Jebel-Quant/rhiza holds a health index of 93 out of 100, placing it in the Exceptional band. It scores highest on Engineering Quality (100/100) and lowest on Community & Adoption (45/100). It was last updated 1 day ago. A single contributor accounts for most of its recent work.
93
overall / 100
Exceptional
Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean, calibrated against the distribution of the public record so bands carry percentile meaning; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At Risk ceiling of 34.
93
Exceptional93-100The record's top tier (≈ top 5%); essentially all checked criteria met
Excellent80-92Strong across the board; minor gaps
Good65-79Healthy; gaps are limited and manageable
Moderate50-64Acceptable with notable gaps; review recommended
Weak35-49Material weaknesses across several areas
At Risk20-34Significant weaknesses; adoption warrants caution
Critical1-19Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
The weighted overall 79 is calibrated to 93 on the published index scale (record calibration 2026-08-02).
Direct dependencies free of known advisories — no direct dependency carries a known advisory
25/25
Indirect dependencies free of known advisories — no indirect dependency carries a known advisory
0/40
No advisories left outstanding — no advisory carries a publication date
Inputs used
source
osv
advisories
0
affected_packages
0
assessed_packages
11
unassessed_packages
0
affected_by_severity
none
direct_affected_packages
0
Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the pypi:rhiza@0.18.0 runtime dependency closure — what installing the published package pulls in — 11 packages. Reachability is not analyzed.
How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight (4%): agent tooling is a real maintenance signal, but a repository with none can still reach 100/100.
Type-checkable code — Python without a type-check config
55/55
Manageable file sizes — 0/77 source files over 60KB
Inputs used
primary_language
Python
largest_source_bytes
38,502
source_files_sampled
77
oversized_source_files
0
Key facts
13GitHub stars
6contributors
1,746commits, last 12 months
1days since last push
100releases
1bus factor
2open issues
PyPIpackage ecosystems
Data collection warnings
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
More detail
Star and fork history 0 ★ / 5 ⇿
0Stars
5Forks
70Releases
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Major 0Minor 13Patch 56
OpenSSF Scorecard 8.7 / 10
8.7aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-31 09:59 UTC
The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Dependency advisories 0
Installing pypi:rhiza@0.18.0 pulls in 11 packages, direct and transitive: 0 carry known advisories, of which 0 are direct dependencies.
No known advisories affect the assessed dependencies.
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [
"ci-cd",
"configuration-templates",
"automation",
"code-quality",
"devcontainer",
"developer-tools",
"docker",
"github-actions",
"linting",
"mkdocs",
"pytest",
"python",
"ruff",
"template",
"uv",
"rhiza"
],
"is_fork": false,
"size_kb": 5769,
"has_wiki": true,
"homepage": "https://jebel-quant.github.io/rhiza/",
"languages": {
"Jinja": 516,
"Shell": 16129,
"Python": 429664,
"Makefile": 48136,
"Dockerfile": 3635
},
"pushed_at": "2026-07-30T03:29:50Z",
"created_at": "2025-12-13T13:54:17Z",
"owner_type": "Organization",
"updated_at": "2026-07-30T03:29:54Z",
"description": "A collection of reusable configuration templates for modern Python projects",
"is_archived": false,
"is_disabled": false,
"license_spdx": null,
"default_branch": "main",
"license_spdx_raw": "NOASSERTION",
"primary_language": "Python",
"significant_languages": [
"Python"
]
},
"owner": {
"blog": "https://jqr.ae",
"name": "Jebel Quant",
"type": "Organization",
"login": "Jebel-Quant",
"company": null,
"location": "United Arab Emirates",
"followers": 24,
"avatar_url": "https://avatars.githubusercontent.com/u/216716219?v=4",
"created_at": "2025-06-17T12:49:51Z",
"is_verified": null,
"public_repos": 25,
"account_age_days": 408
},
"license": {
"state": "custom",
"spdx_id": null,
"raw_spdx": "NOASSERTION",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v1.2.5",
"kind": "patch",
"published_at": "2026-07-30T03:35:51Z"
},
{
"tag": "v1.2.4",
"kind": "patch",
"published_at": "2026-07-29T16:14:35Z"
},
{
"tag": "v1.2.3",
"kind": "patch",
"published_at": "2026-07-29T13:37:09Z"
},
{
"tag": "v1.2.2",
"kind": "patch",
"published_at": "2026-07-20T10:41:20Z"
},
{
"tag": "v1.2.1",
"kind": "patch",
"published_at": "2026-07-17T05:19:48Z"
},
{
"tag": "v1.2.0",
"kind": "minor",
"published_at": "2026-07-16T13:56:12Z"
},
{
"tag": "v1.1.3",
"kind": "patch",
"published_at": "2026-07-10T14:45:52Z"
},
{
"tag": "v1.1.2",
"kind": "patch",
"published_at": "2026-07-10T06:16:53Z"
},
{
"tag": "v1.1.1",
"kind": "patch",
"published_at": "2026-07-09T08:49:33Z"
},
{
"tag": "v1.1.0",
"kind": "minor",
"published_at": "2026-07-09T06:14:21Z"
},
{
"tag": "v1.0.3",
"kind": "patch",
"published_at": "2026-07-08T03:58:16Z"
},
{
"tag": "v1.0.2",
"kind": "patch",
"published_at": "2026-07-06T11:19:32Z"
},
{
"tag": "v1.0.1",
"kind": "patch",
"published_at": "2026-06-30T06:09:19Z"
},
{
"tag": "v1.0.0",
"kind": "major",
"published_at": "2026-06-28T19:37:35Z"
},
{
"tag": "v0.19.9",
"kind": "patch",
"published_at": "2026-06-28T12:59:40Z"
},
{
"tag": "v0.19.8",
"kind": "patch",
"published_at": "2026-06-28T11:27:06Z"
},
{
"tag": "v0.19.7",
"kind": "patch",
"published_at": "2026-06-27T15:34:41Z"
},
{
"tag": "v0.19.6",
"kind": "patch",
"published_at": "2026-06-27T03:36:24Z"
},
{
"tag": "v0.19.5",
"kind": "patch",
"published_at": "2026-06-24T08:30:23Z"
},
{
"tag": "v0.19.4",
"kind": "patch",
"published_at": "2026-06-22T02:25:36Z"
},
{
"tag": "v0.19.3",
"kind": "patch",
"published_at": "2026-06-16T12:49:12Z"
},
{
"tag": "v0.19.2",
"kind": "patch",
"published_at": "2026-06-16T12:35:27Z"
},
{
"tag": "v0.19.1",
"kind": "patch",
"published_at": "2026-06-15T09:37:43Z"
},
{
"tag": "v0.19.0",
"kind": "minor",
"published_at": "2026-06-14T16:25:53Z"
},
{
"tag": "v0.18.10",
"kind": "patch",
"published_at": "2026-06-12T20:23:56Z"
},
{
"tag": "v0.18.9",
"kind": "patch",
"published_at": "2026-06-10T14:48:32Z"
},
{
"tag": "v0.18.8",
"kind": "patch",
"published_at": "2026-06-06T05:10:41Z"
},
{
"tag": "v0.18.7",
"kind": "patch",
"published_at": "2026-06-06T04:00:44Z"
},
{
"tag": "v0.18.6",
"kind": "patch",
"published_at": "2026-06-04T02:54:54Z"
},
{
"tag": "v0.18.5",
"kind": "patch",
"published_at": "2026-05-31T20:13:46Z"
},
{
"tag": "v0.18.4",
"kind": "patch",
"published_at": "2026-05-28T16:10:31Z"
},
{
"tag": "v0.18.3",
"kind": "patch",
"published_at": "2026-05-28T15:42:43Z"
},
{
"tag": "v0.18.2",
"kind": "patch",
"published_at": "2026-05-28T12:59:42Z"
},
{
"tag": "v0.18.1",
"kind": "patch",
"published_at": "2026-05-28T12:05:04Z"
},
{
"tag": "v0.18.0",
"kind": "minor",
"published_at": "2026-05-28T11:29:12Z"
},
{
"tag": "v0.17.0",
"kind": "minor",
"published_at": "2026-05-27T10:35:34Z"
},
{
"tag": "v0.16.0",
"kind": "minor",
"published_at": "2026-05-27T09:49:42Z"
},
{
"tag": "v0.15.3",
"kind": "patch",
"published_at": "2026-05-26T14:20:11Z"
},
{
"tag": "v0.15.2",
"kind": "patch",
"published_at": "2026-05-26T07:24:48Z"
},
{
"tag": "v0.15.1",
"kind": "patch",
"published_at": "2026-05-26T06:33:10Z"
},
{
"tag": "v0.15.0",
"kind": "minor",
"published_at": "2026-05-26T03:27:41Z"
},
{
"tag": "v0.14.0",
"kind": "minor",
"published_at": "2026-05-25T11:26:21Z"
},
{
"tag": "v0.13.3",
"kind": "patch",
"published_at": "2026-05-25T09:14:12Z"
},
{
"tag": "v0.13.2",
"kind": "patch",
"published_at": "2026-05-25T08:16:13Z"
},
{
"tag": "v0.13.1",
"kind": "patch",
"published_at": "2026-05-25T07:36:40Z"
},
{
"tag": "v0.13.0",
"kind": "minor",
"published_at": "2026-05-25T06:25:48Z"
},
{
"tag": "v0.12.0",
"kind": "minor",
"published_at": "2026-05-24T16:38:21Z"
},
{
"tag": "v0.11.0",
"kind": "minor",
"published_at": "2026-05-24T13:05:03Z"
},
{
"tag": "v0.10.9",
"kind": "patch",
"published_at": "2026-05-22T06:36:48Z"
},
{
"tag": "v0.10.8",
"kind": "patch",
"published_at": "2026-05-22T06:32:42Z"
},
{
"tag": "v0.10.7",
"kind": "patch",
"published_at": "2026-05-17T18:28:22Z"
},
{
"tag": "v0.10.6",
"kind": "patch",
"published_at": "2026-05-06T18:20:03Z"
},
{
"tag": "v0.10.5",
"kind": "patch",
"published_at": "2026-04-29T08:19:45Z"
},
{
"tag": "v0.10.4",
"kind": "patch",
"published_at": "2026-04-27T08:02:40Z"
},
{
"tag": "v0.10.3",
"kind": "patch",
"published_at": "2026-04-25T03:24:13Z"
},
{
"tag": "v0.10.2",
"kind": "patch",
"published_at": "2026-04-22T04:18:34Z"
},
{
"tag": "v0.10.1",
"kind": "patch",
"published_at": "2026-04-18T15:38:36Z"
},
{
"tag": "v0.10.0",
"kind": "minor",
"published_at": "2026-04-17T18:38:08Z"
},
{
"tag": "v0.9.5",
"kind": "patch",
"published_at": "2026-04-13T19:39:59Z"
},
{
"tag": "v0.9.4",
"kind": "patch",
"published_at": "2026-04-13T10:11:15Z"
},
{
"tag": "v0.9.3",
"kind": "patch",
"published_at": "2026-04-13T09:24:52Z"
},
{
"tag": "v0.9.2",
"kind": "patch",
"published_at": "2026-04-12T09:59:42Z"
},
{
"tag": "v0.8.22",
"kind": "patch",
"published_at": "2026-04-12T09:22:55Z"
},
{
"tag": "v0.9.1",
"kind": "patch",
"published_at": "2026-04-12T07:47:10Z"
},
{
"tag": "v0.9.0",
"kind": "minor",
"published_at": "2026-04-03T11:16:47Z"
},
{
"tag": "v0.8.21",
"kind": "patch",
"published_at": "2026-04-03T09:42:12Z"
},
{
"tag": "v0.8.20",
"kind": "patch",
"published_at": "2026-04-02T04:23:17Z"
},
{
"tag": "v0.8.19",
"kind": "patch",
"published_at": "2026-04-01T08:11:28Z"
},
{
"tag": "v0.8.18",
"kind": "patch",
"published_at": "2026-04-01T03:59:20Z"
},
{
"tag": "v0.8.17",
"kind": "patch",
"published_at": "2026-03-31T04:54:52Z"
},
{
"tag": "v0.8.16",
"kind": "patch",
"published_at": "2026-03-22T05:05:32Z"
},
{
"tag": "v0.8.15",
"kind": "patch",
"published_at": "2026-03-21T04:38:46Z"
},
{
"tag": "v0.8.14",
"kind": "patch",
"published_at": "2026-03-19T10:54:02Z"
},
{
"tag": "v0.8.13",
"kind": "patch",
"published_at": "2026-03-17T05:21:32Z"
},
{
"tag": "v0.8.12",
"kind": "patch",
"published_at": "2026-03-13T15:39:57Z"
},
{
"tag": "v0.8.11",
"kind": "patch",
"published_at": "2026-03-13T12:01:22Z"
},
{
"tag": "v0.8.10",
"kind": "patch",
"published_at": "2026-03-13T09:00:09Z"
},
{
"tag": "v0.8.9",
"kind": "patch",
"published_at": "2026-03-10T15:46:47Z"
},
{
"tag": "v0.8.8",
"kind": "patch",
"published_at": "2026-03-10T04:23:33Z"
},
{
"tag": "v0.8.7",
"kind": "patch",
"published_at": "2026-03-09T19:31:33Z"
},
{
"tag": "v0.8.6",
"kind": "patch",
"published_at": "2026-03-06T05:57:07Z"
},
{
"tag": "v0.8.5",
"kind": "patch",
"published_at": "2026-02-27T16:15:31Z"
},
{
"tag": "v0.8.4",
"kind": "patch",
"published_at": "2026-02-27T09:30:02Z"
},
{
"tag": "v0.8.3",
"kind": "patch",
"published_at": "2026-02-24T07:11:42Z"
},
{
"tag": "v0.8.2",
"kind": "patch",
"published_at": "2026-02-23T06:40:48Z"
},
{
"tag": "v0.8.1-rc.1",
"kind": "prerelease",
"published_at": "2026-02-16T12:01:10Z"
},
{
"tag": "v0.8.0",
"kind": "minor",
"published_at": "2026-02-15T20:50:54Z"
},
{
"tag": "v0.7.5",
"kind": "patch",
"published_at": "2026-02-14T04:44:22Z"
},
{
"tag": "v0.7.4",
"kind": "patch",
"published_at": "2026-02-14T02:58:09Z"
},
{
"tag": "v0.7.3",
"kind": "patch",
"published_at": "2026-02-14T02:40:05Z"
},
{
"tag": "v0.7.1",
"kind": "patch",
"published_at": "2026-02-07T13:58:36Z"
},
{
"tag": "v0.7.0",
"kind": "minor",
"published_at": "2026-02-05T21:55:29Z"
},
{
"tag": "v0.6.2",
"kind": "patch",
"published_at": "2026-02-02T19:08:23Z"
},
{
"tag": "v0.6.1",
"kind": "patch",
"published_at": "2026-01-26T21:23:05Z"
},
{
"tag": "v0.6.0",
"kind": "minor",
"published_at": "2026-01-16T18:01:03Z"
},
{
"tag": "v0.5.0",
"kind": "minor",
"published_at": "2026-01-03T14:04:37Z"
},
{
"tag": "v0.4.1",
"kind": "patch",
"published_at": "2026-01-01T12:16:49Z"
},
{
"tag": "v0.4.0",
"kind": "minor",
"published_at": "2025-12-26T06:23:13Z"
},
{
"tag": "v0.3.2",
"kind": "patch",
"published_at": "2025-12-25T02:10:47Z"
},
{
"tag": "v0.3.1",
"kind": "patch",
"published_at": "2025-12-24T07:56:55Z"
}
],
"recent_commits": [
{
"oid": "e5d7005e2d9fc3d5a23b96d13b203b4f2afe3cce",
"body": null,
"is_bot": false,
"headline": "chore: release v1.2.5",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-30T03:28:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4d3805c498086c9ad2b1d4b9f3e2b2931a83aee7",
"body": "… (#1447)\n\nThe composite action now lives in jebel-quant/actions, a repo dedicated to\nshared Actions building blocks, so it can be consumed by every Jebel-Quant repo\nrather than only by the one that happens to host it. All 16 live call sites and\nthe bundles/github release stub now point there; the l\n[…]\n# v1` comment to match how every third-party action in this\nrepo is pinned.\n\nCo-authored-by: Thomas Schmelzer <thomas.s@yukkalab.com>\nCo-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "refactor(github): consume configure-git-auth from jebel-quant/actions…",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-30T02:56:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b5ee2ae1e4807b77e7106965986b09523b8f1d34",
"body": null,
"is_bot": false,
"headline": "chore: release v1.2.4",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-29T16:03:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "758769249fe91b4502eed2fc31ab6e500a6954dd",
"body": "The live workflows pinned this repo's own composite action as\njebel-quant/rhiza/.github/actions/configure-git-auth@vX.Y.Z. A cross-repo ref\nmust resolve at `Set up job`, before checkout, so every release broke itself:\npushing the release commit published workflows referencing a tag that did not\nexis\n[…]\n/.rhiza/.cfg.toml, with a note that consumers must not glob their\nown workflow stubs: those pin rhiza's version, not the consumer's.\n\nCo-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(github): reference own composite action by local path (#1446)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-29T14:21:32Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a18d87ec4b51e071c8ed6edfa0cbc37d31c9ce58",
"body": null,
"is_bot": false,
"headline": "chore: release v1.2.3",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-29T12:52:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d02b8d94301cc2831eb4da35af8fb270ca90d989",
"body": "bump-my-version discovers .bumpversion.toml or pyproject.toml, not\n.rhiza/.cfg.toml, so `bump-my-version bump` reported \"No configuration file\nfound to update\" and rewrote nothing. Declare the locations here:\n\n- [project] version, anchored to the table so a [tool.*] table sharing the\n number is not\n[…]\nately excluded and regenerated with `uv lock`: a bare\nversion search would also rewrite python-dotenv, which sits at the same 1.2.2.\n\nCo-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: declare every version location for bump-my-version",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-29T12:50:55Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b199f8bec62797a4ef130b95f5bb04a6ebfd63c9",
"body": "…6.0 (#1442)\n\n* chore(deps): update pre-commit hook astral-sh/ruff-pre-commit to v0.16.0\n\n* fix: remove stale Ruff suppression in GitLab CI test\n\n---------\n\nCo-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>\nCo-authored-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>",
"is_bot": true,
"headline": "chore(deps): update pre-commit hook astral-sh/ruff-pre-commit to v0.1…",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-29T07:50:49Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "05775449aa90672441598e88d03c434cd75e3ab2",
"body": "…igest to 485af05 (#1441)\n\nCo-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>\nCo-authored-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>",
"is_bot": true,
"headline": "chore(deps): update gcr.io/oss-fuzz-base/base-builder-python docker d…",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-29T07:22:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "99da6ac1c99311e573948bd351ea182e99576cf5",
"body": "Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): lock file maintenance (#1445)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-29T07:13:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c31e3cf9246ccbf2ef5f4d87559401ce98aec431",
"body": "…0 (#1443)\n\nCo-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): update pre-commit hook astral-sh/uv-pre-commit to v0.12.…",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-29T06:49:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f20180d4089c5cfa3fb55e310d6ee6f6e7abdf73",
"body": "… (#1444)\n\nCo-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): update pre-commit hook betterleaks/betterleaks to v1.7.2…",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-29T06:32:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "28e7924f6badab6559d78b74e542704d0f3e0188",
"body": "…1439)\n\n* Initial plan\n\n* Remove Ruff target-version pin from core template\n\n---------\n\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "core: stop pinning Ruff target-version to py311 in synced template (#…",
"author_name": "Copilot",
"author_login": "Copilot",
"committed_at": "2026-07-28T16:56:38Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "fe2f685a90d6e0929412e418305d2dd3d4e35c21",
"body": "Bumps the github-actions group with 6 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.1` | `4.37.3` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.1` | `4.37.3` |\n| [docker/login\n[…]\n.\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>",
"is_bot": true,
"headline": "chore(deps)(deps): bump the github-actions group with 6 updates (#1437)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-28T06:44:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "dce01a6df22f07d456ee487500c70e36a2ae75e9",
"body": "…#1436)\n\nBumps the python-dependencies group with 1 update: [ty](https://github.com/astral-sh/ty).\n\n\nUpdates `ty` from 0.0.63 to 0.0.64\n- [Release notes](https://github.com/astral-sh/ty/releases)\n- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/ast\n[…]\nupdate:semver-patch\n dependency-group: python-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps-dev)(deps-dev): bump ty in the python-dependencies group (…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-28T06:15:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0dfca19678edd5948a3d2ef91ccdb290213f78b5",
"body": "Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): lock file maintenance (#1435)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-27T01:49:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cfe9b6f4fa4d556416c8c2770c35696dc662ea91",
"body": "List one trove classifier per supported Python version, clamped to the\nrange that requires-python actually admits, and drop the generic\n\"Programming Language :: Python :: 3\" / \":: 3 :: Only\" rows.\n\nCo-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore(pyproject): declare explicit Python version classifiers (#1434)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-25T19:10:49Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b9c7c944c5adb23ceca9a90e0037351cbdeb1985",
"body": "Bumps the github-actions group with 7 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [actions/checkout](https://github.com/actions/checkout) | `6.0.3` | `6.1.0` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.0` | `4.37.1` |\n| [github/codeql-action/analyze](\n[…]\nsion-update:semver-patch\n dependency-group: github-actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps)(deps): bump the github-actions group with 7 updates (#1431)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-21T18:19:44Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b61e8e671bb0e48377923c0ddc0f7ce5415b2260",
"body": null,
"is_bot": false,
"headline": "chore: release v1.2.2",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-20T10:32:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6ca1aeaae401159e99ff0e494f9a262cd7185f5f",
"body": "* chore: stop requiring deprecated License classifier\n\nPyPI has deprecated the `License ::` trove classifiers in favor of the\nSPDX `license` expression field, so the shipped pyproject test should no\nlonger insist on one.\n\n- Drop `test_license_classifier_present` from the tests bundle.\n- Remove the M\n[…]\nd-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nSigned-off-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: forbid deprecated License classifier in pyproject (#1430)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-20T08:04:36Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "10dd2ccd9e15e18d9c233022ff528fdd38761a32",
"body": "PyPI has deprecated the `License ::` trove classifiers in favor of the\nSPDX `license` expression field, so the shipped pyproject test should no\nlonger insist on one.\n\n- Drop `test_license_classifier_present` from the tests bundle.\n- Remove the MIT `License ::` classifier from the root pyproject.\n- Modernize the root `license` field to the SPDX string form (`\"MIT\"`).\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: stop requiring deprecated License classifier (#1429)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-20T06:11:56Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "ea6564ec64ed8ab40faf790909756e0b8cf2a27d",
"body": "Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): lock file maintenance (#1428)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-19T05:23:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5e5b4c332529027b8752afa133760ddd8e58bf1a",
"body": "Generated by rhiza-claude /rhiza:stats (scripts/stats.py).\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: add generated stats dashboard (#1427)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-18T04:22:24Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "498d00137884fc0f187b816c7b90572319c5372f",
"body": "Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): lock file maintenance (#1426)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-17T17:09:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "99cf49c23fb0df5ffe6f7cb837c2dda4cd1476d2",
"body": "Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>\nCo-authored-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>",
"is_bot": true,
"headline": "chore(deps): update dependency typer to v0.27.0 (#1425)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-17T14:11:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d962b771728ff176965265596c6ef7bfe6a15f81",
"body": "…29 (#1423)\n\nCo-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): update pre-commit hook astral-sh/uv-pre-commit to v0.11.…",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-17T14:10:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "77d273ed714e67067387448c3293527a271c15b3",
"body": "…5.22 (#1422)\n\nCo-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>\nCo-authored-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>",
"is_bot": true,
"headline": "chore(deps): update pre-commit hook astral-sh/ruff-pre-commit to v0.1…",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-17T14:02:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "636ccc604f340150091b24a3a827fa4de76e6f62",
"body": "…igest to 5a4612c (#1421)\n\nCo-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): update gcr.io/oss-fuzz-base/base-builder-python docker d…",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-17T13:49:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0b7585503b68fba10f10a07418f4c31e13fff590",
"body": "* Delete .rhiza/make.d/releasing.mk\n\nSigned-off-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>\n\n* test: complete removal of releasing.mk feature\n\nCommit 8d147fb deleted the root .rhiza/make.d/releasing.mk symlink but\nleft the bundle source, its test file, and doc references dangling,\nbreaking `ma\n[…]\nd-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nSigned-off-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Delete .rhiza/make.d/releasing.mk (#1419)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-17T07:46:54Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e0fe02300840e39fe75d19db2741e9a790f87794",
"body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: release v1.2.1",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-17T05:14:53Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "092071281d37f0ff54533d94cacc92fdc43999c8",
"body": "The reusable-workflow and configure-git-auth pins across the live\n.github/ workflows and the bundle stubs were stale (v0.18.6 / v0.19.9 /\nv1.1.3) — v1.2.0 was cut without refreshing them. Bump all 32 self-\nreferences to v1.2.1 so downstream consumers and the mother repo track\nthe release being published.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "ci: bump rhiza self-reference workflow and action pins to v1.2.1",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-17T05:13:23Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "7a906d2cf8c33d1d870ca7c7f5af3127f070c3ed",
"body": "Bump version 1.1.3 → 1.2.0 and add the CHANGELOG entry.\n\nHeadline: rhiza-tools is fully removed from the template and the CI\nPython-version matrix is now derived from pyproject classifiers by\nbuild-and-inspect-python-package (#1414, #1415, #1416). Also: sync/validate and\nreleasing de-CLI'd (#1408, #\n[…]\nndle removed (#1396), v* tags protected + required checks pinned (#1410).\n\nCo-authored-by: Thomas Schmelzer <thomas.s@yukkalab.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: release v1.2.0 (#1417)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-16T13:48:09Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "432b341b86d182c23a94daf48d1be22ad8f7e56a",
"body": "* chore: remove all rhiza-tools usage from the template\n\nrhiza-tools has been reduced to a single command; this removes every\n`uvx rhiza-tools` invocation from the Rhiza template and, per the\nretire-all-scanning decision, drops the dependency-vulnerability and\nsuppression gates.\n\n- CI Python matrix:\n[…]\nhored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Thomas Schmelzer <thomas.s@yukkalab.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: remove all rhiza-tools usage from the template (#1415)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-16T13:29:47Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f5c82ada9667303d85e66f7af2a28771d29fee32",
"body": "…udit, analyze-benchmarks) (#1416)\n\n* chore: drop suppression-audit make target (rhiza-tools usage)\n\nThe suppression-audit target's only body was a uvx \"rhiza-tools>=0.8.1\"\ncall. Remove the target (and its .PHONY entry) plus the now-orphaned\ntest that asserted on it, as part of winding down rhiza-to\n[…]\ndme` target (keeps the prose-drift gate\n green).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: remove rhiza-tools usage from make.d (suppression-audit, pip-a…",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-16T13:08:32Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "98d0fcfee4478bd410b25d94564f5d46a164decf",
"body": "* Initial plan\n\n* ci: derive matrix from BAIPP classifier output\n\n---------\n\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "ci: derive reusable Python matrix from BAIPP classifiers (#1414)",
"author_name": "Copilot",
"author_login": "Copilot",
"committed_at": "2026-07-16T10:59:02Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "20e5e93edc46f2b77bfa5d4e48e5578ac60ff1ca",
"body": "…de /release (#1411)\n\nVersion bumping and release tagging are now driven by the rhiza-claude\n`/release` command (bump pyproject.toml + regenerate CHANGELOG.md + tag\nlocally; push the tag to trigger rhiza_release.yml). rhiza-tools should\ncarry only headless CI/CD tools, so the developer-initiated bum\n[…]\npresentation, and completion scripts; point releasing at /release.\n\nRefs Jebel-Quant/rhiza-tools#327, Jebel-Quant/rhiza-tools#328.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: drop make bump/release targets — releasing moves to rhiza-clau…",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-15T11:54:22Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6502ddc565806e45bb7a30755d680d1bdbba3781",
"body": "…#1410)\n\n* security: pin required checks to GitHub Actions and protect v* tags\n\n- main-branch-protection: pin each required status check to the GitHub\n Actions app (integration_id 15368) so a same-named status from another\n app/integration cannot satisfy the merge gate.\n- tag-protection (new): tag\n[…]\n/rulesets/tag-protection.json: add (matches root)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "security: pin required checks to GitHub Actions and protect v* tags (…",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-14T09:49:48Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1b1e28061199c97ec6be748701e44c09c4c104e2",
"body": "* chore: de-CLI make sync/validate — drop the rhiza-cli dependency\n\nThe core make layer no longer shells out to `uvx \"rhiza==$VERSION\" ...`.\nInstead `make sync` and `make validate` runtime-fetch the stdlib scripts\nfrom a pinned rhiza-claude release and run them with `python3`:\n\n- add RHIZA_CLAUDE_RE\n[…]\nd-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nSigned-off-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: de-CLI make sync/validate — drop the rhiza-cli dependency (#1408)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-14T06:16:58Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "04bf907107ad4f7516c0a1a1bab6961f75960751",
"body": "Bumps the github-actions group with 6 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.19.4` | `2.20.0` |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.3` | `4.37.0` |\n| [github\n[…]\nsion-update:semver-minor\n dependency-group: github-actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps)(deps): bump the github-actions group with 6 updates (#1409)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-14T05:45:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "536f87395aa15d5deed65652508555cca6356c87",
"body": "Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>\nCo-authored-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>",
"is_bot": true,
"headline": "chore(deps): update dependency mypy to v2.3.0 (#1406)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-13T12:25:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6143997bd44682b4b7c4b05e2fc197534a0f39e0",
"body": "…5.21 (#1404)\n\nCo-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): update pre-commit hook astral-sh/ruff-pre-commit to v0.1…",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-13T12:21:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "468fb87d894f575d998dcfe8a94d519555c67a9a",
"body": "…28 (#1405)\n\nCo-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>\nCo-authored-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>",
"is_bot": true,
"headline": "chore(deps): update pre-commit hook astral-sh/uv-pre-commit to v0.11.…",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-13T12:04:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2a6526aa81b150ad09121ef2c14da4acdfdbff99",
"body": "Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): update dependency typer to v0.26.8 (#1407)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-13T10:35:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d74a64d01e892acadf058b68418f961bd52f2ffa",
"body": "…#1403)\n\nTemplate sync becomes on-demand only (`make sync` / `rhiza sync`); drop the\nwhole scheduled-sync feature:\n\n- delete the sync workflows: the reusable `.github/workflows/rhiza_sync.yml`,\n the GitHub stub (`bundles/github/...`), and the GitLab stub\n (`bundles/gitlab/.gitlab/workflows/rhiza_s\n[…]\nPAT section, and the\n GitLab COMPARISON/README/TESTING pages)\n\nDownstream repos drop their auto-sync workflow on their next sync.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: remove the automated rhiza_sync feature (sync is now manual) (…",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-13T10:20:25Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "852be33eeea7883de99d20eafd8793366c536629",
"body": "Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): lock file maintenance (#1402)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-13T05:44:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ea207ef06fe5eb8af7f1aa204c65f700c2f8ea82",
"body": "* Apply suggested fix to tests/utils/test_link_dogfood.py from Copilot Autofix\n\nCo-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>\nSigned-off-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>\n\n* Fix relink() signature and test to resolve lowes\n[…]\nail.com>\nCo-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Potential fix for 1 code quality finding (#1401)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-11T18:27:03Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a888fe7fe3536114c106cd1060ec92af6d956001",
"body": "… Copilot Autofix (#1400)\n\nSigned-off-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>\nCo-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "Apply suggested fix to tests/bundles/test_bundle_combinations.py from…",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-11T13:22:46Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "076ec264f17351264617f6132f31438e1566aea2",
"body": "* Initial plan\n\n* fix: apply requested safety and robustness diffs\n\n* fix: satisfy ruff TRY003 and 100% docstring coverage in link_dogfood tests\n\nMove the long AssertionError message to a variable (TRY003) and add\ndocstrings to the two nested monkeypatch stand-ins so interrogate reaches\n100%.\n\nCo-Au\n[…]\n: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>\nCo-authored-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Fix latent helper hazards and harden dogfood linking path (#1399)",
"author_name": "Copilot",
"author_login": "Copilot",
"committed_at": "2026-07-11T13:12:44Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "07036653ba795b5107712fcfcd60f501db868719",
"body": "Signed-off-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>\nCo-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "Fix for Module is imported more than once (#1398)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-11T13:07:22Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "a9b53ca68f6cf557e93b18429f708c91a9cb5189",
"body": "…d, git init commit, regex escape (#1395)\n\n* Initial plan\n\n* Fix Dockerfile CMD, CHANGELOG duplicate entry, lazy test sources, bundle names cache, NPX guard, git init commit, and regex escape\n\n* style: apply ruff autofixes (raw string prefix, dict comprehension formatting)\n\nCo-Authored-By: Claude Op\n[…]\n: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>\nCo-authored-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: Dockerfile CMD, CHANGELOG duplicate, lazy test sources, NPX guar…",
"author_name": "Copilot",
"author_login": "Copilot",
"committed_at": "2026-07-11T12:54:48Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "9b5c3b7ad4b2325d044c7f27e81331c058f29d06",
"body": "Signed-off-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>\nCo-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "Fix for Module is imported more than once (#1397)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-11T12:20:24Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "6186f35d243afc5812de35aeeefe5bb3076ef4f3",
"body": "Fully retire the `claude` bundle (already dropped from all profiles in\n#1392). It shipped Claude Code slash commands under `.claude/commands/`\nthat are no longer maintained here.\n\n- delete bundles/claude/ and the dogfooded root .claude/commands/\n- drop the claude bundle from .rhiza/template-bundles.\n[…]\nle path bundles/core/.rhiza/assets/.\n\nThe opt-in github/gitlab-quality-review bundles (headless claude CLI\nreview) are unaffected.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(bundles): remove the claude bundle and its slash commands (#1396)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-11T12:19:27Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "8e6a8d48b98db05a10b7da67d26fac7ed54508c8",
"body": null,
"is_bot": false,
"headline": "Chore: bump version 1.1.2 → 1.1.3",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-10T14:43:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "966aee3c134eae7a816b9cadf16737d9ab9b80f9",
"body": "* test(gitlab): validate GitLab CI templates without a GitLab host\n\nAdds tests/bundles/test_gitlab_ci.py, which assembles a gitlab-project (the\ndownstream sync closure) and exercises it three ways, closing the gap that let\nthe retired uv:*-bookworm image tag slip through GitHub-only CI:\n\n- test_pipe\n[…]\ns Schmelzer <thomas.schmelzer@gmail.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "test(gitlab): validate GitLab CI templates without a GitLab host (#1394)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-10T14:41:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "88d7e3e4d8437d7064de43fc09aa2610685e8c37",
"body": "* fix(gitlab): use valid uv image tag 0.11.16-debian (was -bookworm)\n\nAstral no longer publishes OS-codename Docker tags (`-bookworm`) for uv\n0.11.16; the Debian image is now tagged `-debian`/`-trixie`. The old\n`ghcr.io/astral-sh/uv:0.11.16-bookworm` returns 404 on ghcr, breaking every\nGitLab CI job\n[…]\nfied the tag exists on\nghcr for python 3.11–3.14.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: repair stale uv Docker image tags (gitlab + docker bundles) (#1393)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-10T14:23:12Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "da1bd1ab14f64d98e885181ceba7687e290dd0a4",
"body": "…oject profiles (#1392)\n\nThe claude bundle (Claude Code slash commands) is no longer included by\ndefault in the local, github-project, and gitlab-project profiles. It\nremains a standalone bundle (requires: core) that projects can adopt\nexplicitly. Docs (README profiles table, BUNDLE_TAXONOMY) updated to match.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(bundles): drop claude bundle from local/github-project/gitlab-pr…",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-10T10:43:54Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "1c7aba62090f1d8e2a0cd0022862e800986669a1",
"body": "Adds a `make install-completions` convenience target that copies the\nbundled shell-completion scripts (.rhiza/completions/) into the user's\ncompletion directory, so `make <TAB>` works without manual setup.\n\n- New core fragment bundles/core/.rhiza/make.d/completions.mk (ships to\n consumers via the c\n[…]\nE; SHELL_KIND scoping).\n\nUses its own `##@ Shell Completion` help section to satisfy the\none-section-per-fragment structure guard.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(make): add install-completions target (#1391)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-10T09:01:32Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b0748ea2ac6b1b0e3bbf76470b717427cf22a289",
"body": null,
"is_bot": false,
"headline": "Chore: bump version 1.1.1 → 1.1.2",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-10T06:14:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "259a5e343e83789908a8c3d43962b2ac2897d90c",
"body": "…lf-test downstream (#1390)\n\n* fix(tests): standardize git_repo fixture on `main`; stop syncing its self-test downstream (#1388)\n\nThe shared `git_repo` fixture hardcoded `master` in three places (remote\nHEAD, local checkout, push), the one spot in the template that disagreed\nwith rhiza's `main` stan\n[…]\nd-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nSigned-off-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(tests): standardize git_repo fixture on main; stop syncing its se…",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-10T06:04:50Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4c1561d3f88e6ed455c49d72bc860eee4782f096",
"body": "The tests bundle shipped a self-contained, self-testing trio to every\nconsumer repo — the git_repo fixture (in conftest.py), its only consumer\ntest_git_repo_fixture.py, and test_utils.py (whose GIT export only the\nfixture used). None of it is usable by consumers: it exists purely to\ntest itself, so \n[…]\nres). Verified: relocated fixture test + bundle\nsuite pass (45 passed, 2 skipped); full tests/ tree collects cleanly\n(1341 tests).\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: stop shipping the git_repo fixture in the tests bundle (#1389)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-10T05:33:42Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "bb8e32006be6258ee8dcb4e3a9af47bed648fb8d",
"body": "The `dogfood-symlinks` job was gated by\n`if: github.repository == 'jebel-quant/rhiza'`, so in every downstream\nconsumer of this reusable workflow it could only ever appear as a\npermanently-skipped job — pure noise in their CI job list.\n\nIts invariant (root dogfood copies are byte-identical symlinks \n[…]\nRemoving the job keeps the drift guard where it belongs (the test suite)\nand stops leaking a skipped job into downstream projects.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "ci: drop mother-repo-only dogfood symlink guard from reusable CI (#1387)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-10T05:03:24Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a1a30d523526ce01bcf3b40b8c8a24b87be491e3",
"body": "… bundle (#1386)\n\nThe /rhiza_* Claude Code slash commands lived in the required `core` bundle\n(rhiza_quality, rhiza_release, rhiza_update) and the `book` bundle (rhiza_book),\nforcing .claude/commands/* onto every downstream consumer regardless of whether\nthey use Claude Code. That is inconsistent wi\n[…]\nts/ 1332 passed; .rhiza/tests/ 46 passed/1 skipped; sync-self-check\nclean; template-bundles.yml validates against its JSON schema.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(bundles): extract Claude Code commands into a dedicated `claude`…",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-10T04:48:18Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4474112f98e77161cf4d2ecbb0f909a96d07bb12",
"body": "Docs / discoverability:\n- Move the LFS bundle doc from .rhiza/docs/LFS.md to docs/lfs/LFS.md so it\n follows the same dogfood-symlink pattern as every other bundle doc and now\n appears in the book (added to the Development nav in mkdocs.yml). This\n changes where downstream consumers of the lfs bun\n[…]\nrise-sync / validate into a single parse-time IS_MOTHER_REPO\n variable, so the origin regex lives in one place and git runs once.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: relocate LFS doc into the book + dedup Makefile fragments (#1385)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-10T04:04:03Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "cc162bbe38291955e0aa5f3418c1bcfd10fbba24",
"body": null,
"is_bot": false,
"headline": "Chore: bump version 1.1.0 → 1.1.1",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-09T08:36:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d3d15a9e38c94077fc787a262086ffa9b3d3f729",
"body": "…dead template (#1383) (#1384)\n\n* Chore: bump version 1.0.3 → 1.1.0\n\n* test: add missing docstring to TestGitlabImagePinning._gitlab_ci_yml\n\nRestores docstring coverage to 100% (interrogate gate).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "refactor(gitlab-ci): single-source uv image, cross-job caching, drop …",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-09T08:26:42Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "c9178dbfd10c54310f9e0d2153e8400d0c210ed1",
"body": "…) (#1382)\n\n* fix: self-provision ty/mypy in typecheck target (#1381)\n\nThe `typecheck` target invoked `ty` and `mypy` with bare `uv run`, which\nonly runs a tool already present in the project environment — it does not\nauto-install. Neither checker is a declared dependency, so on a clean CI\nrunner (`\n[…]\ncommand shape and no longer found the substrings.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: self-provision ty/mypy in typecheck + harmonize GitLab CI (#1381…",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-09T07:57:27Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "94214b12ebb2747d52de8ab9e3601579495757f4",
"body": null,
"is_bot": false,
"headline": "Chore: bump version 1.0.3 → 1.1.0",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-09T06:10:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2e70e1069f3e3122457005272df6398feaf3db42",
"body": "…1380)\n\n`.rhiza/requirements/*.txt` (shipped via the core/tests/marimo bundles and\npip-installed by `make install`) overlapped and diverged from pyproject's\n`[dependency-groups]`, and — because the shipped Makefiles ran `uv run <tool>` —\nit silently provisioned every downstream consumer too. Replace\n[…]\nct.py`.\n\nVerified: make test (1304), rhiza-test (46), docs-coverage (100%), typecheck,\ndeptry, fmt all green; uv.lock regenerated.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "refactor: remove .rhiza/requirements; provision tooling on the fly (#…",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-09T06:09:34Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "9b39ef22575141c4e11209afa98032102c778c1f",
"body": "…o tests/ (#1379)\n\n* test: move rhiza-managed template tests out of the shipped bundle into tests/\n\nThe `.rhiza/tests` suite ships downstream via the `tests`/`github`/`lfs`\nbundles and runs in every consumer repo (`make rhiza-test`). Many of those\ntests only validate rhiza-managed template files — M\n[…]\n\n explicitly; the test keeps running on Windows.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: move rhiza-managed template tests out of the shipped bundle int…",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-09T05:26:45Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e0df519736ce21aeb9c382004dc307fdd5796ab1",
"body": "… to rhiza-tools (#1378)\n\nThe suppression-audit and pip-audit tooling that lived in .rhiza/utils/*.py\nmoved into the rhiza-tools package (v0.8.0, #311) as first-class\n`rhiza-tools pip-audit` and `rhiza-tools suppression-audit` commands. Stop\nshipping the scripts from any bundle and call the CLI inst\n[…]\naims retained.\n- Update affected tests and docs (CLAUDE.md, SECURITY.md scope, CI_ENFORCEMENT,\n GLOSSARY, rhiza_quality command).\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "refactor: remove .rhiza/utils; delegate pip-audit & suppression-audit…",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-09T04:53:29Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "dae98a7946ff356ebc415db4f30e9fedb6f7335f",
"body": null,
"is_bot": false,
"headline": "Chore: bump version 1.0.2 → 1.0.3",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-08T03:55:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "986dcfc92921f42978e591b532bd46d51ce5e6c1",
"body": "…Rs/MRs (GitHub + GitLab) (#1376)\n\n* Add opt-in github-quality-review bundle (advisory Claude scorecard)\n\nIntroduce a new GitHub overlay bundle that runs the synced /rhiza_quality\ncommand via Claude Code on pull requests and posts an advisory scorecard as\na PR comment. It supplements — never replace\n[…]\n and the job does not error (still allow_failure)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add opt-in quality-review bundles: advisory Claude design review on P…",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-08T03:50:32Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "72d7bd5ff080899624741cf2e72c7ca96d46645c",
"body": "Bumps the github-actions group with 5 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.2` | `4.36.3` |\n| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.2` | `4.36.3` |\n| [docker/login\n[…]\nsion-update:semver-patch\n dependency-group: github-actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps)(deps): bump the github-actions group with 5 updates (#1375)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-07T06:21:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9298b23ea55079fdc576c527ac5ee8729babd917",
"body": "…coverage (#1372, #1373) (#1374)\n\nReduce every C-or-worse cyclomatic-complexity block in the Python surface to B\nor better, and document why `make test` runs without a coverage number here.\n\n#1372 — complexity:\n- utils/link_dogfood.py: relink C(20)->B(9) by extracting _classify_dogfood\n (per-file e\n[…]\n fmt, typecheck, validate (100% cov on .rhiza/utils), and\ntest (1194 passed) all green; radon shows no C-or-worse block remaining.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "refactor: eliminate C-ranked complexity blocks; document mother-repo …",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-07T04:20:57Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a68814fd3c916f5e55b3c43740ec332ff901ddf3",
"body": "Harden the symlink dogfood model introduced on symlink-dogfood-bundles.\n\nCloses #1369: add tests/bundles/test_bundle_dogfood_symlinks.py — for every\ntracked root path with a bundle twin, assert it is either a documented\ncarve-out (a real file) or a symlink resolving into bundles/ byte-identical to\ni\n[…]\npo-only dogfood-symlinks CI job\nthat fails a PR which adds a bundle file (or lets a copy reappear) without\nrunning make sync-self.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "test(bundles): guard dogfood symlink invariant + CI drift check (#1371)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-06T13:55:13Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "749157d7a8115847da2f42d511edb49b098b0e79",
"body": "…es (#1357)\n\nMake bundles/ the single source of truth for the mother repo's own\ndogfood files. 68 root files (.rhiza/**, .claude/commands/*, top-level\nMakefile/ruff.toml/cliff.toml/LICENSE/pytest.ini, etc.) are now relative\nsymlinks into their owning bundle, so editing the bundle file propagates\naut\n[…]\nf` to (re)create the links\n- add tests/bundles/test_bundle_github_sync.py for the .github copies\n- document the model in CLAUDE.md\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "refactor: dogfood bundles via symlinks instead of byte-identical copi…",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-06T11:48:56Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "76e9bec5ac5ec09e016253ddc7a4431c53a10a0f",
"body": null,
"is_bot": false,
"headline": "Chore: bump version 1.0.1 → 1.0.2",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-06T11:14:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1c9a2185ad47ea447f87cdd83dc7a2f1c4c7cebb",
"body": "* Initial plan\n\n* Add vscode bundle for recommended extensions and editor settings\n\n---------\n\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>\nCo-authored-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>",
"is_bot": false,
"headline": "Add vscode bundle for recommended extensions and editor settings (#1362)",
"author_name": "Copilot",
"author_login": "Copilot",
"committed_at": "2026-07-06T11:12:41Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "086a37d3fed2a0f1eaf5f29f01bce65cfe808fae",
"body": "* Initial plan\n\n* Add TYPECHECKER option to run ty or mypy instead of both\n\n---------\n\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>\nCo-authored-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>",
"is_bot": false,
"headline": "Add TYPECHECKER option to run ty or mypy instead of both (#1360)",
"author_name": "Copilot",
"author_login": "Copilot",
"committed_at": "2026-07-06T11:07:04Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "71d2617e202a01c213d532723afbbaf61d06dd5d",
"body": "PyPI metadata for a just-published release — especially the first\nrelease of a new package — can lag the upload by several minutes,\ncausing the conda recipe step to fail spuriously. Retry grayskull up\nto 5 times with a 60s pause before giving up.\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(release): retry grayskull while PyPI metadata propagates (#1363)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-07-06T10:08:21Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "18c2ffd159b08a8b3a636296b1f675267deb439e",
"body": "…a to v0.37.4 (#1368)\n\nCo-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): update pre-commit hook python-jsonschema/check-jsonschem…",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-06T10:07:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bfb8ff27e00929867b06f910fdcbba57703c706d",
"body": "…igest to 6768b69 (#1365)\n\nCo-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): update gcr.io/oss-fuzz-base/base-builder-python docker d…",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-06T09:39:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dd701d489b8c3a640c6a03cdc9472ee31f84135c",
"body": "…26 (#1366)\n\nCo-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>\nCo-authored-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>",
"is_bot": true,
"headline": "chore(deps): update pre-commit hook astral-sh/uv-pre-commit to v0.11.…",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-06T09:39:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cb324bd7f595ead7dc40e1a4993c451960361e9c",
"body": "… (#1367)\n\nCo-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): update pre-commit hook betterleaks/betterleaks to v1.6.1…",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-06T09:38:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1c1083e97e4995cf38b8baed6e32ec1216d581f7",
"body": "Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): lock file maintenance (#1364)",
"author_name": "renovate[bot]",
"author_login": "renovate[bot]",
"committed_at": "2026-07-06T09:20:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ffc34b80ebd46a79eea1407940cc70566a35693a",
"body": "Addresses a Copilot code-quality finding on the changelog dry-run test\ndocstring (\"dry-run output\" -> \"dry run output\"). Applied to both the\n`bundles/tests` source and the self-synced `.rhiza/tests` copy to avoid\nsync drift.\n\nOriginated downstream in jebel-quant/rhiza-tools#302; making the change\nupstream so it survives the next template sync.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(tests): reword dry-run docstring in test_releasing_targets (#1358)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-06-30T15:20:01Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "04d8f42656366a9e07dc584ff75ab579764d89b0",
"body": null,
"is_bot": false,
"headline": "Chore: bump version 1.0.0 → 1.0.1",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-06-30T06:05:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0af7fa1f4ccb15a2ff8fc302f815a6958769bdb1",
"body": "Bumps the github-actions group with 4 updates: [jebel-quant/rhiza](https://github.com/jebel-quant/rhiza), [actions/cache](https://github.com/actions/cache), [actions/attest](https://github.com/actions/attest) and [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance).\n\n[…]\nsion-update:semver-patch\n dependency-group: github-actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps)(deps): bump the github-actions group with 4 updates (#1356)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-30T05:46:41Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d87960cd7d97b6dab392534228dcb39d31f7990d",
"body": "* Apply suggested fix to bundles/tests/.rhiza/tests/structure/test_project_layout.py from Copilot Autofix\n\nCo-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>\nSigned-off-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>\n\n* test: mirror optional\n[…]\nas.schmelzer@gmail.com>\nCo-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Potential fix for 1 code quality finding (#1355)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-06-30T04:56:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "08d2e1872dfbb2875ec811ed38dcdd22ef8b7d3b",
"body": "…ath (#1352)\n\n* Fix for Commented-out code\n\nCo-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>\nSigned-off-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>\n\n* test: replace conftest sys.path hack + re-exports with pytest pythonpath\n\nThe sy\n[…]\nchmelzer@gmail.com>\nCo-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: replace conftest sys.path hack + re-exports with pytest pythonp…",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-06-30T04:51:51Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0fdb4ed98d458834bd8128572c41f7c65b35cb5a",
"body": "* Fix for Commented-out code\n\nCo-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>\nSigned-off-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>\n\n* test: sync root .rhiza/ dogfood copy with bundle edit\n\nPR edited the bundle source bundles/tes\n[…]\nchmelzer@gmail.com>\nCo-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Fix for Commented-out code (#1348)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-06-30T04:40:27Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4293462dc91e0fb7e1f4f207d0a48efc5073de22",
"body": "* Apply suggested fix to CLAUDE.md from Copilot Autofix\n\nCo-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>\nSigned-off-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>\n\n* Apply suggested fix to CLAUDE.md from Copilot Autofix\n\nCo-authored-by: \n[…]\nchmelzer@gmail.com>\n\n---------\n\nSigned-off-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>\nCo-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "Potential fixes for 3 code quality findings (#1354)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-06-30T04:31:51Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "73d621dbfe32868de595f40a7c162b88ee73f419",
"body": "Signed-off-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>\nCo-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "Apply suggested fix to CLAUDE.md from Copilot Autofix (#1353)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-06-30T04:24:37Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "d61726ada4096d58182fd3640ee9d7da7de9ab86",
"body": "* Apply suggested fix to CLAUDE.md from Copilot Autofix\n\nCo-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>\nSigned-off-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>\n\n* Apply suggested fix to CLAUDE.md from Copilot Autofix\n\nCo-authored-by: \n[…]\nchmelzer@gmail.com>\n\n---------\n\nSigned-off-by: Thomas Schmelzer <thomas.schmelzer@gmail.com>\nCo-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "Potential fixes for 2 code quality findings (#1351)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-06-30T04:18:56Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1a1111c7d45e9a6361f057853a4b4f8fb2d0344f",
"body": "* Initial plan\n\n* docs: add hyperlinks for MkDocs and zensical in CLAUDE.md\n\n---------\n\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: add hyperlinks for MkDocs and zensical in CLAUDE.md (#1349)",
"author_name": "Copilot",
"author_login": "Copilot",
"committed_at": "2026-06-30T04:11:35Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "d64b5e9222df50befc13ae293556e70320a6e5d5",
"body": "The mother repo runs on GitHub Actions only; there is no root\n.gitlab-ci.yml. GitLab support ships as a template via bundles/gitlab/\nfor downstream consumers that adopt the gitlab-project profile.\n\nCloses #1345\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: correct GitLab-CI claim in CLAUDE.md (#1345) (#1346)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-06-29T08:30:25Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "7779aedaa52f792e9f052ead04aa2fcba2882500",
"body": "…ile loading (#1344)\n\n- Add docs/reference/BUNDLE_TAXONOMY.md mapping the bundle/profile model,\n wired into mkdocs nav, with a doc-consistency test ensuring every bundle\n and profile in template-bundles.yml is documented.\n- Add docs/operations/CI_ENFORCEMENT.md recording which gates block vs repor\n[…]\ndles/doctor/paper fragments.\n- Add tests/bundles/test_bundle_test_coverage.py tying every declared bundle\n to a behavioural test.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: add bundle taxonomy + CI enforcement references, document Makef…",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-06-29T07:13:21Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "86a28b0b0fc8a8fb5162237fde9ede4c2470467c",
"body": "… (#1338)\n\nInstead of a free-text yes/no, present the actionable findings as a multi-select\nmenu (AskUserQuestion, multiSelect) with one option per finding so the user picks\nexactly which to file (including none). Applied to both the root copy and the\ncore-bundle source.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(rhiza_quality): make the issue-filing prompt a multi-select menu…",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-06-29T06:08:34Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "26d76ea5529c0ceef97d5b6940f4d75a4df4f765",
"body": "Update the /rhiza_quality command instructions (both the root copy and the\ncore-bundle source) to add an explicit issue-filing workflow: after presenting\nthe recommendations, ask whether to turn the actionable findings into tracker\nissues, and on an explicit yes detect the host from the git remote a\n[…]\ntained issue per finding (gh / glab). Drops the old blanket\n\"do not create GitHub issues\" clause that the new workflow supersedes.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(rhiza_quality): offer to file findings as tracker issues (#1337)",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-06-29T05:58:15Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "7aaf6591bce6e752e52e267b7f8f48857ea0d9cc",
"body": "…(#1336)\n\nCloses #1333, #1334, #1335.\n\n- #1333: add .rhiza/tests/integration/test_benchmark_targets.py — dry-runs the\n `benchmark` target, asserts it is .PHONY, depends on install, and drives\n pytest-benchmark (--benchmark-only/--benchmark-json/analyze-benchmarks) under\n the benchmarks-folder gua\n[…]\n Installed N\", removing the per-gate venv churn. Applied to\n both dogfood copies (.rhiza/ and bundles/core/) kept byte-identical.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Test benchmark + devcontainer bundles; stop install dependency churn …",
"author_name": "Thomas Schmelzer",
"author_login": "tschm",
"committed_at": "2026-06-29T05:57:38Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2000043eba086b1647a20e1a899dfd195b73996e",
"body": "* Initial plan\n\n* fix(ci): tolerate cancelled matrix legs in CI gate\n\nThe CI gate was failing when a typecheck matrix leg was cancelled by a\ntransient runner issue (GitHub Actions infrastructure). The gate checked\n`needs.typecheck.result != \"success\"`, which fails for `cancelled`.\n\nChange the condit\n[…]\nsilience property.\n\nFixes: https://github.com/Jebel-Quant/rhiza/actions/runs/28344335938/job/83965148182\n\n---------\n\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(ci): tolerate cancelled matrix legs in CI gate (#1332)",
"author_name": "Copilot",
"author_login": "Copilot",
"committed_at": "2026-06-29T02:35:22Z",
"body_truncated": true,
"is_coding_agent": true
}
],
"releases_count": 100,
"commits_last_year": 1746,
"latest_release_at": "2026-07-30T03:35:51Z",
"latest_release_tag": "v1.2.5",
"releases_from_tags": false,
"days_since_last_push": 1,
"active_weeks_last_year": 52,
"days_since_latest_release": 1,
"mean_days_between_releases": 2.3
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 62,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": true
},
"ecosystem": {
"packages": [
{
"name": "rhiza",
"exists": true,
"license": "MIT",
"keywords": [
"ci",
"configuration",
"ruff",
"taskfile",
"templates",
"Intended Audience :: Developers",
"License :: OSI Approved :: MIT License",
"Programming Language :: Python :: 3",
"Programming Language :: Python :: 3 :: Only",
"Programming Language :: Python :: 3.11",
"Programming Language :: Python :: 3.12",
"Programming Language :: Python :: 3.13",
"Programming Language :: Python :: 3.14",
"Topic :: Software Development :: Build Tools"
],
"ecosystem": "pypi",
"matches_repo": true,
"registry_url": "https://pypi.org/project/rhiza/",
"is_deprecated": false,
"latest_version": "0.18.0",
"repository_url": "https://github.com/jebel-quant/rhiza-cli",
"versions_count": 70,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": 25379,
"first_published_at": "2025-12-16T10:34:45.319323Z",
"latest_published_at": "2026-06-24T10:53:05.719790Z",
"latest_version_yanked": null,
"days_since_latest_publish": 36
}
]
},
"popularity": {
"forks": 5,
"stars": 13,
"watchers": 1,
"fork_history": {
"days": [
{
"date": "2026-01-07",
"count": 1
},
{
"date": "2026-01-08",
"count": 1
},
{
"date": "2026-02-01",
"count": 1
},
{
"date": "2026-06-01",
"count": 1
},
{
"date": "2026-06-12",
"count": 1
}
],
"complete": true,
"collected": 5,
"total_forks": 5
},
"star_history": null,
"open_issues_and_prs": 2
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile",
"bundles/core/Makefile"
],
"api_schema_files": [],
"has_devcontainer": true,
"typecheck_configs": [],
"toolchain_manifests": [],
"largest_source_bytes": 38502,
"source_files_sampled": 77,
"oversized_source_files": 0,
"agent_instruction_files": [
"CLAUDE.md"
],
"agent_instruction_max_bytes": 9437
},
"dependencies": {
"manifests": [
"pyproject.toml"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 11,
"malicious_count": 0,
"assessed_package": "pypi:rhiza@0.18.0",
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"pypi"
],
"dependencies": [],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 923,
"open_issues": 2,
"closed_ratio": 0.995,
"closed_issues": 402,
"closed_unmerged_prs": 116
},
"bus_factor": 1,
"bot_contributors": 5,
"top_contributors": [
{
"type": "User",
"login": "tschm",
"commits": 1086,
"avatar_url": "https://avatars.githubusercontent.com/u/2046079?v=4"
},
{
"type": "User",
"login": "HarryCampion",
"commits": 132,
"avatar_url": "https://avatars.githubusercontent.com/u/40582604?v=4"
},
{
"type": "User",
"login": "markrichardson",
"commits": 15,
"avatar_url": "https://avatars.githubusercontent.com/u/5681211?v=4"
},
{
"type": "User",
"login": "gesta81",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/5859088?v=4"
},
{
"type": "User",
"login": "armaanPy",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/52916251?v=4"
},
{
"type": "User",
"login": "cottrellashley",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/97458555?v=4"
}
],
"contributors_sampled": 6,
"top_contributor_share": 0.877
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"rhiza_benchmark.yml",
"rhiza_book.yml",
"rhiza_ci.yml",
"rhiza_codeql.yml",
"rhiza_devcontainer.yml",
"rhiza_docker.yml",
"rhiza_fuzzing.yml",
"rhiza_marimo.yml",
"rhiza_mutation.yml",
"rhiza_paper.yml",
"rhiza_quality_review.yml",
"rhiza_release.yml",
"rhiza_scorecard.yml",
"rhiza_weekly.yml"
],
"has_docs_dir": true,
"linter_configs": [
"ruff.toml"
],
"has_editorconfig": true,
"has_linter_config": true,
"has_precommit_config": true
},
"security_signals": {
"lockfiles": [
"uv.lock"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 8,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "23 out of 23 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 2,
"reason": "badge detected: InProgress",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/14 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 5 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 10,
"reason": "project is fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 9,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 28 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 9,
"reason": "dependency not pinned by hash detected -- score normalized to 9",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 10,
"reason": "SAST tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 10,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 8,
"reason": "5 out of the last 5 releases have a total of 5 signed artifacts.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 10,
"reason": "GitHub workflow tokens follow principle of least privilege",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 9,
"reason": "1 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "e5d7005e2d9fc3d5a23b96d13b203b4f2afe3cce",
"ran_at": "2026-07-31T09:59:37Z",
"aggregate_score": 8.7,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": true,
"has_security_policy": true,
"has_dependabot_config": true
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-30T03:31:55Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-30T02:56:00Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 2,
"created_at": "2025-12-13T14:27:59Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1267,
"created_at": "2026-06-18T07:22:52Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/Jebel-Quant/rhiza",
"host": "github.com",
"name": "rhiza",
"owner": "Jebel-Quant"
},
"metrics": {
"overall": {
"key": "overall",
"band": "exceptional",
"name": "Overall health",
"note": "The weighted overall 79 is calibrated to 93 on the published index scale (record calibration 2026-08-02).",
"notes": [
{
"code": "overall_calibration",
"params": {
"raw": 79,
"calibrated": 93,
"calibration": "2026-08-02"
}
}
],
"value": 93,
"inputs": {
"security": 90,
"vitality": 99,
"community": 45,
"governance": 62,
"calibration": "2026-08-02",
"engineering": 100,
"ai_readiness": 81,
"weighted_overall_raw": 79
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "exceptional",
"name": "Vitality",
"value": 99,
"weight": 0.21,
"metrics": [
{
"key": "development_activity",
"band": "exceptional",
"name": "Development activity",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"commits_last_year": 1746,
"human_commit_share": 0.72,
"days_since_last_push": 1,
"active_weeks_last_year": 52
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 1 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 1
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "52/52 weeks with commits",
"points": 36,
"status": "met",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 52
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "1746 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 1746
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 28 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "exceptional",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 98,
"inputs": {
"releases_count": 100,
"latest_release_tag": "v1.2.5",
"releases_from_tags": false,
"days_since_latest_release": 1,
"mean_days_between_releases": 2.3
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "100 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 100
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 1 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 1
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~2.3 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 2.3
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "5 out of the last 5 releases have a total of 5 signed artifacts.",
"points": 8,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "exceptional",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 4,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 4 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 4
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "weak",
"name": "Community & Adoption",
"value": 45,
"weight": 0.17,
"metrics": [
{
"key": "popularity",
"band": "at_risk",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 22,
"inputs": {
"forks": 5,
"stars": 13,
"watchers": 1,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "13 stars",
"points": 17.5,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 13
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "5 forks",
"points": 5,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 5
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "1 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 1
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 51,
"inputs": {
"has_readme": true,
"has_license": true,
"readme_badges": null,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"readme_badge_services": [],
"has_pull_request_template": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "license file present, not a recognized license",
"points": 16.9,
"status": "partial",
"details": [
{
"code": "license_custom",
"params": {}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 6.3,
"status": "met",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "good",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 73,
"inputs": {
"packages": [
"rhiza"
],
"dependents": null,
"ecosystems": "pypi",
"total_downloads": null,
"monthly_downloads": 25379
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "25,379 downloads/month across pypi",
"points": 58.7,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 25379,
"ecosystems": "pypi"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 62,
"weight": 0.23,
"metrics": [
{
"key": "maintainer_resilience",
"band": "at_risk",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 30,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 6,
"top_contributor_share": 0.877
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 88% of commits",
"points": 2.8,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 88
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "6 contributors",
"points": 8.1,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 6
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 5 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Newcomer PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"newcomer_pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 79,
"inputs": {
"merged_prs": 923,
"open_issues": 2,
"closed_issues": 402,
"prs_merged_7d": null,
"prs_decided_7d": null,
"prs_merged_30d": null,
"prs_decided_30d": null,
"issue_closed_ratio": 0.995,
"closed_unmerged_prs": 116,
"first_time_authors_30d": null,
"first_time_prs_merged_30d": null,
"first_time_prs_decided_30d": null
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "100% of issues closed",
"points": 41.8,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 100
}
}
],
"max_points": 42
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "923/1039 decided PRs merged",
"points": 26.7,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 923,
"decided": 1039
}
}
],
"max_points": 30
},
{
"key": "newcomer_pr_acceptance",
"name": "Newcomer PR acceptance",
"detail": "no first-time contributor's PR decided in 30d",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_newcomer_prs",
"params": {
"days": 30
}
}
],
"max_points": 13
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/14 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 53,
"inputs": {
"followers": 24,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "Jebel-Quant",
"public_repos": 25,
"account_age_days": 408
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "24 followers of Jebel-Quant",
"points": 10.1,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 24,
"login": "Jebel-Quant"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "25 public repos, account ~1 yr old",
"points": 12.5,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 25
}
},
{
"code": "account_age_years",
"params": {
"years": 1
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "exceptional",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"rhiza"
],
"ecosystems": "pypi",
"any_deprecated": false,
"min_days_since_publish": 36
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on pypi",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "pypi"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 36 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 36
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "70 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 70
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "exceptional",
"name": "Engineering Quality",
"value": 100,
"weight": 0.19,
"metrics": [
{
"key": "engineering_practices",
"band": "exceptional",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": true,
"has_linter_config": true,
"has_precommit_config": true
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "14 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 14
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": "ruff.toml",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "ruff.toml"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 9.6,
"status": "met",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 6.4,
"status": "met",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "23 out of 23 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "exceptional",
"name": "Documentation",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"topics": [
"ci-cd",
"configuration-templates",
"automation",
"code-quality",
"devcontainer",
"developer-tools",
"docker",
"github-actions",
"linting",
"mkdocs",
"pytest",
"python",
"ruff",
"template",
"uv",
"rhiza"
],
"has_wiki": true,
"homepage": "https://jebel-quant.github.io/rhiza/",
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://jebel-quant.github.io/rhiza/",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "16 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 16
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "excellent",
"name": "Security",
"value": 90,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "excellent",
"name": "Security posture",
"note": null,
"notes": [],
"value": 87,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 18,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 0,
"scorecard_aggregate": 8.7
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 6,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "23 out of 23 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "badge detected: InProgress",
"points": 0.5,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/14 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 5 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is fuzzed",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 28 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 9",
"points": 4.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "5 out of the last 5 releases have a total of 5 signed artifacts.",
"points": 6,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "GitHub workflow tokens follow principle of least privilege",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "1 existing vulnerabilities detected",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "exceptional",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the pypi:rhiza@0.18.0 runtime dependency closure — what installing the published package pulls in — 11 packages. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_published",
"params": {
"package": "pypi:rhiza@0.18.0",
"assessed": 11
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 0,
"affected_packages": 0,
"assessed_packages": 11,
"unassessed_packages": 0,
"affected_by_severity": "none",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "no indirect dependency carries a known advisory",
"points": 25,
"status": "met",
"details": [
{
"code": "no_indirect_advisories",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "exceptional",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 11,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "exceptional",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"commit_weight_rule": {
"min_commits": 50,
"min_commit_share": 0.1
},
"review_only_matches": 0,
"below_threshold_exposures": [],
"assessed_self_published_locations": 7
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "excellent",
"name": "AI Readiness",
"value": 81,
"weight": 0.04,
"metrics": [
{
"key": "ai_agent_context",
"band": "excellent",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.903,
"agent_instruction_files": [
"CLAUDE.md"
],
"agent_instruction_max_bytes": 9437
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "CLAUDE.md",
"points": 45,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "CLAUDE.md"
}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "65 of 72 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 65,
"sampled": 72
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "excellent",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 88,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"uv.lock"
],
"has_dockerfile": true,
"typed_language": false,
"bootstrap_files": [
"Makefile",
"bundles/core/Makefile"
],
"has_devcontainer": true,
"has_linter_config": true,
"typecheck_configs": [],
"agent_commit_share": 0.62,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0.28
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile, bundles/core/Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile, bundles/core/Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": "ruff.toml",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "ruff.toml"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "devcontainer, Dockerfile, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "devcontainer, Dockerfile, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "62 of the last 100 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 62,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "28 of the last 100 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 28,
"sampled": 100
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 9",
"points": 9,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "moderate",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"primary_language": "Python",
"largest_source_bytes": 38502,
"source_files_sampled": 77,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Python without a type-check config",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_typecheck_config_language",
"params": {
"language": "Python"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/77 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 77,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight: agent tooling is a real maintenance signal, but its absence must never gate the top of the scale (calibration saturates at raw 91, so 100/100 remains reachable with AI Readiness at zero)."
}
],
"classification": {
"labels": [
"library"
],
"scores": {
"library": 6
},
"primary": "library",
"evidence": [
{
"tier": "distribution",
"label": "library",
"source": "registry:pypi",
"weight": 6
}
],
"artifacts": [],
"confidence": "medium",
"host_extension": false,
"runs_as_process": false,
"consumed_by_code": true
},
"metrics_version": "2.3.1"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-31T09:59:56.198477Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/j/Jebel-Quant/rhiza.svg",
"full_name": "Jebel-Quant/rhiza",
"license_state": "custom",
"license_spdx": null
}
Related records
Inspected repositories sharing catalogue tags or ecosystems with Jebel-Quant/rhiza. Read them side by side →
Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v2.3.1, schema v0.27.0 — full methodology · metrics wiki.
