Öffentliches RegisterMittel
Software-GesundheitsberichtSchema 0.27.0 · Metriken 1.13.0 · 2026-07-28 07:46 UTC
rbtr / shunt
A merge queue for Forgejo and Gitea
rbtr/shunt erreicht einen Gesundheitsindex von 58 von 100 und liegt damit im Bereich Mittel. Am stärksten schneidet es bei AI Readiness (79/100) ab, am schwächsten bei Community & Adoption (33/100). Zuletzt vor 4 Tagen aktualisiert. Ein einzelner Mitwirkender trägt den Großteil der jüngsten Arbeit.
58
gesamt / 100Software-Gesundheitsindex
Metriken werden auf einer Skala von 1–100 in gewichtete Kategorien gruppiert. Der Gesamtwert beginnt als ihr Mittel; sobald öffentliche Evidenz die Richtlinie für Hochrisikojurisdiktionen auslöst, wird die Bewertung angepasst und erhält die Obergrenze 49 (Gefährdet). AI Readiness liegt außerhalb.
58
Exzellent85-100Vorbildlich; erfüllt im Wesentlichen alle geprüften Kriterien
Gut70-84Gesund; geringfügige Lücken
Mittel50-69Akzeptabel mit deutlichen Lücken; Überprüfung empfohlen
Gefährdet30-49Erhebliche Schwächen; eine Übernahme erfordert Vorsicht
Kritisch1-29Schwerwiegende Probleme (aufgegeben, nur ein Maintainer, keine Hygiene)
Bewertungsprofil
Jede Achse ist eine Kategorie. Die Form zählt mehr als der Durchschnitt — ein gesundes Projekt füllt die gesamte Fläche, während ein Profil aus Spitzen und Kratern bedeutet, dass Stärke in einer Dimension Risiken in einer anderen verdeckt.
Eigentümerschaft
Evan BakerPersönliches Konto
54 Follower55 öffentliche Reposseit Dez. 2012@Microsoft @Azure
Dieses Repository gehört einem persönlichen Konto. Ein Projekt mit nur einem Eigentümer trägt ein höheres Kontinuitätsrisiko als ein organisationsgetragenes.
Paket-Ökosysteme
| Registry | Paket | Version | Downloads / Monat | Versionen | Zuletzt veröffentlicht |
|---|---|---|---|---|---|
| Go | github.com/rbtr/shunt | v0.9.0 | - | 10 | vor 5 Tagen |
Metriken nach Kategorie
Vitalität
Lebt das Projekt — wird Code geschrieben und werden Releases ausgeliefert?
69
Entwicklungsaktivität
55Mittel
Wie die Bewertung erfolgt
| 36/36 | Push-Aktualität — letzter Push vor 4 Tagen |
| 3.5/36 | Commit-Rhythmus — 5/52 Wochen mit Commits |
| 15.6/18 | Commit-Volumen — 53 Commits im letzten Jahr |
| 0/10 | OpenSSF Scorecard: Maintained — project was created within the last 90 days. Please review its contents carefully |
Verwendete Eingangsdaten
| commits_last_year | 53 |
| human_commit_share | 1 |
| days_since_last_push | 4 |
| active_weeks_last_year | 5 |
Release-Disziplin
90Exzellent
Wie die Bewertung erfolgt
| 27/27 | Liefert Releases aus — 10 Releases veröffentlicht |
| 36/36 | Release-Aktualität — letztes Release vor 5 Tagen |
| 27/27 | Release-Rhythmus — ein Release etwa alle 3,4 Tage |
| 0/10 | OpenSSF Scorecard: Signed-Releases — Project has not signed or included provenance with any releases. |
Verwendete Eingangsdaten
| releases_count | 10 |
| latest_release_tag | v0.9.0 |
| releases_from_tags | nein |
| days_since_latest_release | 5 |
| mean_days_between_releases | 3,4 |
Community & Verbreitung
Hat das Projekt Nutzer, Downloads, Aufmerksamkeit und ein einladendes Umfeld für Beitragende?
33
Popularität & Verbreitung
1Kritisch
Wie die Bewertung erfolgt
| 0/60 | Stars — 2 Stars |
| 0/25 | Forks — 0 Forks |
| 0/15 | Watcher — 1 Watcher |
Verwendete Eingangsdaten
| forks | 0 |
| stars | 2 |
| watchers | 1 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community-Gesundheit
70Gut
Wie die Bewertung erfolgt
| 22.5/22.5 | README |
| 22.5/22.5 | Lizenz — anerkannte Lizenz (MIT) |
| 18/18 | CONTRIBUTING-Leitfaden |
| 0/13.5 | Verhaltenskodex |
| 0/7.2 | Issue-Vorlage |
| 0/6.3 | PR-Vorlage |
Verwendete Eingangsdaten
| has_readme | ja |
| has_license | ja |
| has_contributing | ja |
| has_issue_template | nein |
| has_code_of_conduct | nein |
| has_pull_request_template | nein |
Nachhaltigkeit & Governance
Überdauert das Projekt die Menschen, die es tragen — Bus-Faktor, Reaktionsfähigkeit, Trägerschaft und Paketpflege?
55
Maintainer-Resilienz (Bus-Faktor)
13Kritisch
Wie die Bewertung erfolgt
| 9/54 | Bus-Faktor — 1 Beitragende decken die Hälfte aller Commits ab |
| 0/22.5 | Commit-Verteilung — wichtigste beitragende Person verfasste 100 % der Commits |
| 1.4/13.5 | Breite der Beitragenden — 1 Beitragende |
| 3/10 | OpenSSF Scorecard: Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
Verwendete Eingangsdaten
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
Wie die Bewertung erfolgt
| 31.2/46.8 | Issue-Lösungsquote — 67 % der Issues geschlossen |
| 36.2/38.3 | PR-Annahme — 53/56 entschiedene PRs gemergt |
| 0/15 | OpenSSF Scorecard: Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
Verwendete Eingangsdaten
| merged_prs | 53 |
| open_issues | 1 |
| closed_issues | 2 |
| issue_closed_ratio | 0,667 |
| closed_unmerged_prs | 3 |
Eigentümerschaft & Trägerschaft
59Mittel
Wie die Bewertung erfolgt
| 10/30 | Organisatorische Trägerschaft — persönliches (Nutzer-)Konto |
| 0/20 | Verifizierte Domain — für Nutzerkonten nicht anwendbar |
| 12.5/25 | Reichweite des Inhabers — 54 Follower von rbtr |
| 24.7/25 | Kontohistorie — 55 öffentliche Repos, Kontoalter ca. 13 Jahre |
Verwendete Eingangsdaten
| followers | 54 |
| owner_type | User |
| is_verified | — |
| owner_login | rbtr |
| public_repos | 55 |
| account_age_days | 4.986 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): Verifizierte Domain. Die verbleibenden Gewichte wurden renormalisiert.
Paketpflege
100Exzellent
Wie die Bewertung erfolgt
| 25/25 | Veröffentlicht & auflösbar — 1 Paket(e) auf go |
| 35/35 | Veröffentlichungsaktualität — letzte Veröffentlichung vor 5 Tagen |
| 20/20 | Versionshistorie — 10 veröffentlichte Versionen |
| 20/20 | Nicht veraltet — aktiv, nicht veraltet oder zurückgezogen |
Verwendete Eingangsdaten
| packages | github.com/rbtr/shunt |
| ecosystems | go |
| any_deprecated | nein |
| min_days_since_publish | 5 |
Engineering-Qualität
Sind grundlegende Engineering- und Dokumentationspraktiken vorhanden?
71
Engineering-Praktiken
68Mittel
Wie die Bewertung erfolgt
| 24/24 | CI-Workflows — 2 Workflow(s) |
| 24/24 | Tests vorhanden |
| 0/16 | Linter-Konfiguration |
| 0/9.6 | Pre-Commit-Hooks |
| 0/6.4 | .editorconfig |
| 20/20 | OpenSSF Scorecard: CI-Tests — 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 |
Verwendete Eingangsdaten
| has_ci | ja |
| has_tests | ja |
| has_editorconfig | nein |
| has_linter_config | nein |
| has_precommit_config | nein |
Dokumentation
75Gut
Wie die Bewertung erfolgt
| 30/30 | README |
| 25/25 | Dokumentationsverzeichnis |
| 0/15 | Dokumentations-/Homepage-Site |
| 10/10 | Repository-Beschreibung |
| 10/10 | Topics — 5 Topics |
| 0/10 | Wiki |
Verwendete Eingangsdaten
| topics | devops, forgejo, gitea, golang, merge-queue |
| has_wiki | nein |
| homepage | — |
| has_readme | ja |
| has_docs_dir | ja |
| has_description | ja |
Sicherheit
Sind die sichtbaren Sicherheits- und Lieferkettenpraktiken belastbar, ohne ungeklärte Exposition gegenüber Hochrisikojurisdiktionen?
59
Sicherheitslage
49Gefährdet
Wie die Bewertung erfolgt
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 4.5/7.5 | Branch-Protection — branch protection is not maximal on development and all release branches |
| 2.5/2.5 | CI-Tests — 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
| 0.8/2.5 | Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | Lizenz — license file detected |
| 0/7.5 | Maintained — project was created within the last 90 days. Please review its contents carefully |
| 5/5 | Packaging — packaging workflow detected |
| 5/5 | Pinned-Dependencies — all dependencies are pinned |
| 5/5 | SAST — SAST tool is run on all commits |
| 2/5 | Security-Policy — security policy file detected |
| 0/7.5 | Signed-Releases — Project has not signed or included provenance with any releases. |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 6.8/7.5 | Vulnerabilities — 1 existing vulnerabilities detected |
Verwendete Eingangsdaten
| source | openssf_scorecard |
| checks_evaluated | 18 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 0 |
| scorecard_aggregate | 4,9 |
Abhängigkeits-Advisories
100Exzellent
Wie die Bewertung erfolgt
| 35/35 | Direkte Abhängigkeiten ohne bekannte Advisories — keine direkte Abhängigkeit trägt ein bekanntes Advisory |
| 0/25 | Indirekte Abhängigkeiten ohne bekannte Advisories — transitive Menge in diesem Bereich nicht von Entwicklungs- und Test-Abhängigkeiten trennbar |
| 0/40 | Keine offenen Advisories — kein Advisory trägt ein Veröffentlichungsdatum |
Verwendete Eingangsdaten
| source | osv |
| advisories | 1 |
| affected_packages | 1 |
| assessed_packages | 11 |
| unassessed_packages | 0 |
| affected_by_severity | unknown 1 |
| direct_affected_packages | 0 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): Indirekte Abhängigkeiten ohne bekannte Advisories, Keine offenen Advisories. Die verbleibenden Gewichte wurden renormalisiert. 11 aufgelöste Abhängigkeiten wurden mit OSV abgeglichen. Dieses Repository veröffentlicht kein Paket, das der Index auflöst; bewertet wurde daher der Abhängigkeitsgraph des Repositorys. Dieser Graph vermischt Entwicklungs- und Test-Pins mit ausgelieferten Abhängigkeiten, daher werden nur die deklarierten Laufzeit-Abhängigkeiten bewertet; transitive Befunde werden als Kontext ausgewiesen und fließen nicht in die Bewertung ein. Erreichbarkeit wird nicht analysiert.
AI Readiness
Wie gut ist das Repository dafür ausgestattet, mit KI-Coding-Agenten entwickelt und gepflegt zu werden? Ein unabhängiges, experimentelles Badge — Gewicht 0,0, es wird eigenständig ausgewiesen und verändert den Gesamt-Gesundheitswert nicht.
79
AI-Agentenkontext & Leitlinien
85Exzellent
Wie die Bewertung erfolgt
| 45/45 | Agentenanweisungen — .github/copilot-instructions.md, AGENTS.md |
| 0/15 | Maschinenlesbare Doku (llms.txt) |
| 40/40 | Lesbare Commit-Historie — 53 von 53 menschlichen Commits benennen ihre Absicht (strukturierter Betreff oder erläuternder Text) |
Verwendete Eingangsdaten
| has_llms_txt | nein |
| legible_history_share | 1 |
| agent_instruction_files | .github/copilot-instructions.md, AGENTS.md |
| agent_instruction_max_bytes | 2.891 |
Wie die Bewertung erfolgt
| 18/18 | Bootstrap mit einem Befehl — Makefile |
| 22/22 | Automatisierte Tests |
| 0/11 | Lint-/Format-Konfiguration |
| 11/11 | Statische Typprüfung — Go (statisch typisiert) |
| 10/10 | Reproduzierbare Umgebung — Dockerfile, lockfile |
| 10/10 | Belegte Agentenpraxis — 40 der letzten 53 Commits von Agenten verfasst oder ihnen zugeschrieben |
| 0/8 | Automatisierte Wartung — keine automatisierten Abhängigkeits-Updates beobachtet |
| 10/10 | OpenSSF Scorecard: Pinned-Dependencies — all dependencies are pinned |
Verwendete Eingangsdaten
| has_nix | nein |
| has_tests | ja |
| lockfiles | go.sum |
| has_dockerfile | ja |
| typed_language | ja |
| bootstrap_files | Makefile |
| has_devcontainer | nein |
| has_linter_config | nein |
| typecheck_configs | — |
| agent_commit_share | 0,755 |
| toolchain_manifests | go.mod |
| dependency_bot_commit_share | 0 |
AI-Code-Lesbarkeit für Modelle
98Exzellent
Wie die Bewertung erfolgt
| 45/45 | Typprüfbarer Code — Go (statisch typisiert) |
| 53/55 | Handhabbare Dateigrößen — 1/27 Quelldateien über 60 KB |
Verwendete Eingangsdaten
| primary_language | Go |
| largest_source_bytes | 75.207 |
| source_files_sampled | 27 |
| oversized_source_files | 1 |
Maschinenlesbare AI-Schnittstellen
40Gefährdet
Wie die Bewertung erfolgt
| 0/40 | API-Schema (OpenAPI/GraphQL/proto) |
| 0/20 | MCP-Server |
| 40/40 | Lauffähige Beispiele — examples |
Verwendete Eingangsdaten
| example_dirs | examples |
| has_mcp_signal | nein |
| api_schema_files | — |
Eckdaten
2GitHub-Sterne
1Mitwirkende
53Commits, letzte 12 Monate
4Tage seit letztem Push
10Releases
1Bus-Faktor
1offene Issues
GoPaket-Ökosysteme
Warnungen zur Datenerhebung
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
Weitere Details
OpenSSF Scorecard 4.9 / 10
4.9Gesamtwert
Unabhängige, werkzeugneutrale Sicherheitsbewertung durch das quelloffene OpenSSF Scorecard. Jede Prüfung honoriert eine Sicherheits-Praxis, nicht das Werkzeug eines bestimmten Anbieters. Prüfungen, die Scorecard nicht ermitteln konnte, sind mit k. A. markiert und vom Sicherheitswert ausgeschlossen (nie als null gezählt).
| 10 | Binary-Artifacts | no binaries found in the repo |
| 6 | Branch-Protection | branch protection is not maximal on development and all release branches |
| 10 | CI-Tests | 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/30 approved changesets -- score normalized to 0 |
| 3 | Contributors | project has 1 contributing companies or organizations -- score normalized to 3 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 0 | Maintained | project was created within the last 90 days. Please review its contents carefully |
| 10 | Packaging | packaging workflow detected |
| 10 | Pinned-Dependencies | all dependencies are pinned |
| 10 | SAST | SAST tool is run on all commits |
| 4 | Security-Policy | security policy file detected |
| 0 | Signed-Releases | Project has not signed or included provenance with any releases. |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 9 | Vulnerabilities | 1 existing vulnerabilities detected |
Direkte Abhängigkeiten 3
| Registry | Paket | Versionsvorgabe | Manifest |
|---|---|---|---|
| Go | github.com/jackc/pgx/v5 | v5.10.0 | go.mod |
| Go | go.etcd.io/bbolt | v1.3.11 | go.mod |
| Go | gopkg.in/yaml.v3 | v3.0.1 | go.mod |
Alle Abhängigkeiten 11
Vollständig aufgelöster Abhängigkeitssatz aus dem GitHub-Abhängigkeitsgraphen: 3 direkte und 8 indirekte (transitive) Pakete. Die transitive Hülle ist vollständig, wenn das Repository eine Lockfile eincheckt.
| Registry | Paket | Version | Beziehung |
|---|---|---|---|
| Go | github.com/jackc/pgx/v5 | v5.10.0 | direkt |
| Go | go.etcd.io/bbolt | v1.3.11 | direkt |
| Go | gopkg.in/yaml.v3 | v3.0.1 | direkt |
| Go | github.com/jackc/pgpassfile | v1.0.0 | indirekt |
| Go | github.com/jackc/pgservicefile | v0.0.0-20240606120523-5a60cdf6a761 | indirekt |
| Go | github.com/jackc/puddle/v2 | v2.2.2 | indirekt |
| Go | github.com/kr/text | v0.2.0 | indirekt |
| Go | github.com/rogpeppe/go-internal | v1.15.0 | indirekt |
| Go | golang.org/x/sync | v0.21.0 | indirekt |
| Go | golang.org/x/sys | v0.30.0 | indirekt |
| Go | golang.org/x/text | v0.39.0 | indirekt |
Abhängigkeits-Advisories 1
Dieses Repository veröffentlicht kein vom Index auflösbares Paket, daher wurde sein eigener Abhängigkeitsgraph bewertet – 11 Pakete, darunter auch Entwicklungs- und Test-Pins, die nie ausgeliefert werden: 1 tragen bekannte Advisories, davon 0 direkte.
| Paket | Version | Beziehung | Schweregrad | Advisories | Behoben in |
|---|---|---|---|---|---|
| golang.org/x/sys | v0.30.0 | indirekt | unbekannt | 1 | 0.44.0 |
Ein Advisory bedeutet, dass die im Abhängigkeitsgraphen erfasste Version in den betroffenen Bereich eines Advisories fällt. Erreichbarkeit wird nicht analysiert, und der Graph enthält Entwicklungs- und Test-Pins — ein Fund kann das Werkzeug betreffen und nicht die ausgelieferte Software.
JSON-Rohbericht maschinenlesbar
{
"data": {
"repo": {
"topics": [
"devops",
"forgejo",
"gitea",
"golang",
"merge-queue"
],
"is_fork": false,
"size_kb": 1836,
"has_wiki": false,
"homepage": null,
"languages": {
"Go": 340376,
"Makefile": 1036,
"Dockerfile": 933,
"Go Template": 1008
},
"pushed_at": "2026-07-23T13:22:32Z",
"created_at": "2026-06-21T15:10:46Z",
"owner_type": "User",
"updated_at": "2026-07-22T17:07:20Z",
"description": "A merge queue for Forgejo and Gitea",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": null,
"name": "Evan Baker",
"type": "User",
"login": "rbtr",
"company": "@Microsoft @Azure ",
"location": "Cloud City",
"followers": 54,
"avatar_url": "https://avatars.githubusercontent.com/u/2940321?v=4",
"created_at": "2012-12-01T19:25:14Z",
"is_verified": null,
"public_repos": 55,
"account_age_days": 4986
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.9.0",
"kind": "minor",
"published_at": "2026-07-22T16:34:56Z"
},
{
"tag": "v0.8.0",
"kind": "minor",
"published_at": "2026-07-22T00:22:39Z"
},
{
"tag": "v0.7.0",
"kind": "minor",
"published_at": "2026-07-18T00:30:16Z"
},
{
"tag": "v0.6.0",
"kind": "minor",
"published_at": "2026-07-17T22:04:46Z"
},
{
"tag": "v0.5.0",
"kind": "minor",
"published_at": "2026-07-11T21:54:23Z"
},
{
"tag": "v0.4.1",
"kind": "patch",
"published_at": "2026-06-26T14:40:16Z"
},
{
"tag": "v0.4.0",
"kind": "minor",
"published_at": "2026-06-26T02:30:19Z"
},
{
"tag": "v0.3.0",
"kind": "minor",
"published_at": "2026-06-23T20:20:50Z"
},
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2026-06-22T17:51:38Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2026-06-21T17:21:06Z"
}
],
"recent_commits": [
{
"oid": "cad481de9c75a028874b31e04465c6765a61b438",
"body": "## What this changes\n\nAdds a per-managed-engine lifecycle wrapper (`managedEngine`) that\ncloses a stale-checkpoint-write race, and introduces bounded\ncross-engine concurrency via `SHUNT_MAX_CONCURRENT_RECONCILES` (default\n`1` — exact serial behaviour preserved).\n\n## The race this closes\n\n`Refresh()`\n[…]\nst -race ./internal/manager/...\n./internal/engine/...` — clean.\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "feat: per-engine lifecycle and bounded concurrent tick (#59)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-07-22T17:06:11Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e9646d616d99862fc78ff48e56835a6ab5ce6f56",
"body": "## Summary\n\nPromotes the [`[Unreleased]`](../blob/main/CHANGELOG.md) content to\n**v0.9.0** (2026-07-22) and fixes the comparison-link footer (missing\nv0.7.0 / v0.8.0 / v0.9.0 entries since the footer was last updated at\nv0.6.0).\n\n### Version choice\n\nv0.8.0 → **v0.9.0** (minor bump). The changes in t\n[…]\nease, push `ghcr.io/rbtr/shunt:0.9.0`, and push the Helm\nchart.\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Prepare v0.9.0 release (#58)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-07-22T16:33:05Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2c60bd9c7280c9f8a76dcb5c15775c043d581d64",
"body": "…ervability contract (#57)\n\n## Summary\n\nExtends the observability contract with three categories of additions,\nall backward-compatible.\n\n### 1. Per-batch phase tracking\n\nA durable `phase` field (and `phaseSince` timestamp) is added to the\nengine's `activeBatch` struct. Only phases observable between\n[…]\nnd\nnew `/status` fields\n- `CHANGELOG.md` — `[Unreleased]` entry\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "feat: add phase tracking, histograms, and safe config exposure to obs…",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-07-22T16:28:42Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d2cc08e161f16aaa6d962fcd4f77815903e88fae",
"body": "## Summary\n- release clarified merge queue feedback (sticky queue acknowledgements,\nretry/requeue vs terminal state distinction) as v0.8.0\n- update the Helm chart and README installation examples\n- fix the Kustomize base manifests, which had drifted to a stale `0.1.0`\nimage pin across the last seven\n[…]\nomize deploy/kustomize/base` (confirms rendered image\ntag)\n- `git diff --check`\n- independent rubber-duck review of the release diff\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>",
"is_bot": false,
"headline": "Prepare v0.8.0 release (#54)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-07-22T00:20:23Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "15895f1c1452943b20f9f26c957d8c9b60013ed1",
"body": "## Summary\n- CI's `govulncheck ./...` started failing on `main` after #53, flagging\n**GO-2026-5970** (infinite loop on invalid input) in\n`golang.org/x/text@v0.29.0`\n- the vulnerable path is `postgres.stdDB.ExecContext` →\n`sql.DB.ExecContext` → `norm.Form.*`, reached only because\n`jackc/pgx/v5@v5.10.\n[…]\nthe dependency + CHANGELOG diff\n\nOnce merged, I'll rebase #54 (release-v0.8.0) on top so the Security\nentry ships as part of v0.8.0.\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>",
"is_bot": false,
"headline": "Fix govulncheck: bump golang.org/x/text to v0.39.0 (#55)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-07-22T00:10:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e09f387e92cdcf3ad71b550abe66d133accb9039",
"body": "## Summary\n- acknowledge queued auto-merge requests before staging\n- distinguish retry, requeue, and terminal states in sticky queue\ncomments\n- document the separate sticky-status and durable-outcome comment types\n\n## Validation\n- `make lint test build`\n- `GOTOOLCHAIN=go1.25.12 go test -race ./...`\n- independent comment-lifecycle review\n\n---------\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>",
"is_bot": false,
"headline": "Clarify merge queue feedback (#53)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-07-21T23:51:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "42b9b66ac7ed81d8ede5348592aed8ac642bc9d6",
"body": "## Summary\n- release outage resilience and replica-safe queue ownership as v0.7.0\n- update the Helm chart and README installation examples\n\n## Validation\n- `helm lint charts/shunt`\n- `git diff --check`\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>",
"is_bot": false,
"headline": "Prepare v0.7.0 release (#52)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-07-17T23:57:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6444352bdc81aa54d42d39915c9b22947203a145",
"body": "## Summary\n- acquire a queue lease before reconciliation, with durable Postgres\nownership for multi-replica deployments\n- safely reload durable queue state after lease handoff and bound\nlease-held work below the TTL\n- keep Forge outage/rate-limit cooldowns quiet while retaining local\nqueue observabi\n[…]\nake lint test build`\n- `GOTOOLCHAIN=go1.25.12 go test -race ./...`\n- independent correctness and security-focused reviews\n\n---------\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>",
"is_bot": false,
"headline": "Enforce queue ownership with durable leases (#51)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-07-17T23:55:02Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ecaa390b36e29ddafd1b9ed02dc49de97732835f",
"body": "## Summary\n- add durable queue-lease storage with atomic acquire, renewal, and\nexpired takeover\n- add an ordered embedded migration and focused persistence coverage\n\n## Validation\n- `make lint test build`\n- independent correctness review\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>",
"is_bot": false,
"headline": "Add Postgres queue lease primitive (#50)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-07-17T23:47:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d8cae6562a0257965a0c504fa2f44f92b175a70c",
"body": "## Summary\n- add safe-read retries, shared request throttling, and\noutage/rate-limit circuits\n- probe Forge health before resuming normal requests\n- expose validated runtime resilience configuration\n\n## Validation\n- `make lint test build`\n- independent correctness review\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>",
"is_bot": false,
"headline": "Add resilient Forge API client (#49)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-07-17T23:47:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "676f0f837bce381ee1b7cffbce0bf0cd178252ab",
"body": "## Summary\n- publish native auto-merge landing, recovery, and least-privilege\nbranch protection as v0.6.0\n- update Helm chart metadata and documented image/chart install versions\n- finalize changelog comparison links\n\n## Validation\n- make helm-lint\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>",
"is_bot": false,
"headline": "Prepare v0.6.0 release (#48)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-07-17T22:02:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "862503668b463daa947675bf17fbee59cbf26f3b",
"body": "Fixes git askpass, updates docs\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>",
"is_bot": false,
"headline": "Restore askpass credential handling (#47)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-07-17T21:55:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "de17f922379c5b82746527c419ea3c45f0cddce0",
"body": "Fixes #45 \nLets forgejo merge queued PRs instead of shunt directly merging.\nMaintains queue order by writing each successful PR check individual,\nwaiting for completed merge, then writing the next check in the stack.\nStops reprocessing invalid event so shunt doesn't loop forever on PR\nstatus data races.\n\n---------\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>",
"is_bot": false,
"headline": "Fix automerge race (#46)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-07-17T21:26:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2238756f0469d2cf346b90c6e383874dd6405084",
"body": "## Summary\n- publish the immutable staging-branch protection and active-head\nrestack changes as v0.5.0\n- bump the Helm chart and README install examples to 0.5.0\n- finalize changelog comparison links\n\n## Validation\n- make lint test build\n- helm lint charts/shunt\n\n---------\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>",
"is_bot": false,
"headline": "Prepare v0.5.0 release (#43)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-07-11T21:52:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "408e70aefbd5d5eed8c9fb7d8816bd216fed4779",
"body": "## Summary\n- use fresh immutable `mq/<base>/staging-*` refs for every staging\nattempt\n- stop force-pushing/deleting shunt staging refs and remove startup\nstaging-pruning\n- add exact bot-only protection for `mq/<base>/staging*` refs in single-\nand multi-repo setup\n\n## Validation\n- `make lint test bui\n[…]\nindependent code-review pass\n- independent security-review pass\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Protect immutable staging branches (#42)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-07-11T17:05:02Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f00163af65ba81337316d8e742d9bed925d89b42",
"body": "## Summary\n- restack active staging batches when a queued PR head SHA changes\n- guard stale terminal failures and first-PR staging conflicts from\nbouncing updated heads\n- subscribe managed webhooks to `pull_request_sync` and wake on PR\nupdate events\n- document the restack behavior\n\n## Validation\n- g\n[…]\nacksIfHeadChangesDuringBounce'\n-count=1\\n- make lint test build\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Restack active batches when PR heads change (#41)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-28T23:50:24Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "521eb1cc47aeb44aed5b78de5cd26e221e00916f",
"body": "## Summary\n- move the managed webhook adoption fix into the v0.4.1 changelog\n- bump README install examples and Helm chart metadata to 0.4.1\n- add the README hero image asset\n\n## Validation\n- make lint test build\n- helm lint charts/shunt\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Prepare v0.4.1 release (#40)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-26T14:38:37Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "356c4d572553f7b0f6fb3e21e552ae7c1fb20515",
"body": "## Summary\n- treat Forgejo and Gitea JSON repository hook types as equivalent for\nmanaged webhook adoption\n- add a regression test for same-URL `forgejo` hooks so shunt PATCHes\ninstead of POSTing a duplicate\n- clarify managed webhook docs and changelog entry\n\nFixes #38\n\n## Validation\n- go test ./int\n[…]\nforge -run 'TestEnsureWebhook' -count=1\\n- make\nlint test build\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Adopt Forgejo-typed managed webhooks (#39)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-26T05:08:25Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3cfbbda1b377a3a608d5c67c4bedf74635d810f3",
"body": "Finalize v0.4.0 release notes and version references.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Prepare v0.4.0 release",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-26T02:28:25Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "87dafc6b87698f013d4b9fc3b2262964b73d0698",
"body": "## Summary\n- add SHUNT_POSTGRES_DSN runtime support for the existing Postgres\ncheckpoint store\n- apply the embedded shunt_queue_state migration at startup before use\n- reject simultaneous SHUNT_STATE_PATH and SHUNT_POSTGRES_DSN\nconfiguration\n- add bounded database pool settings and startup ping/migr\n[…]\nlm lint charts/shunt\n- independent database/runtime review pass\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Wire Postgres checkpoint storage (#36)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-25T15:13:28Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6a677c4273d8be38e0c02420ed1f1ad31bd2dcba",
"body": "## Summary\n- add /status.html as a small human-readable page for the existing\nprocess-local queue status snapshot\n- keep /status as the JSON contract and reuse the same safe queue\nidentity/PR-number data\n- add tests for route wiring, content type, rendered queue details, and\nHTML escaping\n- update R\n[…]\nv1.4.0 ./...\n- helm lint charts/shunt\n- independent review pass\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add human-readable queue status page (#35)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-25T14:36:27Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c5f7a7f4c08173172e4f8e51ac9e90d2c2b926e1",
"body": "## Summary\n- add a default-suite burn-in test that uses a real temporary git\nrepository and the production git staging implementation\n- drive a multi-PR batch through gate failure, bisection, bad-PR bounce,\nand good-PR landings\n- harden the test against inherited host Git config such as GPG signing,\n[…]\nv1.4.0 ./...\n- helm lint charts/shunt\n- independent review pass\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add local merge queue burn-in coverage (#34)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-25T14:25:31Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0a27efe02d445742645a4f6116cf4839fcbe4539",
"body": "## Summary\n- add process-local oldest queue age gauge and time-in-queue histogram\nmetrics\n- wire engine observations for merged, bounced, and dropped PRs\n- update README/design/roadmap/changelog for the new observability and\npersistence limits\n\n## Validation\n- make lint test build\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add queue age and time-in-queue metrics (#18)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-25T13:58:36Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "1781951f0ce6b3ca6aba76e1e9dac8fd055e9a67",
"body": "## Summary\n- document minimum bot token permission categories for current shunt\nbehavior\n- clarify runtime secret-storage and public URL guidance\n- mark least-privilege token guidance complete in the roadmap\n- refresh the live forge integration harness for the context-aware\nclient API\n\n## Validation\n- git diff --check\n- make lint test build\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Document least-privilege bot token guidance (#14)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-25T05:55:24Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "12c42f2cac0af5328a70d924bdd1a41df2b89a55",
"body": "## Summary\n- add `/status` JSON queue snapshot endpoint alongside `/healthz`,\n`/metrics`, and `/webhook`\n- report safe process-local queue identity, depth, active/pending\nPR-number batches, and active-batch presence without exposing internal\nstaging details\n- refresh observability docs, metrics help\n[…]\nnt test build`\n- removed generated `shunt` binary before commit\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add queue status endpoint (#17)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-25T05:54:34Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "09e95659885fbfd6452e7a8c96a427e79f61070c",
"body": "## Summary\n- add a Postgres-backed implementation of the merged engine checkpoint\nboundary in internal/checkpoint/postgres\n- include an embedded Postgres migration for shunt_queue_state\n- keep bbolt checkpoint JSON compatibility pinned while using\nPostgres-specific JSON DTOs for snake_case JSONB\n- d\n[…]\nv1.4.0 ./...\n- helm lint charts/shunt\n- independent review pass\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add Postgres queue state foundation (#22)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-25T04:51:31Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "afd23dbe9d8ebcae327d3e3622c91a47f7ef3741",
"body": "## Summary\n- add an env-gated live Forgejo/Gitea integration harness for the forge\nclient\n- document required and optional harness environment variables\n- update the roadmap to mark forge client integration coverage as\navailable while end-to-end burn-in remains manual\n\n## Validation\n- SHUNT_FORGE_IN\n[…]\nnt=1 -v\n- make lint test build (removed generated shunt binary)\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add forge integration test harness (#21)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-24T20:04:28Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "619a2e15608139411cd984fc66a20bc25b9b3979",
"body": "## Summary\n- add root-context shutdown and graceful HTTP server shutdown\n- propagate context through reconcile, checkpoint, forge API, and git\nstaging operations\n- replace freeform daemon logs with stdlib slog JSON and stable\ncomponent/repo fields\n- raise the minimum Go/toolchain baseline to 1.25\n- \n[…]\n\n- independent code review/rubber-duck pass\n\nStacked on PR #23.\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Harden Go daemon lifecycle and logging (#33)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-24T20:03:24Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "93c0d4ef550ad14abeaa2c203198d5a8750460cc",
"body": "## Summary\n- add consumer-side engine checkpoint hooks for queue snapshots\n- keep snapshot DTOs in neutral internal/checkpoint and the default\nbbolt implementation in internal/checkpoint/bolt\n- save pending candidates, active batch metadata, linger state, and\nbisection counters\n- wire SHUNT_STATE_PA\n[…]\ne imports engine; engine\nowns the consumer-side store interface\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add engine queue checkpoint hooks (#23)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-24T19:46:59Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "dc3a4829e96dfe89fba7848cb5c3983774653a3c",
"body": "## Summary\n- document the Forgejo run-level readiness fix in the changelog and\nroadmap\n- update the example mq gate workflow to allow multi-job gates with run\naggregate status\n- remove stale roadmap wording about per-repo overrides still being\npending\n \n# Validation\n- git diff --check\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: update run readiness guidance (#32)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-24T15:32:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8978b3933e97125ff00fd2eec30e971d890aa406",
"body": "## Summary\n- read Forgejo Actions run-level aggregate status for mq staging\nbranches before considering a batch terminal\n- fall back to task aggregation only when the run endpoint is\nunavailable\n- avoid overwriting a successful source-head merge-queue status when\nForgejo already completed the PR mer\n[…]\neview agent: no significant issues found after follow-up review\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Fix Forgejo merge queue run readiness (#31)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-24T15:07:21Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3a908baffc7de6431be11d4ef38d6cdba9fedbaf",
"body": "## Summary\n- add `SHUNT_WEBHOOK_URL` so shunt can create/update matching repo\nwebhooks with its existing admin token\n- wire managed webhooks through single-repo and topic discovery paths\n- document the config and update examples/Helm/Kustomize\n\n## Validation\n- make lint test build\n\nSigned-off-by: Evan Baker <rbtr@users.noreply.github.com>\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add managed repository webhook setup (#29)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-24T00:37:06Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "32744f72ea64d927b79e814cc297353af923a105",
"body": "## Summary\n- add source-PR terminal feedback for landed, bounced, skipped/requeued,\nand merge-error outcomes\n- set failed/error source-head statuses for rejected or skipped PRs and\ninclude staging run/commit links\n- update sticky queue comments for terminal states when enabled while\nstill posting du\n[…]\nnd add engine/forge tests\n\n## Validation\n- make lint test build\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Propagate queue outcomes to source PRs (#30)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-24T00:34:17Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4b7783190556da3d58b269d2d978475483bacc38",
"body": "## Summary\n- add v0.3.0 changelog notes for the merged operational hardening work\n- update roadmap/README version-facing status copy\n\n## Validation\n- git diff --check\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Prepare v0.3.0 release docs (#28)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-23T20:19:21Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "aae40651ddfa87a95a23762156b46f689a089fa9",
"body": "## Summary\n- add /webhook endpoint for Forgejo/Gitea events with optional\nshared-secret signature validation\n- wake reconciliation through a coalesced channel while retaining\npolling as a backstop\n- document webhook setup and update roadmap status\n\n## Validation\n- make lint test build\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add webhook wakeup support (#16)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-23T20:06:06Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "68acf850e0bf2b68e7863604d7181a5d1596e30d",
"body": "## Summary\n- add opt-in SHUNT_QUEUE_COMMENTS sticky PR queue-status comments with a\nstable marker and update-in-place behavior\n- show base, position, state, and active batch details while avoiding\nrepeated writes through process-local caching\n- document the setting and update README, ROADMAP, Helm, \n[…]\nnd\nexamples\n\n## Validation\n- make lint test build\n- rm -f shunt\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add opt-in queue status PR comments (#25)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-23T20:03:08Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6d8bd5c7d7169d86f2fc5bf4a2a778328d551341",
"body": "## Summary\n- treat Forgejo `/actions/tasks` rows as job-shaped tasks, not whole\nworkflow runs\n- aggregate all tasks from the newest matching `(head_sha, head_branch,\nrun_number, workflow_id)` before returning success\n- keep waiting while any matching job is blocked/running/waiting; fail\nif any match\n[…]\nthored-by: Copilot <223556219+Copilot@users.noreply.github.com>\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Aggregate Forgejo action task statuses (#27)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-23T19:16:46Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d772c5e027286a84f8fc6c9e519f492a14234980",
"body": "## Summary\n- add .shunt.yml parsing for per-repository queue overrides\n- read repo config through the Forgejo/Gitea raw file API and apply it\nin manager/single-repo setup\n- document the config file and mark the roadmap item complete\n\n## Validation\n- make lint test build\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add per-repository config overrides (#19)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-23T14:41:23Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "c56b8e9634bc174b2427121f447fce689b6d3616",
"body": "## Summary\n- list forge branches and prune shunt-owned stale staging branches for a\nmanaged base\n- run pruning before first reconciliation in single-repo and\ntopic-discovery modes\n- mark startup staging-branch GC complete in the roadmap\n\n## Validation\n- make lint test build\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Prune stale staging branches on startup (#15)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-23T14:24:54Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "76cf25c8f1f3607dab861f0539df61a8943bb41e",
"body": "Summary:\n- Document that shunt bot tokens need repo admin, not just write,\nbecause branch-protection APIs require admin access.\n- Clarify SHUNT_MERGE_STYLE must match enabled repo merge methods.\n- Warn that mq gate workflows should prefer one job or successful no-op\njobs instead of skipped terminal tasks.\n\nValidation:\n- git diff --check\n\nDocs: README.md, docs/design.md, examples/mq-gate.yml,\nexamples/.env.example\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: capture shunt operator gotchas (#26)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-23T14:24:03Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "0179f8f14c62f201d938c24feddf75a3593635b6",
"body": "## Summary\n- add v0.2.0 changelog entries for the merged post-launch feature set\n- update roadmap framing/priorities now that v0.2 work has landed\n- remove stale merge-commit-only limitation and update README status\nwording\n\n## Validation\n- git diff --check\n\nAfter this merges, v0.2.0 can be tagged/released from main.\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Prepare v0.2.0 release docs (#13)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-22T17:49:29Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "ac5deb57c416585ec59119a09e758aeb5f8c58ad",
"body": "## Summary\n- allow SHUNT_MERGE_STYLE=merge, squash, or rebase\n- normalize merge-commit aliases back to the Forgejo/Gitea merge API\nvalue\n- expand API/client and config tests for all supported merge methods\n- update README, design docs, env example, and roadmap\n\n## Validation\n- go test ./cmd/shunt ./\n[…]\ncked on #11 (`parallel-bisection`) while #9/#11 are still open.\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Support squash and rebase merge styles (#12)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-22T17:43:11Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e1eb19084fc37f30dbd25a829415ac5dab736691",
"body": "## Summary\n- add SHUNT_BISECT_FANOUT to run bisection subtrees concurrently\n- preserve ordered landing by blocking later results behind earlier\ncandidates\n- requeue speculative runs when an earlier landing advances the base\n- update docs, roadmap, examples, Helm, and Kustomize config\n\n## Validation\n\n[…]\nrics-endpoint`) to avoid conflicts while that PR is\nstill open.\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add configurable parallel bisection (#11)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-22T17:40:11Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "874dbfb4a91aabf0f4cd9209867280631074f44a",
"body": "## Summary\n- Add `/metrics` next to `/healthz` with dependency-free Prometheus text\nexposition.\n- Track per-queue depth/active batch gauges plus batches started, PR\nmerges, bounces, staging conflicts, reconcile errors, and terminal gate\noutcomes.\n- Wire metrics through single-repo and topic-managed \n[…]\nincluding active batch members and queued bisection candidates.\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add Prometheus metrics endpoint (#9)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-22T16:12:28Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f368a3df3f8e0cb81e3fef20fe95b0e03ff4ddc9",
"body": "## Summary\n- Add process-wide `SHUNT_BATCH_LINGER` and `SHUNT_BATCH_TARGET`\nsettings for accumulating ready PRs before seeding the first batch.\n- Preserve immediate batching by default (`SHUNT_BATCH_LINGER=0`,\n`SHUNT_BATCH_TARGET=0`) and keep bisection candidates immediate.\n- Wire the settings throu\n[…]\nmain\nfuture work.\n- Code review sub-agent reported no findings.\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add configurable batch linger window (#10)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-22T03:45:41Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f06d92524648434469c2fc0272a31799ba472670",
"body": "## Summary\n- Replace immediate singleton conflict retry with an order-preserving\nprefix/suffix split.\n- If staging conflicts after earlier PRs, test the prefix first, then\nretry the conflicting suffix on the real current base.\n- If the conflict is already first in a candidate, bounce that PR and\nreq\n[…]\n conflicts on the first PR in\na candidate still bounce that PR.\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Preserve queue order on staging conflicts (#8)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-22T03:18:44Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "74d64da88fd6f320baef2728ce71bf07911cc45d",
"body": "## Summary\n- Refetch each PR immediately before landing a passing batch.\n- Skip landing without setting success status when the PR is\nclosed/merged, auto-merge was cancelled, or the head SHA changed from\nthe tested SHA.\n- Pass the tested head SHA as `head_commit_id` to Forgejo/Gitea merge\nrequests s\n[…]\nand mid-merge\nhead drift is not merged successfully.\n\n---------\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Revalidate PR heads before gated merge (#7)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-22T02:23:56Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f0f765c657d1385708079be49d8bbb5abff50540",
"body": "## Summary\n- confirm stale ROADMAP release/package claims are absent on current\norigin/main\n- document the completed v0.1.0 release packaging in the changelog\n\n## Validation\n- git diff --check\n- checked ROADMAP.md for stale single-arch / multi-arch manifest claims\n\n## Docs\n- CHANGELOG.md\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Document v0.1.0 release packaging (#6)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-22T02:22:42Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "944fc019f68eb94748bd75ee9e2d372076919e48",
"body": "## Summary\n- pin GitHub Actions references to resolved commit SHAs\n- pin the Go builder image by digest and keep the git runtime digest pin\n- switch workflow runners from `ubuntu-latest` to `ubuntu-24.04`\n- use the exact `0.1.0` image tag in install examples and Kustomize\n- disable automatic `latest\n[…]\nining blocking mutable action/image ref\nissues\n\nDocs: README.md\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Pin release images and workflow actions (#5)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-21T17:19:31Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "86bae0dcbe6c30ad694cda634c96c835c1c5a0ea",
"body": "## Summary\n- keep bot tokens out of git subprocess environments and read git\ncredentials via a temp token file\n- stop reconciling repos removed from topic discovery or archived\n- URL-escape branch-protection API paths\n- avoid token-on-command-line guidance in the Kubernetes example\n\n## Validation\n- \n[…]\nss: no high-confidence findings\n\nDocs: examples/kubernetes.yaml\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Harden day-1 runtime behavior (#2)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-21T17:01:42Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a0e61341bffd6aed2de4d6e1d250815d82bdcecf",
"body": "## Summary\n- replace the Copilot session-state path in AGENTS.md with a generic\nworktree path placeholder\n\n## Validation\n- git diff --check\n\nDocs: AGENTS.md\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Remove local path from agent worktree docs (#3)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-21T17:01:25Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "f6695c5a5c4a4007d3552881bb4d978a9d2d824c",
"body": "## Summary\n- publish tag releases with downloadable binaries and checksums\n- publish multi-arch GHCR images and an OCI Helm chart on tag pushes\n- add a Helm chart and Kustomize base for Kubernetes installs\n- pin the runtime git image instead of using latest\n- document release/install options and kee\n[…]\niew pass: no vulnerabilities found\n\nDocs: README.md, ROADMAP.md\n\nCo-authored-by: Evan Baker <2940321+rbtr@users.noreply.github.com>\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Add release packaging and install artifacts (#4)",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-21T17:01:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "49e5172e93b0620226de2a7ee86c8a8a4c60a1f5",
"body": null,
"is_bot": false,
"headline": "shunt: a merge queue for Forgejo",
"author_name": "Evan Baker",
"author_login": "rbtr",
"committed_at": "2026-06-21T16:14:24Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 10,
"commits_last_year": 53,
"latest_release_at": "2026-07-22T16:34:56Z",
"latest_release_tag": "v0.9.0",
"releases_from_tags": false,
"days_since_last_push": 4,
"active_weeks_last_year": 5,
"days_since_latest_release": 5,
"mean_days_between_releases": 3.4
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 71,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "github.com/rbtr/shunt",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/rbtr/shunt",
"is_deprecated": false,
"latest_version": "v0.9.0",
"repository_url": "https://github.com/rbtr/shunt",
"versions_count": 10,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-22T16:33:05Z",
"latest_version_yanked": null,
"days_since_latest_publish": 5
}
]
},
"popularity": {
"forks": 0,
"stars": 2,
"watchers": 1,
"fork_history": {
"days": [],
"complete": true,
"collected": 0,
"total_forks": 0
},
"star_history": null,
"open_issues_and_prs": 1
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"examples"
],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"go.mod"
],
"largest_source_bytes": 75207,
"source_files_sampled": 27,
"oversized_source_files": 1,
"agent_instruction_files": [
".github/copilot-instructions.md",
"AGENTS.md"
],
"agent_instruction_max_bytes": 2891
},
"dependencies": {
"manifests": [
"go.mod"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [
{
"name": "golang.org/x/sys",
"direct": false,
"version": "v0.30.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5024"
],
"fixed_version": "0.44.0",
"advisory_count": 1,
"oldest_advisory_days": 66
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"unknown": 1
},
"advisory_count": 1,
"affected_count": 1,
"assessed_count": 11,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "github.com/jackc/pgx/v5",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v5.10.0"
},
{
"name": "go.etcd.io/bbolt",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.3.11"
},
{
"name": "gopkg.in/yaml.v3",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v3.0.1"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "github.com/jackc/pgx/v5",
"direct": true,
"version": "v5.10.0",
"ecosystem": "go"
},
{
"name": "go.etcd.io/bbolt",
"direct": true,
"version": "v1.3.11",
"ecosystem": "go"
},
{
"name": "gopkg.in/yaml.v3",
"direct": true,
"version": "v3.0.1",
"ecosystem": "go"
},
{
"name": "github.com/jackc/pgpassfile",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/jackc/pgservicefile",
"direct": false,
"version": "v0.0.0-20240606120523-5a60cdf6a761",
"ecosystem": "go"
},
{
"name": "github.com/jackc/puddle/v2",
"direct": false,
"version": "v2.2.2",
"ecosystem": "go"
},
{
"name": "github.com/kr/text",
"direct": false,
"version": "v0.2.0",
"ecosystem": "go"
},
{
"name": "github.com/rogpeppe/go-internal",
"direct": false,
"version": "v1.15.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sync",
"direct": false,
"version": "v0.21.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sys",
"direct": false,
"version": "v0.30.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/text",
"direct": false,
"version": "v0.39.0",
"ecosystem": "go"
}
],
"collected": true,
"truncated": false,
"total_count": 11,
"direct_count": 3,
"indirect_count": 8
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 53,
"open_issues": 1,
"closed_ratio": 0.667,
"closed_issues": 2,
"closed_unmerged_prs": 3
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "rbtr",
"commits": 53,
"avatar_url": "https://avatars.githubusercontent.com/u/2940321?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"release.yml"
],
"has_docs_dir": true,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 6,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 3,
"reason": "project has 1 contributing companies or organizations -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 10,
"reason": "all dependencies are pinned",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 10,
"reason": "SAST tool is run on all commits",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 4,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 0,
"reason": "Project has not signed or included provenance with any releases.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 9,
"reason": "1 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "cad481de9c75a028874b31e04465c6765a61b438",
"ran_at": "2026-07-28T07:45:46Z",
"aggregate_score": 4.9,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": true,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-28T04:42:37Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-22T17:06:12Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 44,
"created_at": "2026-07-17T13:44:14Z",
"last_comment_at": "2026-07-17T14:51:33Z",
"last_comment_author": "rbtr"
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/rbtr/shunt",
"host": "github.com",
"name": "shunt",
"owner": "rbtr"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 58,
"inputs": {
"security": 59,
"vitality": 69,
"community": 33,
"governance": 55,
"engineering": 71
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "moderate",
"name": "Vitality",
"value": 69,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"commits_last_year": 53,
"human_commit_share": 1,
"days_since_last_push": 4,
"active_weeks_last_year": 5
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 4 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 4
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "5/52 weeks with commits",
"points": 3.5,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 5
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "53 commits in the last year",
"points": 15.6,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 53
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"releases_count": 10,
"latest_release_tag": "v0.9.0",
"releases_from_tags": false,
"days_since_latest_release": 5,
"mean_days_between_releases": 3.4
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "10 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 10
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 5 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 5
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~3.4 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 3.4
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 33,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"forks": 0,
"stars": 2,
"watchers": 1,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "2 stars",
"points": 0,
"status": "missed",
"details": [
{
"code": "stars",
"params": {
"count": 2
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "0 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 0
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "1 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 1
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "good",
"name": "Community health",
"note": null,
"notes": [],
"value": 70,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 55,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 13,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "moderate",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 67,
"inputs": {
"merged_prs": 53,
"open_issues": 1,
"closed_issues": 2,
"issue_closed_ratio": 0.667,
"closed_unmerged_prs": 3
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "67% of issues closed",
"points": 31.2,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 67
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "53/56 decided PRs merged",
"points": 36.2,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 53,
"decided": 56
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 59,
"inputs": {
"followers": 54,
"owner_type": "User",
"is_verified": null,
"owner_login": "rbtr",
"public_repos": 55,
"account_age_days": 4986
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "54 followers of rbtr",
"points": 12.5,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 54,
"login": "rbtr"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "55 public repos, account ~13 yr old",
"points": 24.7,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 55
}
},
{
"code": "account_age_years",
"params": {
"years": 13
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"github.com/rbtr/shunt"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 5
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 5 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 5
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "10 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 10
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 71,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 68,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "2 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 2
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "good",
"name": "Documentation",
"note": null,
"notes": [],
"value": 75,
"inputs": {
"topics": [
"devops",
"forgejo",
"gitea",
"golang",
"merge-queue"
],
"has_wiki": false,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "5 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 5
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 59,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": null,
"notes": [],
"value": 49,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 18,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 0,
"scorecard_aggregate": 4.9
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 4.5,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "all dependencies are pinned",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is run on all commits",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 2,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "1 existing vulnerabilities detected",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 11 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories",
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 11
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 1,
"affected_packages": 1,
"assessed_packages": 11,
"unassessed_packages": 0,
"affected_by_severity": "unknown 1",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 11,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 2
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "good",
"name": "AI Readiness",
"value": 79,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "excellent",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 1,
"agent_instruction_files": [
".github/copilot-instructions.md",
"AGENTS.md"
],
"agent_instruction_max_bytes": 2891
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": ".github/copilot-instructions.md, AGENTS.md",
"points": 45,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".github/copilot-instructions.md, AGENTS.md"
}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "53 of 53 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 53,
"sampled": 53
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "good",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 81,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": true,
"typed_language": true,
"bootstrap_files": [
"Makefile"
],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0.755,
"toolchain_manifests": [
"go.mod"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "40 of the last 53 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 40,
"sampled": 53
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "all dependencies are pinned",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 98,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 75207,
"source_files_sampled": 27,
"oversized_source_files": 1
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "1/27 source files over 60KB",
"points": 53,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 27,
"oversized": 1
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "at_risk",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"example_dirs": [
"examples"
],
"has_mcp_signal": false,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "examples",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "examples"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-07-28T07:46:01.795499Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/r/rbtr/shunt.svg",
"full_name": "rbtr/shunt",
"license_state": "standard",
"license_spdx": "MIT"
}Bewertungen sind Signale, keine Garantien. Sie spiegeln öffentlich sichtbare Praxis auf GitHub wider — kein Code-Audit und keine Sicherheitsgarantie.
Fehlende Daten werden ausgeschlossen und die Gewichte neu normiert, nie als null bewertet. Die Methodik ist versioniert und offen: Metriken v1.13.0, Schema v0.27.0 — vollständige Methodik · Metriken-Wiki.
Wie ein einzelnes Ergebnis im Gesamtregister steht: aggregierte Statistiken — Go.