f76e95847c4b4",
"body": "A profile can now restrict which security keys its machines accept,\nso personal keys are never used against work devices and vice versa.\nThe allowlist lives beside the alias store in the active profile's\nprivate data directory (serials identify hardware and never enter the\nshareable repo); an absent\n[…]\nlicit parameters, so\ninit's security-key step can drive the same flows.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(security-key): add a per-profile serial allowlist",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:13:24Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "073d5141a522326b022ed41d330425f99d433c2d",
"body": "internal/linker links a dotfiles repository's trees into $HOME:\nfolded file/dir symlinks, unfolding into existing real directories,\nand stale symlinks replaced in place — removing a symlink never\ndestroys the file it names. Real files in the way resolve through a\ncaller-supplied Resolver — backup (m\n[…]\n the\nactive profile's stored paths instead of guessing from $REPOS_DIR.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(dotfiles): add the stow-style linker and dotfiles commands",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:12:14Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "27f6a0138d4673ff21a68fc14f676ab6c67126e9",
"body": "A ~90-file go:embed template derived from the legacy dotfiles,\nscrubbed of runtime state and PII, with legacy applet calls rewritten\nto dotty noun-verb commands. A Go manifest maps wizard answers onto\ncomponents (core, add-ons, agents, security keys), per-component\nBrewfile fragments compose and ded\n[…]\nr against the\nresolved .git/worktrees path, ready for dotty git resign.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(scaffold): embed the dotfiles template with repo-shared profiles",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:11:40Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d9447a63a6ecec85dcfbedbd40fcb5a233032771",
"body": "One internal/git package covers commit re-signing and fork-friendly\nstacked branches behind a single three-method Runner. Stacks land via\ntrue fast-forward merges only, because GitHub's built-in merge methods\ncreate new commits and break the chain's signatures. The verbs:\n\n- start and append record \n[…]\ng\n them from any recorded lineage), and fast-forwards the local trunk.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(git): add the signature-preserving stacked branch workflow",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:09:03Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "054eb0cf14ddb58aa977f7b6c0fe446a0d4a8944",
"body": "Option gains a Selected field: MultiSelect renders preselected entries\nand FuzzySelect starts its cursor on the single selected option while\nthe filter is empty. ConfirmDefault lets callers preset the yes/no\nanswer, and InputSuggest adds tab-completable suggestions on top of\nInput — both for intervi\n[…]\ne field total, giving every option a row while long\nlists still scroll.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(tui): grow the prompt helpers for interview flows",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T12:09:26Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "755a2388a5390d8f83311b9982fb06d3b70d917b",
"body": "Bumps [golang.org/x/term](https://github.com/golang/term) from 0.44.0 to 0.45.0.\n- [Commits](https://github.com/golang/term/compare/v0.44.0...v0.45.0)\n\n---\nupdated-dependencies:\n- dependency-name: golang.org/x/term\n dependency-version: 0.45.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "deps(deps): Bump golang.org/x/term from 0.44.0 to 0.45.0 (#60)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-16T15:26:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6004b213314dcdfce0d63b57837ce1f530821485",
"body": "rewriteTrailers only replaced the exact \"oldName <oldEmail>\" identity, so\na trailer written with an empty email (\"Name <>\") never matched and was\nleft behind while --reset-author still fixed the commit author. Match\nempty-email identities by name — for the old and new names both — and fill\nthem in with the current user.name/user.email.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(git): populate empty sign-off emails during resign --reset-author",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-13T22:56:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2f6d055bd653724357a48014aa9dc1588b564d93",
"body": "Bumps [charm.land/bubbles/v2](https://github.com/charmbracelet/bubbles) from 2.1.0 to 2.1.1.\n- [Release notes](https://github.com/charmbracelet/bubbles/releases)\n- [Commits](https://github.com/charmbracelet/bubbles/compare/v2.1.0...v2.1.1)\n\n---\nupdated-dependencies:\n- dependency-name: charm.land/bub\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "deps(deps): Bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 (#51)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-13T15:27:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f95e89dba07db2545cf6f15b08bdf4869585e1c6",
"body": "Bumps [charm.land/bubbletea/v2](https://github.com/charmbracelet/bubbletea) from 2.0.7 to 2.0.8.\n- [Release notes](https://github.com/charmbracelet/bubbletea/releases)\n- [Commits](https://github.com/charmbracelet/bubbletea/compare/v2.0.7...v2.0.8)\n\n---\nupdated-dependencies:\n- dependency-name: charm.\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "deps(deps): Bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 (#50)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-10T11:30:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "841aac01c5e93590b9a04ec34ea0e18df43b1248",
"body": "mise run docs picked up drift: the tmux reference pages predate the\ngrok agent window (dotty tmux now lists opencode, grok, codex, claude).\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: regenerate the CLI reference",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-10T11:08:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ac63aeff24d8bac1ed6cac4b020c563663543b23",
"body": "Migrate from the Makefile-fragment library (make/ submodule, go-cli.mk)\nto bitwise-media-group/toolchain v2: the submodule remounts at .mise/\n(new repo name in .gitmodules; GitHub redirects the old URL), a root\nmise.toml selects the go-cli archetype and carries the [vars] knobs\n(app, app_pkg), and t\n[…]\nlows v5.0.0, the mise-task-aware\npipeline generation that discovers which canonical tasks the repo\ndefines and skips the rest.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "build: adopt the toolchain mise-task layout",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-10T11:08:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "25ca10561a98ccf807287e4cf967b9e67b6615c1",
"body": "Add grok to the agent windows created by dotty tmux new, placed\nbetween codex and opencode, and mention it in the command help text.\n\nAlso align the TestNewSession expectations with the nerd-font glyphs\nsession.go actually uses for the editor and zsh window names; the\nplain-space expectations had the layout tests failing.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(tmux): launch grok in its own agent window",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-10T00:34:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "09b9d4a17e2784bc0fd71b31c8b330a6491f8f9e",
"body": "profile activate and both YubiKey pickers move from tui.Select to\ntui.FuzzySelect (same ErrAborted / ErrNotInteractive contract, and the\nsecuritykey docs already promised a fuzzy picker). That leaves tui.Select\nwith no callers, so it and its huh-specific tests go; the fuzzy widget's own\nbenchmarks replace them (48us/frame vs huh's 3.2ms — it only styles the\nvisible window). MultiSelect stays on huh for the checklist flows.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "refactor(tui): migrate the remaining pickers to FuzzySelect",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-10T00:21:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "471f9f1e13816d8824fd451581fc8baf608fe7d1",
"body": "huh's Select filter is a plain case-insensitive substring match with no\ncustomization hook, so `dotty tmux new` could not match scattered queries\nlike bmgdot -> bitwise-media-group/dotty. Add tui.FuzzySelect, a bubbletea\nwidget in the treeselect mould built on the sahilm/fuzzy matcher already in\nthe\n[…]\nighted, enter accepts the cursor row, esc aborts, and long lists scroll\ninside the maxPromptRows window with an overflow hint.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(tui): add fzf-style fuzzy picker and use it for tmux new",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-10T00:21:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f7223a9e3d88bfddbdeeb1480f181571ca291b75",
"body": "500 repos across 20 orgs plus depth-pruned noise; the walk sits around\n1.7ms, confirming the tmux-new picker's latency lives in rendering, not\ndiscovery.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "test(tmux): add FindRepos benchmark over a realistic repo tree",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-10T00:21:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f886dd3db72192980badc0b3fcdacf53fd55b3cb",
"body": "huh only applies its 10-row default height to dynamic options; a Select or\nMultiSelect built from static options sizes its viewport to the full option\ncount, so `dotty tmux new` painted all ~130 repositories on every frame —\n1,392 lines into scrollback for a single prompt. Cap fields longer than\nmax\n[…]\nTests pin the sizing\nrule and the filter-reaches-unrendered contract; benchmarks compare the\ncapped and uncapped frame render.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "perf(tui): cap picklist height so long lists render a viewport",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-10T00:21:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6041bb04ad13260f071cbdd8d906e135d79dd8a0",
"body": "Re-implement the legacy tmux-session start flow as a visible\n`dotty tmux new [query]`: pick a repository under $REPOS_DIR (default\n~/Repos, four levels deep; \".\" resolves the enclosing repo) and\ncreate-or-attach a session laid out with the editor over a small shell\nsplit, one window per installed co\n[…]\nwitch-client\ninstead of a failing nested attach, and the worktree integration and\nattach/end subcommands are not carried over.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(tmux): add tmux new session launcher",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-10T00:21:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "139e70ba38ca7ec16761a6596b448a894537f1ac",
"body": "Port the legacy agent-tmux-status helper into dotty as a hidden\n`dotty tmux set-status [waiting|attention|clear]` verb. Inside tmux it sets\nthe per-window @agent_status option the tmux theme renders; outside tmux it\nfalls back to an OSC 0 terminal title on /dev/tty. The command is no-op-safe\n(always\n[…]\nause Claude Code / Codex hooks\ntreat a non-zero exit as a failure. Hook configs invoke it directly; no\nlegacy symlink is kept.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(tmux): add hidden set-status command for agent lifecycle hooks",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-09T23:13:37Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0df2bfc144932001bce8c60d108b46f06606ab36",
"body": "Bumps the dev-tooling group with 2 updates: [markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2) and [prettier](https://github.com/prettier/prettier).\n\n\nUpdates `markdownlint-cli2` from 0.22.1 to 0.23.0\n- [Changelog](https://github.com/DavidAnson/markdownlint-cli2/blob/main/CHANGELOG\n[…]\nversion-update:semver-patch\n dependency-group: dev-tooling\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "build(deps-dev): Bump the dev-tooling group with 2 updates (#47)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-09T15:28:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1873972459468d7e5a84570aec3140385590b33b",
"body": "Bumps the bitwise-media-group group with 8 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [bitwise-media-group/github-workflows/.github/workflows/add-to-project.yaml](https://github.com/bitwise-media-group/github-workflows) | `4.3.1` | `4.4.0` |\n| [bitwise-media-group/github-workflows/.gith\n[…]\nupdate:semver-minor\n dependency-group: bitwise-media-group\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "build(deps): Bump the bitwise-media-group group with 8 updates (#46)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-06T15:28:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7ab2c215a07efb1ca67e2d8019e564edd20012bc",
"body": "Advance the SHA pin from d8af26d (v4.3.0) to a28e6738 (v4.3.1); no caller-contract changes.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "build(deps): bump github-workflows reusable workflows to v4.3.1",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-04T19:57:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8ff60c94bd2c135bd7a09cefdf772e5c693f6ea0",
"body": "The library migration (eeca3b3) deleted tools/go.mod but left the goreleaser\nsboms config invoking syft through it, so the next tagged release would fail\nat the SBOM step. Generate SBOMs with the plain `syft` from PATH instead: the\nmake/ library's snapshot/release targets install it from the .syft-v\n[…]\nLIs come from the make/ submodule's .<tool>-version pins,\n and the pr gate is the archetype's tidy fmt lint test build commit\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(release): finish the make-library migration for SBOM generation",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-04T19:01:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fc1627169d06fbcafa0f98a2b2a9931aa6affc09",
"body": "Bumps the dev-tooling group with 1 update: [prettier](https://github.com/prettier/prettier).\n\n\nUpdates `prettier` from 3.8.4 to 3.9.0\n- [Release notes](https://github.com/prettier/prettier/releases)\n- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)\n- [Commits](https://github\n[…]\nversion-update:semver-minor\n dependency-group: dev-tooling\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "build(deps-dev): Bump prettier in the dev-tooling group (#41)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-04T14:34:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "eeca3b3d9d3f206bbb44d02264e770e7a76b435f",
"body": "Replace dotty's hand-written Makefile with a one-line include of the shared\ngo-cli.mk archetype from bitwise-media-group/make, mounted as the make/ submodule\n(tracking the release branch). The canonical lint/build/test/ci/pr contract now\ncomes from the library; only dotty's repo-local targets (docs,\n[…]\nholder to the canonical \"BitWise Media Group Ltd\"\n\nmake lint/build/test stay byte-for-byte equivalent to the previous recipes.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "build(make): adopt shared Makefile library via submodule",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-04T14:29:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "bb85ad1c36faa1a55f6109727a4d54e0d3211727",
"body": "Signed-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "ci: update all pipelines to latest",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-04T14:26:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f335ec62f5142bdea302e1f28dbdf5778ca545bf",
"body": "Bumps [charm.land/lipgloss/v2](https://github.com/charmbracelet/lipgloss) from 2.0.4 to 2.0.5.\n- [Release notes](https://github.com/charmbracelet/lipgloss/releases)\n- [Commits](https://github.com/charmbracelet/lipgloss/compare/v2.0.4...v2.0.5)\n\n---\nupdated-dependencies:\n- dependency-name: charm.land/lipgloss/v2\n dependency-version: 2.0.5\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "deps(deps): Bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-03T16:22:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "319b45bf686ddf6565c381d1158ddcbc3f249825",
"body": "…th 7 updates\n\nBumps the bitwise-media-group group with 7 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [bitwise-media-group/github-workflows/.github/workflows/ci.yaml](https://github.com/bitwise-media-group/github-workflows) | `4.0.3` | `4.1.0` |\n| [bitwise-media-group/\n[…]\npendency-version: 4.1.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: bitwise-media-group\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "build(deps): Bump the bitwise-media-group group across 1 directory wi…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-03T15:35:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f56c7f71eed60006713073c2485052a260049d19",
"body": "Replace the placeholder light palette with the .theme-dotty-light tokens\n(design-system/tokens/themes.css): warm paper canvas, near-white cards,\nsunken cream terminals, and warm-tinted shadows.\n\nSplit the accent per the design system: the yellow ramp stays bright in\nboth modes and is only used as fi\n[…]\nnstead of\npinning the dark canvas, and the light-mode footer sits on the paper\nsurface with a hairline top border.\n\nCloses #28\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: implement the light theme from the design-system dotty kit",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-03T15:26:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ab67274db2769728f2de4245257185f61d1775f7",
"body": "Prettier fallout from make fmt: the section prose now fills the\n80-column prose width.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: rewrap signing-key trust section in DESIGN.md",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-03T00:32:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e2da8d1355aba1dc2f1e852b261f0fcf59fe2a91",
"body": "Wrap the AskPassReply signature under the 120-column limit (lll) and\ntidy the Trust tests: extract wantCounts/wantPerm helpers to bring\nTestTrust under the gocyclo threshold — wantPerm also stops ignoring\nthe os.Stat error the inline checks discarded — drop the writeStubPub\nparameters that only ever received one value (unparam), and wrap the\nover-long parseAllowedSigner table rows (lll).\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "style(signing-key): resolve make fmt lint findings",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-03T00:01:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c9cf9f5e86c385964e79c8da10e1d7f0dca03c8a",
"body": "The ask-pass bridge only enabled pinentry-mac's keychain cache when the\nkey's fingerprint arrived out-of-band ($DOTTY_SSH_KEYINFO, set by\n`signing-key sign`) or embedded in an agent-style prompt (SHA256:<fp>).\nssh's own pubkey-auth prompt — \"Enter PIN for <TYPE> key <path>: \" —\nnames the key by file\n[…]\ningerprints it, which\nresolves to the same keychain item the sign path caches — one saved PIN\nserves both git signing and ssh.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(signing-key): cache ssh client-auth PINs in the macOS keychain",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-03T00:01:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f9cb2afa8e710429e8871f00fcb185111abbeb81",
"body": "Recognize a dotty-ssh-askpass argv[0] basename in the argv dispatcher —\nalongside the existing DOTTY_ASKPASS=1 sentinel — so a globally-exported\nSSH_ASKPASS routes every OpenSSH PIN prompt to the pinentry bridge,\nincluding the ssh-keygen spawned by `signing-key new`/`import`, which\ninherits no senti\n[…]\nk` now installs the shim symlink under\n~/.local/share/dotty. While here, swap errors.As for the generic\nerrors.AsType in main.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(signing-key): route the dotty-ssh-askpass shim to ask-pass",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-03T00:01:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a8eb4b0e4c0471e8698e20f0b0b1765e29e0a508",
"body": "Add `dotty signing-key trust`: append every signing key on the\nplugged-in YubiKeys to the OpenSSH allowed_signers file so git can\nverify the commits and tags they sign. Entries pair the committer email\n(git config user.email) with the key blob; the path comes from\ngpg.ssh.allowedSignersFile, falling\n[…]\n reading git config,\ncli.ExpandHome for ~ paths captured from git config, a DESIGN.md\nsection, and the generated CLI/man docs.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(signing-key): trust enrolled keys in git allowed_signers",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-03T00:01:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cb06801a37676602e045229d4052822544087b94",
"body": "Set extra.scope = \"/\" so preference storage (the __consent choice,\ncolour palette) is keyed to the domain root instead of /dotty/. One\nconsent answer on any oss.bitwisemedia.uk site now applies here too.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: share cookie-consent choice across oss.bitwisemedia.uk",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-03T00:01:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8376362816f8e55ca116a177097d63ebb6c7dbe9",
"body": "Homebrew removed the --no-cleanup flag from `brew bundle install`, so\n`dotty brewfile upgrade` failed with \"ambiguous option: --no-cleanup\"\n(prefix-matching --no-cleanup-go / --no-cleanup-uv). brew bundle install\ndoes not clean up unless asked, so dropping the flag preserves the\n\"without removing anything\" behaviour.\n\nFixes #27\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(brewfile): drop obsolete --no-cleanup from brew bundle upgrade",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-03T00:01:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9eadc3ce0d98f829bd26261b992b2d0d3a88c275",
"body": "Signed-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "style: fmt add to project",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-02T23:58:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f6fa25a798f2cf30d9f4f6d36687af0841cb9c56",
"body": "Swap the borrowed Charm palette in the huh forms and the custom bubbletea\nprompts for dotty's own brand tokens from the design system\n(bitwise-media-group/design-system, tokens/themes.css .theme-dotty): a warm\nnear-black surface with a yellow (#F5C518) primary. Titles, selectors, cursors,\nprompts an\n[…]\n notices adopt the shared earthy semantic set from tokens/colors.css\n:root so standalone messages match the forms.\n\nCloses #13\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(tui): theme huh/bubbletea prompts with design-system dotty colours",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-01T09:19:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9aff775b26edd83797f478b1f6efacdde9d545a1",
"body": "Signed-off-by: BitWise Admins <270485327+admin-bitwise@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: sync .github/workflows/add-to-project.yaml from github-settings",
"author_name": "BitWise Admins",
"author_login": "admin-bitwise",
"committed_at": "2026-07-01T09:15:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "385edf3ccbe74e5cc0aebf1abf6eeabc32916905",
"body": "Signed-off-by: BitWise Admins <270485327+admin-bitwise@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: sync .github/workflows/add-to-project.yaml from github-settings",
"author_name": "BitWise Admins",
"author_login": "admin-bitwise",
"committed_at": "2026-07-01T07:54:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2b9ac001ded10c598236dfda90be0732024489f5",
"body": null,
"is_bot": true,
"headline": "chore(main): release 0.1.1",
"author_name": "bitwise-fast-forward-merge[bot]",
"author_login": "bitwise-fast-forward-merge[bot]",
"committed_at": "2026-07-01T00:26:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "248d1f6f820f613806c3fdce1b59a9ab7e6e6ce0",
"body": "Signing through dotty prompted for the PIN on every git commit because the\nsign path never told pinentry to cache it. The predecessor `dot` cooperated\nwith its own ssh-askpass bridge: it exported the key fingerprint and forced\nSSH_ASKPASS so pinentry-mac received SETKEYINFO + allow-external-password\n[…]\nfull env replacement, needed because appending\n cannot remove or reliably override a variable) and RunAssuan (pinentry pipe).\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(signing-key): cache the YubiKey PIN in the macOS keychain",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-01T00:22:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "246421cc0ca637e52ae61a1a0454ea63149dff2c",
"body": "`dotty signing-key link [path]` resolves the connected YubiKey's signing-key\nstub and atomically repoints a stable symlink (and its .pub) at it, printing the\nlink path. This lets ssh name one fixed IdentityFile that follows whichever\nYubiKey is plugged in, with no keys loaded into the agent:\n\n Matc\n[…]\na Match exec prompt would hang) and prefers\ned25519, narrowing with --security-key/--username when several keys are\nconnected.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(signing-key): add link verb to select the plugged-in key for ssh",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-01T00:11:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "56586a83387f51274a6d8d47ed51fcb6dec22c2c",
"body": "GenManHeader left Date unset, so cobra stamped time.Now() and every man page's\n.TH header churned by month on each `make docs`. Pin it to a fixed date — as\nDisableAutoGenTag already does for the markdown output — so generation is\nbyte-for-byte reproducible.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(docs): pin man-page .TH date for reproducible generation",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-01T00:11:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d917296dc2dac0720e7933ec1e833fca560af475",
"body": "Add a `signing-key authorize <[user@]host>` verb that appends a signing\nkey's public key to a remote authorized_keys over the system ssh client.\n\nOnly keys on a currently plugged-in YubiKey are selectable (a single match\nis used directly; several present a fuzzy picker), honouring --security-key\nand\n[…]\nure unless\nthe authorized_keys line carries the matching option. --path overrides the\ndefault ~/.ssh/authorized_keys location.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(signing-key): authorize a key on a remote host's authorized_keys",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-06-30T23:26:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4c1f12272f051f0c3c66e3b968add25867648daa",
"body": "Make Homebrew the primary install path on the landing page: the hero and the\n\"Install\" step now run 'brew install bitwise-media-group/tap/dotty', and the\nstep links through to a new install page as \"Alternative methods\".\n\nAdd docs/install.md, modelled on GoReleaser's OSS install page — Homebrew, go\n\n[…]\n(pymdownx admonition bodies read as indented code\nblocks) and ignore the vendored .venv markdown so the lint gate stays green.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: add an install page with brew, cosign and attestation verification",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-06-30T22:26:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "71dcb0787bb001d8a283286874abcce537a5e59a",
"body": "Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.5.1 to 1.5.2.\n- [Release notes](https://github.com/sigstore/rekor/releases)\n- [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/sigstore/rekor/compare/v1.5.1...v1.5.2)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/sigstore/rekor\n dependency-version: 1.5.2\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "build(deps): Bump github.com/sigstore/rekor in /tools",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-30T22:12:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "64a892d6f59b212bdc19c92da2bcc130b4b828de",
"body": "Bumps [github.com/sigstore/timestamp-authority/v2](https://github.com/sigstore/timestamp-authority) from 2.0.6 to 2.1.0.\n- [Release notes](https://github.com/sigstore/timestamp-authority/releases)\n- [Changelog](https://github.com/sigstore/timestamp-authority/blob/main/CHANGELOG.md)\n- [Commits](https\n[…]\n---\nupdated-dependencies:\n- dependency-name: github.com/sigstore/timestamp-authority/v2\n dependency-version: 2.1.0\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "build(deps): Bump github.com/sigstore/timestamp-authority/v2 in /tools",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-30T22:07:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2f2ed30cca45a00790340164629887e849e4228f",
"body": "Import key-handle stubs from elsewhere on disk into the private data\nstore, verifying each against a connected YubiKey: ssh-keygen -K downloads\nthe resident credentials from the hardware and only stubs whose public key\nis actually resident on a connected key are filed, under that key's serial.\nUnmat\n[…]\nID, plus\ncli.RunInteractiveDir so ssh-keygen -K can run in a scratch dir (it writes\ndownloaded keys to the working directory).\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(signing-key): add import command for existing key stubs",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-06-30T18:12:45Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f7748c2c6112b59e17edd9e079464116578aa57a",
"body": "Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.3.1 to 2.3.2.\n- [Release notes](https://github.com/containerd/containerd/releases)\n- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)\n- [Commits](https://github.com/containerd/cont\n[…]\n.3.2)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/containerd/containerd/v2\n dependency-version: 2.3.2\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "build(deps): Bump github.com/containerd/containerd/v2 in /tools",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-30T18:07:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "501869f12605291ee9f7ccd8f1ca73188e065794",
"body": "Bumps [github.com/sahilm/fuzzy](https://github.com/sahilm/fuzzy) from 0.1.1 to 0.1.3.\n- [Release notes](https://github.com/sahilm/fuzzy/releases)\n- [Commits](https://github.com/sahilm/fuzzy/compare/v0.1.1...v0.1.3)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/sahilm/fuzzy\n dependency-version: 0.1.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "deps(deps): Bump github.com/sahilm/fuzzy from 0.1.1 to 0.1.3",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-30T17:59:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f9c4d5a68a107de286ac5a8240d9ff6fab5e556f",
"body": "Move the Charm TUI stack to its v2 line, which also relocates the module\nimport paths to the charm.land vanity domain:\n\n github.com/charmbracelet/bubbletea -> charm.land/bubbletea/v2 (v2.0.7)\n github.com/charmbracelet/huh -> charm.land/huh/v2 (v2.0.3)\n github.com/charmbracelet/bubbles\n[…]\nompt accent\n colours now use the dark-background variants of the former pairs; huh forms\n stay adaptive via the theme above.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "build(deps): upgrade bubbletea and huh to v2",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-06-30T14:38:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b41d37ce9a0902bf255e2ef3504710c231a6566b",
"body": "… v4.0.3\n\nPin every reusable-workflow caller to 83b83722 (v4.0.3), up from dd3767c5 (v4.0.2). The only change is a fix in the reusable dependabot-merge workflow to match modern gh and indirect deps; caller inputs and permissions are unchanged.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "build(deps): bump bitwise-media-group/github-workflows from v4.0.2 to…",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-06-29T23:16:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5d344f032479881aa6333750a293f1b33812101c",
"body": null,
"is_bot": true,
"headline": "chore(main): release 0.1.0",
"author_name": "bitwise-fast-forward-merge[bot]",
"author_login": "bitwise-fast-forward-merge[bot]",
"committed_at": "2026-06-29T22:34:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "836f6bb723af0ed9956d0f869f76a0c0a3db412c",
"body": "Signed-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: ignore changelog in markdown lint",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-06-29T22:31:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5204656509cfa50136127e900ada6773c5e0d739",
"body": "Bump the pinned reusable workflows from v4.0.0 (4a154ff) to v4.0.2 (dd3767c) to resolve the merge issue.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "ci: bump bitwise-media-group/github-workflows to v4.0.2",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-06-29T22:18:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e640fa9e52ab78153aa21094e417d61f0e121e6a",
"body": "serviceName lived in the build-tag-neutral keychain.go but is only called by the\ndarwin backend (keychain_darwin.go), so on non-darwin builds it is dead code and\nthe `unused` linter fails the Linux lint the reusable CI now runs. Move it next\nto its only caller behind //go:build darwin; the neutral file keeps just the\nshared Keychain/CommandRunner interfaces and sentinel errors.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(env): move serviceName into the darwin keychain backend",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-06-29T18:55:02Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 8,
"commits_last_year": 121,
"latest_release_at": "2026-07-22T09:00:02Z",
"latest_release_tag": "v0.2.6",
"releases_from_tags": false,
"days_since_last_push": 1,
"active_weeks_last_year": 7,
"days_since_latest_release": 5,
"mean_days_between_releases": 3.2
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 100,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"ecosystem": {
"packages": [
{
"name": "github.com/bitwise-media-group/dotty",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/bitwise-media-group/dotty",
"is_deprecated": false,
"latest_version": "v0.2.6",
"repository_url": "https://github.com/bitwise-media-group/dotty",
"versions_count": 9,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-22T08:54:06Z",
"latest_version_yanked": null,
"days_since_latest_publish": 5
},
{
"name": "dotty",
"exists": true,
"license": "UNKNOWN",
"keywords": [
"Development Status :: 4 - Beta",
"Intended Audience :: Developers",
"Intended Audience :: End Users/Desktop",
"Intended Audience :: System Administrators",
"License :: Public Domain",
"Operating System :: MacOS :: MacOS X",
"Operating System :: POSIX",
"Operating System :: Unix",
"Programming Language :: Python",
"Topic :: System :: Installation/Setup",
"Topic :: System :: Systems Administration"
],
"ecosystem": "pypi",
"matches_repo": false,
"registry_url": "https://pypi.org/project/dotty/",
"is_deprecated": false,
"latest_version": "0.1.0",
"repository_url": "http://scrace.org/software/dotty.html",
"versions_count": 1,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": "2013-02-23T21:16:11.038764Z",
"latest_published_at": "2013-02-23T21:16:11.038764Z",
"latest_version_yanked": null,
"days_since_latest_publish": 4902
}
]
},
"popularity": {
"forks": 2,
"stars": 2,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2026-06-20",
"count": 1
},
{
"date": "2026-07-18",
"count": 1
}
],
"complete": true,
"collected": 2,
"total_forks": 2
},
"star_history": null,
"open_issues_and_prs": 7
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile",
"mise.toml"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"go.mod"
],
"largest_source_bytes": 27093,
"source_files_sampled": 218,
"oversized_source_files": 0,
"agent_instruction_files": [
"AGENTS.md",
"CLAUDE.md",
"docs/getting-started/agents.md",
"internal/scaffold/template/shared/AGENTS.md"
],
"agent_instruction_max_bytes": 2897
},
"dependencies": {
"manifests": [
"go.mod",
"pyproject.toml"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 45,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go",
"pypi"
],
"dependencies": [
{
"name": "charm.land/bubbles/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.1.1"
},
{
"name": "charm.land/bubbletea/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.8"
},
{
"name": "charm.land/huh/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.3"
},
{
"name": "charm.land/lipgloss/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.5"
},
{
"name": "github.com/sahilm/fuzzy",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.1.3"
},
{
"name": "github.com/spf13/cobra",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.2"
},
{
"name": "github.com/spf13/pflag",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.10"
},
{
"name": "golang.org/x/term",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.45.0"
},
{
"name": "zensical",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=0.0.46"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "charm.land/bubbles/v2",
"direct": true,
"version": "v2.1.1",
"ecosystem": "go"
},
{
"name": "charm.land/bubbletea/v2",
"direct": true,
"version": "v2.0.8",
"ecosystem": "go"
},
{
"name": "charm.land/huh/v2",
"direct": true,
"version": "v2.0.3",
"ecosystem": "go"
},
{
"name": "charm.land/lipgloss/v2",
"direct": true,
"version": "v2.0.5",
"ecosystem": "go"
},
{
"name": "github.com/sahilm/fuzzy",
"direct": true,
"version": "v0.1.3",
"ecosystem": "go"
},
{
"name": "github.com/spf13/cobra",
"direct": true,
"version": "v1.10.2",
"ecosystem": "go"
},
{
"name": "github.com/spf13/pflag",
"direct": true,
"version": "v1.0.10",
"ecosystem": "go"
},
{
"name": "golang.org/x/term",
"direct": true,
"version": "v0.45.0",
"ecosystem": "go"
},
{
"name": "zensical",
"direct": true,
"version": "0.0.46",
"ecosystem": "pypi"
},
{
"name": "github.com/atotto/clipboard",
"direct": false,
"version": "v0.1.4",
"ecosystem": "go"
},
{
"name": "github.com/catppuccin/go",
"direct": false,
"version": "v0.3.0",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/colorprofile",
"direct": false,
"version": "v0.4.3",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/ultraviolet",
"direct": false,
"version": "v0.0.0-20260703014108-f5a850f9c2b7",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/ansi",
"direct": false,
"version": "v0.11.7",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/exp/ordered",
"direct": false,
"version": "v0.1.0",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/exp/strings",
"direct": false,
"version": "v0.0.0-20240722160745-212f7b056ed0",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/term",
"direct": false,
"version": "v0.2.2",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/termios",
"direct": false,
"version": "v0.1.1",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/windows",
"direct": false,
"version": "v0.2.2",
"ecosystem": "go"
},
{
"name": "github.com/clipperhouse/displaywidth",
"direct": false,
"version": "v0.11.0",
"ecosystem": "go"
},
{
"name": "github.com/clipperhouse/uax29/v2",
"direct": false,
"version": "v2.7.0",
"ecosystem": "go"
},
{
"name": "github.com/cpuguy83/go-md2man/v2",
"direct": false,
"version": "v2.0.6",
"ecosystem": "go"
},
{
"name": "github.com/dustin/go-humanize",
"direct": false,
"version": "v1.0.1",
"ecosystem": "go"
},
{
"name": "github.com/inconshreveable/mousetrap",
"direct": false,
"version": "v1.1.0",
"ecosystem": "go"
},
{
"name": "github.com/lucasb-eyer/go-colorful",
"direct": false,
"version": "v1.4.0",
"ecosystem": "go"
},
{
"name": "github.com/mattn/go-runewidth",
"direct": false,
"version": "v0.0.24",
"ecosystem": "go"
},
{
"name": "github.com/mitchellh/hashstructure/v2",
"direct": false,
"version": "v2.0.2",
"ecosystem": "go"
},
{
"name": "github.com/muesli/cancelreader",
"direct": false,
"version": "v0.2.2",
"ecosystem": "go"
},
{
"name": "github.com/rivo/uniseg",
"direct": false,
"version": "v0.4.7",
"ecosystem": "go"
},
{
"name": "github.com/russross/blackfriday/v2",
"direct": false,
"version": "v2.1.0",
"ecosystem": "go"
},
{
"name": "github.com/xo/terminfo",
"direct": false,
"version": "v0.0.0-20220910002029-abceb7e1c41e",
"ecosystem": "go"
},
{
"name": "go.yaml.in/yaml/v3",
"direct": false,
"version": "v3.0.4",
"ecosystem": "go"
},
{
"name": "golang.org/x/sync",
"direct": false,
"version": "v0.21.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sys",
"direct": false,
"version": "v0.47.0",
"ecosystem": "go"
},
{
"name": "click",
"direct": false,
"version": "8.4.2",
"ecosystem": "pypi"
},
{
"name": "colorama",
"direct": false,
"version": "0.4.6",
"ecosystem": "pypi"
},
{
"name": "deepmerge",
"direct": false,
"version": "2.1.0",
"ecosystem": "pypi"
},
{
"name": "dotty",
"direct": false,
"version": "0.1.0",
"ecosystem": "pypi"
},
{
"name": "jinja2",
"direct": false,
"version": "3.1.6",
"ecosystem": "pypi"
},
{
"name": "markdown",
"direct": false,
"version": "3.10.2",
"ecosystem": "pypi"
},
{
"name": "markupsafe",
"direct": false,
"version": "3.0.3",
"ecosystem": "pypi"
},
{
"name": "pygments",
"direct": false,
"version": "2.20.0",
"ecosystem": "pypi"
},
{
"name": "pymdown-extensions",
"direct": false,
"version": "11.0",
"ecosystem": "pypi"
},
{
"name": "pyyaml",
"direct": false,
"version": "6.0.3",
"ecosystem": "pypi"
},
{
"name": "tomli",
"direct": false,
"version": "2.4.1",
"ecosystem": "pypi"
}
],
"collected": true,
"truncated": false,
"total_count": 45,
"direct_count": 9,
"indirect_count": 36
}
},
"maintainership": {
"issues": {
"open_prs": 2,
"merged_prs": 74,
"open_issues": 5,
"closed_ratio": 0.545,
"closed_issues": 6,
"closed_unmerged_prs": 14
},
"bus_factor": 1,
"bot_contributors": 2,
"top_contributors": [
{
"type": "User",
"login": "dmccaffery",
"commits": 86,
"avatar_url": "https://avatars.githubusercontent.com/u/1803684?v=4"
},
{
"type": "User",
"login": "admin-bitwise",
"commits": 10,
"avatar_url": "https://avatars.githubusercontent.com/u/270485327?v=4"
},
{
"type": "User",
"login": "tiffanywang3",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/5248989?v=4"
}
],
"contributors_sampled": 3,
"top_contributor_share": 0.887
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"add-to-project.yaml",
"ci.yaml",
"dependabot-merge.yaml",
"merge-notice.yaml",
"merge-review-ack.yaml",
"merge.yaml",
"release.yaml",
"security.yaml"
],
"has_docs_dir": true,
"linter_configs": [
".golangci.yaml"
],
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum",
"uv.lock"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 6,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "23 out of 23 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 10,
"reason": "all changesets reviewed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 3 contributing companies or organizations -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 10,
"reason": "project is fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 10,
"reason": "all dependencies are pinned",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 10,
"reason": "SAST tool is run on all commits",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 10,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 8,
"reason": "5 out of the last 5 releases have a total of 5 signed artifacts.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 9,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 10,
"reason": "0 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "fa9db18403fcfc450aed862bf8ad949d05f91862",
"ran_at": "2026-07-28T07:16:12Z",
"aggregate_score": 8.5,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": true
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-28T06:43:18Z",
"oldest_open_prs": [
{
"number": 98,
"created_at": "2026-07-24T12:19:53Z",
"last_comment_at": "2026-07-24T12:21:29Z",
"last_comment_author": "codecov"
},
{
"number": 101,
"created_at": "2026-07-27T01:30:59Z",
"last_comment_at": "2026-07-27T01:32:40Z",
"last_comment_author": "codecov"
}
],
"last_merged_pr_at": "2026-07-26T10:28:14Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 54,
"created_at": "2026-07-14T23:41:40Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 56,
"created_at": "2026-07-15T16:46:42Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 57,
"created_at": "2026-07-15T16:53:45Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 58,
"created_at": "2026-07-15T16:57:49Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 59,
"created_at": "2026-07-15T18:28:47Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/bitwise-media-group/dotty",
"host": "github.com",
"name": "dotty",
"owner": "bitwise-media-group"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 67,
"inputs": {
"security": 88,
"vitality": 75,
"community": 43,
"governance": 57,
"engineering": 76
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 75,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 59,
"inputs": {
"commits_last_year": 121,
"human_commit_share": 0.76,
"days_since_last_push": 1,
"active_weeks_last_year": 7
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 1 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 1
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "7/52 weeks with commits",
"points": 4.8,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 7
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "121 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 121
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 98,
"inputs": {
"releases_count": 8,
"latest_release_tag": "v0.2.6",
"releases_from_tags": false,
"days_since_latest_release": 5,
"mean_days_between_releases": 3.2
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "8 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 8
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 5 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 5
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~3.2 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 3.2
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "5 out of the last 5 releases have a total of 5 signed artifacts.",
"points": 8,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 43,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"forks": 2,
"stars": 2,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "2 stars",
"points": 0,
"status": "missed",
"details": [
{
"code": "stars",
"params": {
"count": 2
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "2 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 2
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "excellent",
"name": "Community health",
"note": null,
"notes": [],
"value": 92,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 13.5,
"status": "met",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 6.3,
"status": "met",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 57,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 26,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 3,
"top_contributor_share": 0.887
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 89% of commits",
"points": 2.5,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 89
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "3 contributors",
"points": 4.1,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 3
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 3 contributing companies or organizations -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 73,
"inputs": {
"merged_prs": 74,
"open_issues": 5,
"closed_issues": 6,
"issue_closed_ratio": 0.545,
"closed_unmerged_prs": 14
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "55% of issues closed",
"points": 25.5,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 55
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "74/88 decided PRs merged",
"points": 32.2,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 74,
"decided": 88
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "all changesets reviewed",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 43,
"inputs": {
"followers": 3,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "bitwise-media-group",
"public_repos": 14,
"account_age_days": 81
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "3 followers of bitwise-media-group",
"points": 4.3,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 3,
"login": "bitwise-media-group"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "14 public repos, account ~0 yr old",
"points": 9,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 14
}
},
{
"code": "account_age_years",
"params": {
"years": 0
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"github.com/bitwise-media-group/dotty"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 5
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 5 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 5
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "9 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 9
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 76,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 84,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "8 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 8
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": ".golangci.yaml",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yaml"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "23 out of 23 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"topics": [],
"has_wiki": false,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "excellent",
"name": "Security",
"value": 88,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "excellent",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Packaging. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"packaging"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 85,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 17,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 1,
"scorecard_aggregate": 8.5
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 4.5,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "23 out of 23 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "all changesets reviewed",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 3 contributing companies or organizations -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is fuzzed",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "all dependencies are pinned",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is run on all commits",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "5 out of the last 5 releases have a total of 5 signed artifacts.",
"points": 6,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "0 existing vulnerabilities detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 45 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories",
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 45
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 0,
"affected_packages": 0,
"assessed_packages": 45,
"unassessed_packages": 0,
"affected_by_severity": "none",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 45,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 3
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "excellent",
"name": "AI Readiness",
"value": 95,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "excellent",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 1,
"agent_instruction_files": [
"AGENTS.md",
"CLAUDE.md",
"docs/getting-started/agents.md",
"internal/scaffold/template/shared/AGENTS.md"
],
"agent_instruction_max_bytes": 2897
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "AGENTS.md, CLAUDE.md, docs/getting-started/agents.md, internal/scaffold/template/shared/AGENTS.md",
"points": 45,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "AGENTS.md, CLAUDE.md, docs/getting-started/agents.md, internal/scaffold/template/shared/AGENTS.md"
}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "76 of 76 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 76,
"sampled": 76
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "excellent",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum",
"uv.lock"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [
"Makefile",
"mise.toml"
],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [],
"agent_commit_share": 0.11,
"toolchain_manifests": [
"go.mod"
],
"dependency_bot_commit_share": 0.15
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile, mise.toml",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile, mise.toml"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": ".golangci.yaml",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yaml"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "11 of the last 100 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 11,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "15 of the last 100 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 15,
"sampled": 100
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "all dependencies are pinned",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 27093,
"source_files_sampled": 218,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/218 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 218,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"pypi package 'dotty' points at a different repository (http://scrace.org/software/dotty.html); excluded from ecosystem scoring"
],
"report_type": "repository",
"generated_at": "2026-07-28T07:16:32.098678Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/b/bitwise-media-group/dotty.svg",
"full_name": "bitwise-media-group/dotty",
"license_state": "standard",
"license_spdx": "MIT"
}
Verwandte Einträge
Geprüfte Repositories, die Katalog-Tags oder Ökosysteme mit bitwise-media-group/dotty teilen. Nebeneinander lesen →
Bewertungen sind Signale, keine Garantien. Sie spiegeln öffentlich sichtbare Praxis auf GitHub wider — kein Code-Audit und keine Sicherheitsgarantie.
Fehlende Daten werden ausgeschlossen und die Gewichte neu normiert, nie als null bewertet. Die Methodik ist versioniert und offen: Metriken v1.13.0, Schema v0.27.0 — vollständige Methodik · Metriken-Wiki.
