Public recordAt risk
Software health reportschema 0.27.0 · metrics 1.13.0 · 2026-07-27 18:10 UTC
DevonTM / osu-touch
Use your phone as a wireless osu! keypad.
DevonTM/osu-touch holds a health index of 40 out of 100, placing it in the At risk band. It scores highest on Vitality (65/100) and lowest on Community & Adoption (24/100). It was last updated 11 days ago. A single contributor accounts for most of its recent work.
40
overall / 100Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
40
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
Ownership
Irfan Ammar AfifPersonal account
6 followers25 public repossince Mar 2019
This repository is owned by a personal account. A single-owner project carries more continuity risk than an organization-backed one.
Package ecosystems
| Registry | Package | Version | Downloads / mo | Versions | Last publish |
|---|---|---|---|---|---|
| Go | github.com/DevonTM/osu-touch | v0.6.0 | - | 6 | 11 days ago |
Metrics by category
Vitality
Is the project alive — is code being written and are releases shipping?
65
Development activity
48At risk
How it's scored
| 28.8/36 | Push recency — last push 11 days ago |
| 2.1/36 | Commit cadence — 3/52 weeks with commits |
| 16.9/18 | Commit volume — 76 commits in the last year |
| 0/10 | OpenSSF Scorecard: Maintained — project was created within the last 90 days. Please review its contents carefully |
Inputs used
| commits_last_year | 76 |
| human_commit_share | 1 |
| days_since_last_push | 11 |
| active_weeks_last_year | 3 |
Release discipline
90Excellent
How it's scored
| 27/27 | Ships releases — 6 releases published |
| 36/36 | Release recency — latest release 11 days ago |
| 27/27 | Release cadence — a release every ~5.4 days |
| 0/10 | OpenSSF Scorecard: Signed-Releases — Project has not signed or included provenance with any releases. |
Inputs used
| releases_count | 6 |
| latest_release_tag | v0.6.0 |
| releases_from_tags | no |
| days_since_latest_release | 11 |
| mean_days_between_releases | 5.4 |
Community & Adoption
Does the project have users, downloads, attention, and a welcoming setup for contributors?
24
Popularity & adoption
1Critical
How it's scored
| 0/60 | Stars — 1 stars |
| 0/25 | Forks — 0 forks |
| 0/15 | Watchers — 0 watchers |
Inputs used
| forks | 0 |
| stars | 1 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community health
50Moderate
How it's scored
| 22.5/22.5 | README |
| 22.5/22.5 | License — recognized license (MIT) |
| 0/18 | CONTRIBUTING guide |
| 0/13.5 | Code of conduct |
| 0/7.2 | Issue template |
| 0/6.3 | PR template |
Inputs used
| has_readme | yes |
| has_license | yes |
| has_contributing | no |
| has_issue_template | no |
| has_code_of_conduct | no |
| has_pull_request_template | no |
Sustainability & Governance
Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?
35
Maintainer resilience (bus factor)
10Critical
How it's scored
| 9/54 | Bus factor — 1 contributor(s) cover half of all commits |
| 0/22.5 | Commit distribution — top contributor authored 100% of commits |
| 1.4/13.5 | Contributor breadth — 1 contributors |
| 0/10 | OpenSSF Scorecard: Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
Inputs used
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
Issue & PR responsiveness
1Critical
How it's scored
| 0/46.8 | Issue resolution — no issues or no data |
| 0/38.3 | PR acceptance — no decided pull requests or no data |
| 0/15 | OpenSSF Scorecard: Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
Inputs used
| merged_prs | 0 |
| open_issues | 0 |
| closed_issues | 0 |
| issue_closed_ratio | — |
| closed_unmerged_prs | 0 |
Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.
Ownership & stewardship
48At risk
How it's scored
| 10/30 | Ownership backing — personal (user) account |
| 0/20 | Verified domain — not applicable to user accounts |
| 6.1/25 | Owner reach — 6 followers of DevonTM |
| 22.3/25 | Track record — 25 public repos, account ~7 yr old |
Inputs used
| followers | 6 |
| owner_type | User |
| is_verified | — |
| owner_login | DevonTM |
| public_repos | 25 |
| account_age_days | 2,693 |
Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.
Package maintenance
100Excellent
How it's scored
| 25/25 | Published & resolvable — 1 package(s) on go |
| 35/35 | Publish recency — latest publish 11 days ago |
| 20/20 | Version history — 6 published versions |
| 20/20 | Not deprecated — active, not deprecated or yanked |
Inputs used
| packages | github.com/DevonTM/osu-touch |
| ecosystems | go |
| any_deprecated | no |
| min_days_since_publish | 11 |
Engineering Quality
Are baseline engineering and documentation practices in place?
42
Engineering practices
30At risk
How it's scored
| 24/24 | CI workflows — 1 workflow(s) |
| 0/24 | Tests present |
| 0/16 | Linter config |
| 0/9.6 | Pre-commit hooks |
| 0/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard: CI-Tests — no data |
Inputs used
| has_ci | yes |
| has_tests | no |
| has_editorconfig | no |
| has_linter_config | no |
| has_precommit_config | no |
Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.
Documentation
60Moderate
How it's scored
| 30/30 | README |
| 0/25 | Documentation directory |
| 0/15 | Documentation / homepage site |
| 10/10 | Repository description |
| 10/10 | Topics — 5 topics |
| 10/10 | Wiki |
Inputs used
| topics | osu, golang, web-application, touch-controller, osu-tools |
| has_wiki | yes |
| homepage | — |
| has_readme | yes |
| has_docs_dir | no |
| has_description | yes |
Security
Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?
28
Security posture
28Critical
How it's scored
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 0/2.5 | CI-Tests — no data |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
| 0/2.5 | Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | License — license file detected |
| 0/7.5 | Maintained — project was created within the last 90 days. Please review its contents carefully |
| 0/5 | Packaging — no data |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — no SAST tool detected |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — Project has not signed or included provenance with any releases. |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 7.5/7.5 | Vulnerabilities — 0 existing vulnerabilities detected |
Inputs used
| source | openssf_scorecard |
| checks_evaluated | 16 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 2 |
| scorecard_aggregate | 2.8 |
Excluded from scoring (no data or not applicable): ci_tests, packaging. Remaining weights renormalized.
AI Readiness
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
48
Agent context & guidance
40At risk
How it's scored
| 0/45 | Agent instructions — no CLAUDE.md / AGENTS.md / editor rules |
| 0/15 | Machine-readable docs (llms.txt) |
| 40/40 | Legible commit history — 69 of 76 human commits state their intent (structured subject or explanatory body) |
Inputs used
| has_llms_txt | no |
| legible_history_share | 0.908 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
How it's scored
| 12.6/18 | One-command bootstrap — go.mod (toolchain convention, no task runner) |
| 0/22 | Automated tests |
| 0/11 | Lint / format config |
| 11/11 | Static type checking — Go (statically typed) |
| 10/10 | Reproducible environment — lockfile |
| 0/10 | Demonstrated agent practice — no agent-authored commits among the last 76 |
| 0/8 | Automated maintenance — no automated dependency updates observed |
| 0/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
Inputs used
| has_nix | no |
| has_tests | no |
| lockfiles | go.sum |
| has_dockerfile | no |
| typed_language | yes |
| bootstrap_files | — |
| has_devcontainer | no |
| has_linter_config | no |
| typecheck_configs | — |
| agent_commit_share | 0 |
| toolchain_manifests | go.mod |
| dependency_bot_commit_share | 0 |
Code legibility for models
100Excellent
How it's scored
| 45/45 | Type-checkable code — Go (statically typed) |
| 55/55 | Manageable file sizes — 0/12 source files over 60KB |
Inputs used
| primary_language | Go |
| largest_source_bytes | 9,744 |
| source_files_sampled | 12 |
| oversized_source_files | 0 |
Key facts
1GitHub stars
1contributors
76commits, last 12 months
11days since last push
6releases
1bus factor
0open issues
Gopackage ecosystems
Data collection warnings
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
More detail
OpenSSF Scorecard 2.8 / 10
2.8aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| n/a | CI-Tests | no pull request found |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/30 approved changesets -- score normalized to 0 |
| 0 | Contributors | project has 0 contributing companies or organizations -- score normalized to 0 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 0 | Maintained | project was created within the last 90 days. Please review its contents carefully |
| n/a | Packaging | packaging workflow not detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | no SAST tool detected |
| 0 | Security-Policy | security policy file not detected |
| 0 | Signed-Releases | Project has not signed or included provenance with any releases. |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 10 | Vulnerabilities | 0 existing vulnerabilities detected |
Direct dependencies 4
| Registry | Package | Version constraint | Manifest |
|---|---|---|---|
| Go | github.com/coder/websocket | v1.8.15 | go.mod |
| Go | github.com/goccy/go-yaml | v1.19.2 | go.mod |
| Go | github.com/skip2/go-qrcode | v0.0.0-20200617195104-da1b6568686e | go.mod |
| Go | golang.org/x/sys | v0.47.0 | go.mod |
All dependencies not collected
The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [
"osu",
"golang",
"web-application",
"touch-controller",
"osu-tools"
],
"is_fork": false,
"size_kb": 137,
"has_wiki": true,
"homepage": null,
"languages": {
"Go": 24684,
"HTML": 16222,
"Python": 9744
},
"pushed_at": "2026-07-16T13:27:58Z",
"created_at": "2026-06-19T13:42:08Z",
"owner_type": "User",
"updated_at": "2026-07-16T13:28:17Z",
"description": "Use your phone as a wireless osu! keypad.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "Go",
"significant_languages": [
"Go",
"HTML",
"Python"
]
},
"owner": {
"blog": "https://ntr.my.id/",
"name": "Irfan Ammar Afif",
"type": "User",
"login": "DevonTM",
"company": null,
"location": "Indonesia",
"followers": 6,
"avatar_url": "https://avatars.githubusercontent.com/u/48514997?v=4",
"created_at": "2019-03-13T10:37:26Z",
"is_verified": null,
"public_repos": 25,
"account_age_days": 2693
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.6.0",
"kind": "minor",
"published_at": "2026-07-16T13:27:58Z"
},
{
"tag": "v0.5.0",
"kind": "minor",
"published_at": "2026-06-25T13:18:51Z"
},
{
"tag": "v0.4.0",
"kind": "minor",
"published_at": "2026-06-24T13:34:24Z"
},
{
"tag": "v0.3.0",
"kind": "minor",
"published_at": "2026-06-21T16:24:22Z"
},
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2026-06-20T14:45:58Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2026-06-19T14:20:45Z"
}
],
"recent_commits": [
{
"oid": "a42c80eec4cc81055567b9f729b08e367d28a29c",
"body": null,
"is_bot": false,
"headline": "Bump app version to 0.6.0",
"author_name": "Irfan Ammar Afif",
"author_login": "DevonTM",
"committed_at": "2026-07-16T13:27:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3f91c8d0492e8fe484a21d5b1cf87dc29e7dc848",
"body": "Update connection and disconnection logs to refer to clients rather\nthan the WebSocket transport, making runtime output clearer.",
"is_bot": false,
"headline": "chore: simplify websocket connection log messages",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-07-16T13:22:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "56b0f70021cc2bf2c16eb4931c06eead6212e060",
"body": "Restrict touch input to the new central tap zone and update the web UI\nstyles for the single-zone layout.\n\nRefresh README wording so setup, pairing, and touch behavior docs match\nthe tap-zone interaction model.",
"is_bot": false,
"headline": "feat(web): add a centered tap zone for touch input",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-07-16T13:17:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6d0842bb74de76b871a090b954cfbf94b0e8be33",
"body": "Refresh go.mod and go.sum for the latest x/sys release to keep\nplatform syscall support current.",
"is_bot": false,
"headline": "chore(deps): update golang.org/x/sys module to v0.47.0",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-07-16T05:41:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0f81e455799d26d0b2325d8dee632013828eb4a2",
"body": "Update the Go version in go.mod to use the latest patch release.",
"is_bot": false,
"headline": "chore(go): bump Go toolchain from 1.26.4 to 1.26.5",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-07-16T05:39:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5f36d3374d7bdbd04c4806be32fd8341e9291531",
"body": "Bump the Go setup action in the release workflow from v6 to v7 to keep CI on the current maintained action version.",
"is_bot": false,
"headline": "ci: update release workflow to use actions/setup-go v7",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-07-16T05:38:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4fd3d763a0d3b39cfc0b71a7ae13235729244785",
"body": "Explain how Windows network profiles affect firewall prompts and phone connectivity. Add a limitations section covering expected latency sources and recommended LAN/Wi-Fi setup for more consistent input.",
"is_bot": false,
"headline": "docs: clarify firewall setup and network latency limits",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-26T08:42:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ce4e8e0ded1d459bed7dfb4b8d9ea0f3cfe4080e",
"body": "Explain that some Android/OEM gestures can hijack near-simultaneous\nthree-finger touches from idle before osu-touch receives normal browser\nevents. Distinguish this from alternating play handled by the touch guard\nand clarify the Xiaomi/Redmi/POCO workaround context.",
"is_bot": false,
"headline": "docs: clarify OS-level three-finger gesture conflicts",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-26T08:12:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2549b9c287b8b43aa6c12f3c8a1df987f2e91234",
"body": "Explain that osu-touch does not require a mobile app, extra hardware, or a\ndedicated keypad, and note quieter tapping as a practical use case.\n\nClarify why the touch surface alternates inputs instead of using fixed\nleft/right zones, and warn that accidental extra touches can affect key order.",
"is_bot": false,
"headline": "docs: clarify touch behavior and keypad use cases in README",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-26T07:44:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d013c5ec6e0b6716f76fa975c10a278581190771",
"body": null,
"is_bot": false,
"headline": "Bump app version to 0.5.0",
"author_name": "Irfan Ammar Afif",
"author_login": "DevonTM",
"committed_at": "2026-06-25T13:18:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "571e18f80be56fbfa239c9ef853e99096724d54a",
"body": "Update the README to explain session-scoped PIN reuse, WebSocket\nmessage size/type handling, low-bit mask behavior, and best-effort\nbrowser release events so the documented protocol matches runtime behavior.",
"is_bot": false,
"headline": "docs: clarify pairing PIN persistence and input messages",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-25T12:55:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dd9080d6a6de0af37620d6e5a5209a6bcb6c898f",
"body": "Update the startup log to say the app is waiting for a client to\nconnect rather than specifically a WebSocket client, making the message\nclearer for users following the pairing flow.",
"is_bot": false,
"headline": "chore: clarify waiting log message for client connection",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-25T12:35:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1380e19a17f3ecab10ab094350b7e25002e35793",
"body": "Add terminal QR code output for the first detected LAN URL so phones can open the client more easily. Keep logging all LAN URLs for multi-interface hosts, clarify pairing PIN behavior, and document QR fallback guidance.",
"is_bot": false,
"headline": "feat: print QR code for mobile browser connection setup",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-25T12:29:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a6560e8e5f80148c02c55a1b1a96db73a67002d0",
"body": "Remove the descriptive tagline from the startup log so the app only reports its name and version.",
"is_bot": false,
"headline": "chore(logging): simplify startup version log message",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-25T10:27:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e69fb0f59b1e68e3ad8dc4c8aa9b1653e487b869",
"body": "Add a README markdown renderer that generates a standalone HTML file\nduring release packaging, then bundle it with config and license files.\nIgnore generated README.html locally to keep release artifacts out of git.\n\nThis gives downloaded release archives an offline, readable copy of the\nproject documentation.",
"is_bot": false,
"headline": "feat(release): include offline README HTML in packages",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-25T10:19:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "58fc3238eada47a01f6da73280986acd455eae25",
"body": "Rename `default-config.yaml` to `config.default.yaml` and update the\nrelease workflow to package the new template name as `config.yaml`.",
"is_bot": false,
"headline": "chore(release): rename default config template",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-25T07:43:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f914d5bd13e1b7112e3c52f93781b66a74db781e",
"body": "Add a default configuration template and copy it into packaged release\narchives as config.yaml so users start with editable defaults.\n\nIgnore local generated config.yaml files and update README examples to\nmatch the bundled YAML format.",
"is_bot": false,
"headline": "chore(release): include default config in release archives",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-25T07:24:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ed39cbe9cb5f616a58c2eeccef44455ce772eb8a",
"body": "Replace environment variable configuration with `config.yaml` loading and automatic default file creation on startup.\n\nAdd `-config` support for custom config paths and document YAML settings for address, key bindings, and MIDI options so configuration is persistent and easier to edit.",
"is_bot": false,
"headline": "feat(config): add YAML file-based configuration support",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-25T07:02:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5c58b1572530a69ce66069858b2ecadefbd5b2a1",
"body": "Split README environment variable examples by Windows cmd and Linux bash usage. Add missing Linux examples for address and MIDI note configuration to make setup instructions clearer across platforms.",
"is_bot": false,
"headline": "docs: clarify platform-specific environment examples",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-25T05:20:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "79e18e914b5432ed8e3569ab10e5302ea4560baf",
"body": "Update Windows examples to use cmd code fences and invocation syntax.\nRemove the PowerShell-specific environment variable example to keep the\nREADME consistent with the documented Windows command prompt workflow.",
"is_bot": false,
"headline": "docs: clarify Windows commands use cmd syntax in README",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-25T05:03:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a125be42e1654d2643fb5a4f6d14c37472d22366",
"body": null,
"is_bot": false,
"headline": "Bump app version to 0.4.0",
"author_name": "Irfan Ammar Afif",
"author_login": "DevonTM",
"committed_at": "2026-06-24T13:33:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c8725369938f7d32b11790bc16a9a9d400c7173e",
"body": "Update the requirements to explicitly note that macOS support is unavailable because it has not been tested on Mac hardware.",
"is_bot": false,
"headline": "docs: clarify macOS is not currently supported",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-24T13:32:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "03e6da6e9be9e9d47be1fcac5f7e1bd433a4d941",
"body": "Add README guidance for using `-buildmode=pie` when building on Linux\nto match the release workflow while keeping it optional for local builds.",
"is_bot": false,
"headline": "docs: document optional Linux PIE build flag",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-24T13:26:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eeee8b7bd3b9246e0e9d9b351e6fae9bbab3c8ae",
"body": "Add `-buildmode=pie` to the release workflow Go build step so packaged binaries are position-independent, improving compatibility with hardened runtime and distribution requirements.",
"is_bot": false,
"headline": "ci(release): build release binaries as PIE artifacts",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-24T13:01:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ba8fc3cdeb79cfcea3acf96fe54c42f8a026582e",
"body": "Sort discovered LAN addresses before logging so common private ranges are\nshown first, with stable IPv4 ordering within each range. This makes the\nmost likely connection URLs easier to find.",
"is_bot": false,
"headline": "fix(network): prioritize common LAN IPs in server logs",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-24T10:59:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1239bbdbded80e4785bd72d9f018e444d24adef0",
"body": "Use the default `websocket.Accept` options instead of skipping origin\nverification, preventing unrestricted browser origins from connecting.",
"is_bot": false,
"headline": "fix(server): restore default WebSocket origin checks",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-24T10:07:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aa0ad53a47f96d1bcf6d00227c92eb580f7b5312",
"body": "Set X-Content-Type-Options and a restrictive Content-Security-Policy\non the index page to reduce content sniffing and resource injection\nrisk while still allowing required inline assets and WebSocket connections.",
"is_bot": false,
"headline": "fix(server): add security headers to index response",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-24T09:27:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a1d7ae602a40e26ec9d1e04da74770ff92e007bf",
"body": "Set a strict read limit on websocket connections to reduce exposure to oversized inbound messages.",
"is_bot": false,
"headline": "fix(server): limit websocket read size",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-24T09:14:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "03ae0af90a1a6d775bd8ae7637785a31934aef31",
"body": "Replace manual private IPv4 prefix checks with `net.IP.IsPrivate()` when listing LAN IPs, removing custom parsing logic and the unused `strings` import.",
"is_bot": false,
"headline": "refactor(network): use net.IP private address detection",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-24T08:00:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e3baa50f001254bcd4a0f9d9dbc4bc2b5d1b419d",
"body": "Add a contents section linking to the main README topics so users can\nquickly find setup, usage, protocol, platform notes, and licensing details.",
"is_bot": false,
"headline": "docs: add README contents for easier project navigation",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-24T07:54:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "829d82dd6bb867458d2cfba5f958c653410c1ff6",
"body": "Update README usage guidance to point users to GitHub Releases and explain how to launch the app on Windows and Linux, including console visibility for LAN URL and pairing PIN.",
"is_bot": false,
"headline": "docs: clarify release download and run instructions",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-24T07:44:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1abe02788b735956b7e4fbead7d62f10dc0c4f42",
"body": "Add known issues guidance for Android/OEM multi-finger gestures that\ncan interrupt browser touch streams, including Xiaomi screenshot gesture\nexamples and settings-based workarounds.",
"is_bot": false,
"headline": "docs: document phone multi-touch gesture conflicts",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-24T07:28:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c96542950dbadbf4134b18b999ee481cdc56227f",
"body": null,
"is_bot": false,
"headline": "Bump app version to 0.3.0",
"author_name": "Irfan Ammar Afif",
"author_login": "DevonTM",
"committed_at": "2026-06-21T16:22:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d656f5e92699b7177f63ea00a7d6839d84055fc7",
"body": "Update the README introduction to describe osu-touch as a phone-based two-key osu! controller and explain the basic setup flow, platform input modes, and no-install benefit.",
"is_bot": false,
"headline": "docs: clarify osu-touch phone keypad overview",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-21T15:59:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "408f0a1a709d787b42ce3c6890bda166f69c4443",
"body": "Update keyboard and MIDI note parsing to require comma-separated pairs,\nincluding the default keyboard mapping. This removes adjacent shorthand\nhandling and aligns README examples with the stricter config format.",
"is_bot": false,
"headline": "fix(config): require comma-separated input mappings",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-21T15:46:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d0dd2910d90f5a927f111307c49defaa89ed0452",
"body": "Simplify the pressed key visual state by removing transform scaling and heavier shadow/gradient transitions, replacing them with lighter opacity and color changes to reduce mobile GPU/CPU load and heat.",
"is_bot": false,
"headline": "perf(web): reduce touch key feedback rendering cost",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-21T15:06:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "67d1b4e8f9ddce80ad83178b97ec90af65f917f3",
"body": "Update the Windows `INPUT` struct to size and align its union payload correctly on both 32-bit and 64-bit builds. This prevents `SendInput` from rejecting `cbSize` with `ERROR_INVALID_PARAMETER`, and documents the expected layout sizes in the README.",
"is_bot": false,
"headline": "fix(input): use architecture-aware SendInput layout",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-21T14:06:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4fc27adf8e8190f733a0a46d713cbcb4cfaca0aa",
"body": "Adds Linux x86_64 support using osu! lazer MIDI input, updates release workflow packaging for Linux, and documents Linux runtime/build requirements.",
"is_bot": false,
"headline": "feat: add Linux MIDI backend and release builds",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-21T13:11:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "27b6d06dfc62b7d63540fb0d6f4ae877648c0df1",
"body": null,
"is_bot": false,
"headline": "Bump app version from 0.1.0 to 0.2.0",
"author_name": "Irfan Ammar Afif",
"author_login": "DevonTM",
"committed_at": "2026-06-20T14:44:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c31f49d5972d74949186806422cb09bf8ab274aa",
"body": "Add a release workflow artifact upload for generated zip packages so builds are retained in GitHub Actions, and use maximum zip compression for release archives.",
"is_bot": false,
"headline": "ci: upload release archives as workflow artifacts",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-20T14:42:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aa56f9b4ecf7c8f16cdcb76542b882c57c569a67",
"body": "Pre-render the embedded index template during startup and cache it in memory so requests can serve the prepared page directly, while failing fast on render errors.",
"is_bot": false,
"headline": "perf(server): pre-render index page at startup",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-20T14:33:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0dd5ba288ea4bc18580f879dd179fadd2f51696b",
"body": "Update README, startup logging, and WebSocket comments to refer to a mobile browser/smartphone instead of a phone, making the supported client context clearer.",
"is_bot": false,
"headline": "docs: clarify mobile browser client wording",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-20T14:18:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "94a87597afa7d42358950e2a0b2515ae08d7751c",
"body": "Add a 250ms delay to invalid `/auth` pairing PIN attempts so HTTP auth failure timing matches WebSocket auth and does not provide a faster guessing path.",
"is_bot": false,
"headline": "fix(auth): delay failed pairing PIN responses",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-20T14:08:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e9ac7463304c43be2a916aa60732051c41dc709",
"body": "Add a transient connecting status when a stored or submitted PIN starts a websocket connection, keeping startup reconnects from briefly flashing disconnected. Shorten the PIN check delay and preserve the connecting state until the connection succeeds or fails.",
"is_bot": false,
"headline": "feat(web): show connecting state during PIN reconnect",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-20T13:57:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6995f15f807203ec3ca289845efae2cd4e9ac127",
"body": "Normalize the LAN URL log output by removing extra padding so it matches the Local URL format and keeps server address logs consistent.",
"is_bot": false,
"headline": "chore: align LAN URL log formatting spacing",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-20T13:23:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "09b92d5aeffe834ddbc7d60ee4b504a681a83dbc",
"body": "Prevent duplicate PIN form submissions while an auth check is in progress, and keep the \"Checking...\" state visible for at least one second so validation feedback feels stable instead of flickering.",
"is_bot": false,
"headline": "fix(web): debounce PIN submission feedback",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-20T13:21:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3e277c91f44de7cc967ecc21bb052bbb9edc8114",
"body": "Add shared method validation for index, auth, and websocket routes so unsupported methods return 405 with an Allow header instead of being processed.",
"is_bot": false,
"headline": "fix(server): reject non-GET requests for HTTP handlers",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-20T11:47:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "517c62ffe584a6b5fb8bb10498ecd94f15b8c36e",
"body": "Add a no-store `/auth` endpoint for checking the startup pairing PIN before opening a WebSocket. Use it in the browser to reject invalid PINs early, distinguish expired sessions from transient connection failures, and avoid reconnect loops on auth errors.",
"is_bot": false,
"headline": "feat(auth): validate pairing PIN before WebSocket connect",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-20T11:37:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7f8937aa776851c368d9978cf2ef4d80c7b7369d",
"body": "Add startup PIN generation and require the browser client to include it\nwhen opening the WebSocket connection. This limits casual LAN access to\nthe touch control surface and refreshes authorization on each restart.",
"is_bot": false,
"headline": "feat: require pairing PIN for websocket access",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-20T09:05:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7a5416f46274a9ffac5ac2fea99775c212a82fd7",
"body": null,
"is_bot": false,
"headline": "Bump app version to 0.1.0",
"author_name": "Irfan Ammar Afif",
"author_login": "DevonTM",
"committed_at": "2026-06-19T14:19:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "34a69fa2ae580debc4a769a5b2957115d3b14676",
"body": "Ensure the input slice remains reachable until after the Windows SendInput\nsyscall completes, preventing the garbage collector from reclaiming or moving\nthe backing buffer while it is still in use.",
"is_bot": false,
"headline": "fix(input): keep SendInput buffer alive during syscall",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-19T14:12:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "61f8260488e411e3b288fabff58ee44345e44e29",
"body": "Add a GitHub Actions release workflow that builds Windows x86, x86_64, and arm64 archives on published releases, then uploads them as release assets.",
"is_bot": false,
"headline": "ci: add release workflow for Windows builds",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-19T14:05:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0d4cb423fb77ad698f1aec2cdd0ad583235019b0",
"body": "Update the Go module declaration and internal imports to use the canonical `github.com/DevonTM/osu-touch` path, ensuring builds resolve correctly outside the local module name.",
"is_bot": false,
"headline": "chore: use GitHub module path for osu-touch imports",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-19T13:50:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4cdb2a0542ee3f37ccec353b19212281d9f9857b",
"body": "Add an MIT license file and update the README to document the project’s licensing.",
"is_bot": false,
"headline": "docs: add MIT license",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-19T13:40:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cb241e63266d0ece20d30b43f12cafec67f2cd5b",
"body": "Add a README disclaimer clarifying the project is unofficial and that\nsynthetic keyboard input may carry policy or anti-cheat risk for users.",
"is_bot": false,
"headline": "docs: add osu! affiliation and usage risk disclaimer",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-19T13:31:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "038e3e74ab2f2e247b5122d2475705010a50e0c7",
"body": "Expand the README to document requirements, environment-based\nconfiguration, configurable input keys, updated touch behavior, and\nWebSocket protocol details.",
"is_bot": false,
"headline": "docs: update README with config and touch behavior",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-19T13:26:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7e30b3fbb7473ea6dc72e19368ad58dcb1ba41b6",
"body": "Reflow the footer hint HTML into separate lines so the touch\ninstructions and version span are easier to read and maintain.",
"is_bot": false,
"headline": "style(web): format footer hint markup for readability",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-19T12:43:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "239c49500ad21be9bbadf71303d2bcfc8397183c",
"body": "Set the `Server` header through middleware so all HTTP routes include the application name and version, instead of only the index handler.",
"is_bot": false,
"headline": "feat(server): add global server header middleware",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-19T12:26:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "91b1366737a53a566dbd8f626502f11371ca2bed",
"body": "Add the `v` prefix before the app version in the startup message so logged output matches the expected version format.",
"is_bot": false,
"headline": "fix: include version prefix in startup log",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-19T12:12:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fabe63b33fad57d079d44d8347612d1b4e495524",
"body": "Add app name and version to the index template data so the footer can display the running build. Also set the HTTP `Server` header to the same app/version identifier for clearer client and diagnostic visibility.",
"is_bot": false,
"headline": "feat(web): show app version in touch interface",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-19T12:10:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8a1f1d36ecb9ef498bce305a70fbca623fb30a04",
"body": "Log the app banner and input keys before server setup, use the listener address directly when binding, and make invalid key configuration messages clearly marked as warnings.",
"is_bot": false,
"headline": "chore: improve startup and config log messages",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-19T11:44:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "da97f18539fc03a94d81d7d018ae357e8c3f0785",
"body": "Add `OSU_TOUCH_KEYS` parsing to configure the two virtual input keys, replacing hardcoded Z/X handling with a reusable input controller. Render the selected key labels in the web UI and log the active bindings at startup.",
"is_bot": false,
"headline": "feat: support configurable osu input keys",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-19T10:59:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ffe31f169bda7249e8c4c54ba5ffa140dfd3b57d",
"body": "Add `OSU_TOUCH_ADDR` support with a default port and update URL logging to derive local/LAN addresses from the active listener, ensuring logs stay accurate for custom bind addresses.",
"is_bot": false,
"headline": "feat: allow configurable server bind address",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-19T10:15:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "56f1e8436dc76b14f9423a0992d7c09c6908cc31",
"body": "Move SendInput logic into a dedicated input package and keep console\ntitle handling in the main Windows package. Extract web server concerns\nfrom main so startup, logging, and shutdown flow stay focused and easier\nto maintain.",
"is_bot": false,
"headline": "refactor: split Windows input and web server handling",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-19T09:58:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "76a4e1cbff8d0c3c471fbdb7066b052c9e68510e",
"body": "Center key label content by wrapping key text in a vertical flex layout and removing negative letter spacing so large labels render more reliably.",
"is_bot": false,
"headline": "fix(web): center key label layout",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-19T08:55:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "89e334168febf386bd1ed83d4df9a9c4e40e3358",
"body": "Add an empty favicon data URI to prevent browsers from requesting a default favicon and generating unnecessary 404 noise.",
"is_bot": false,
"headline": "fix(web): suppress missing favicon request",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-19T08:40:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bf187cff3fc35e86bdfbb68b2dc76b22490bae64",
"body": "Rename touch cleanup and idle burst tracking helpers to better reflect their purpose, and add a comment explaining the multi-touch guard that prevents same-frame Z/X tap bursts.",
"is_bot": false,
"headline": "chore(web): clarify touch burst guard naming",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-19T08:33:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "decbdccd1880f972d07b140239bbbd6304f82521",
"body": "Update touch handling so each new active touch alternates between Z and X, while releasing the active pointer releases the current key. Add a short simultaneous-touch guard to avoid accidental double input bursts and update the on-screen hint to match the new behavior.",
"is_bot": false,
"headline": "fix(web): alternate touch inputs for Z/X controls",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-19T08:22:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1560b2541663d410639640811f3ef621cf6141c2",
"body": null,
"is_bot": false,
"headline": "fix: remove dot in some logs print",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-16T15:03:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f85007288f51d31b5970196ba315d128adf632e6",
"body": "…ibility",
"is_bot": false,
"headline": "fix: enhance hint display for touch instructions and improve text vis…",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-16T14:56:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4a05423ad0b9b486066267a2b3a140d52e435333",
"body": "…sistency",
"is_bot": false,
"headline": "fix: update header title to include exclamation mark for branding con…",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-16T13:35:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "41a7653844f0db97702e84c1472ac522f0e43382",
"body": null,
"is_bot": false,
"headline": "feat: implement console title setting and enhance server startup logging",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-16T13:32:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a72278de7a17e5b4553996e855f250a0aa92ceb6",
"body": "… struct alignment",
"is_bot": false,
"headline": "fix: update README for clarity on WebSocket behavior and adjust input…",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-16T13:20:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c9e8206fa8f08f5178921ba7cfe155348f9a189e",
"body": "…estures",
"is_bot": false,
"headline": "fix: enhance touch interaction handling and prevent default browser g…",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-16T13:10:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "12e05701cd32249cfe869a652bcad3e6a2e081f7",
"body": "Remove the startup log that printed Win32 INPUT struct layout details, keeping Windows input handling quiet during normal app usage.",
"is_bot": false,
"headline": "chore: remove Windows input layout debug logging",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-16T12:39:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f520b8bc248cc2b4ec7bb33e89ebb4d1ccc53a23",
"body": "…nt components",
"is_bot": false,
"headline": "initial commit: add core application files, including server and clie…",
"author_name": "DevonTM",
"author_login": "DevonTM",
"committed_at": "2026-06-16T12:38:40Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 6,
"commits_last_year": 76,
"latest_release_at": "2026-07-16T13:27:58Z",
"latest_release_tag": "v0.6.0",
"releases_from_tags": false,
"days_since_last_push": 11,
"active_weeks_last_year": 3,
"days_since_latest_release": 11,
"mean_days_between_releases": 5.4
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 42,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "github.com/DevonTM/osu-touch",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/DevonTM/osu-touch",
"is_deprecated": false,
"latest_version": "v0.6.0",
"repository_url": "https://github.com/DevonTM/osu-touch",
"versions_count": 6,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-16T13:27:07Z",
"latest_version_yanked": null,
"days_since_latest_publish": 11
}
]
},
"popularity": {
"forks": 0,
"stars": 1,
"watchers": 0,
"fork_history": {
"days": [],
"complete": true,
"collected": 0,
"total_forks": 0
},
"star_history": null,
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"go.mod"
],
"largest_source_bytes": 9744,
"source_files_sampled": 12,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"go.mod"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "github.com/coder/websocket",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.8.15"
},
{
"name": "github.com/goccy/go-yaml",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.19.2"
},
{
"name": "github.com/skip2/go-qrcode",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.0.0-20200617195104-da1b6568686e"
},
{
"name": "golang.org/x/sys",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.47.0"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 0,
"open_issues": 0,
"closed_ratio": null,
"closed_issues": 0,
"closed_unmerged_prs": 0
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "DevonTM",
"commits": 76,
"avatar_url": "https://avatars.githubusercontent.com/u/48514997?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": false,
"ci_workflows": [
"release.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": null,
"reason": "no pull request found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "no SAST tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 0,
"reason": "Project has not signed or included provenance with any releases.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 10,
"reason": "0 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "a42c80eec4cc81055567b9f729b08e367d28a29c",
"ran_at": "2026-07-27T18:10:15Z",
"aggregate_score": 2.8,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-16T13:29:01Z",
"oldest_open_prs": [],
"last_merged_pr_at": null,
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/DevonTM/osu-touch",
"host": "github.com",
"name": "osu-touch",
"owner": "DevonTM"
},
"metrics": {
"overall": {
"key": "overall",
"band": "at_risk",
"name": "Overall health",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"security": 28,
"vitality": 65,
"community": 24,
"governance": 35,
"engineering": 42
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "moderate",
"name": "Vitality",
"value": 65,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "at_risk",
"name": "Development activity",
"note": null,
"notes": [],
"value": 48,
"inputs": {
"commits_last_year": 76,
"human_commit_share": 1,
"days_since_last_push": 11,
"active_weeks_last_year": 3
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 11 days ago",
"points": 28.8,
"status": "partial",
"details": [
{
"code": "push_recency",
"params": {
"days": 11
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "3/52 weeks with commits",
"points": 2.1,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 3
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "76 commits in the last year",
"points": 16.9,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 76
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"releases_count": 6,
"latest_release_tag": "v0.6.0",
"releases_from_tags": false,
"days_since_latest_release": 11,
"mean_days_between_releases": 5.4
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "6 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 6
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 11 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 11
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~5.4 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 5.4
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "critical",
"name": "Community & Adoption",
"value": 24,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"forks": 0,
"stars": 1,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "1 stars",
"points": 0,
"status": "missed",
"details": [
{
"code": "stars",
"params": {
"count": 1
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "0 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 0
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "at_risk",
"name": "Sustainability & Governance",
"value": 35,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 10,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "critical",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"issue_resolution",
"pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 1,
"inputs": {
"merged_prs": 0,
"open_issues": 0,
"closed_issues": 0,
"issue_closed_ratio": null,
"closed_unmerged_prs": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "no issues or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_issues_or_data",
"params": {}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "no decided pull requests or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_decided_prs_or_data",
"params": {}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 48,
"inputs": {
"followers": 6,
"owner_type": "User",
"is_verified": null,
"owner_login": "DevonTM",
"public_repos": 25,
"account_age_days": 2693
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "6 followers of DevonTM",
"points": 6.1,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 6,
"login": "DevonTM"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "25 public repos, account ~7 yr old",
"points": 22.3,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 25
}
},
{
"code": "account_age_years",
"params": {
"years": 7
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"github.com/DevonTM/osu-touch"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 11
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 11 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 11
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "6 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 6
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "at_risk",
"name": "Engineering Quality",
"value": 42,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "at_risk",
"name": "Engineering practices",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_ci_tests"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 30,
"inputs": {
"has_ci": true,
"has_tests": false,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "1 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 1
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 60,
"inputs": {
"topics": [
"osu",
"golang",
"web-application",
"touch-controller",
"osu-tools"
],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "5 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 5
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "critical",
"name": "Security",
"value": 28,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "critical",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): CI-Tests, Packaging. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"ci_tests",
"packaging"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 28,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 2.8
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "no SAST tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "0 existing vulnerabilities detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 2
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "at_risk",
"name": "AI Readiness",
"value": 48,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.908,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "69 of 76 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 69,
"sampled": 76
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "at_risk",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 34,
"inputs": {
"has_nix": false,
"has_tests": false,
"lockfiles": [
"go.sum"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [
"go.mod"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "go.mod (toolchain convention, no task runner)",
"points": 12.6,
"status": "partial",
"details": [
{
"code": "toolchain_convention",
"params": {
"files": "go.mod"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 76",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 76
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 9744,
"source_files_sampled": 12,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/12 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 12,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-27T18:10:20.006760Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/d/DevonTM/osu-touch.svg",
"full_name": "DevonTM/osu-touch",
"license_state": "standard",
"license_spdx": "MIT"
}Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
How one result sits in the wider record: aggregate statistics — Go.