lmtani/pumbaa erreicht einen Gesundheitsindex von 71 von 100 und liegt damit im Bereich Gut. Am stärksten schneidet es bei AI Readiness (84/100) ab, am schwächsten bei Community & Adoption (45/100). Zuletzt vor 13 Tagen aktualisiert. Ein einzelner Mitwirkender trägt den Großteil der jüngsten Arbeit.
71
gesamt / 100
Gut
Software-Gesundheitsindex
Metriken werden auf einer standardisierten Skala von 1–100 in gewichtete Kategorien gruppiert. Der Gesamtwert beginnt als ihr gewichtetes Mittel, kalibriert auf die Verteilung des öffentlichen Registers, sodass die Stufen Perzentilbedeutung tragen; sobald öffentliche Evidenz die Richtlinie für Hochrisikojurisdiktionen auslöst, wird die Bewertung angepasst und erhält die Obergrenze Gefährdet von 34.
71
Außergewöhnlich93-100Die Spitzengruppe des Registers (≈ obere 5 %); erfüllt im Wesentlichen alle geprüften Kriterien
Gut65-79Gesund; Lücken sind begrenzt und beherrschbar
Mittel50-64Akzeptabel mit deutlichen Lücken; Überprüfung empfohlen
Schwach35-49Wesentliche Schwächen in mehreren Bereichen
Gefährdet20-34Erhebliche Schwächen; eine Übernahme erfordert Vorsicht
Kritisch1-19Schwerwiegende Probleme (aufgegeben, nur ein Maintainer, keine Hygiene)
Bewertungsprofil
Jede Achse ist eine Kategorie. Die Form zählt mehr als der Durchschnitt — ein gesundes Projekt füllt die gesamte Fläche, während ein Profil aus Spitzen und Kratern bedeutet, dass Stärke in einer Dimension Risiken in einer anderen verdeckt.
Der gewichtete Gesamtwert 63 wird auf der veröffentlichten Indexskala auf 71 kalibriert (Register-Kalibrierung 2026-08-02).
31 Follower22 öffentliche Reposseit Juni 2015@mendelics
Dieses Repository gehört einem persönlichen Konto. Ein Projekt mit nur einem Eigentümer trägt ein höheres Kontinuitätsrisiko als ein organisationsgetragenes.
Direkte Abhängigkeiten ohne bekannte Advisories — 1 betroffen: google.golang.org/grpc v1.80.0 (critical 9.1)
0/25
Indirekte Abhängigkeiten ohne bekannte Advisories — transitive Menge in diesem Bereich nicht von Entwicklungs- und Test-Abhängigkeiten trennbar
40/40
Keine offenen Advisories — kein Advisory ist länger als 90 Tage öffentlich
Verwendete Eingangsdaten
source
osv
advisories
6
affected_packages
5
assessed_packages
114
unassessed_packages
0
affected_by_severity
critical 1, unknown 4
direct_affected_packages
1
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): Indirekte Abhängigkeiten ohne bekannte Advisories. Die verbleibenden Gewichte wurden renormalisiert. 114 aufgelöste Abhängigkeiten wurden mit OSV abgeglichen. Dieses Repository veröffentlicht kein Paket, das der Index auflöst; bewertet wurde daher der Abhängigkeitsgraph des Repositorys. Dieser Graph vermischt Entwicklungs- und Test-Pins mit ausgelieferten Abhängigkeiten, daher werden nur die deklarierten Laufzeit-Abhängigkeiten bewertet; transitive Befunde werden als Kontext ausgewiesen und fließen nicht in die Bewertung ein. Erreichbarkeit wird nicht analysiert.
Wie gut ist das Repository dafür ausgestattet, mit KI-Coding-Agenten entwickelt und gepflegt zu werden? Trägt ein bewusst kleines Gewicht (4 %): Agenten-Tooling ist ein echtes Pflegesignal, doch ein Repository ohne jedes Signal kann weiterhin 100/100 erreichen.
Handhabbare Dateigrößen — 1/299 Quelldateien über 60 KB
Verwendete Eingangsdaten
primary_language
Go
largest_source_bytes
368.163
source_files_sampled
299
oversized_source_files
1
Eckdaten
22GitHub-Sterne
2Mitwirkende
75Commits, letzte 12 Monate
13Tage seit letztem Push
31Releases
1Bus-Faktor
0offene Issues
GoPaket-Ökosysteme
Warnungen zur Datenerhebung
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
Weitere Details
Stern- und Fork-Verlauf 0 ★ / 3 ⇿
0Sterne
3Forks
9Releases
Wann jeder Stern und Fork hinzugefügt wurde, von GitHub erfasst und nach Tagen gruppiert. Das kumulierte Wachstum steht direkt über den täglichen Zugängen, aus denen es besteht, sodass beide gegeneinander lesbar sind: stetiger organischer Zuwachs sieht ganz anders aus als ein abrupter, kurzlebiger Ausschlag. Wo dieser Unterschied messbar ist, wird er als Wachstumsauthentizität ausgewiesen.
Major 0Minor 1Patch 7
Jeder Punkt umfasst 3 Tage.
OpenSSF Scorecard 4.5 / 10
4.5Gesamtwert
Unabhängige, werkzeugneutrale Sicherheitsbewertung durch das quelloffene OpenSSF Scorecard. Jede Prüfung honoriert eine Sicherheits-Praxis, nicht das Werkzeug eines bestimmten Anbieters. Prüfungen, die Scorecard nicht ermitteln konnte, sind mit k. A. markiert und vom Sicherheitswert ausgeschlossen (nie als null gezählt).Scorecard v5.5.0 · 2026-08-01 20:02 UTC
Vollständig aufgelöster Abhängigkeitssatz aus dem GitHub-Abhängigkeitsgraphen: 23 direkte und 91 indirekte (transitive) Pakete. Die transitive Hülle ist vollständig, wenn das Repository eine Lockfile eincheckt.
Dieses Repository veröffentlicht kein vom Index auflösbares Paket, daher wurde sein eigener Abhängigkeitsgraph bewertet – 114 Pakete, darunter auch Entwicklungs- und Test-Pins, die nie ausgeliefert werden: 5 tragen bekannte Advisories, davon 1 direkte.
Paket
Version
Beziehung
Schweregrad
Advisories
Behoben in
google.golang.org/grpc
v1.80.0
direkt
kritisch
2
1.82.1
go.opentelemetry.io/otel
v1.43.0
indirekt
unbekannt
1
1.44.0
golang.org/x/crypto
v0.52.0
indirekt
unbekannt
1
—
golang.org/x/net
v0.55.0
indirekt
unbekannt
1
0.56.0
golang.org/x/text
v0.37.0
indirekt
unbekannt
1
0.39.0
Ein Advisory bedeutet, dass die im Abhängigkeitsgraphen erfasste Version in den betroffenen Bereich eines Advisories fällt. Erreichbarkeit wird nicht analysiert, und der Graph enthält Entwicklungs- und Test-Pins — ein Fund kann das Werkzeug betreffen und nicht die ausgelieferte Software.
JSON-Rohbericht maschinenlesbar
{
"data": {
"repo": {
"topics": [
"cromwell",
"cli",
"workflow",
"bioinformatics",
"wdl"
],
"is_fork": false,
"size_kb": 14157,
"has_wiki": false,
"homepage": "https://lmtani.github.io/pumbaa",
"languages": {
"Go": 1460283,
"HTML": 58530,
"ANTLR": 12332,
"Shell": 3951,
"Makefile": 8210
},
"pushed_at": "2026-07-18T22:29:48Z",
"created_at": "2020-08-15T21:23:53Z",
"owner_type": "User",
"updated_at": "2026-07-18T21:15:56Z",
"description": "A companion for the Cromwell Server",
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "main",
"license_spdx_raw": "Apache-2.0",
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": null,
"name": "Lucas Mitsuo Taniguti",
"type": "User",
"login": "lmtani",
"company": "@mendelics ",
"location": "Piracicaba",
"followers": 31,
"avatar_url": "https://avatars.githubusercontent.com/u/12699242?v=4",
"created_at": "2015-06-01T15:47:10Z",
"is_verified": null,
"public_repos": 22,
"account_age_days": 4079
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v1.1.0",
"kind": "minor",
"published_at": "2026-07-18T22:29:48Z"
},
{
"tag": "v1.0.9",
"kind": "patch",
"published_at": "2026-07-07T22:43:47Z"
},
{
"tag": "v1.0.8",
"kind": "patch",
"published_at": "2026-06-16T11:06:04Z"
},
{
"tag": "v1.0.7",
"kind": "patch",
"published_at": "2026-04-11T23:34:05Z"
},
{
"tag": "v1.0.6",
"kind": "patch",
"published_at": "2026-02-24T12:42:18Z"
},
{
"tag": "v1.0.5",
"kind": "patch",
"published_at": "2026-01-20T17:53:49Z"
},
{
"tag": "v1.0.4",
"kind": "patch",
"published_at": "2026-01-15T15:52:15Z"
},
{
"tag": "v1.0.3",
"kind": "patch",
"published_at": "2026-01-13T19:42:14Z"
},
{
"tag": "v1.0.2",
"kind": "patch",
"published_at": "2025-12-26T12:51:08Z"
},
{
"tag": "v1.0.1",
"kind": "patch",
"published_at": "2025-12-18T22:45:09Z"
},
{
"tag": "v1.0.0",
"kind": "major",
"published_at": "2025-12-13T14:54:47Z"
},
{
"tag": "v0.10.4",
"kind": "patch",
"published_at": "2024-10-18T14:35:52Z"
},
{
"tag": "v0.10.3",
"kind": "patch",
"published_at": "2023-12-04T18:44:04Z"
},
{
"tag": "v0.10.2",
"kind": "patch",
"published_at": "2023-12-04T18:17:58Z"
},
{
"tag": "v0.10.1",
"kind": "patch",
"published_at": "2023-06-06T17:39:27Z"
},
{
"tag": "v0.10.0",
"kind": "minor",
"published_at": "2023-04-17T22:29:56Z"
},
{
"tag": "v0.9.2",
"kind": "patch",
"published_at": "2022-02-02T19:35:47Z"
},
{
"tag": "v0.9.1",
"kind": "patch",
"published_at": "2022-01-18T20:00:17Z"
},
{
"tag": "v0.9",
"kind": "other",
"published_at": "2022-01-09T12:45:58Z"
},
{
"tag": "v0.8.10",
"kind": "patch",
"published_at": "2021-12-29T02:33:22Z"
},
{
"tag": "v0.8.9",
"kind": "patch",
"published_at": "2021-09-24T16:18:34Z"
},
{
"tag": "v0.8.8",
"kind": "patch",
"published_at": "2021-07-27T11:36:06Z"
},
{
"tag": "v0.8.7",
"kind": "patch",
"published_at": "2021-07-16T18:38:43Z"
},
{
"tag": "v0.8.6",
"kind": "patch",
"published_at": "2021-05-19T20:06:25Z"
},
{
"tag": "v0.8.5",
"kind": "patch",
"published_at": "2021-04-07T20:19:58Z"
},
{
"tag": "v0.8.4",
"kind": "patch",
"published_at": "2021-04-01T15:47:42Z"
},
{
"tag": "v0.8.3",
"kind": "patch",
"published_at": "2021-03-30T00:29:26Z"
},
{
"tag": "v0.8.2",
"kind": "patch",
"published_at": "2021-02-23T12:58:22Z"
},
{
"tag": "v0.8.1",
"kind": "patch",
"published_at": "2021-02-20T17:47:12Z"
},
{
"tag": "v0.8",
"kind": "other",
"published_at": "2020-11-09T11:12:07Z"
},
{
"tag": "v0.1",
"kind": "other",
"published_at": "2020-09-12T14:02:18Z"
}
],
"recent_commits": [
{
"oid": "e5e49f1a35520b79cf63bfadeaef07896ebe0cb3",
"body": "…runs (#55)\n\n* feat(wdl): call graph and task specs for cache reasoning\n\nDeciding whether a task can be served from the call cache needs two things\nthe parser already had the data for but never exposed: which calls consume\nwhich other calls' outputs, and the parts of a task definition that Cromwell\n\n[…]\nto the metadata port for that: asking the server for\nsubmittedFiles:inputs alone costs about a twenty-fifth of the bytes of full\nmetadata, which is what makes scanning thirty runs take under a second.",
"is_bot": false,
"headline": "feat(cache): forecast which tasks a submission would reuse before it …",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2026-07-18T21:15:50Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8b21070fd43f1b14b6199e70029badea1d69df22",
"body": "…ng (#54)\n\n* refactor(tests): move shared test_data into package-local testdata dirs\n\nThe top-level test_data/ directory was shared by only three packages.\nMoving fixtures next to their consumers follows the Go testdata\nconvention, makes pkg/wdl self-contained as a public library, and\nremoves the ru\n[…]\n pumbaa hits, and\nserves the real task logs off disk via a relocatable __FIXROOT__ token.\ndemo.gif is re-recorded here against that same stub so the committed\nasset matches what the workflow produces.",
"is_bot": false,
"headline": "docs: professional README with a demo GIF, plus testdata and CI tooli…",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2026-07-17T21:53:37Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1bd3c9dd68cd792c589350e8365ec004b2461df7",
"body": "…tting (#53)\n\n* feat(submit): scaffold inputs from the WDL and preflight before submitting\n\nPumbaa is strong once a run exists, and weakest where newcomers spend most\nof their pain: getting to a correct submission. The only guard rail was a\nmissing-required-inputs check; everything else — a typo'd k\n[…]\nromwell.\n\nWired as a new preflight check, run only when -d is given; submit passes its\ndependencies bytes through. A missing import blocks (Cromwell would fail to\nparse); an unreadable zip only warns.",
"is_bot": false,
"headline": "feat(submit): scaffold inputs from the WDL and preflight before submi…",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2026-07-17T18:55:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f7b4e850ac60cad909a9404fae1d7e54ea84683e",
"body": "* chore: remove dead code and refresh the improvement backlog\n\nReachability analysis (deadcode from the CLI entry point) cross-checked\nagainst test usage found code with no callers anywhere:\n\n- examples/mock_report and recommendation's MockLLMGenerator: the example\n was referenced by nothing and wa\n[…]\n\nagent's action table and its live E2E/cost-validation tests, and the\nprompts package. Generic Go/BubbleTea boilerplate was trimmed — the\nguide now optimizes for what a session actually needs to know.",
"is_bot": false,
"headline": "chore: remove dead code and refresh the improvement backlog (#52)",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2026-07-17T13:29:36Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "052b73cc00457ded71adb9d447dd6be8ecb93bdb",
"body": "…e tests (#50)\n\n* refactor(telemetry): move the telemetry contract to ports\n\nThe Service interface (and its Event/CommandContext types) lived in\ninfrastructure, making telemetry the last interfaces->infrastructure\ndependency. The contract now lives in ports — the same pattern already\nused for the se\n[…]\narrying start/vmStartTime\nand cost rate with no end timestamps, a queued attempt with no\ntimestamps at all, two levels of expanded subworkflow metadata, and\nnumeric cpu/preemptible runtime attributes.",
"is_bot": false,
"headline": "refactor: telemetry port, consolidated agent prompts, mapper edge-cas…",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2026-07-17T12:25:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5a235f1080a07444d11d6b05623248628798a534",
"body": "… chat agent (#51)\n\nThe agent could list log paths and dump raw metadata, but debugging a\nfailed run took many calls and the metadata of a subworkflow-heavy run\nis megabytes — far beyond what a model context handles. Four actions\nclose the gap, each a thin adapter over domain logic:\n\n- failures: ded\n[…]\nction table now builds from a Deps struct and skips actions whose\ndependencies are absent. The agent's system instruction routes failure\ndebugging through failures -> read_log instead of raw metadata.",
"is_bot": false,
"headline": "feat(agents): failures, read_log, cost and preemption actions for the…",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2026-07-17T12:19:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "586c9fddeab4a7343112be611a034c4cd9eefb2b",
"body": "…ns (#49)\n\nThe chat package had zero tests across ~2,100 lines, including the\ncustom agent loop. The recent split into focused files and the\nports.ChatSessionStore interface made the pure logic and state\ntransitions cheap to test:\n\n- stream: tool-call execution path (the same one the agent loop uses\n[…]\nk lookup and context-label tagging, using the\n ADK in-memory service plus a small ChatSessionStore fake.\n\nCoverage goes from 0% to ~36% of the package, concentrated on the\nlogic that breaks silently.",
"is_bot": false,
"headline": "test(tui): cover the chat screen's agent loop, update flow and sessio…",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2026-07-17T01:51:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c4900d015d8add2c73e8d92fe8351c063439fe7d",
"body": "…#48)\n\nThe lint target had been permanently red — 118 findings once the per-linter\noutput cap is lifted — so it protected nothing and new debt accumulated\nunnoticed. This zeroes every finding and adds a lint job to CI (pinned to\nthe same golangci-lint version as local runs) so the count stays at zer\n[…]\nted lipgloss Copy and filepicker Height\n replaced by their current APIs, lowercase error strings, tagged switches,\n redundant nil-before-len checks removed.\n- unused: two dead struct fields removed.",
"is_bot": false,
"headline": "chore(lint): zero all golangci-lint findings and enforce lint in CI (…",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2026-07-17T01:39:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4630407b260c9976276245acb19076c2ca295ceb",
"body": "The cost breakdown keyed shards by ShardIndex alone, so the same task\nrunning in many subworkflow instances (each at shard -1 of its own\ninstance) collapsed into a single shard: a task with 59 executions showed\n\"shards=2\". Shard keys now carry the subworkflow instance path.\n\nThe preemption summary h\n[…]\nuseful. It now walks\nloaded subworkflows with instance-scoped task keys, keeping retry chains\nfrom different instances separate, and skips unloaded subworkflow calls\ninstead of treating them as tasks.",
"is_bot": false,
"headline": "fix(domain): scope shard aggregation by subworkflow instance (#47)",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2026-07-16T21:32:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4e8bccd4d1ccd8f32b0081f3891f3b71aa110c3e",
"body": "…units (#46)\n\nThe per-task breakdown summed two different units into one \"$\" total:\nattempts with a real vmCostPerHour contributed dollars, while attempts\nwithout cost data contributed a cpu × mem × hours pseudo-value. On backends\nthat report no cost, the whole total was fiction with a dollar sign.\n\n[…]\nes otherwise. The modal shows dollar rows and ~estimate\nrows distinctly, with bars scaled within each unit, and the opt-in API\nvalidation test now compares only the dollar total (the comparable part).",
"is_bot": false,
"headline": "fix(cost): keep real dollars and resource-hour estimates in separate …",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2026-07-16T21:23:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "22fb89b64fa490bd51ead95925e076b973a0aa50",
"body": "…ual for running tasks (#45)\n\n* refactor(application): remove infrastructure imports from use case layer\n\nResourceVisualizationUseCase reached into infrastructure for two concrete\nhelpers: recommendation.NewFileDebugWriter and templates.RenderReport.\nIntroduce ports.ResourceReportRenderer (implement\n[…]\n attempt with broken timestamps cannot accrue forever. Replaying the\nsame metadata now yields a total in line with the cost API.\n\n* docs: record technical improvement backlog from the internal/ review",
"is_bot": false,
"headline": "refactor: enforce hexagonal boundaries in internal/ and fix cost accr…",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2026-07-16T13:32:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6642e020e17c52a2d67a5903f8717c3a83fbc6af",
"body": "Resolves all 14 open Dependabot alerts: 13 in x/crypto (SSH auth\nbypass via unenforced @revoked status, key constraint enforcement,\nserver deadlock, panics and DoS) and 1 in x/net (HTML parser DoS).\nx/sys, x/term and x/text were bumped as transitive requirements.",
"is_bot": false,
"headline": "fix(deps): bump golang.org/x/crypto to v0.52.0 and x/net to v0.55.0",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-07-16T11:31:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "68a6a7e8816daad99a4f98d1d5b7a7ffcc93a015",
"body": "…ts (#44)\n\n* refactor(tui): unify navigation, preserve screen state, and improve UX affordances\n\nNavigation architecture:\n- Navigation messages now live in tui/common (NavigateToDebugMsg,\n NavigateToChatMsg, NavigateBackMsg); screens emit them via commands and\n AppModel is the single handler. The \n[…]\n* fix(debug): show real keys in help overlay ($ cost, ctrl+c quit)\n\n* refactor(cli): remove no-op --verbose flag from metadata command\n\nThe flag was parsed but never used; calls were always displayed.",
"is_bot": false,
"headline": "feat(tui): unified navigation, streaming chat, run diff, and task cos…",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2026-07-07T22:43:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "22ca35e5748c22d4a204f88e1715a5d556ce76cc",
"body": "When a run reused a task via Cromwell call caching, its wall-clock is\njust the cache-copy time (~seconds), which the diff would report as a\nbogus \"N× faster/slower\". The comparison now resolves cache provenance\nand compares real work instead.\n\n- recover the real duration, docker, status and attempt \n[…]\n note\n\nLayers stay separated: cache-result parsing, call lookup and the recovery\nvalue objects are pure domain; fetching and chasing chains is the use\ncase; the flag and annotations are the interface.",
"is_bot": false,
"headline": "feat(cli): cache-aware comparison in workflow diff",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-06-13T14:02:41Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ffc627adcc6f470e3c3967e04422e9a41d2b9d30",
"body": "Adds `pumbaa workflow diff <id-a> <id-b>` (alias `compare`) to answer\n\"what changed between these two runs?\".\n\n- domain: pure CompareWorkflows(a, b) producing a RunDiff — flattens\n inputs/options JSON to dot/bracket paths and reports only changed\n keys (added/removed/modified); flags the WDL sourc\n[…]\n the full RunDiff for scripting.\n\nDuration changes are only surfaced when both ≥1.5× and ≥30s apart, so\nshort tasks do not show as noise. A TUI dashboard entry point can reuse\nthe same use case later.",
"is_bot": false,
"headline": "feat(cli): compare two workflow runs with `workflow diff`",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-06-13T14:02:41Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c8f453b1769e6bdb669134fa4f0c50f086c94b94",
"body": "F opens a modal grouping every failed task in the loaded tree by error\nsignature: messages are normalized (paths, UUIDs, shard/attempt numbers\nstripped) so the same root cause across hundreds of shards collapses\ninto one entry, e.g. \"187× Job exit code 137 at <path>\" with the first\ntask names listed\n[…]\n causes\nare taken from the deepest causedBy chain, and the raw summary can be\ncopied with y. Falls back to workflow-level failures when no failed\ncall carries a message (e.g. input validation errors).",
"is_bot": false,
"headline": "feat(tui): aggregated failure summary modal (F) in debug view",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-06-13T14:02:41Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "adb3a435bbea408ed3130ec23b64e3ea5a7079ee",
"body": "y now opens a small modal listing the copyable values for the selected\nnode instead of copying only the Docker image:\n\n- workflow/subworkflow: workflow ID, workflow root, workflow log,\n inputs/options JSON\n- task/shard: stderr/stdout paths, call root, command line, Docker\n image, monitoring log, Batch job ID, workflow ID\n\nNavigate with arrows + enter, or press 1-9 to copy an item directly.",
"is_bot": false,
"headline": "feat(tui): contextual copy menu on y in debug view",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-06-13T14:02:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fa823d862c7a1175a161eab17699601ae69af86f",
"body": "- w in the debug view re-fetches workflow metadata every 30s while the\n workflow runs, preserving tree expansion, cursor position and loaded\n subworkflows (re-fetched after each refresh)\n- status transitions since the last refresh are surfaced in the footer\n (e.g. \"TaskX: Running → Failed\"); watc\n[…]\now reaches a terminal state\n- header shows a WATCH badge while active\n- w in the dashboard toggles auto-refresh of the workflow list on the\n existing 30s tick, skipped while a modal or filter is open",
"is_bot": false,
"headline": "feat(tui): watch mode with auto-refresh in debug and dashboard",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-06-13T14:02:41Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "860c8497053b32646ed8cc1c1fdfd04e755ddff4",
"body": "- f expands only the paths leading to failed or preempted/retried calls,\n auto-fetching failed subworkflows that were not loaded yet (chained fetches)\n- ] / [ jump to next/previous failed task, expanding ancestors and\n wrapping around the tree\n- collapsed nodes show a red ✗N badge with the count of failed\n descendants, so failures buried in scatters/subworkflows stay visible;\n the ⟳N badge also counts recovered preemptions (status Done after a retry)",
"is_bot": false,
"headline": "feat(tui): failure-oriented navigation in debug tree",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-06-13T14:02:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "44e798c049f3b3edd0e3d93374a28fb829d7c69c",
"body": "The details panel title used TitleStyle, whose MarginBottom(1) made the\npanel one line taller than its height budget. The whole view exceeded\nthe terminal height and the terminal scrolled the header bar (workflow\nname, status, duration, cost) off the top of the screen.\n\nUse a margin-free panel title\n[…]\nncate the\nheader bar's left side ANSI-aware when it alone exceeds the terminal\nwidth. A debug-view smoke test now guards the height/width budget at\nseveral terminal sizes, mirroring the dashboard one.",
"is_bot": false,
"headline": "fix(tui): debug header bar pushed off-screen by details title margin",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-06-12T18:18:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ac1313fadf85bc1acf43dc80d54b8e964eeae916",
"body": "Pressing < and > moves the split between the execution tree and the\ndetails panel in 5% steps (clamped to 20-70%), instead of the fixed\n40/60 ratio. The chosen ratio survives terminal resizes since panel\nwidths are now derived in one place from the stored percentage.",
"is_bot": false,
"headline": "feat(tui): resizable tree/details split in debug view",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-06-12T18:13:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b7cf903e1b1a836407da269fe6daba50e6e50865",
"body": "Pressing / (name) or l (label) now shows a one-line filter bar above\nthe table and narrows the visible rows on every keystroke, instead of\nreplacing the whole list with a blind input modal. Enter keeps the\nprevious behavior of applying the filter server-side; esc restores the\nunfiltered list. The ma\n[…]\nnarrowing the list.\n\nAdd a ? help overlay with the full keyboard reference, mirroring the\ndebug screen, and reorder footer hints so the most-used ones survive\nthe fit-to-width cut on narrow terminals.",
"is_bot": false,
"headline": "feat(tui): live inline filtering and help overlay on dashboard",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-06-12T18:10:44Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "77c3845001c6f2b00175e5cc7b2407bd170ef925",
"body": "…glyphs\n\nReplace the 4-line boxed headers on dashboard, debug and chat with a\nsingle header bar (brand chip + breadcrumb + badges), freeing 3-6 rows\nof useful content per screen. Layout math is centralized in\ncommon/layout.go so header, panels and footer always add up to the\nterminal height - previo\n[…]\nad of wrapping, and table rows are truncated ANSI-aware so\nnarrow terminals no longer overflow. The chat breadcrumb also reflects\nstandalone mode instead of always claiming Dashboard > Debug ancestry.",
"is_bot": false,
"headline": "feat(tui): single-line header bars, richer status colors, width-safe …",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-06-12T18:05:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "bd3ffdc44c42c873404ed44628876dad43342750",
"body": "Replace ~110 hardcoded hex colors across dashboard, debug and chat\nwith semantic tokens in common/colors.go using lipgloss.AdaptiveColor,\nso the TUI stays readable on light and dark terminals and theme\nchanges happen in one place. Dedupe debug/styles.go into aliases of\ncommon styles and drop dead st\n[…]\n and truncate by display width so\nmulti-byte names no longer break column alignment, make truncation\nhelpers rune-safe, and honor the labels column max width (previously\nignored, overflowing the row).",
"is_bot": false,
"headline": "refactor(tui): unify adaptive color palette and fix text truncation",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-06-12T17:45:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "481392c2bae635d669409dbfd73369bf05b0f527",
"body": "Both the CLI inputs use case and the TUI debug Inputs modal now read\nfrom `submittedFiles.inputs` (the exact JSON the user submitted to\nCromwell) instead of the post-parse `inputs` map. The parsed map can\ninclude defaults and type coercions applied by Cromwell, hiding what\nwas actually submitted.",
"is_bot": false,
"headline": "feat(workflow): return raw submitted inputs file in inputs view",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-04-26T14:02:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a27acda5791c41a12f3ec99510fa5772f1597064",
"body": "Press 'u' in the dashboard to navigate directly to a workflow by its\nUUID. Invalid IDs show a human-friendly message (\"Invalid workflow ID\",\n\"Workflow not found\", \"Cannot connect to server\") in an animated\nyellow notification bar that auto-clears after 3 seconds.\n\nAlso migrates all existing statusMsg usages (abort, labels, metadata\nerrors) to the same animated notification pattern for consistency.",
"is_bot": false,
"headline": "feat(tui): add go-to-workflow-by-UUID with animated status notifications",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-04-11T23:32:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5cc6f661e62919ff8076ba3ea38603415b72db51",
"body": "The footer showed \"l label\" and \"L labels\" which were nearly\nindistinguishable. Use distinct verbs to clarify intent:\n- / search name, l search label (read-only filter operations)\n- L edit labels (write operation on selected workflow)\n\nAlso make the filter modal title contextual (\"Search by Name\" vs\n\"Search by Label\") and improve input placeholders.",
"is_bot": false,
"headline": "fix(tui): disambiguate label-related key bindings in dashboard",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-04-11T19:32:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "def5471d6f5351d5dfbd3854ccb9fcc27937048c",
"body": "…ields\n\n- Run gofmt -r 'interface{} -> any' across all internal packages\n- Remove deprecated DebugMetadataReady and NavigateToDebugID fields\n from dashboard model\n- Remove dead fallback branches that were guarded by nil checks on\n metadataFetcher, which is now always initialized",
"is_bot": false,
"headline": "chore: replace interface{} with any and remove deprecated dashboard f…",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-04-11T19:04:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fe87aa92d9cd861aabf22c91b003cf4e9d24bf29",
"body": "- Replace 4 setter calls with single NewModelWithRepository constructor\n that accepts WorkflowRepository directly, eliminating the ceremony in\n app.go\n- Extract duplicate initializeChatDependencies from DebugHandler and\n DashboardHandler into shared initChatDependencies in chat_deps.go",
"is_bot": false,
"headline": "refactor(handler): simplify dashboard init and extract shared chat setup",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-04-11T18:52:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bdf00c8d25ccb93e08fc5111245d6a35d26fcc4f",
"body": "- Resolve WorkflowQuerier/WorkflowQueryer naming confusion: keep\n WorkflowQuerier as query-only, remove WorkflowQueryer duplicate\n- Split dashboard fetcher into separate querier and aborter fields\n- Compose MetadataParser into WorkflowMetadataFetcher, removing the\n standalone interface and redunda\n[…]\n Add WorkflowReader (5-method read-only port) for agent tools and\n chat handler, replacing the full WorkflowRepository dependency\n- Simplify container wiring by removing duplicate CromwellClient args",
"is_bot": false,
"headline": "refactor(ports): clean up port interfaces for clarity and ISP compliance",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-04-11T18:14:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ce156a18d6b02fb125cf3a7dad391a339887bddd",
"body": "…ient\n\nRemove direct Cromwell imports from TUI debug, CLI handlers, and agent\ntools by routing all access through existing port interfaces. This\neliminates duplicate interface definitions and redundant client\ninstantiation, keeping infrastructure/cromwell referenced only from the\nDI container root.\n\n[…]\nor subworkflow parsing\n- Replace tools/cromwell.Repository with ports.WorkflowRepository\n- Reuse injected repository in debug, dashboard, and chat handlers\n- Make domain error messages engine-agnostic",
"is_bot": false,
"headline": "refactor(arch): decouple handlers and tools from concrete Cromwell cl…",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-04-11T13:55:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5be20148ea1e680ae0a7b41d8caffcb635af2172",
"body": "Parses the WDL to identify required inputs (non-optional, no default)\nand checks them against the provided inputs JSON, preventing unnecessary\nround-trips to the server when required inputs are missing.",
"is_bot": false,
"headline": "feat(submit): validate required WDL inputs before submitting to Cromwell",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-04-11T12:45:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "79a86042b0d3e6925397d048a59e79534d2bb3cc",
"body": "Includes migration from tablewriter v0 to v1 API in presenter.",
"is_bot": false,
"headline": "build(deps): update all Go dependencies",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-04-03T13:10:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e31a96e62f4de405c207cdcb4784d9431d607076",
"body": "…(#41)\n\nBumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) from 1.38.0 to 1.40.0.\n- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)\n- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)\n- [Commits](\n[…]\ndk\n dependency-version: 1.40.0\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "build(deps): bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.40.0 …",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-01T11:28:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0eedd5ae537e56e5bb78737a021593f403149802",
"body": null,
"is_bot": false,
"headline": "fix(tui): More consistent behavior of returning and closing (esc)",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-02-02T22:33:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3b2806a8a66dd52c74f86fa8d0227dabd4a92529",
"body": null,
"is_bot": false,
"headline": "Merge branch 'main' of https://github.com/lmtani/cromwell-cli",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-01-20T17:49:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aa8b6e2817dc1f5d415b67a4ef201cbe7770a6b7",
"body": null,
"is_bot": false,
"headline": "chore: exit behavior",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-01-20T17:48:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "99de80c50f55d15641527959392109c076a5ea52",
"body": "* feat(update): include release notes in update warning\n\n* refactor(llm): organize directories\n\n* refactor: use common factory",
"is_bot": false,
"headline": "refactor: organize llm and recommendation packages (#40)",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2026-01-20T17:36:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "12789f22bb50e3997eba07f89de5ceb0a2aa5f24",
"body": null,
"is_bot": false,
"headline": "feat(update): include release notes in update warning",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-01-20T15:17:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5fbf8609de6042940ac43d9ff23ad77cf43b4d36",
"body": "…ommendations (#39)\n\n* feat: linear regression\n\n* fix: keep only valid data\n\n* feat: specify input names in formulas\n\n* feat: AI based sugestions\n\n* refactor: use LLM to categorize task priority\n\n* refactor: better prompt\n\n* refactor: ui\n\n* feat(cli): add --no-llm\n\n* default view\n\n* refactor: add do\n[…]\n: add mock for llm response\n\n* docs: update resource analysis\n\n* docs: add LLM disclaimer\n\n---------\n\nCo-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(analyze): Add resource analysis report with LLM optimization rec…",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2026-01-20T13:50:01Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "9569a926a48347e46897d1aed64cf37b5d127b9e",
"body": null,
"is_bot": false,
"headline": "docs(resources): Add new section about resource analysis",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-01-16T14:52:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "02b9f71b78bc933368acee98dbb7a416dc8cb98a",
"body": "…n dashboard (#37)\n\n* feat(resources): Add command to summarize resources used in each task of workflow\n\n* refactor: normalize memory and disk values\n\n* feat: aggregate metrics from multiple workflows\n\n* refactor: add disclaimer and charts with percentage of uses",
"is_bot": false,
"headline": "feat: add resource reporting engine and interactive HTML visualizatio…",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2026-01-16T13:56:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a814b45716905d935cc542247e2f5c4ea4ede353",
"body": null,
"is_bot": false,
"headline": "feat(version): notify users when a new pumbaa release is available (#36)",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2026-01-16T13:41:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "24dbc53b2b56753cc49b168349ebf4a2fa50d700",
"body": "Refactors the TUI architecture from three separate packages that communicated\nvia flags and tea.Quit to a unified single-application design using message-based\nnavigation within a single tea.Program instance.\n\nKey changes:\n\nArchitecture:\n- Add AppModel as the central coordinator for Dashboard, Debug\n[…]\nrumbs show current location\n- Centralized dependency injection reduces code duplication\n- Cleaner separation between CLI handlers and TUI logic\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "refactor(tui): unify TUI screens into single AppModel with navigation",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-01-15T19:03:54Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e6b637c71c5f41029badec9cee7f2d86436af428",
"body": null,
"is_bot": false,
"headline": "feat(CLI): commands for querying inputs/outputs of a workflow",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-01-15T15:26:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b97fcf210ccc9bb3efdb2ccfea3a2a046cf8c2be",
"body": null,
"is_bot": false,
"headline": "fix(submit): Remove hardcoded v1 in submit usecase",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-01-15T14:52:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ee80dc6286ae9219ebd0fe3b97e4864cf9aac8a2",
"body": null,
"is_bot": false,
"headline": "fix(CI): update env vars",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-01-13T19:41:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0ffa692090d6b67ad1a6fb26cebfcbc44365ce43",
"body": null,
"is_bot": false,
"headline": "refactor(telemetry): Remove Sentry",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-01-13T19:28:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3bd334f2062cedb234b6a972335392c0e898f026",
"body": null,
"is_bot": false,
"headline": "refactor(tui): remove duplicated code",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-01-13T17:15:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2720fb82d3b6a032c9680fd60854de53ca062ad4",
"body": null,
"is_bot": false,
"headline": "docs(README): Keep it short",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-01-13T17:00:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c8d4742df49293c64bf9398c01575d448ab4e020",
"body": null,
"is_bot": false,
"headline": "docs: Add section describing AI chat with context",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2026-01-13T16:56:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "617a77bc458d6efacb6e5e33ff656d88fdddb248",
"body": "* feat(chat): add session summaries and session switcher modal\n\n- Add summary column to sessions table with auto-migration\n- Implement SessionInfo type for session metadata display\n- Add UpdateSummary and ListWithSummaries methods to SQLiteService\n- Create modal system for chat TUI (modal_kind.go, m\n[…]\n for closing modals end screens\n\n* refactor: include placeholder for session summary\n\n* refactor: Create registry for gemini models\n\n---------\n\nCo-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(AI): Add session summary and seach function (#35)",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2026-01-13T16:24:42Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "930c296b11d32f7aa98b2836d3649d518aabcc20",
"body": "* refactor: remove interface declared in tui package\n\n* refactor: dependency injection for dashboard and debug tuis\n\n* refactor: tui decoupled from cromwell implementation\n\n* refactor: compose WorkflowRepository\n\n* refactor(application): simplify use cases by returning domain entities directly\n\n* do\n[…]\n* refactor: Use renderModalViewportContent for all modals\n\n* feat(search): add search for the call tree\n\n* docs: remove agent guide\n\n---------\n\nCo-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Code refactor and some new features (#34)",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2026-01-13T14:22:47Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6caf7010db6ae6cec9e719bc9ff6bb5155d2d599",
"body": "… (#33)\n\n* refactor: introduce `StorageBackend` interface and refactor `FileProvider` to delegate to local and GCS backends.\n\n* feat: implement help overlay and add context to clipboard copy messages",
"is_bot": false,
"headline": "refactor(FileProvider): add storage backend to adopt strategy pattern…",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2025-12-27T12:14:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6d3c7a11c500c82c11935d842d3a1778d8461c31",
"body": null,
"is_bot": false,
"headline": "feat(chat): add metrics on token usage (#32)",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2025-12-27T12:12:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "abd78029de31ceb4de36a6a893ca46353aeff5ae",
"body": null,
"is_bot": false,
"headline": "refactor(Debug): remove very simple usecase (#31)",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2025-12-27T12:11:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aa1dcc632488ca34de65755240eddb5fc3ce1a50",
"body": "* refactor: Introduce a modular agent tool architecture replacing the monolithic pumbaa tool\n\n* refactor(agent): reestructure packages related to chat\n\n* chore(imports): apply goimports\n\n* refactor(ollama): remove package name from type name\n\n* docs(arch): update content\n\n* refactor(ports): Centrali\n[…]\nproject of social image\n\n* docs: Add Chat Agent feature documentation and navigation links.\n\n* docs: Reorganize navigation and enhance feature descriptions with new UI elements and detailed debug view",
"is_bot": false,
"headline": "refactor: update docs, reorganize packages and add tests (#30)",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2025-12-26T12:50:14Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "646b5abd43341fad9ffa128b0e9da1c8bf8fc35b",
"body": "* refactor(telemetry): move logic to a new `TrackCommand` method and improved error handling\n\n* chore: Add telemetry error capturing and integrate it into the TUI dashboard\n\n* fix(tui): categorize error and display with specific titles and troubleshooting tips\n\n* feat: Add telemetry breadcrumbs to track application flow and user actions in various handlers and CLI commands.",
"is_bot": false,
"headline": "chore(telemetry): Enhanced error tracking and breadcrumbs (#29)",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2025-12-24T18:24:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "31960e974800b0fbeee05346aa111443770068ef",
"body": "…or OS_TITLE. (#28)",
"is_bot": false,
"headline": "fix: replace non-POSIX sed capitalization with POSIX-compatible awk f…",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2025-12-24T14:37:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "77448666cc53b1d8926339aaead4f9d375a0b016",
"body": null,
"is_bot": false,
"headline": "docs: update and expand keybinding documentation in quick start guide",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2025-12-24T11:05:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b2998c30acb53b5134bd41f9585c36f1030c6a8f",
"body": null,
"is_bot": false,
"headline": "chore: Update default and recommended Gemini model to 2.5-flash.",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2025-12-24T10:58:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0508a2e41c5e293a7ab012d1aa0c77c518ae1ef0",
"body": null,
"is_bot": false,
"headline": "refactor: pure go sqlite driver",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2025-12-24T10:39:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "989d3e749bf037693ff5cb64325c56a45bcbc587",
"body": null,
"is_bot": false,
"headline": "refactor: keep only command + subcommand on track",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2025-12-23T19:14:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "387d30c746ae5ba813ce99571cd08963869a3f5d",
"body": null,
"is_bot": false,
"headline": "docs: more styling",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2025-12-23T18:41:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "41544723e6a53612aa8ad666cdc8ab31dc0c5789",
"body": null,
"is_bot": false,
"headline": "docs: better styling and updates",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2025-12-23T18:07:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ea6e2edf358421943d6e9f58434c561f554ea49e",
"body": "* feat(chat): Add Ollama based interaction\n\n* feat: Implement session persistence\n\n* feat: Add vertexai LLM provider\n\n* feat: max calls and warn to user\n\n* refactor: better tui for chat\n\n* fix: chat header\n\n* refactor: no need to truncate session id\n\n* docs: update with latest changes\n\n* feat: imple\n[…]\nprovider name as a badge in the chat header\n\n* refactor: remve CLI command used for debuging\n\n* feat: Add telemetry infrastructure with Sentry integration, command tracking, and opt-out configuration.",
"is_bot": false,
"headline": "feat(chat): add AI chat agent and configuration management (#27)",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2025-12-23T17:22:49Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fe6a9f3622c2a96a49b5f25a9fd3b6f5fa1d844e",
"body": "…and disk usage (#26)\n\n* feat: add intelligent path truncation for GCS and local paths in the debug view.\n\n* feat: Add TUI resource analysis modal with log parsing and efficiency recommendations.\n\n* feat: Add inline resource monitoring view with persistent action bar, refactor detail view content re\n[…]\nr health status display and workflow label management in the TUI dashboard.\n\n* refactor: type badge first\n\n* feat: introduce common TUI icons and refine debug view details and action bar presentation.",
"is_bot": false,
"headline": "feat: add task efficiency calculation based on monitored CPU, memory …",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2025-12-22T14:17:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5c3a4b9e906d188969288eb14b6cceaf18b74ce2",
"body": null,
"is_bot": false,
"headline": "feat: Add horizontal scrolling to the log modal.",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2025-12-20T11:15:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "393c12b31ffffaed814f21675ccc7de3d64b7a2b",
"body": null,
"is_bot": false,
"headline": "feat(monitoring): introduce script and new documentation",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2025-12-19T11:19:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "42961fef97fc9029be4f8b1fa11a2575ad278350",
"body": null,
"is_bot": false,
"headline": "feat(tui): add syntax highlighting for debug logs and commands",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2025-12-19T11:19:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d9e41c7bdba6f8b78da85adb356475a16820cc84",
"body": "…y (#25)\n\n* refactor: remove unused functions from timeline modal\n\n* refactor(timeline): remove workflow name from list of calls\n\n* feat(cost): add workflow cost retrieval and display in debug TUI\n\n* feat(debug): add workflow log functionality and display paths in details view\n\n* fix(bundle): update\n[…]\n(debug): no necessary to expand subworkflows\n\n* chore(changelog): update changelog configuration to include additional filters and group titles\n\n* build(makefile): add command to preview release notes",
"is_bot": false,
"headline": "feat: get workflow total price at once and fix bundle output director…",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2025-12-18T22:42:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "992acff369ecafee7a11175566beca00895acae3",
"body": null,
"is_bot": false,
"headline": "fix: update actions and goreleaser versions in workflows",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2025-12-16T01:40:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "91c906a1aa4fb0aea1b97e23e6fbb10cb4fb3e37",
"body": "* fix(debuginfo): improve AggregateStatus logic for retry handling\n\n* feat(debuginfo): aggregate multiple shard attempts into single tree nodes\n\n* test(debuginfo): add comprehensive tests for shard grouping and aggregate status\n\n* refactor(debuginfo): implement treeBuilder for improved workflow tree construction\n\n* refactor: remove unused code",
"is_bot": false,
"headline": "feat(debug): aggregate multiple shards retry into single one (#24)",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2025-12-15T10:17:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2c26599c9ce13804a82177184b729115a1023eec",
"body": "Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.43.0 to 0.45.0.\n- [Commits](https://github.com/golang/crypto/compare/v0.43.0...v0.45.0)\n\n---\nupdated-dependencies:\n- dependency-name: golang.org/x/crypto\n dependency-version: 0.45.0\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "build(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#23)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2025-12-14T18:53:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "81f8f16192612aa7e638ec00b50ea940868f8633",
"body": "* feat: AI generated code for wdl language parsing\n\n* refactor: better project architecture\n\n* feat: add Makefile for build automation and project management\n\n* feat: add tui for debugging\n\n* feat(tui/debug): add log viewing functionality and enhance key bindings\n\n- Introduced new key bindings for v\n[…]\nguration, and usage of Pumbaa CLI tool\n\n* feat(dashboard): enhance workflow row rendering with proper truncation and styling\n\n* feat(docs): add new images and enhance dashboard and debug documentation",
"is_bot": false,
"headline": "Code reorganization and new features (#22)",
"author_name": "Lucas Mitsuo Taniguti",
"author_login": "lmtani",
"committed_at": "2025-12-13T14:49:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ca1969ae01e5a48b80d71240c74a33dd07b1cbd6",
"body": null,
"is_bot": false,
"headline": "build: Remove Codecov upload step from test job",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2025-07-12T11:53:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "370d51d17ae98a227a42e87f2732a5372f4f2832",
"body": null,
"is_bot": false,
"headline": "build: Remove deepsource and readme section",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2025-07-12T11:52:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a9c15f4222d7c82a757402a5103f55766bc83155",
"body": null,
"is_bot": false,
"headline": "fix: Write build wdl even when no dependencies present",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2024-10-18T14:33:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eb5b7fe200257b8f5390ef6791a7a4a93666f792",
"body": null,
"is_bot": false,
"headline": "build(CI): Update Go image",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2024-10-18T13:40:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a45e4935533a1471f7d8ec8611dbfb24c07fc06b",
"body": null,
"is_bot": false,
"headline": "fix(build): Accept import duplications with same MD5",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2024-09-23T10:25:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "84f76beecfa05f95406f10cb0445326ec2d44b40",
"body": null,
"is_bot": false,
"headline": "fix(build): Recursively find import statements",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2024-09-01T14:30:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "801e5fabc08151de461bebef0627ab4e762b62fb",
"body": null,
"is_bot": false,
"headline": "tests(wdlImports): Add some examples of importing subworkflows",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2024-09-01T14:29:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3ca35212829fdb07d28a69aad7650ce5a69aac06",
"body": null,
"is_bot": false,
"headline": "refactor(cli): Make inputs optional for submit command",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2024-09-01T14:28:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eb021742d82b861693c2ef49fa16648f80ae8e72",
"body": null,
"is_bot": false,
"headline": "build(Go): Update to .22",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2024-09-01T14:27:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9a170d92653353cf5d58053e5b316af0399e532e",
"body": "* wip refactoring\r\n\r\n* wip refactoring\r\n\r\n* refactor: Something close to hexagonal architecture\r\n\r\n* fix: config templating\r\n\r\n* refactor: Code style\r\n\r\n* tests: Come back with some tests\r\n\r\n* tests: refactor tests to new pattern\r\n\r\n* refactor: Add HTTP port\r\n\r\n* refactor: Decouple IAP token generat\n[…]\nrefactor: FileSystem and WDL\r\n\r\n* tests: Happy path for filesystem\r\n\r\n* tests: happy path for resource usage logic\r\n\r\n* tests: More happy path tests\r\n\r\n* refactor: Inject filesystem port into deployer",
"is_bot": false,
"headline": "refactor: Implement Ports and Adapters Pattern (#21)",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2024-05-04T11:38:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b3f9dd71f5bc98ab94cce5f5b86f899ff36641a4",
"body": null,
"is_bot": false,
"headline": "feat: Ignore gcs auth if no google sdk present",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2024-03-09T12:26:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e75cfb38ef1196fa35c121e03d42fa7b5a600a93",
"body": null,
"is_bot": false,
"headline": "fix: enable/disable GCS filesystem",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2023-12-04T18:43:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6a5cf42218b49052869218b0eeae5d6679a6412f",
"body": null,
"is_bot": false,
"headline": "fix: no default valur fo GCS",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2023-12-04T18:17:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "547a56a8f680e008beb8d3b4dd13af1707da230f",
"body": null,
"is_bot": false,
"headline": "build: revert dist name",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2023-12-04T17:52:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7b0973d1c8a32e394fdb9acee6c75ec1cdbeed36",
"body": null,
"is_bot": false,
"headline": "build: remove windows",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2023-12-04T17:46:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e0f1773cf815707bb28ea163bfe8efd6735f1169",
"body": null,
"is_bot": false,
"headline": "build: go releaser update",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2023-12-04T14:13:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "76717f35fab9999e60265f2912924cdb49b6bd8b",
"body": null,
"is_bot": false,
"headline": "build: create binary for arm architecture",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2023-12-04T14:08:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c97b239051607f767a78827e955d947dd3e2c240",
"body": null,
"is_bot": false,
"headline": "refactor: do not raise exception if grep does not match",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2023-12-04T14:05:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5d58058f9b0b214058f53172fe54aa096a26d7e7",
"body": null,
"is_bot": false,
"headline": "refactor: error message if no binary available",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2023-12-04T13:57:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3c322e0fa64170ea2133bd5b8ae54782a9d0da72",
"body": null,
"is_bot": false,
"headline": "refactor: change wget -> curl",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2023-12-04T13:50:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b6b3504b52f305f7db61fa259c25513e4741e279",
"body": null,
"is_bot": false,
"headline": "refactor: check if google credential are available",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2023-12-04T10:16:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5927143ea0378e0d6b25947c7935fcaf89b1e7e1",
"body": null,
"is_bot": false,
"headline": "docs: small update on readme",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2023-06-10T13:53:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2eaeb4383edb3834708f38927746facccd66286a",
"body": null,
"is_bot": false,
"headline": "refactor: better function name",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2023-06-10T13:46:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "955c36b0c03003dae8615c9ed4ea52b5d9eb88c0",
"body": null,
"is_bot": false,
"headline": "refactor: project structure",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2023-06-10T13:44:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a645482b70b698d752362b8f5fa4cd92af81a2fa",
"body": null,
"is_bot": false,
"headline": "refactor: create internal packages",
"author_name": "Lucas Taniguti",
"author_login": "lmtani",
"committed_at": "2023-06-10T13:07:47Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 31,
"commits_last_year": 75,
"latest_release_at": "2026-07-18T22:29:48Z",
"latest_release_tag": "v1.1.0",
"releases_from_tags": false,
"days_since_last_push": 13,
"active_weeks_last_year": 14,
"days_since_latest_release": 13,
"mean_days_between_releases": 23.6
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 71,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "github.com/lmtani/pumbaa",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/lmtani/pumbaa",
"is_deprecated": false,
"latest_version": "v1.1.0",
"repository_url": "https://github.com/lmtani/pumbaa",
"versions_count": 28,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-18T21:15:50Z",
"latest_version_yanked": null,
"days_since_latest_publish": 13
}
]
},
"popularity": {
"forks": 3,
"stars": 22,
"watchers": 2,
"fork_history": {
"days": [
{
"date": "2021-08-06",
"count": 1
},
{
"date": "2021-10-25",
"count": 1
},
{
"date": "2024-02-14",
"count": 1
}
],
"complete": true,
"collected": 3,
"total_forks": 3
},
"star_history": null,
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"go.mod"
],
"largest_source_bytes": 368163,
"source_files_sampled": 299,
"oversized_source_files": 1,
"agent_instruction_files": [
"CLAUDE.md"
],
"agent_instruction_max_bytes": 6850
},
"dependencies": {
"manifests": [
"go.mod"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [
{
"name": "google.golang.org/grpc",
"direct": true,
"version": "v1.80.0",
"severity": "critical",
"ecosystem": "go",
"cvss_score": 9.1,
"advisory_ids": [
"GHSA-hrxh-6v49-42gf",
"GO-2026-6061"
],
"fixed_version": "1.82.1",
"advisory_count": 2,
"oldest_advisory_days": 10
},
{
"name": "go.opentelemetry.io/otel",
"direct": false,
"version": "v1.43.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5158"
],
"fixed_version": "1.44.0",
"advisory_count": 1,
"oldest_advisory_days": 8
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.52.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5932"
],
"fixed_version": null,
"advisory_count": 1,
"oldest_advisory_days": 24
},
{
"name": "golang.org/x/net",
"direct": false,
"version": "v0.55.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5942"
],
"fixed_version": "0.56.0",
"advisory_count": 1,
"oldest_advisory_days": 18
},
{
"name": "golang.org/x/text",
"direct": false,
"version": "v0.37.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5970"
],
"fixed_version": "0.39.0",
"advisory_count": 1,
"oldest_advisory_days": 18
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"unknown": 4,
"critical": 1
},
"advisory_count": 6,
"affected_count": 5,
"assessed_count": 114,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 1
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "cloud.google.com/go/logging",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.14.0"
},
{
"name": "cloud.google.com/go/storage",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.61.3"
},
{
"name": "github.com/alecthomas/chroma/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.23.1"
},
{
"name": "github.com/antlr4-go/antlr/v4",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v4.13.1"
},
{
"name": "github.com/charmbracelet/bubbles",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.0"
},
{
"name": "github.com/charmbracelet/bubbletea",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.3.10"
},
{
"name": "github.com/charmbracelet/glamour",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.0"
},
{
"name": "github.com/charmbracelet/huh",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.0"
},
{
"name": "github.com/charmbracelet/lipgloss",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.1.1-0.20250404203927-76690c660834"
},
{
"name": "github.com/fatih/color",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.19.0"
},
{
"name": "github.com/google/uuid",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.6.0"
},
{
"name": "github.com/muesli/reflow",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.3.0"
},
{
"name": "github.com/olekukonko/tablewriter",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.1.4"
},
{
"name": "github.com/urfave/cli/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.27.7"
},
{
"name": "golang.org/x/sync",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.20.0"
},
{
"name": "golang.org/x/term",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.43.0"
},
{
"name": "google.golang.org/adk",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.0"
},
{
"name": "google.golang.org/api",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.274.0"
},
{
"name": "google.golang.org/genai",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.52.1"
},
{
"name": "google.golang.org/grpc",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.80.0"
},
{
"name": "google.golang.org/protobuf",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.36.11"
},
{
"name": "gopkg.in/yaml.v3",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v3.0.1"
},
{
"name": "modernc.org/sqlite",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.48.1"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "cloud.google.com/go/logging",
"direct": true,
"version": "v1.14.0",
"ecosystem": "go"
},
{
"name": "cloud.google.com/go/storage",
"direct": true,
"version": "v1.61.3",
"ecosystem": "go"
},
{
"name": "github.com/alecthomas/chroma/v2",
"direct": true,
"version": "v2.23.1",
"ecosystem": "go"
},
{
"name": "github.com/antlr4-go/antlr/v4",
"direct": true,
"version": "v4.13.1",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/bubbles",
"direct": true,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/bubbletea",
"direct": true,
"version": "v1.3.10",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/glamour",
"direct": true,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/huh",
"direct": true,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/lipgloss",
"direct": true,
"version": "v1.1.1-0.20250404203927-76690c660834",
"ecosystem": "go"
},
{
"name": "github.com/fatih/color",
"direct": true,
"version": "v1.19.0",
"ecosystem": "go"
},
{
"name": "github.com/google/uuid",
"direct": true,
"version": "v1.6.0",
"ecosystem": "go"
},
{
"name": "github.com/muesli/reflow",
"direct": true,
"version": "v0.3.0",
"ecosystem": "go"
},
{
"name": "github.com/olekukonko/tablewriter",
"direct": true,
"version": "v1.1.4",
"ecosystem": "go"
},
{
"name": "github.com/urfave/cli/v2",
"direct": true,
"version": "v2.27.7",
"ecosystem": "go"
},
{
"name": "golang.org/x/sync",
"direct": true,
"version": "v0.20.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/term",
"direct": true,
"version": "v0.43.0",
"ecosystem": "go"
},
{
"name": "google.golang.org/adk",
"direct": true,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "google.golang.org/api",
"direct": true,
"version": "v0.274.0",
"ecosystem": "go"
},
{
"name": "google.golang.org/genai",
"direct": true,
"version": "v1.52.1",
"ecosystem": "go"
},
{
"name": "google.golang.org/grpc",
"direct": true,
"version": "v1.80.0",
"ecosystem": "go"
},
{
"name": "google.golang.org/protobuf",
"direct": true,
"version": "v1.36.11",
"ecosystem": "go"
},
{
"name": "gopkg.in/yaml.v3",
"direct": true,
"version": "v3.0.1",
"ecosystem": "go"
},
{
"name": "modernc.org/sqlite",
"direct": true,
"version": "v1.48.1",
"ecosystem": "go"
},
{
"name": "cel.dev/expr",
"direct": false,
"version": "v0.25.1",
"ecosystem": "go"
},
{
"name": "cloud.google.com/go",
"direct": false,
"version": "v0.123.0",
"ecosystem": "go"
},
{
"name": "cloud.google.com/go/auth",
"direct": false,
"version": "v0.19.0",
"ecosystem": "go"
},
{
"name": "cloud.google.com/go/auth/oauth2adapt",
"direct": false,
"version": "v0.2.8",
"ecosystem": "go"
},
{
"name": "cloud.google.com/go/compute/metadata",
"direct": false,
"version": "v0.9.0",
"ecosystem": "go"
},
{
"name": "cloud.google.com/go/iam",
"direct": false,
"version": "v1.7.0",
"ecosystem": "go"
},
{
"name": "cloud.google.com/go/longrunning",
"direct": false,
"version": "v0.9.0",
"ecosystem": "go"
},
{
"name": "cloud.google.com/go/monitoring",
"direct": false,
"version": "v1.25.0",
"ecosystem": "go"
},
{
"name": "github.com/atotto/clipboard",
"direct": false,
"version": "v0.1.4",
"ecosystem": "go"
},
{
"name": "github.com/aymanbagabas/go-osc52/v2",
"direct": false,
"version": "v2.0.1",
"ecosystem": "go"
},
{
"name": "github.com/aymerick/douceur",
"direct": false,
"version": "v0.2.0",
"ecosystem": "go"
},
{
"name": "github.com/catppuccin/go",
"direct": false,
"version": "v0.3.0",
"ecosystem": "go"
},
{
"name": "github.com/cespare/xxhash/v2",
"direct": false,
"version": "v2.3.0",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/colorprofile",
"direct": false,
"version": "v0.4.3",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/ansi",
"direct": false,
"version": "v0.11.6",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/cellbuf",
"direct": false,
"version": "v0.0.15",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/exp/slice",
"direct": false,
"version": "v0.0.0-20260330094520-2dce04b6f8a4",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/exp/strings",
"direct": false,
"version": "v0.1.0",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/term",
"direct": false,
"version": "v0.2.2",
"ecosystem": "go"
},
{
"name": "github.com/clipperhouse/displaywidth",
"direct": false,
"version": "v0.11.0",
"ecosystem": "go"
},
{
"name": "github.com/clipperhouse/uax29/v2",
"direct": false,
"version": "v2.7.0",
"ecosystem": "go"
},
{
"name": "github.com/cncf/xds/go",
"direct": false,
"version": "v0.0.0-20260202195803-dba9d589def2",
"ecosystem": "go"
},
{
"name": "github.com/cpuguy83/go-md2man/v2",
"direct": false,
"version": "v2.0.7",
"ecosystem": "go"
},
{
"name": "github.com/dlclark/regexp2",
"direct": false,
"version": "v1.11.5",
"ecosystem": "go"
},
{
"name": "github.com/dustin/go-humanize",
"direct": false,
"version": "v1.0.1",
"ecosystem": "go"
},
{
"name": "github.com/envoyproxy/go-control-plane/envoy",
"direct": false,
"version": "v1.37.0",
"ecosystem": "go"
},
{
"name": "github.com/envoyproxy/protoc-gen-validate",
"direct": false,
"version": "v1.3.3",
"ecosystem": "go"
},
{
"name": "github.com/erikgeiser/coninput",
"direct": false,
"version": "v0.0.0-20211004153227-1c3628e74d0f",
"ecosystem": "go"
},
{
"name": "github.com/felixge/httpsnoop",
"direct": false,
"version": "v1.0.4",
"ecosystem": "go"
},
{
"name": "github.com/go-jose/go-jose/v4",
"direct": false,
"version": "v4.1.4",
"ecosystem": "go"
},
{
"name": "github.com/go-logr/logr",
"direct": false,
"version": "v1.4.3",
"ecosystem": "go"
},
{
"name": "github.com/go-logr/stdr",
"direct": false,
"version": "v1.2.2",
"ecosystem": "go"
},
{
"name": "github.com/goccy/go-json",
"direct": false,
"version": "v0.10.6",
"ecosystem": "go"
},
{
"name": "github.com/google/go-cmp",
"direct": false,
"version": "v0.7.0",
"ecosystem": "go"
},
{
"name": "github.com/google/jsonschema-go",
"direct": false,
"version": "v0.4.2",
"ecosystem": "go"
},
{
"name": "github.com/google/s2a-go",
"direct": false,
"version": "v0.1.9",
"ecosystem": "go"
},
{
"name": "github.com/googleapis/enterprise-certificate-proxy",
"direct": false,
"version": "v0.3.14",
"ecosystem": "go"
},
{
"name": "github.com/googleapis/gax-go/v2",
"direct": false,
"version": "v2.21.0",
"ecosystem": "go"
},
{
"name": "github.com/googlecloudplatform/opentelemetry-operations-go/detectors/gcp",
"direct": false,
"version": "v1.31.0",
"ecosystem": "go"
},
{
"name": "github.com/googlecloudplatform/opentelemetry-operations-go/exporter/metric",
"direct": false,
"version": "v0.55.0",
"ecosystem": "go"
},
{
"name": "github.com/googlecloudplatform/opentelemetry-operations-go/internal/resourcemapping",
"direct": false,
"version": "v0.55.0",
"ecosystem": "go"
},
{
"name": "github.com/gorilla/css",
"direct": false,
"version": "v1.0.1",
"ecosystem": "go"
},
{
"name": "github.com/gorilla/websocket",
"direct": false,
"version": "v1.5.3",
"ecosystem": "go"
},
{
"name": "github.com/lucasb-eyer/go-colorful",
"direct": false,
"version": "v1.4.0",
"ecosystem": "go"
},
{
"name": "github.com/mattn/go-colorable",
"direct": false,
"version": "v0.1.14",
"ecosystem": "go"
},
{
"name": "github.com/mattn/go-isatty",
"direct": false,
"version": "v0.0.20",
"ecosystem": "go"
},
{
"name": "github.com/mattn/go-localereader",
"direct": false,
"version": "v0.0.1",
"ecosystem": "go"
},
{
"name": "github.com/mattn/go-runewidth",
"direct": false,
"version": "v0.0.22",
"ecosystem": "go"
},
{
"name": "github.com/microcosm-cc/bluemonday",
"direct": false,
"version": "v1.0.27",
"ecosystem": "go"
},
{
"name": "github.com/mitchellh/hashstructure/v2",
"direct": false,
"version": "v2.0.2",
"ecosystem": "go"
},
{
"name": "github.com/muesli/ansi",
"direct": false,
"version": "v0.0.0-20230316100256-276c6243b2f6",
"ecosystem": "go"
},
{
"name": "github.com/muesli/cancelreader",
"direct": false,
"version": "v0.2.2",
"ecosystem": "go"
},
{
"name": "github.com/muesli/termenv",
"direct": false,
"version": "v0.16.0",
"ecosystem": "go"
},
{
"name": "github.com/ncruces/go-strftime",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/olekukonko/cat",
"direct": false,
"version": "v0.0.0-20250911104152-50322a0618f6",
"ecosystem": "go"
},
{
"name": "github.com/olekukonko/errors",
"direct": false,
"version": "v1.2.0",
"ecosystem": "go"
},
{
"name": "github.com/olekukonko/ll",
"direct": false,
"version": "v0.1.8",
"ecosystem": "go"
},
{
"name": "github.com/planetscale/vtprotobuf",
"direct": false,
"version": "v0.6.1-0.20240319094008-0393e58bdf10",
"ecosystem": "go"
},
{
"name": "github.com/remyoudompheng/bigfft",
"direct": false,
"version": "v0.0.0-20230129092748-24d4a6f8daec",
"ecosystem": "go"
},
{
"name": "github.com/rivo/uniseg",
"direct": false,
"version": "v0.4.7",
"ecosystem": "go"
},
{
"name": "github.com/russross/blackfriday/v2",
"direct": false,
"version": "v2.1.0",
"ecosystem": "go"
},
{
"name": "github.com/spiffe/go-spiffe/v2",
"direct": false,
"version": "v2.6.0",
"ecosystem": "go"
},
{
"name": "github.com/xo/terminfo",
"direct": false,
"version": "v0.0.0-20220910002029-abceb7e1c41e",
"ecosystem": "go"
},
{
"name": "github.com/xrash/smetrics",
"direct": false,
"version": "v0.0.0-20250705151800-55b8f293f342",
"ecosystem": "go"
},
{
"name": "github.com/yuin/goldmark",
"direct": false,
"version": "v1.8.2",
"ecosystem": "go"
},
{
"name": "github.com/yuin/goldmark-emoji",
"direct": false,
"version": "v1.0.6",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/auto/sdk",
"direct": false,
"version": "v1.2.1",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/contrib/detectors/gcp",
"direct": false,
"version": "v1.42.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
"direct": false,
"version": "v0.67.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
"direct": false,
"version": "v0.67.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel",
"direct": false,
"version": "v1.43.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/log",
"direct": false,
"version": "v0.19.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/metric",
"direct": false,
"version": "v1.43.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/sdk",
"direct": false,
"version": "v1.43.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/sdk/metric",
"direct": false,
"version": "v1.43.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/trace",
"direct": false,
"version": "v1.43.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.52.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/exp",
"direct": false,
"version": "v0.0.0-20260312153236-7ab1446f8b90",
"ecosystem": "go"
},
{
"name": "golang.org/x/net",
"direct": false,
"version": "v0.55.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/oauth2",
"direct": false,
"version": "v0.36.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sys",
"direct": false,
"version": "v0.45.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/text",
"direct": false,
"version": "v0.37.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/time",
"direct": false,
"version": "v0.15.0",
"ecosystem": "go"
},
{
"name": "google.golang.org/genproto",
"direct": false,
"version": "v0.0.0-20260401024825-9d38bb4040a9",
"ecosystem": "go"
},
{
"name": "google.golang.org/genproto/googleapis/api",
"direct": false,
"version": "v0.0.0-20260401024825-9d38bb4040a9",
"ecosystem": "go"
},
{
"name": "google.golang.org/genproto/googleapis/rpc",
"direct": false,
"version": "v0.0.0-20260401024825-9d38bb4040a9",
"ecosystem": "go"
},
{
"name": "modernc.org/libc",
"direct": false,
"version": "v1.70.0",
"ecosystem": "go"
},
{
"name": "modernc.org/mathutil",
"direct": false,
"version": "v1.7.1",
"ecosystem": "go"
},
{
"name": "modernc.org/memory",
"direct": false,
"version": "v1.11.0",
"ecosystem": "go"
},
{
"name": "rsc.io/omap",
"direct": false,
"version": "v1.2.0",
"ecosystem": "go"
},
{
"name": "rsc.io/ordered",
"direct": false,
"version": "v1.1.1",
"ecosystem": "go"
}
],
"collected": true,
"truncated": false,
"total_count": 114,
"direct_count": 23,
"indirect_count": 91
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 51,
"open_issues": 0,
"closed_ratio": 1,
"closed_issues": 1,
"closed_unmerged_prs": 3
},
"bus_factor": 1,
"bot_contributors": 1,
"top_contributors": [
{
"type": "User",
"login": "lmtani",
"commits": 206,
"avatar_url": "https://avatars.githubusercontent.com/u/12699242?v=4"
},
{
"type": "User",
"login": "deepsourcebot",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/60907429?v=4"
}
],
"contributors_sampled": 2,
"top_contributor_share": 0.995
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"docs.yml",
"release.yml",
"update-demo-gif.yml"
],
"has_docs_dir": true,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "12 out of 12 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 3,
"reason": "project has 1 contributing companies or organizations -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "24 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 0,
"reason": "Project has not signed or included provenance with any releases.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 5,
"reason": "5 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "e5e49f1a35520b79cf63bfadeaef07896ebe0cb3",
"ran_at": "2026-08-01T20:02:33Z",
"aggregate_score": 4.5,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-18T22:37:07Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-18T21:15:50Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/lmtani/pumbaa",
"host": "github.com",
"name": "pumbaa",
"owner": "lmtani"
},
"metrics": {
"overall": {
"key": "overall",
"band": "good",
"name": "Overall health",
"note": "The weighted overall 63 is calibrated to 71 on the published index scale (record calibration 2026-08-02).",
"notes": [
{
"code": "overall_calibration",
"params": {
"raw": 63,
"calibrated": 71,
"calibration": "2026-08-02"
}
}
],
"value": 71,
"inputs": {
"security": 49,
"vitality": 75,
"community": 45,
"governance": 58,
"calibration": "2026-08-02",
"engineering": 77,
"ai_readiness": 84,
"weighted_overall_raw": 63
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 75,
"weight": 0.21,
"metrics": [
{
"key": "development_activity",
"band": "good",
"name": "Development activity",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"commits_last_year": 75,
"human_commit_share": 0.98,
"days_since_last_push": 13,
"active_weeks_last_year": 14
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 13 days ago",
"points": 28.8,
"status": "partial",
"details": [
{
"code": "push_recency",
"params": {
"days": 13
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "14/52 weeks with commits",
"points": 9.7,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 14
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "75 commits in the last year",
"points": 16.9,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 75
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "24 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"releases_count": 31,
"latest_release_tag": "v1.1.0",
"releases_from_tags": false,
"days_since_latest_release": 13,
"mean_days_between_releases": 23.6
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "31 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 31
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 13 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 13
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~23.6 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 23.6
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "exceptional",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 15,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 15 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 15
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "weak",
"name": "Community & Adoption",
"value": 45,
"weight": 0.17,
"metrics": [
{
"key": "popularity",
"band": "at_risk",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 24,
"inputs": {
"forks": 3,
"stars": 22,
"watchers": 2,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "22 stars",
"points": 21.4,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 22
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "3 forks",
"points": 2.5,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 3
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "2 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 2
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "good",
"name": "Community health",
"note": null,
"notes": [],
"value": 70,
"inputs": {
"has_readme": true,
"has_license": true,
"readme_badges": null,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": false,
"readme_badge_services": [],
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 58,
"weight": 0.23,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 15,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 2,
"top_contributor_share": 0.995
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0.1,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "2 contributors",
"points": 2.7,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 2
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "excellent",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Newcomer PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"newcomer_pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 81,
"inputs": {
"merged_prs": 51,
"open_issues": 0,
"closed_issues": 1,
"prs_merged_7d": null,
"prs_decided_7d": null,
"prs_merged_30d": null,
"prs_decided_30d": null,
"issue_closed_ratio": 1,
"closed_unmerged_prs": 3,
"first_time_authors_30d": null,
"first_time_prs_merged_30d": null,
"first_time_prs_decided_30d": null
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "100% of issues closed",
"points": 42,
"status": "met",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 100
}
}
],
"max_points": 42
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "51/54 decided PRs merged",
"points": 28.3,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 51,
"decided": 54
}
}
],
"max_points": 30
},
{
"key": "newcomer_pr_acceptance",
"name": "Newcomer PR acceptance",
"detail": "no first-time contributor's PR decided in 30d",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_newcomer_prs",
"params": {
"days": 30
}
}
],
"max_points": 13
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 53,
"inputs": {
"followers": 31,
"owner_type": "User",
"is_verified": null,
"owner_login": "lmtani",
"public_repos": 22,
"account_age_days": 4079
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "31 followers of lmtani",
"points": 10.8,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 31,
"login": "lmtani"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "22 public repos, account ~11 yr old",
"points": 21.9,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 22
}
},
{
"code": "account_age_years",
"params": {
"years": 11
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "exceptional",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"github.com/lmtani/pumbaa"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 13
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 13 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 13
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "28 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 28
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 77,
"weight": 0.19,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 68,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "4 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 4
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "12 out of 12 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "excellent",
"name": "Documentation",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"topics": [
"cromwell",
"cli",
"workflow",
"bioinformatics",
"wdl"
],
"has_wiki": false,
"homepage": "https://lmtani.github.io/pumbaa",
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://lmtani.github.io/pumbaa",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "5 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 5
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "weak",
"name": "Security",
"value": 49,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "weak",
"name": "Security posture",
"note": null,
"notes": [],
"value": 45,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 18,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 0,
"scorecard_aggregate": 4.5
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "12 out of 12 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "24 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "5 existing vulnerabilities detected",
"points": 3.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "good",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 114 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 114
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 66,
"inputs": {
"source": "osv",
"advisories": 6,
"affected_packages": 5,
"assessed_packages": 114,
"unassessed_packages": 0,
"affected_by_severity": "critical 1, unknown 4",
"direct_affected_packages": 1
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "1 affected: google.golang.org/grpc v1.80.0 (critical 9.1)",
"points": 9.5,
"status": "partial",
"details": [
{
"code": "advisories_affected",
"params": {
"count": 1,
"packages": "google.golang.org/grpc v1.80.0 (critical 9.1)"
}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory has been public longer than 90 days",
"points": 40,
"status": "met",
"details": [
{
"code": "advisories_none_stale",
"params": {
"days": 90
}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "exceptional",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 114,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "exceptional",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"commit_weight_rule": {
"min_commits": 50,
"min_commit_share": 0.1
},
"review_only_matches": 0,
"below_threshold_exposures": [],
"assessed_self_published_locations": 2
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "excellent",
"name": "AI Readiness",
"value": 84,
"weight": 0.04,
"metrics": [
{
"key": "ai_agent_context",
"band": "excellent",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.99,
"agent_instruction_files": [
"CLAUDE.md"
],
"agent_instruction_max_bytes": 6850
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "CLAUDE.md",
"points": 45,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "CLAUDE.md"
}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "97 of 98 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 97,
"sampled": 98
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "good",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 77,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [
"Makefile"
],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0.04,
"toolchain_manifests": [
"go.mod"
],
"dependency_bot_commit_share": 0.02
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "4 of the last 100 commits agent-authored or agent-credited",
"points": 8,
"status": "partial",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 4,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "2 of the last 100 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 2,
"sampled": 100
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "exceptional",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 368163,
"source_files_sampled": 299,
"oversized_source_files": 1
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "1/299 source files over 60KB",
"points": 54.8,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 299,
"oversized": 1
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight: agent tooling is a real maintenance signal, but its absence must never gate the top of the scale (calibration saturates at raw 91, so 100/100 remains reachable with AI Readiness at zero)."
}
],
"classification": {
"labels": [
"cli",
"library",
"tui"
],
"scores": {
"cli": 6,
"tui": 4,
"library": 6
},
"primary": "cli",
"evidence": [
{
"tier": "distribution",
"label": "library",
"source": "registry:go",
"weight": 6
},
{
"tier": "dependencies",
"label": "cli",
"source": "dep:github.com/urfave/cli/v2",
"weight": 4
},
{
"tier": "dependencies",
"label": "tui",
"source": "dep:github.com/charmbracelet/bubbletea",
"weight": 4
},
{
"tier": "tags",
"label": "cli",
"source": "tag:cli",
"weight": 2
}
],
"artifacts": [],
"confidence": "medium",
"host_extension": false,
"runs_as_process": true,
"consumed_by_code": true
},
"metrics_version": "2.3.1"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-08-01T20:02:43.378650Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/l/lmtani/pumbaa.svg",
"full_name": "lmtani/pumbaa",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}
Verwandte Einträge
Geprüfte Repositories, die Katalog-Tags oder Ökosysteme mit lmtani/pumbaa teilen. Nebeneinander lesen →
Bewertungen sind Signale, keine Garantien. Sie spiegeln öffentlich sichtbare Praxis auf GitHub wider — kein Code-Audit und keine Sicherheitsgarantie.
Fehlende Daten werden ausgeschlossen und die Gewichte neu normiert, nie als null bewertet. Die Methodik ist versioniert und offen: Metriken v2.3.1, Schema v0.27.0 — vollständige Methodik · Metriken-Wiki.
