Public record
Software health reportschema 0.27.0 · metrics 1.13.0 · 2026-07-23 00:46 UTC

getporter / porter

Porter enables you to package your application artifact, client tools, configuration and deployment logic together as an installer that you can distribute, and install with a single command.

GoApache-2.0★ 1,422 stars⑂ 222 forkssince Nov 2018View on GitHub ↗
#porter#cnab#cncf

getporter/porter holds a health index of 78 out of 100, placing it in the Good band. It scores highest on AI Readiness (86/100) and lowest on Security (63/100). It was last updated today. 2 contributors account for most of its recent work.

78
overall / 100
Good

Software health index

Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.

78
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
VitalityCommunity &AdoptionSustainability &GovernanceEngineeringQualitySecurityAI Readiness

Score profile

Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.

Ownership

PorterOrganization
48 followers48 public repossince Oct 2019

This repository is backed by an organization — shared, accountable stewardship that can outlive any single maintainer.

Package ecosystems

RegistryPackageVersionDownloads / moVersionsLast publish
Goget.porter.sh/porterv1.6.1-1365 days ago

Metrics by category

Vitality

Is the project alive — is code being written and are releases shipping?

80Good · 22% of overall

Development activity

97Excellent
How it's scored
36/36Push recency — last push 0 days ago
33.2/36Commit cadence — 48/52 weeks with commits
18/18Commit volume — 265 commits in the last year
10/10OpenSSF Scorecard: Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Inputs used
commits_last_year265
human_commit_share0.68
days_since_last_push0
active_weeks_last_year48

Release discipline

54Moderate
How it's scored
27/27Ships releases — 100 releases published
0/36Release recency — latest release 1,933 days ago
27/27Release cadence — a release every ~-141.3 days
0/10OpenSSF Scorecard: Signed-Releases — Project has not signed or included provenance with any releases.
Inputs used
releases_count100
latest_release_tagcanary
releases_from_tagsno
days_since_latest_release1,933
mean_days_between_releases-141.3

Community & Adoption

Does the project have users, downloads, attention, and a welcoming setup for contributors?

85Excellent · 18% of overall

Popularity & adoption

78Good
How it's scored
51.1/60Stars — 1,422 stars
19.5/25Forks — 222 forks
7.6/15Watchers — 24 watchers
Inputs used
forks222
stars1,422
watchers24
growth_stateunverified
growth_factor_pct100
growth_unverified_reasonno_history

Community health

92Excellent
How it's scored
22.5/22.5README
22.5/22.5License — recognized license (Apache-2.0)
18/18CONTRIBUTING guide
13.5/13.5Code of conduct
0/7.2Issue template
6.3/6.3PR template
Inputs used
has_readmeyes
has_licenseyes
has_contributingyes
has_issue_templateno
has_code_of_conductyes
has_pull_request_templateyes

Sustainability & Governance

Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?

74Good · 24% of overall

Maintainer resilience (bus factor)

62Moderate
How it's scored
25.2/54Bus factor — 2 contributor(s) cover half of all commits
13.7/22.5Commit distribution — top contributor authored 39% of commits
13.5/13.5Contributor breadth — 99 contributors
10/10OpenSSF Scorecard: Contributors — project has 70 contributing companies or organizations
Inputs used
bus_factor2
contributors_sampled99
top_contributor_share0.392

Issue & PR responsiveness

75Good
How it's scored
42.1/46.8Issue resolution — 90% of issues closed
33.1/38.3PR acceptance — 1,967/2,272 decided PRs merged
0/15OpenSSF Scorecard: Code-Review — Found 1/19 approved changesets -- score normalized to 0
Inputs used
merged_prs1,967
open_issues123
closed_issues1,116
issue_closed_ratio0.901
closed_unmerged_prs305

Ownership & stewardship

66Moderate
How it's scored
30/30Ownership backing — organization-owned
0/20Verified domain
12.2/25Owner reach — 48 followers of getporter
24.3/25Track record — 48 public repos, account ~6 yr old
Inputs used
followers48
owner_typeOrganization
is_verified—
owner_logingetporter
public_repos48
account_age_days2,457

Package maintenance

100Excellent
How it's scored
25/25Published & resolvable — 1 package(s) on go
35/35Publish recency — latest publish 5 days ago
20/20Version history — 136 published versions
20/20Not deprecated — active, not deprecated or yanked
Inputs used
packagesget.porter.sh/porter
ecosystemsgo
any_deprecatedno
min_days_since_publish5

Engineering Quality

Are baseline engineering and documentation practices in place?

84Good · 20% of overall

Engineering practices

80Good
How it's scored
24/24CI workflows — 11 workflow(s)
24/24Tests present
16/16Linter config — .golangci.yml
0/9.6Pre-commit hooks
0/6.4.editorconfig
16/20OpenSSF Scorecard: CI-Tests — 26 out of 29 merged PRs checked by a CI test -- score normalized to 8
Inputs used
has_ciyes
has_testsyes
has_editorconfigno
has_linter_configyes
has_precommit_configno

Documentation

90Excellent
How it's scored
30/30README
25/25Documentation directory
15/15Documentation / homepage site — https://porter.sh
10/10Repository description
10/10Topics — 3 topics
0/10Wiki
Inputs used
topicsporter, cnab, cncf
has_wikino
homepagehttps://porter.sh
has_readmeyes
has_docs_diryes
has_descriptionyes

Security

Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?

63Moderate · 16% of overall

Security posture

54Moderate
How it's scored
7.5/7.5Binary-Artifacts — no binaries found in the repo
0/7.5Branch-Protection — no data
2/2.5CI-Tests — 26 out of 29 merged PRs checked by a CI test -- score normalized to 8
1.2/2.5CII-Best-Practices — badge detected: Passing
0/7.5Code-Review — Found 1/19 approved changesets -- score normalized to 0
2.5/2.5Contributors — project has 70 contributing companies or organizations
10/10Dangerous-Workflow — no dangerous workflow patterns detected
7.5/7.5Dependency-Update-Tool — update tool detected
0/5Fuzzing — project is not fuzzed
2.5/2.5License — license file detected
7.5/7.5Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
0/5Packaging — no data
0/5Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0
4.5/5SAST — SAST tool detected but not run on all commits
5/5Security-Policy — security policy file detected
0/7.5Signed-Releases — Project has not signed or included provenance with any releases.
0/7.5Token-Permissions — detected GitHub workflow tokens with excessive permissions
0/7.5Vulnerabilities — 11 existing vulnerabilities detected
Inputs used
sourceopenssf_scorecard
checks_evaluated16
scorecard_versionv5.5.0
checks_inconclusive2
scorecard_aggregate5.4
Excluded from scoring (no data or not applicable): branch_protection, packaging. Remaining weights renormalized.

Dependency advisories

100Excellent
How it's scored
35/35Direct dependencies free of known advisories — no direct dependency carries a known advisory
0/25Indirect dependencies free of known advisories — transitive set not separable from development and test dependencies in this scope
0/40No advisories left outstanding — no advisory carries a publication date
Inputs used
sourceosv
advisories18
affected_packages4
assessed_packages293
unassessed_packages0
affected_by_severityhigh 2, unknown 2
direct_affected_packages0
Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 293 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.

AI Readiness

How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.

86Excellent · 0% of overall

Agent context & guidance

85Excellent
How it's scored
45/45Agent instructions — docs/content/docs/references/docker-images/agent.md
0/15Machine-readable docs (llms.txt)
40/40Legible commit history — 58 of 68 human commits state their intent (structured subject or explanatory body)
Inputs used
has_llms_txtno
legible_history_share0.853
agent_instruction_filesdocs/content/docs/references/docker-images/agent.md
agent_instruction_max_bytes4,506

Verify loop (build / test / typecheck)

77Good
How it's scored
12.6/18One-command bootstrap — docs/go.mod, go.mod (toolchain convention, no task runner)
22/22Automated tests
11/11Lint / format config — .golangci.yml
11/11Static type checking — Go (statically typed)
10/10Reproducible environment — Dockerfile, lockfile
2/10Demonstrated agent practice — 1 of the last 100 commits agent-authored or agent-credited
8/8Automated maintenance — 32 of the last 100 commits are automated dependency updates
0/10OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0
Inputs used
has_nixno
has_testsyes
lockfilesgo.sum
has_dockerfileyes
typed_languageyes
bootstrap_files—
has_devcontainerno
has_linter_configyes
typecheck_configs—
agent_commit_share0.01
toolchain_manifestsdocs/go.mod, go.mod
dependency_bot_commit_share0.32

Code legibility for models

100Excellent
How it's scored
45/45Type-checkable code — Go (statically typed)
55/55Manageable file sizes — 0/584 source files over 60KB
Inputs used
primary_languageGo
largest_source_bytes55,257
source_files_sampled584
oversized_source_files0

Machine-readable interfaces

100Excellent
How it's scored
40/40API schema (OpenAPI/GraphQL/proto) — pkg/secrets/plugins/proto/secrets_protocol.proto, pkg/signing/plugins/proto/signing_protocol.proto, pkg/storage/plugins/proto/storage_protocol.proto, proto/porterapis/installation/v1alpha1/installation.proto, proto/porterapis/porter/v1alpha1/porter.proto
20/20MCP server
40/40Runnable examples — examples
Inputs used
example_dirsexamples
has_mcp_signalyes
api_schema_filespkg/secrets/plugins/proto/secrets_protocol.proto, pkg/signing/plugins/proto/signing_protocol.proto, pkg/storage/plugins/proto/storage_protocol.proto, proto/porterapis/installation/v1alpha1/installation.proto, proto/porterapis/porter/v1alpha1/porter.proto

Key facts

1,422GitHub stars
99contributors
265commits, last 12 months
0days since last push
100releases
2bus factor
123open issues
Gopackage ecosystems

Data collection warnings

  • Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token

More detail

Star and fork history 0 ★ / 222 ⇿
0Stars
222Forks
99Releases

When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.

0408012016020024022152018-122022-092026-07
Major 1Minor 18Patch 47

Each point covers 7 days.

OpenSSF Scorecard 5.4 / 10
5.4aggregate

Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-23 00:45 UTC

10Binary-Artifactsno binaries found in the repo
n/aBranch-Protectioninternal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
8CI-Tests26 out of 29 merged PRs checked by a CI test -- score normalized to 8
5CII-Best-Practicesbadge detected: Passing
0Code-ReviewFound 1/19 approved changesets -- score normalized to 0
10Contributorsproject has 70 contributing companies or organizations
10Dangerous-Workflowno dangerous workflow patterns detected
10Dependency-Update-Toolupdate tool detected
0Fuzzingproject is not fuzzed
10Licenselicense file detected
10Maintained30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
n/aPackagingpackaging workflow not detected
0Pinned-Dependenciesdependency not pinned by hash detected -- score normalized to 0
9SASTSAST tool detected but not run on all commits
10Security-Policysecurity policy file detected
0Signed-ReleasesProject has not signed or included provenance with any releases.
0Token-Permissionsdetected GitHub workflow tokens with excessive permissions
0Vulnerabilities11 existing vulnerabilities detected
Direct dependencies 68
RegistryPackageVersion constraintManifest
Goget.porter.sh/magefilesv0.6.14go.mod
Gogithub.com/Masterminds/semver/v3v3.5.0go.mod
Gogithub.com/PaesslerAG/jsonpathv0.1.1go.mod
Gogithub.com/carolynvs/aferoxv0.3.0go.mod
Gogithub.com/carolynvs/datetime-printerv0.2.0go.mod
Gogithub.com/cbroglie/mustachev1.4.0go.mod
Gogithub.com/cnabio/cnab-gov0.26.4go.mod
Gogithub.com/cnabio/cnab-to-ociv0.6.1go.mod
Gogithub.com/cnabio/image-relocationv0.9.2go.mod
Gogithub.com/containerd/containerd/v2v2.3.3go.mod
Gogithub.com/davecgh/go-spewv1.1.2-0.20180830191138-d8f796af33ccgo.mod
Gogithub.com/distribution/referencev0.6.1-0.20240718132515-8c942b0459dfgo.mod
Gogithub.com/docker/buildxv0.35.0go.mod
Gogithub.com/docker/cliv29.6.2+incompatiblego.mod
Gogithub.com/dustin/go-humanizev1.0.1go.mod
Gogithub.com/ghodss/yamlv1.0.0go.mod
Gogithub.com/google/go-cmpv0.7.0go.mod
Gogithub.com/google/go-containerregistryv0.21.7go.mod
Gogithub.com/google/uuidv1.6.0go.mod
Gogithub.com/grpc-ecosystem/go-grpc-middlewarev1.4.0go.mod
Gogithub.com/grpc-ecosystem/go-grpc-prometheusv1.2.0go.mod
Gogithub.com/hashicorp/go-hclogv1.6.3go.mod
Gogithub.com/hashicorp/go-multierrorv1.1.1go.mod
Gogithub.com/hashicorp/go-pluginv1.7.0go.mod
Gogithub.com/jeremywohl/flattenv1.0.1go.mod
Gogithub.com/magefile/magev1.17.2go.mod
Gogithub.com/mattn/go-colorablev0.1.15go.mod
Gogithub.com/mattn/go-isattyv0.0.23go.mod
Gogithub.com/mikefarah/yq/v3v3.0.0-20201202084205-8846255d1c37go.mod
Gogithub.com/mitchellh/mapstructurev1.5.0go.mod
Gogithub.com/mmcdole/gofeedv1.4.0go.mod
Gogithub.com/moby/buildkitv0.31.2go.mod
Gogithub.com/moby/moby/apiv1.55.0go.mod
Gogithub.com/moby/moby/clientv0.5.0go.mod
Gogithub.com/moby/termv0.5.2go.mod
Gogithub.com/modelcontextprotocol/go-sdkv1.6.1go.mod
Gogithub.com/olekukonko/tablewriterv1.1.4go.mod
Gogithub.com/opencontainers/go-digestv1.0.0go.mod
Gogithub.com/opencontainers/image-specv1.1.1go.mod
Gogithub.com/osteele/liquidv1.8.1go.mod
Gogithub.com/pelletier/go-tomlv1.9.5go.mod
Gogithub.com/prometheus/client_golangv1.23.2go.mod
Gogithub.com/spf13/aferov1.15.0go.mod
Gogithub.com/spf13/cobrav1.10.2go.mod
Gogithub.com/spf13/pflagv1.0.10go.mod
Gogithub.com/spf13/viperv1.21.0go.mod
Gogithub.com/stretchr/testifyv1.11.1go.mod
Gogithub.com/tidwall/gjsonv1.19.0go.mod
Gogithub.com/tidwall/sjsonv1.2.5go.mod
Gogithub.com/uwu-tools/magexv0.10.1go.mod
Gogithub.com/xeipuuv/gojsonschemav1.2.0go.mod
Gogo.mongodb.org/mongo-driverv1.17.9go.mod
Gogo.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpcv0.69.0go.mod
Gogo.opentelemetry.io/otelv1.44.0go.mod
Gogo.opentelemetry.io/otel/exporters/otlp/otlptracev1.44.0go.mod
Gogo.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpcv1.44.0go.mod
Gogo.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttpv1.44.0go.mod
Gogo.opentelemetry.io/otel/exporters/stdout/stdouttracev1.44.0go.mod
Gogo.opentelemetry.io/otel/sdkv1.44.0go.mod
Gogo.opentelemetry.io/otel/tracev1.44.0go.mod
Gogo.uber.org/zapv1.28.0go.mod
Gogolang.org/x/syncv0.22.0go.mod
Gogoogle.golang.org/grpcv1.82.1go.mod
Gogoogle.golang.org/protobufv1.36.12-0.20260120151049-f2248ac996afgo.mod
Gogopkg.in/AlecAivazis/survey.v1v1.8.8go.mod
Gogopkg.in/op/go-logging.v1v1.0.0-20160211212156-b2cb9fa56473go.mod
Gogopkg.in/yaml.v3v3.0.1go.mod
Gok8s.io/utilsv0.0.0-20260319190234-28399d86e0b5go.mod
All dependencies 293

Full resolved dependency set from the GitHub dependency graph: 67 direct and 226 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.

RegistryPackageVersionRelation
Goget.porter.sh/magefilesv0.6.14direct
Gogithub.com/carolynvs/aferoxv0.3.0direct
Gogithub.com/carolynvs/datetime-printerv0.2.0direct
Gogithub.com/cbroglie/mustachev1.4.0direct
Gogithub.com/cnabio/cnab-gov0.26.4direct
Gogithub.com/cnabio/cnab-to-ociv0.6.1direct
Gogithub.com/cnabio/image-relocationv0.9.2direct
Gogithub.com/containerd/containerd/v2v2.3.3direct
Gogithub.com/davecgh/go-spewv1.1.2-0.20180830191138-d8f796af33ccdirect
Gogithub.com/distribution/referencev0.6.1-0.20240718132515-8c942b0459dfdirect
Gogithub.com/docker/buildxv0.35.0direct
Gogithub.com/docker/cliv29.6.2+incompatibledirect
Gogithub.com/dustin/go-humanizev1.0.1direct
Gogithub.com/ghodss/yamlv1.0.0direct
Gogithub.com/google/go-cmpv0.7.0direct
Gogithub.com/google/go-containerregistryv0.21.7direct
Gogithub.com/google/uuidv1.6.0direct
Gogithub.com/grpc-ecosystem/go-grpc-middlewarev1.4.0direct
Gogithub.com/grpc-ecosystem/go-grpc-prometheusv1.2.0direct
Gogithub.com/hashicorp/go-hclogv1.6.3direct
Gogithub.com/hashicorp/go-multierrorv1.1.1direct
Gogithub.com/jeremywohl/flattenv1.0.1direct
Gogithub.com/magefile/magev1.17.2direct
Gogithub.com/masterminds/semver/v3v3.5.0direct
Gogithub.com/mattn/go-colorablev0.1.15direct
Gogithub.com/mattn/go-isattyv0.0.23direct
Gogithub.com/mikefarah/yq/v3v3.0.0-20201202084205-8846255d1c37direct
Gogithub.com/mitchellh/mapstructurev1.5.0direct
Gogithub.com/mmcdole/gofeedv1.4.0direct
Gogithub.com/moby/buildkitv0.31.2direct
Gogithub.com/moby/moby/apiv1.55.0direct
Gogithub.com/moby/moby/clientv0.5.0direct
Gogithub.com/moby/termv0.5.2direct
Gogithub.com/modelcontextprotocol/go-sdkv1.6.1direct
Gogithub.com/olekukonko/tablewriterv1.1.4direct
Gogithub.com/opencontainers/go-digestv1.0.0direct
Gogithub.com/opencontainers/image-specv1.1.1direct
Gogithub.com/osteele/liquidv1.8.1direct
Gogithub.com/paesslerag/jsonpathv0.1.1direct
Gogithub.com/pelletier/go-tomlv1.9.5direct
Gogithub.com/prometheus/client_golangv1.23.2direct
Gogithub.com/spf13/aferov1.15.0direct
Gogithub.com/spf13/cobrav1.10.2direct
Gogithub.com/spf13/pflagv1.0.10direct
Gogithub.com/spf13/viperv1.21.0direct
Gogithub.com/stretchr/testifyv1.11.1direct
Gogithub.com/tidwall/gjsonv1.19.0direct
Gogithub.com/tidwall/sjsonv1.2.5direct
Gogithub.com/uwu-tools/magexv0.10.1direct
Gogithub.com/xeipuuv/gojsonschemav1.2.0direct
Gogo.mongodb.org/mongo-driverv1.17.9direct
Gogo.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpcv0.69.0direct
Gogo.opentelemetry.io/otelv1.44.0direct
Gogo.opentelemetry.io/otel/exporters/otlp/otlptracev1.44.0direct
Gogo.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpcv1.44.0direct
Gogo.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttpv1.44.0direct
Gogo.opentelemetry.io/otel/exporters/stdout/stdouttracev1.44.0direct
Gogo.opentelemetry.io/otel/sdkv1.44.0direct
Gogo.opentelemetry.io/otel/tracev1.44.0direct
Gogo.uber.org/zapv1.28.0direct
Gogolang.org/x/syncv0.22.0direct
Gogoogle.golang.org/grpcv1.82.1direct
Gogoogle.golang.org/protobufv1.36.12-0.20260120151049-f2248ac996afdirect
Gogopkg.in/alecaivazis/survey.v1v1.8.8direct
Gogopkg.in/op/go-logging.v1v1.0.0-20160211212156-b2cb9fa56473direct
Gogopkg.in/yaml.v3v3.0.1direct
Gok8s.io/utilsv0.0.0-20260319190234-28399d86e0b5direct
Gogithub.com/agnivade/levenshteinv1.2.1indirect
Gogithub.com/apparentlymart/go-textseg/v15v15.0.0indirect
Gogithub.com/asaskevich/govalidatorv0.0.0-20230301143203-a9d515a09cc2indirect
Gogithub.com/aws/aws-sdk-go-v2v1.42.0indirect
Gogithub.com/aws/aws-sdk-go-v2/configv1.32.24indirect
Gogithub.com/aws/aws-sdk-go-v2/credentialsv1.19.23indirect
Gogithub.com/aws/aws-sdk-go-v2/feature/ec2/imdsv1.18.29indirect
Gogithub.com/aws/aws-sdk-go-v2/internal/configsourcesv1.4.29indirect
Gogithub.com/aws/aws-sdk-go-v2/internal/endpoints/v2v2.7.29indirect
Gogithub.com/aws/aws-sdk-go-v2/internal/v4av1.4.30indirect
Gogithub.com/aws/aws-sdk-go-v2/service/internal/accept-encodingv1.13.12indirect
Gogithub.com/aws/aws-sdk-go-v2/service/internal/presigned-urlv1.13.29indirect
Gogithub.com/aws/aws-sdk-go-v2/service/signinv1.1.5indirect
Gogithub.com/aws/aws-sdk-go-v2/service/ssov1.31.3indirect
Gogithub.com/aws/aws-sdk-go-v2/service/ssooidcv1.36.6indirect
Gogithub.com/aws/aws-sdk-go-v2/service/stsv1.43.3indirect
Gogithub.com/aws/smithy-gov1.27.2indirect
Gogithub.com/azure/go-ansitermv0.0.0-20250102033503-faa5f7b0171cindirect
Gogithub.com/beorn7/perksv1.0.1indirect
Gogithub.com/blang/semverv3.5.1+incompatibleindirect
Gogithub.com/cenkalti/backoff/v5v5.0.3indirect
Gogithub.com/cespare/xxhash/v2v2.3.0indirect
Gogithub.com/clipperhouse/displaywidthv0.11.0indirect
Gogithub.com/clipperhouse/uax29/v2v2.7.0indirect
Gogithub.com/cloudflare/circlv1.6.3indirect
Gogithub.com/containerd/consolev1.0.5indirect
Gogithub.com/containerd/containerd/apiv1.11.1indirect
Gogithub.com/containerd/continuityv0.5.0indirect
Gogithub.com/containerd/errdefsv1.0.0indirect
Gogithub.com/containerd/errdefs/pkgv0.3.0indirect
Gogithub.com/containerd/logv0.1.0indirect
Gogithub.com/containerd/platformsv1.0.0-rc.4indirect
Gogithub.com/containerd/ttrpcv1.2.8indirect
Gogithub.com/containerd/typeurl/v2v2.3.0indirect
Gogithub.com/cpuguy83/go-md2man/v2v2.0.7indirect
Gogithub.com/cyberphone/json-canonicalizationv0.0.0-20241213102144-19d51d7fe467indirect
Gogithub.com/decred/dcrd/dcrec/secp256k1/v4v4.4.1indirect
Gogithub.com/digitorus/pkcs7v0.0.0-20250730155240-ffadbf3f398cindirect
Gogithub.com/digitorus/timestampv0.0.0-20250524132541-c45532741eeaindirect
Gogithub.com/distribution/distributionv2.8.3+incompatibleindirect
Gogithub.com/docker/distributionv2.8.3+incompatibleindirect
Gogithub.com/docker/dockerv28.5.2+incompatibleindirect
Gogithub.com/docker/docker-credential-helpersv0.9.8indirect
Gogithub.com/docker/go-connectionsv0.7.0indirect
Gogithub.com/docker/go-metricsv0.0.1indirect
Gogithub.com/docker/go-unitsv0.5.0indirect
Gogithub.com/emicklei/go-restful/v3v3.13.0indirect
Gogithub.com/fatih/colorv1.19.0indirect
Gogithub.com/felixge/httpsnoopv1.0.4indirect
Gogithub.com/fsnotify/fsnotifyv1.9.0indirect
Gogithub.com/fvbommel/sortorderv1.1.0indirect
Gogithub.com/fxamacker/cbor/v2v2.9.0indirect
Gogithub.com/go-logr/logrv1.4.3indirect
Gogithub.com/go-logr/stdrv1.2.2indirect
Gogithub.com/go-openapi/analysisv0.25.2indirect
Gogithub.com/go-openapi/errorsv0.22.7indirect
Gogithub.com/go-openapi/jsonpointerv0.23.1indirect
Gogithub.com/go-openapi/jsonreferencev0.21.6indirect
Gogithub.com/go-openapi/loadsv0.23.3indirect
Gogithub.com/go-openapi/runtimev0.32.3indirect
Gogithub.com/go-openapi/runtime/server-middlewarev0.30.0indirect
Gogithub.com/go-openapi/specv0.22.5indirect
Gogithub.com/go-openapi/strfmtv0.26.3indirect
Gogithub.com/go-openapi/swagv0.26.0indirect
Gogithub.com/go-openapi/swag/cmdutilsv0.26.0indirect
Gogithub.com/go-openapi/swag/convv0.26.0indirect
Gogithub.com/go-openapi/swag/fileutilsv0.26.0indirect
Gogithub.com/go-openapi/swag/jsonnamev0.26.0indirect
Gogithub.com/go-openapi/swag/jsonutilsv0.26.0indirect
Gogithub.com/go-openapi/swag/loadingv0.26.0indirect
Gogithub.com/go-openapi/swag/manglingv0.26.0indirect
Gogithub.com/go-openapi/swag/netutilsv0.26.0indirect
Gogithub.com/go-openapi/swag/stringutilsv0.26.0indirect
Gogithub.com/go-openapi/swag/typeutilsv0.26.0indirect
Gogithub.com/go-openapi/swag/yamlutilsv0.26.0indirect
Gogithub.com/go-openapi/validatev0.25.3indirect
Gogithub.com/go-viper/mapstructure/v2v2.5.0indirect
Gogithub.com/gobwas/globv0.2.3indirect
Gogithub.com/goccy/go-jsonv0.10.6indirect
Gogithub.com/goccy/go-yamlv1.19.2indirect
Gogithub.com/gofrs/flockv0.13.0indirect
Gogithub.com/golang/protobufv1.5.4indirect
Gogithub.com/golang/snappyv1.0.0indirect
Gogithub.com/google/certificate-transparency-gov1.3.3indirect
Gogithub.com/google/gnostic-modelsv0.7.1indirect
Gogithub.com/google/jsonschema-gov0.4.3indirect
Gogithub.com/google/shlexv0.0.0-20191202100458-e7afc7fbc510indirect
Gogithub.com/gorilla/muxv1.8.1indirect
Gogithub.com/grpc-ecosystem/grpc-gateway/v2v2.29.0indirect
Gogithub.com/hashicorp/errwrapv1.1.0indirect
Gogithub.com/hashicorp/go-cleanhttpv0.5.2indirect
Gogithub.com/hashicorp/yamuxv0.1.2indirect
Gogithub.com/hiddeco/sshsigv0.2.0indirect
Gogithub.com/imfing/hextrav0.7.3indirect
Gogithub.com/in-toto/attestationv1.2.0indirect
Gogithub.com/in-toto/in-toto-golangv0.11.0indirect
Gogithub.com/inconshreveable/mousetrapv1.1.0indirect
Gogithub.com/json-iterator/gov1.1.12indirect
Gogithub.com/kballard/go-shellquotev0.0.0-20180428030007-95032a82bc51indirect
Gogithub.com/klauspost/compressv1.18.6indirect
Gogithub.com/kr/ptyv1.1.5indirect
Gogithub.com/lestrrat-go/blackmagicv1.0.4indirect
Gogithub.com/lestrrat-go/dsigv1.0.0indirect
Gogithub.com/lestrrat-go/dsig-secp256k1v1.0.0indirect
Gogithub.com/lestrrat-go/httpccv1.0.1indirect
Gogithub.com/lestrrat-go/httprc/v3v3.0.4indirect
Gogithub.com/lestrrat-go/jwx/v3v3.0.13indirect
Gogithub.com/lestrrat-go/option/v2v2.0.0indirect
Gogithub.com/masterminds/semverv1.5.0indirect
Gogithub.com/mattn/go-runewidthv0.0.23indirect
Gogithub.com/mgutz/ansiv0.0.0-20200706080929-d51e80ef957dindirect
Gogithub.com/microsoft/go-winiov0.6.3-0.20251027160822-ad3df93bed29indirect
Gogithub.com/mitchellh/copystructurev1.2.0indirect
Gogithub.com/mitchellh/go-testing-interfacev1.14.1indirect
Gogithub.com/mitchellh/hashstructure/v2v2.0.2indirect
Gogithub.com/mitchellh/reflectwalkv1.0.2indirect
Gogithub.com/mmcdole/goxpp/v2v2.0.0indirect
Gogithub.com/moby/docker-image-specv1.3.1indirect
Gogithub.com/moby/go-archivev0.2.0indirect
Gogithub.com/moby/lockerv1.0.1indirect
Gogithub.com/moby/patternmatcherv0.6.1indirect
Gogithub.com/moby/policy-helpersv0.0.0-20260612073044-d5411a945cfcindirect
Gogithub.com/moby/sys/atomicwriterv0.1.0indirect
Gogithub.com/moby/sys/mountinfov0.7.2indirect
Gogithub.com/moby/sys/sequentialv0.7.0indirect
Gogithub.com/moby/sys/signalv0.7.1indirect
Gogithub.com/moby/sys/userv0.4.0indirect
Gogithub.com/moby/sys/usernsv0.1.0indirect
Gogithub.com/modern-go/concurrentv0.0.0-20180306012644-bacd9c7ef1ddindirect
Gogithub.com/modern-go/reflect2v1.0.3-0.20250322232337-35a7c28c31eeindirect
Gogithub.com/montanaflynn/statsv0.8.2indirect
Gogithub.com/morikuni/aecv1.1.0indirect
Gogithub.com/munnerz/goautonegv0.0.0-20191010083416-a7dc8b61c822indirect
Gogithub.com/oklog/runv1.2.0indirect
Gogithub.com/oklog/ulidv1.3.1indirect
Gogithub.com/oklog/ulid/v2v2.1.1indirect
Gogithub.com/olekukonko/catv0.0.0-20250911104152-50322a0618f6indirect
Gogithub.com/olekukonko/errorsv1.2.0indirect
Gogithub.com/olekukonko/llv0.1.7indirect
Gogithub.com/open-policy-agent/opav1.14.1indirect
Gogithub.com/osteele/tuesdayv1.0.4indirect
Gogithub.com/package-url/packageurl-gov0.1.5indirect
Gogithub.com/paesslerag/gvalv1.2.4indirect
Gogithub.com/pelletier/go-toml/v2v2.3.1indirect
Gogithub.com/pkg/errorsv0.9.1indirect
Gogithub.com/planetscale/vtprotobufv0.6.1-0.20240319094008-0393e58bdf10indirect
Gogithub.com/pmezard/go-difflibv1.0.1-0.20181226105442-5d4384ee4fb2indirect
Gogithub.com/prometheus/client_modelv0.6.2indirect
Gogithub.com/prometheus/commonv0.67.5indirect
Gogithub.com/prometheus/procfsv0.20.1indirect
Gogithub.com/protonmail/go-cryptov1.4.1indirect
Gogithub.com/qri-io/jsonpointerv0.1.1indirect
Gogithub.com/qri-io/jsonschemav0.2.2-0.20210831022256-780655b2ba0eindirect
Gogithub.com/rcrowley/go-metricsv0.0.0-20250401214520-65e299d6c5c9indirect
Gogithub.com/russross/blackfriday/v2v2.1.0indirect
Gogithub.com/sagikazarmark/locaferov0.12.0indirect
Gogithub.com/secure-systems-lab/go-securesystemslibv0.11.0indirect
Gogithub.com/segmentio/asmv1.2.1indirect
Gogithub.com/segmentio/encodingv0.5.4indirect
Gogithub.com/shibumi/go-pathspecv1.3.0indirect
Gogithub.com/shopspring/decimalv1.4.0indirect
Gogithub.com/sigstore/protobuf-specsv0.5.1indirect
Gogithub.com/sigstore/rekorv1.5.2indirect
Gogithub.com/sigstore/rekor-tiles/v2v2.2.2-0.20260601073857-5d098a2b6443indirect
Gogithub.com/sigstore/sigstorev1.10.8indirect
Gogithub.com/sigstore/sigstore-gov1.2.1indirect
Gogithub.com/sigstore/timestamp-authority/v2v2.1.2indirect
Gogithub.com/sirupsen/logrusv1.9.4indirect
Gogithub.com/spf13/castv1.10.0indirect
Gogithub.com/subosito/gotenvv1.6.0indirect
Gogithub.com/tchap/go-patricia/v2v2.3.3indirect
Gogithub.com/theupdateframework/go-tuf/v2v2.4.2indirect
Gogithub.com/tidwall/matchv1.2.0indirect
Gogithub.com/tidwall/prettyv1.2.1indirect
Gogithub.com/tonistiigi/dchapes-modev0.0.0-20250318174251-73d941a28323indirect
Gogithub.com/tonistiigi/fsutilv0.0.0-20260716115106-30cd4fc5d911indirect
Gogithub.com/tonistiigi/go-csvvaluev0.0.0-20240814133006-030d3b2625d0indirect
Gogithub.com/tonistiigi/unitsv0.0.0-20180711220420-6950e57a87eaindirect
Gogithub.com/tonistiigi/vt100v0.0.0-20240514184818-90bafcd6ababindirect
Gogithub.com/transparency-dev/formatsv0.1.1indirect
Gogithub.com/transparency-dev/merklev0.0.2indirect
Gogithub.com/valyala/fastjsonv1.6.10indirect
Gogithub.com/vektah/gqlparser/v2v2.5.32indirect
Gogithub.com/x448/float16v0.8.4indirect
Gogithub.com/xdg-go/pbkdf2v1.0.0indirect
Gogithub.com/xdg-go/scramv1.2.0indirect
Gogithub.com/xdg-go/stringprepv1.0.4indirect
Gogithub.com/xeipuuv/gojsonpointerv0.0.0-20190905194746-02993c407bfbindirect
Gogithub.com/xeipuuv/gojsonreferencev0.0.0-20180127040603-bd5ef7bd5415indirect
Gogithub.com/yashtewari/glob-intersectionv0.2.0indirect
Gogithub.com/yosida95/uritemplate/v3v3.0.2indirect
Gogithub.com/youmark/pkcs8v0.0.0-20240726163527-a2c0da244d78indirect
Gogithub.com/zclconf/go-ctyv1.18.0indirect
Gogo.opentelemetry.io/auto/sdkv1.2.1indirect
Gogo.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptracev0.69.0indirect
Gogo.opentelemetry.io/contrib/instrumentation/net/http/otelhttpv0.69.0indirect
Gogo.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpcv1.44.0indirect
Gogo.opentelemetry.io/otel/metricv1.44.0indirect
Gogo.opentelemetry.io/otel/sdk/metricv1.44.0indirect
Gogo.opentelemetry.io/proto/otlpv1.10.0indirect
Gogo.uber.org/multierrv1.11.0indirect
Gogo.yaml.in/yaml/v2v2.4.4indirect
Gogo.yaml.in/yaml/v3v3.0.4indirect
Gogolang.org/x/cryptov0.53.0indirect
Gogolang.org/x/modv0.37.0indirect
Gogolang.org/x/netv0.56.0indirect
Gogolang.org/x/oauth2v0.36.0indirect
Gogolang.org/x/sysv0.46.0indirect
Gogolang.org/x/termv0.44.0indirect
Gogolang.org/x/textv0.38.0indirect
Gogolang.org/x/timev0.15.0indirect
Gogolang.org/x/toolsv0.46.0indirect
Gogoogle.golang.org/genproto/googleapis/apiv0.0.0-20260526163538-3dc84a4a5aaaindirect
Gogoogle.golang.org/genproto/googleapis/rpcv0.0.0-20260526163538-3dc84a4a5aaaindirect
Gogopkg.in/evanphx/json-patch.v4v4.13.0indirect
Gogopkg.in/inf.v0v0.9.1indirect
Gogopkg.in/yaml.v2v2.4.0indirect
Gok8s.io/apiv0.36.2indirect
Gok8s.io/apimachineryv0.36.2indirect
Gok8s.io/client-gov0.36.2indirect
Gok8s.io/klog/v2v2.140.0indirect
Gok8s.io/kube-openapiv0.0.0-20260319004828-5883c5ee87b9indirect
Gosigs.k8s.io/jsonv0.0.0-20250730193827-2d320260d730indirect
Gosigs.k8s.io/randfillv1.0.0indirect
Gosigs.k8s.io/structured-merge-diff/v6v6.3.2indirect
Gosigs.k8s.io/yamlv1.6.0indirect
Dependency advisories 4

This repository publishes no package the index resolves, so its own dependency graph was assessed — 293 packages, which also include development and test pins that never ship: 4 carry known advisories, of which 0 are direct.

PackageVersionRelationSeverityAdvisoriesFixed in
github.com/distribution/distributionv2.8.3+incompatibleindirecthigh63.1.1
github.com/docker/dockerv28.5.2+incompatibleindirecthigh1029.3.1
golang.org/x/cryptov0.53.0indirectunknown1—
golang.org/x/textv0.38.0indirectunknown10.39.0

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

Raw JSON report machine-readable
{
  "data": {
    "repo": {
      "topics": [
        "porter",
        "cnab",
        "cncf"
      ],
      "is_fork": false,
      "size_kb": 41790,
      "has_wiki": false,
      "homepage": "https://porter.sh",
      "languages": {
        "Go": 2437938,
        "Shell": 7029,
        "Dockerfile": 4344,
        "PowerShell": 1730
      },
      "pushed_at": "2026-07-22T13:31:47Z",
      "created_at": "2018-11-02T16:34:04Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-22T12:33:05Z",
      "description": "Porter enables you to package your application artifact, client tools, configuration and deployment logic together as an installer that you can distribute, and install with a single command.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": "https://porter.sh",
      "name": "Porter",
      "type": "Organization",
      "login": "getporter",
      "company": null,
      "location": null,
      "followers": 48,
      "avatar_url": "https://avatars.githubusercontent.com/u/57189554?v=4",
      "created_at": "2019-10-30T16:22:52Z",
      "is_verified": null,
      "public_repos": 48,
      "account_age_days": 2457
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "canary",
          "kind": "other",
          "published_at": "2021-04-06T21:29:46Z"
        },
        {
          "tag": "v1.6.1",
          "kind": "patch",
          "published_at": "2026-07-17T23:06:03Z"
        },
        {
          "tag": "latest",
          "kind": "other",
          "published_at": "2021-04-06T21:13:34Z"
        },
        {
          "tag": "v1.6.0",
          "kind": "minor",
          "published_at": "2026-07-08T07:25:57Z"
        },
        {
          "tag": "v1.5.0",
          "kind": "minor",
          "published_at": "2026-04-11T20:14:16Z"
        },
        {
          "tag": "v1.4.0",
          "kind": "minor",
          "published_at": "2025-12-03T09:32:05Z"
        },
        {
          "tag": "v1.3.0",
          "kind": "minor",
          "published_at": "2025-08-03T19:20:50Z"
        },
        {
          "tag": "v1.2.1",
          "kind": "patch",
          "published_at": "2024-12-22T21:54:11Z"
        },
        {
          "tag": "v1.2.0",
          "kind": "minor",
          "published_at": "2024-11-14T22:07:22Z"
        },
        {
          "tag": "v1.1.1",
          "kind": "patch",
          "published_at": "2024-09-29T19:41:00Z"
        },
        {
          "tag": "v1.1.0",
          "kind": "minor",
          "published_at": "2024-06-27T15:00:59Z"
        },
        {
          "tag": "v1.1.0-rc",
          "kind": "prerelease",
          "published_at": "2024-06-13T16:14:53Z"
        },
        {
          "tag": "v1.0.17",
          "kind": "patch",
          "published_at": "2024-03-27T00:49:11Z"
        },
        {
          "tag": "v1.0.16",
          "kind": "patch",
          "published_at": "2024-01-28T02:48:52Z"
        },
        {
          "tag": "v1.0.15",
          "kind": "patch",
          "published_at": "2023-07-14T03:26:04Z"
        },
        {
          "tag": "v1.0.14",
          "kind": "patch",
          "published_at": "2023-04-24T21:56:56Z"
        },
        {
          "tag": "v1.0.13",
          "kind": "patch",
          "published_at": "2023-04-12T20:16:03Z"
        },
        {
          "tag": "v1.0.12",
          "kind": "patch",
          "published_at": "2023-04-12T20:20:58Z"
        },
        {
          "tag": "v1.0.11",
          "kind": "patch",
          "published_at": "2023-03-30T15:07:45Z"
        },
        {
          "tag": "v1.0.10",
          "kind": "patch",
          "published_at": "2023-03-23T19:20:38Z"
        },
        {
          "tag": "v1.0.9",
          "kind": "patch",
          "published_at": "2023-02-22T17:58:48Z"
        },
        {
          "tag": "v1.0.8",
          "kind": "patch",
          "published_at": "2023-02-14T22:24:11Z"
        },
        {
          "tag": "v1.0.7",
          "kind": "patch",
          "published_at": "2023-01-31T21:00:00Z"
        },
        {
          "tag": "v1.0.6",
          "kind": "patch",
          "published_at": "2023-01-25T18:14:54Z"
        },
        {
          "tag": "v1.0.5",
          "kind": "patch",
          "published_at": "2023-01-18T18:59:49Z"
        },
        {
          "tag": "v1.0.4",
          "kind": "patch",
          "published_at": "2022-12-09T14:56:16Z"
        },
        {
          "tag": "v1.0.3",
          "kind": "patch",
          "published_at": "2022-12-05T15:32:57Z"
        },
        {
          "tag": "v1.0.2",
          "kind": "patch",
          "published_at": "2022-11-09T18:40:22Z"
        },
        {
          "tag": "v1.0.1",
          "kind": "patch",
          "published_at": "2022-10-14T15:03:26Z"
        },
        {
          "tag": "v1.0.0",
          "kind": "major",
          "published_at": "2022-10-03T15:13:50Z"
        },
        {
          "tag": "v1.0.0-rc.3",
          "kind": "prerelease",
          "published_at": "2022-09-26T18:19:12Z"
        },
        {
          "tag": "v1.0.0-rc.2",
          "kind": "prerelease",
          "published_at": "2022-09-21T17:57:23Z"
        },
        {
          "tag": "v0.38.13",
          "kind": "patch",
          "published_at": "2022-09-21T16:33:35Z"
        },
        {
          "tag": "v1.0.0-rc.1",
          "kind": "prerelease",
          "published_at": "2022-09-07T16:52:25Z"
        },
        {
          "tag": "v1.0.0-beta.4",
          "kind": "prerelease",
          "published_at": "2022-08-31T16:25:59Z"
        },
        {
          "tag": "v1.0.0-beta.3",
          "kind": "prerelease",
          "published_at": "2022-08-04T20:03:49Z"
        },
        {
          "tag": "v1.0.0-beta.2",
          "kind": "prerelease",
          "published_at": "2022-08-01T17:11:38Z"
        },
        {
          "tag": "v1.0.0-beta.1",
          "kind": "prerelease",
          "published_at": "2022-07-05T17:24:35Z"
        },
        {
          "tag": "v1.0.0-alpha.22",
          "kind": "prerelease",
          "published_at": "2022-06-16T21:17:05Z"
        },
        {
          "tag": "v1.0.0-alpha.21",
          "kind": "prerelease",
          "published_at": "2022-06-16T18:04:50Z"
        },
        {
          "tag": "v0.38.12",
          "kind": "patch",
          "published_at": "2022-06-09T18:30:44Z"
        },
        {
          "tag": "v1.0.0-alpha.20",
          "kind": "prerelease",
          "published_at": "2022-05-31T14:33:53Z"
        },
        {
          "tag": "canary-v1",
          "kind": "other",
          "published_at": "2022-05-20T18:55:16Z"
        },
        {
          "tag": "v0.38.11",
          "kind": "patch",
          "published_at": "2022-05-02T14:27:33Z"
        },
        {
          "tag": "v1.0.0-alpha.19",
          "kind": "prerelease",
          "published_at": "2022-04-08T18:29:07Z"
        },
        {
          "tag": "v1.0.0-alpha.18",
          "kind": "prerelease",
          "published_at": "2022-04-05T19:03:24Z"
        },
        {
          "tag": "v1.0.0-alpha.17",
          "kind": "prerelease",
          "published_at": "2022-03-30T16:52:15Z"
        },
        {
          "tag": "v1.0.0-alpha.15",
          "kind": "prerelease",
          "published_at": "2022-03-23T16:06:23Z"
        },
        {
          "tag": "v1.0.0-alpha.14",
          "kind": "prerelease",
          "published_at": "2022-03-22T21:20:58Z"
        },
        {
          "tag": "v0.38.10",
          "kind": "patch",
          "published_at": "2022-03-22T20:25:35Z"
        },
        {
          "tag": "v1.0.0-alpha.13",
          "kind": "prerelease",
          "published_at": "2022-03-04T17:02:05Z"
        },
        {
          "tag": "v1.0.0-alpha.12",
          "kind": "prerelease",
          "published_at": "2022-03-03T16:18:58Z"
        },
        {
          "tag": "v1.0.0-alpha.11",
          "kind": "prerelease",
          "published_at": "2022-02-28T15:51:46Z"
        },
        {
          "tag": "v1.0.0-alpha.10",
          "kind": "prerelease",
          "published_at": "2022-02-16T22:24:32Z"
        },
        {
          "tag": "v0.38.9",
          "kind": "patch",
          "published_at": "2022-02-16T14:26:19Z"
        },
        {
          "tag": "v1.0.0-alpha.9",
          "kind": "prerelease",
          "published_at": "2022-02-07T14:45:41Z"
        },
        {
          "tag": "v1.0.0-alpha.8",
          "kind": "prerelease",
          "published_at": "2022-01-26T20:01:18Z"
        },
        {
          "tag": "v1.0.0-alpha.7",
          "kind": "prerelease",
          "published_at": "2022-01-12T20:34:59Z"
        },
        {
          "tag": "v1.0.0-alpha.6",
          "kind": "prerelease",
          "published_at": "2022-01-12T18:10:16Z"
        },
        {
          "tag": "v0.38.8",
          "kind": "patch",
          "published_at": "2021-11-22T18:50:34Z"
        },
        {
          "tag": "v1.0.0-alpha.5",
          "kind": "prerelease",
          "published_at": "2021-10-20T21:35:14Z"
        },
        {
          "tag": "v1.0.0-alpha.4",
          "kind": "prerelease",
          "published_at": "2021-10-13T17:36:28Z"
        },
        {
          "tag": "v0.38.7",
          "kind": "patch",
          "published_at": "2021-09-28T15:14:40Z"
        },
        {
          "tag": "v1.0.0-alpha.3",
          "kind": "prerelease",
          "published_at": "2021-09-21T14:59:15Z"
        },
        {
          "tag": "v0.38.6",
          "kind": "patch",
          "published_at": "2021-09-15T18:48:30Z"
        },
        {
          "tag": "v0.38.5",
          "kind": "patch",
          "published_at": "2021-08-23T14:41:28Z"
        },
        {
          "tag": "v0.38.4",
          "kind": "patch",
          "published_at": "2021-07-12T21:29:36Z"
        },
        {
          "tag": "v0.38.3",
          "kind": "patch",
          "published_at": "2021-06-16T15:56:04Z"
        },
        {
          "tag": "v1.0.0-alpha.2",
          "kind": "prerelease",
          "published_at": "2021-06-16T14:30:20Z"
        },
        {
          "tag": "v1.0.0-alpha.1",
          "kind": "prerelease",
          "published_at": "2021-06-15T21:13:57Z"
        },
        {
          "tag": "v0.38.2",
          "kind": "patch",
          "published_at": "2021-06-15T18:14:12Z"
        },
        {
          "tag": "v0.38.1",
          "kind": "patch",
          "published_at": "2021-05-04T23:04:16Z"
        },
        {
          "tag": "v0.38.0",
          "kind": "minor",
          "published_at": "2021-05-04T17:46:17Z"
        },
        {
          "tag": "v0.37.3",
          "kind": "patch",
          "published_at": "2021-04-27T21:01:20Z"
        },
        {
          "tag": "v0.37.2",
          "kind": "patch",
          "published_at": "2021-04-08T16:11:48Z"
        },
        {
          "tag": "v0.37.1",
          "kind": "patch",
          "published_at": "2021-04-08T13:14:37Z"
        },
        {
          "tag": "v0.37.0",
          "kind": "minor",
          "published_at": "2021-03-31T15:12:32Z"
        },
        {
          "tag": "v0.36.0",
          "kind": "minor",
          "published_at": "2021-03-23T21:31:15Z"
        },
        {
          "tag": "v0.35.0",
          "kind": "minor",
          "published_at": "2021-03-22T14:54:25Z"
        },
        {
          "tag": "v0.34.4",
          "kind": "patch",
          "published_at": "2021-04-05T18:22:29Z"
        },
        {
          "tag": "v0.34.3",
          "kind": "patch",
          "published_at": "2021-04-05T18:30:07Z"
        },
        {
          "tag": "v0.34.2",
          "kind": "patch",
          "published_at": "2021-04-05T18:30:03Z"
        },
        {
          "tag": "v0.34.1",
          "kind": "patch",
          "published_at": "2021-04-05T18:29:58Z"
        },
        {
          "tag": "v0.34.0",
          "kind": "minor",
          "published_at": "2021-02-23T14:22:56Z"
        },
        {
          "tag": "v0.33.1",
          "kind": "patch",
          "published_at": "2021-02-23T14:24:23Z"
        },
        {
          "tag": "v0.33.0",
          "kind": "minor",
          "published_at": "2021-02-04T16:15:19Z"
        },
        {
          "tag": "v0.32.0",
          "kind": "minor",
          "published_at": "2021-02-04T15:07:22Z"
        },
        {
          "tag": "v0.31.2",
          "kind": "patch",
          "published_at": "2021-01-15T21:11:07Z"
        },
        {
          "tag": "v0.31.1",
          "kind": "patch",
          "published_at": "2021-01-14T23:11:45Z"
        },
        {
          "tag": "v0.31.0",
          "kind": "minor",
          "published_at": "2021-01-13T19:09:09Z"
        },
        {
          "tag": "v0.30.1",
          "kind": "patch",
          "published_at": "2020-11-05T20:18:01Z"
        },
        {
          "tag": "v0.30.0",
          "kind": "minor",
          "published_at": "2020-10-29T21:03:10Z"
        },
        {
          "tag": "v0.29.1",
          "kind": "patch",
          "published_at": "2020-09-24T19:11:21Z"
        },
        {
          "tag": "v0.29.0",
          "kind": "minor",
          "published_at": "2020-09-10T14:28:26Z"
        },
        {
          "tag": "v0.28.1",
          "kind": "patch",
          "published_at": "2020-08-27T18:13:42Z"
        },
        {
          "tag": "v0.28.0",
          "kind": "minor",
          "published_at": "2020-08-25T22:43:21Z"
        },
        {
          "tag": "v0.27.2",
          "kind": "patch",
          "published_at": "2020-07-22T15:40:26Z"
        },
        {
          "tag": "v0.27.1",
          "kind": "patch",
          "published_at": "2020-07-07T17:31:15Z"
        },
        {
          "tag": "v0.27.0",
          "kind": "minor",
          "published_at": "2020-06-25T21:47:30Z"
        },
        {
          "tag": "v0.26.3-beta.1",
          "kind": "prerelease",
          "published_at": "2020-06-03T14:16:41Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "cd545ed2901976b77590f03b695dc63df2acc3f2",
          "body": "feat(copy): report layer copy progress (#748)\n\ncopy/publish push image layers via cnab-to-oci, no feedback,\nlooks hung on large bundles. displayEvent now consumes\nFixupEventTypeProgress: live overwritten line on tty, throttled\nper-line on non-tty. no new deps, reuse term+humanize.\n\nadd unit tests for progress formatting/throttling and an\nintegration test asserting copy reports full layer progress.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Report layer copy progress (#3636)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-22T12:31:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "914b3a6add32b14477a61386999d0535f58066aa",
          "body": "* feat(inspect): resolve deps to existing installations\n\nResolve #2627 for the inspect-time dependency graph builder\nonly (per #3623): a v2 dependency with no bundle interface\ndeclared, sharing enabled, and a matching group can now reuse\nan already-installed installation instead of always pulling a\n\n[…]\nundleDigest at query\ntime instead of loading all candidates and matching in Go.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Resolve dependency to existing installation (inspect only) (#3631)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-22T10:11:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7ac7bdb88ab013e1e2ca729b6719d398f633598a",
          "body": "docs: document reaching Docker host from a bundle\n\nAdd DOCKER_NETWORK=host section to connect-to-docker.md and an\nFAQ entry to troubleshooting covering host.docker.internal.\nCloses #1347.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Document reaching Docker host from a bundle (#3635)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-21T08:32:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0e36cc23d3817642e2954e2498e3306a27e36258",
          "body": "docs: add local debugging tips to CONTRIBUTING\n\nAdd section covering --debug/porter-debug param, PORTER_HOME\ninspection, invocation image shell access, and .cnab/Dockerfile.\n\nFixes #713\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Add local debugging tips to CONTRIBUTING (#3634)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-21T07:58:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0e399050b09cf7e0aa9a1f7580cd4758e85e1b61",
          "body": "* Chore(deps): Bump the go-dependencies group with 3 updates\n\nBumps the go-dependencies group with 3 updates: [github.com/cnabio/cnab-to-oci](https://github.com/cnabio/cnab-to-oci), [github.com/docker/cli](https://github.com/docker/cli) and [github.com/moby/buildkit](https://github.com/moby/buildkit\n[…]\nub.com>\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump the go-dependencies group with 3 updates (#3632)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-19T21:14:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1ff86a7ce2de5a41c66829c1d7bbe683eaa7c540",
          "body": "…(#3627)\n\n* migration: error instead of panic when an installation has no claims\n\nmigrateInstallation indexed claimIDs[0] after listItems returned an empty slice (e.g. when the legacy plugin reports no items for the installation), panicking the migration. Return a clear error when there are no claim\n[…]\ne and obscure the real cause. Also add\nmyself to the contributors list.\n\nSigned-off-by: Arunesh Dwivedi <arunesh.devops@gmail.com>\n\n---------\n\nSigned-off-by: Arunesh Dwivedi <arunesh.devops@gmail.com>",
          "is_bot": false,
          "headline": "migration: error instead of panic when an installation has no claims …",
          "author_name": "Arunesh Dwivedi",
          "author_login": "AruneshDwivedi",
          "committed_at": "2026-07-19T20:46:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ba895a3a96ad4dd0e77ef13a489534e18311470a",
          "body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6 to 7.\n- [Release notes](https://github.com/actions/setup-go/releases)\n- [Commits](https://github.com/actions/setup-go/compare/v6...v7)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-go\n  dependency-version: '7'\n  depen\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump actions/setup-go from 6 to 7 (#3633)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-19T15:44:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c28b780cea736c5060bc25642eddf5be297c0974",
          "body": "* test: share setup across archive integration tests\n\nMerge TestArchive_StableDigest and TestArchive_WithNoCompression\ninto TestArchive with subtests, sharing one NewTestPorter and\nSetupIntegrationTest call instead of duplicating it per test.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n*\n[…]\nrnally, which could FailNow on\nwrong goroutine when called from t.Run subtests.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Consolidate archive and output integration tests (#3626)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-17T12:27:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2af109cbad2a6d6f0f481c832245a7e48baa5b6e",
          "body": "Bumps the go-dependencies group with 3 updates: [github.com/cnabio/cnab-go](https://github.com/cnabio/cnab-go), [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) and [google.golang.org/grpc](https://github.com/grpc/grpc-go).\n\n\nUpdates `github.com/cnabio/cnab-go` from 0.26.3 to 0.26.4\n\n[…]\nion-update:semver-patch\n  dependency-group: go-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump the go-dependencies group with 3 updates (#3630)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-16T15:34:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2d1778cdd5fd106e9a6ed23fc5d133ebb3124c16",
          "body": "Bumps the go-dependencies group with 6 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [github.com/containerd/containerd](https://github.com/containerd/containerd) | `1.7.33` | `1.7.34` |\n| [github.com/docker/cli](https://github.com/docker/cli) | `29.5.3+incompatible` | `29.6.1+incompatible`\n[…]\nion-update:semver-minor\n  dependency-group: go-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump the go-dependencies group with 6 updates (#3628)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-13T08:11:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "842ec1b0549699ab0e4f0f66ebb77cc13693e243",
          "body": "* feat(deps): resolve dependency graph for inspect\n\nReplace tree-only DependencyTreeBuilder with GraphBuilder for\n`porter inspect --show-dependencies`.\n\n- Dedup nodes by ref+params+creds+sharing group instead of\n  cloning duplicate subtrees for shared deps.\n- Detect wiring edges: v2 dependency param\n[…]\null-field NodeKey.less comparator.\n\nUpdate tests for new dedup/cycle semantics.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Resolve dependency graph for inspect (#3623)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-11T15:42:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bed3ab51ba4f76ea5e7e62c12dcf0d4f87013b4c",
          "body": "* fix(tests): make smoke test framework parallel-safe\n\nReplace process-wide os.Setenv/os.Chdir in tests/tester with\nper-invocation cwd/env on each porter subprocess, so tests can\nsafely add t.Parallel(). Fixes #2303.\n\n- invoke porter by absolute path, not bare name, to avoid a\n  LookPath race agains\n[…]\ntensen <kimworking@gmail.com>\nSigned-off-by: Kim Christensen <2461567+kichristensen@users.noreply.github.com>\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Make smoke test framework parallel-safe (#3625)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-11T15:41:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e785a14053c8b9738a7666d2bb341771fd6661e5",
          "body": "* feat: lock installations w/ incomplete runs\n\nAdd GetActiveRuns query + gate Execute on it behind dependencies-v2\nflag; add --force-run to bypass. Closes getporter/porter#2651.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n* test: add integration test for installation lock\n\nCover porter i\n[…]\nChristensen <kimworking@gmail.com>\n\n* docs: regen cli docs for --force-run flag\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Lock installations with incomplete runs (#3624)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-11T14:57:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c273540f8c42938e9cad5ece2416117ae28c1af7",
          "body": "…7 updates (#3617)\n\n* Chore(deps): Bump the go-dependencies group across 1 directory with 17 updates\n\nBumps the go-dependencies group with 6 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [github.com/docker/buildx](https://github.com/docker/buildx) | `0.34.0` | `0.35.0` |\n[…]\nub.com>\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump the go-dependencies group across 1 directory with 1…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-07T20:38:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7dbb4a1ec3360b6ab256f39fad77e2f602a7c7af",
          "body": "* fix: nil run parameters in list output\n\nResolvedValue is never persisted, so a Run read back from\nstorage always has blank parameter values. NewDisplayRun\nshowed these as misleading empty strings; leave Parameters\nnil instead so it's omitted from list output.\n\nCloses #2199\n\nSigned-off-by: Kim Chri\n[…]\nfiles\n\nRegenerate fixtures to match nil'd Parameters in\nDisplayRun list output.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Nil run parameters in list output (#3622)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-07T12:13:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1c075d60b2a7d2b04c44ce4eb10ff4338587869f",
          "body": "* fix(build): correct --no-lint hint on autobuild\n\nLint errors during autobuild (install/upgrade/invoke/\nuninstall/publish) told users to rerun with --no-lint,\nbut that flag only exists on porter build.\n\nAdd ErrLintFailed sentinel and detect it in\nensureLocalBundleIsUpToDate, rewriting the message t\n[…]\nflag message still leaked\ninto output. Drop the wrap; add test for the rewrite.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Correct --no-lint hint on autobuild lint errors (#3620)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-07T12:11:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ca6994d5d31ba3a515b25305bdb2447a63e94aea",
          "body": "fix(publish): support OCI index invocation images\n\nDocker 29.x containerd store archives invocation images\nas an OCI index (manifest + attestation) not a plain\nmanifest. Publish-from-archive assumed a plain manifest\nand failed with \"unexpected media type\".\n\nfindImageInLayout now returns the descript\n[…]\nrs\nknow the media type; pushImageFromLayout pushes via\nremote.WriteIndex when it's an index, recursing into\nchild manifests/layers.\n\nCloses #3615\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Support OCI index invocation images (#3618)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-07T12:11:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d40f89f1f8eac8de2f7d0ed41350bc27118fc0f6",
          "body": "* docs: document CLEANUP_CONTAINERS setting\n\nAdd CLEANUP_CONTAINERS env var to connect-to-docker docs,\nw/ example for inspecting a bundle-action container after\nit runs. Cross-link from troubleshooting page.\n\nCloses #803\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n* docs: improve finding\n[…]\ning by the\n`/cnab/app/run` command when other containers were created\nafter it.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Document CLEANUP_CONTAINERS setting (#3621)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-06T13:24:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "42b69afa6b438a0b7090dcedac4e1ea0f17a0ef6",
          "body": "Bumps [docker/login-action](https://github.com/docker/login-action) from 4.2.0 to 4.4.0.\n- [Release notes](https://github.com/docker/login-action/releases)\n- [Commits](https://github.com/docker/login-action/compare/v4.2.0...v4.4.0)\n\n---\nupdated-dependencies:\n- dependency-name: docker/login-action\n  \n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump docker/login-action from 4.2.0 to 4.4.0 (#3619)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-05T21:38:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a76f6af4cdd8a912dbe27a38a8905d316c5f3473",
          "body": "* fix: skip porter-state for modifies: false actions\n\nWhen a custom action has modifies: false, Finalize() now skips\npackStateBag(), preventing porter-state from being written back\nto the installation. Run records and user-defined outputs are\nstill persisted as expected.\n\nFixes #3579\n\nSigned-off-by:\n[…]\ntion\n\nPoint to SaveOperationResult(), not Finalize(), which\nwas never modified.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Skip porter-state for `modifies: false` custom actions (#3582)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-05T21:30:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ab3b8917c56a1ae8507f7c692b926830ab860d0d",
          "body": "…rter build (#3614)\n\n* feat(experimental): add file-sources feature flag\n\nRegister the file-sources experimental flag in ParseFlags and\nadd tests covering flag parsing and enablement behavior.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n* fix(manifest): broaden schema checks for feature \n[…]\ntents error in config_test\n- drop redundant Manifest selector on embedded field\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Add file-sources experimental feature for downloading files during po…",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-05T21:24:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ece392c079146cff5a8600ba618bd1d5c8a1fa51",
          "body": "go.mod requires go>=1.26.0, default was 1.25.10, breaking\nbuild. Use 1.26.4 for latest security fixes.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "fix(ci): bump default go version to 1.26.4",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-02T08:21:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ab34af87a8916a9be7f090db4943346bd102277a",
          "body": "….6 to 2.1.0 (#3616)\n\nChore(deps): Bump github.com/sigstore/timestamp-authority/v2\n\nBumps [github.com/sigstore/timestamp-authority/v2](https://github.com/sigstore/timestamp-authority) from 2.0.6 to 2.1.0.\n- [Release notes](https://github.com/sigstore/timestamp-authority/releases)\n- [Changelog](https\n[…]\n/v2\n  dependency-version: 2.1.0\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump github.com/sigstore/timestamp-authority/v2 from 2.0…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-02T08:09:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "27a5693da6bfc7a7cbed85227bbdca0ead075bbd",
          "body": "* feat: forward SIGTERM to bundle steps for graceful shutdown (#3602)\n\nWhen a user cancels porter with SIGINT, the cancellation now propagates\ngracefully to the running bundle step instead of hard-killing it.\n\n- Porter runtime (PID 1 in the invocation image) now handles SIGTERM in\n  addition to SIGI\n[…]\n a non-zero exit from the\ncleanup script (ExitError) is caught as a regression.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Forward SIGTERM to bundle steps for graceful shutdown (#3603)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-02T08:08:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e6e6f4b061ddb55b9b6dcef7b9e740b8a0fb3744",
          "body": "Bumps [actions/cache](https://github.com/actions/cache) from 5 to 6.\n- [Release notes](https://github.com/actions/cache/releases)\n- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)\n- [Commits](https://github.com/actions/cache/compare/v5...v6)\n\n---\nupdated-dependencies:\n- dependenc\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump actions/cache from 5 to 6 (#3613)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-28T21:34:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5c8e10143bd6d511e59c336ca8670e325e1cbeb8",
          "body": "* fix: show params with sources in explain output\n\nParameters with a source (e.g. output injection) were\nhidden from `porter explain`. Show them with an\n`(injected)` default label so users know Porter will\nattempt to populate them from a prior run's output.\n\nFor install and stateless actions where i\n[…]\nnil passed as interface{}\nwhere a concrete cnabtooci.RegistryOptions is needed.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Show params with sources in porter explain output (#3604)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-06-27T22:13:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c8b89caea58645a1e2813a0c12a2b848d66dbcd1",
          "body": "Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.5.1 to 1.5.2.\n- [Release notes](https://github.com/sigstore/rekor/releases)\n- [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/sigstore/rekor/compare/v1.5.1...v1.5.2)\n\n---\n\n[…]\nkor\n  dependency-version: 1.5.2\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump github.com/sigstore/rekor from 1.5.1 to 1.5.2 (#3611)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-26T11:39:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5497e64df8efe210b67f73c205fa960282abd4a6",
          "body": "* fix: param sets override persisted --param values\n\nWhen upgrading, parameters previously set via --param were\npersisted on the installation and incorrectly suppressed\nresolution of values from a named parameter set. Parameter\nsets should take precedence over old persisted values, with\nonly current\n[…]\ndled correctly, and TrimSpace corruption of whitespace\nin values is eliminated.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Param sets override persisted --param values on upgrade (#3600)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-06-26T11:35:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "79304bdf8b507694f0c3b67b422ed4aa3fd419df",
          "body": "….33 (#3610)\n\nBumps [github.com/containerd/containerd](https://github.com/containerd/containerd) from 1.7.31 to 1.7.33.\n- [Release notes](https://github.com/containerd/containerd/releases)\n- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)\n- [Commits](https://github.com/co\n[…]\nndency-version: 1.7.33\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump github.com/containerd/containerd from 1.7.31 to 1.7…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-26T10:49:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ccb683b2cfddb3261d6b67d91fd9c9022241a5d8",
          "body": "….2.5 (#3608)\n\nChore(deps): Bump github.com/containerd/containerd/v2\n\nBumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.2.3 to 2.2.5.\n- [Release notes](https://github.com/containerd/containerd/releases)\n- [Changelog](https://github.com/containerd/containerd\n[…]\n/v2\n  dependency-version: 2.2.5\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump github.com/containerd/containerd/v2 from 2.2.3 to 2…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-23T09:54:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c6bcee2f22e7d4bfc8deba78f19775aa77b96ba6",
          "body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/v6...v7)\n\n---\nupdated-dependenc\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump actions/checkout from 6 to 7 (#3606)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-23T09:52:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "07c927850f697ae2935a736c5d652a79937d847e",
          "body": "* feat(config): add dependencies.version-strategy setting\n\nAdd DependenciesConfig struct, constants for the four strategies\n(exact, max-patch, max-minor, min), and GetDependenciesVersionStrategy\naccessor that defaults to \"exact\".\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n* feat(cnab): \n[…]\n ref rather than error.\nOnly error when there is no pinned ref to fall back to.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Resolve dependency version ranges (#3572)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-06-13T22:35:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "478d31a7014ad9ad7ec1698cd649feff551ceb05",
          "body": "* fix: print errors once, not per span level\n\nRemove console logging from TraceLogger.Error() so errors are\nonly recorded to the OTel span. main.go (porter and exec) now\nprints the final error to stderr exactly once after command\nexecution fails, eliminating the repeated/growing error chain\nvisible \n[…]\nngly.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\nCo-authored-by: schristoff <28318173+schristoff@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Print errors once, not per span level (#3592)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-05-27T09:32:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a5b4e3e17175f69555c7d6268f0a17b0d8b9e2be",
          "body": "Bumps [docker/login-action](https://github.com/docker/login-action) from 4.1.0 to 4.2.0.\n- [Release notes](https://github.com/docker/login-action/releases)\n- [Commits](https://github.com/docker/login-action/compare/v4.1.0...v4.2.0)\n\n---\nupdated-dependencies:\n- dependency-name: docker/login-action\n  \n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump docker/login-action from 4.1.0 to 4.2.0 (#3597)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-27T09:31:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "35dbbc2c9d3e0fc8464e142772f77c31c56978a8",
          "body": "chore: update Go to 1.25.10\n\nBump go.mod and all workflow files from 1.25.8 to 1.25.10.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Update Go to 1.25.10 (#3593)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-05-18T21:36:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "94395e35c04ccbcc2cd771ee5ee2c8e343bca2b6",
          "body": "docs: add .dockerignore page for bundles\n\nExplain why .dockerignore exists, what the default\nfile contains, and how to use it to reduce installer\nimage size. Link from the bundle index and from the\ncustom-dockerfile page.\n\nCloses #1264\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Add .dockerignore page for bundles (#3594)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-05-18T09:43:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bb128f54ba69ca5eb3423235c1ea65dd06aeadc2",
          "body": "… updates (#3591)\n\nBumps the go-dependencies group with 3 updates in the / directory: [github.com/docker/buildx](https://github.com/docker/buildx), [github.com/tidwall/gjson](https://github.com/tidwall/gjson) and [google.golang.org/grpc](https://github.com/grpc/grpc-go).\n\n\nUpdates `github.com/docker\n[…]\nion-update:semver-minor\n  dependency-group: go-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump the go-dependencies group across 1 directory with 5…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-17T20:46:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d09ee7ab896da84957eb444c371aaff58a28b5d7",
          "body": "* feat: Add MCP server\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n* ci: ignore segmentio/asm in license check\n\nLicense lives at repo root; subpackages have no own LICENSE\nfiles, causing go-licenses to fail. Introduced transitively\nvia github.com/modelcontextprotocol/go-sdk.\n\nSigned-off-\n[…]\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n* docs: Update CLI docs\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Add MCP server (#3577)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-05-17T13:55:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "34f99cc8c5f4d5918693366428f76550963db407",
          "body": "…com/in-toto/in-toto-golang-0.11.0\n\nChore(deps): Bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0",
          "is_bot": false,
          "headline": "Merge pull request #3589 from getporter/dependabot/go_modules/github.…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-05-10T10:43:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c06754cfde9e70f37655969acd7149d56ec2c71d",
          "body": "Bumps [github.com/in-toto/in-toto-golang](https://github.com/in-toto/in-toto-golang) from 0.10.0 to 0.11.0.\n- [Release notes](https://github.com/in-toto/in-toto-golang/releases)\n- [Changelog](https://github.com/in-toto/in-toto-golang/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/in-toto/i\n[…]\n.11.0)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/in-toto/in-toto-golang\n  dependency-version: 0.11.0\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump github.com/in-toto/in-toto-golang",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-08T22:27:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4cb9c9597ac720298bf541430d77f2a78a201289",
          "body": "…ndencies-6fcea45fc3\n\nChore(deps): Bump the go-dependencies group with 4 updates",
          "is_bot": false,
          "headline": "Merge pull request #3588 from getporter/dependabot/go_modules/go-depe…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-05-04T16:07:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "87fc7268516c93c0a7c3f3f32b8e37713625a6ea",
          "body": "Bumps the go-dependencies group with 4 updates: [github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver), [github.com/docker/cli](https://github.com/docker/cli), [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) and [go.uber.org/zap](https://github.com/uber-go/zap).\n\n\n[…]\n dependency-version: 1.28.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n  dependency-group: go-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump the go-dependencies group with 4 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-03T04:53:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3185c8c96f8ec034e75261d2ea12375f3769573d",
          "body": "…ndencies-cd0d47135c\n\nChore(deps): Bump the go-dependencies group with 4 updates",
          "is_bot": false,
          "headline": "Merge pull request #3587 from getporter/dependabot/go_modules/go-depe…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-04-26T09:41:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f7ff4bed53d712252275be29742f30816ed3b39a",
          "body": "Bumps the go-dependencies group with 4 updates: [github.com/docker/cli](https://github.com/docker/cli), [github.com/magefile/mage](https://github.com/magefile/mage), [github.com/moby/moby/api](https://github.com/moby/moby) and [github.com/moby/moby/client](https://github.com/moby/moby).\n\n\nUpdates `g\n[…]\n  dependency-version: 0.4.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: go-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump the go-dependencies group with 4 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-26T04:53:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4dd49bf479a4a546573c9272b23ae32e6fb1e812",
          "body": "…com/sigstore/timestamp-authority/v2-2.0.6\n\nChore(deps): Bump github.com/sigstore/timestamp-authority/v2 from 2.0.5 to 2.0.6",
          "is_bot": false,
          "headline": "Merge pull request #3586 from getporter/dependabot/go_modules/github.…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-04-19T16:46:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "96aad64dd4dfd12829a59e23fad4b64944060d06",
          "body": "Bumps [github.com/sigstore/timestamp-authority/v2](https://github.com/sigstore/timestamp-authority) from 2.0.5 to 2.0.6.\n- [Release notes](https://github.com/sigstore/timestamp-authority/releases)\n- [Changelog](https://github.com/sigstore/timestamp-authority/blob/main/CHANGELOG.md)\n- [Commits](https\n[…]\n---\nupdated-dependencies:\n- dependency-name: github.com/sigstore/timestamp-authority/v2\n  dependency-version: 2.0.6\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump github.com/sigstore/timestamp-authority/v2",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-19T07:36:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "df193514ea1c2a0687a7fd2c362b90afb165bb5a",
          "body": "….31 in the go-dependencies group (#3585)\n\nChore(deps): Bump github.com/containerd/containerd\n\nBumps the go-dependencies group with 1 update: [github.com/containerd/containerd](https://github.com/containerd/containerd).\n\n\nUpdates `github.com/containerd/containerd` from 1.7.30 to 1.7.31\n- [Release no\n[…]\nion-update:semver-patch\n  dependency-group: go-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump github.com/containerd/containerd from 1.7.30 to 1.7…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-19T07:35:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c9ce8e1e67c7aab88fb565afecf435d98a8d2006",
          "body": "…ions/upload-artifact-7.0.1\n\nChore(deps): Bump actions/upload-artifact from 7.0.0 to 7.0.1",
          "is_bot": false,
          "headline": "Merge pull request #3583 from getporter/dependabot/github_actions/act…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-04-12T15:16:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1a757e5955b788806502515071abb24445210b69",
          "body": "…ifact-7.0.1",
          "is_bot": false,
          "headline": "Merge branch 'main' into dependabot/github_actions/actions/upload-art…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-04-12T14:49:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c27de1a10d771d884bc4a0aec4982abdbaf82385",
          "body": "…ndencies-3af53f2ad0\n\nChore(deps): Bump the go-dependencies group with 4 updates",
          "is_bot": false,
          "headline": "Merge pull request #3584 from getporter/dependabot/go_modules/go-depe…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-04-12T14:48:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "69240c38476d8105c8c9fb2c3a50888171b1b848",
          "body": "Bumps the go-dependencies group with 4 updates: [github.com/docker/cli](https://github.com/docker/cli), [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry), [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) and [go.opentelemetry.io/contrib/instrume\n[…]\n dependency-version: 0.68.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n  dependency-group: go-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump the go-dependencies group with 4 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-12T04:53:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f781bcda8a19a772d10d3cd9502a8898e2b1da07",
          "body": "Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 7.0.0 to 7.0.1.\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-artifact/compare/v7.0.0...v7.0.1)\n\n---\nupdated-dependencies:\n- dependency-name: actions/upload-artifact\n  dependency-version: 7.0.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump actions/upload-artifact from 7.0.0 to 7.0.1",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-12T04:52:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a81c51a810dcab466285335357dd013e54dcbfa1",
          "body": "* fix: scope secret resolution to selected context\n\nIn multi-context configs, ${secret.*} references were collected\nfrom the entire file before the active context was known. This\ncaused secrets from unselected contexts to be resolved, failing\nwhen those secrets don't exist in the active plugin.\n\nNow\n[…]\nll\nprevents redundant scanning across the two passes within a\nsingle Load call.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Scope secret resolution to selected context (#3561)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-04-10T22:09:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bd5b8206f94aec73ed49391fdb3b3f02808410c3",
          "body": "…ker/login-action-4.1.0\n\nChore(deps): Bump docker/login-action from 4.0.0 to 4.1.0",
          "is_bot": false,
          "headline": "Merge pull request #3580 from getporter/dependabot/github_actions/doc…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-04-05T21:07:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1a3153d354ca67c39b4808d990ea37f088171ae8",
          "body": "…n-4.1.0",
          "is_bot": false,
          "headline": "Merge branch 'main' into dependabot/github_actions/docker/login-actio…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-04-05T20:01:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "af90c5c99de70ae758a425289052531a36a5988f",
          "body": "…ndencies-d6ac97ecb2\n\nChore(deps): Bump the go-dependencies group with 13 updates",
          "is_bot": false,
          "headline": "Merge pull request #3581 from getporter/dependabot/go_modules/go-depe…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-04-05T19:54:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "03372cd8ca81f3659287550b6781ec6809fef60f",
          "body": "Bumps the go-dependencies group with 13 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [github.com/docker/buildx](https://github.com/docker/buildx) | `0.32.1` | `0.33.0` |\n| [github.com/magefile/mage](https://github.com/magefile/mage) | `1.17.0` | `1.17.1` |\n| [github.com/moby/buildkit](htt\n[…]\n dependency-version: 1.80.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n  dependency-group: go-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump the go-dependencies group with 13 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-05T04:53:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "97bf5f8395dd892b4a1b8258cd3d735a9989f23b",
          "body": "Bumps [docker/login-action](https://github.com/docker/login-action) from 4.0.0 to 4.1.0.\n- [Release notes](https://github.com/docker/login-action/releases)\n- [Commits](https://github.com/docker/login-action/compare/v4.0.0...v4.1.0)\n\n---\nupdated-dependencies:\n- dependency-name: docker/login-action\n  dependency-version: 4.1.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump docker/login-action from 4.0.0 to 4.1.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-05T04:52:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c9278496ddf9b1a6a849116f7db0afb587b2b19e",
          "body": "…ndencies-acda7f0ef0\n\nChore(deps): Bump the go-dependencies group with 3 updates",
          "is_bot": false,
          "headline": "Merge pull request #3578 from getporter/dependabot/go_modules/go-depe…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-04-01T19:46:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "71173c3940ad21df34c5c3c23078aba87e9879ee",
          "body": "…0ef0",
          "is_bot": false,
          "headline": "Merge branch 'main' into dependabot/go_modules/go-dependencies-acda7f…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-04-01T19:19:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0adcbe213fffc328400e874aa871b7d184f57c47",
          "body": "* feat: add persistent parameter shorthand\n\nAdd `persistent: true` on a parameter as shorthand for\nwiring up a matching output so the value is remembered\nacross bundle executions (install → upgrade/uninstall).\n\nRequires schema version 1.2.0 and the\n`persistent-parameters` experimental feature flag.\n\n[…]\nersistent-parameters (schema 1.2.0) should also\nbe able to use dependencies-v2.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "feat: add persistent parameter shorthand (#3574)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-03-30T11:58:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2bb4c9b830c979607cb259872be19b883dc1f73c",
          "body": "Bumps the go-dependencies group with 3 updates: [github.com/docker/cli](https://github.com/docker/cli), [github.com/magefile/mage](https://github.com/magefile/mage) and [github.com/moby/buildkit](https://github.com/moby/buildkit).\n\n\nUpdates `github.com/docker/cli` from 29.3.0+incompatible to 29.3.1+\n[…]\n dependency-version: 0.28.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: go-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump the go-dependencies group with 3 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-29T04:53:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "de01a51d53c8df655e15a48897ea9e4747d56456",
          "body": "Add a best-practices page explaining when to use the\n`images` section vs hardcoded image references, including\nhow relocation works and an approach decision table.\n\nUpdate the manifest images section with context on when\nto use or skip the images section. Add cross-links from\nairgap and manifest docs to the new page.\n\nCloses #2708\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "docs: add best practice for bundle image refs (#3575)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-03-24T16:23:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "787de67cb852de21ac1aa674830124846e64c537",
          "body": "…e go-dependencies group across 1 directory (#3576)\n\nChore(deps): Bump get.porter.sh/magefiles\n\nBumps the go-dependencies group with 1 update in the / directory: [get.porter.sh/magefiles](https://github.com/getporter/magefiles).\n\n\nUpdates `get.porter.sh/magefiles` from 0.6.13 to 0.6.14\n- [Release no\n[…]\nion-update:semver-patch\n  dependency-group: go-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump get.porter.sh/magefiles from 0.6.13 to 0.6.14 in th…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-24T16:23:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f2e05dc7aa84456e90998d04cab8f815c7fdc84c",
          "body": "Migrate away from docker/docker to moby/moby/X",
          "is_bot": false,
          "headline": "Merge pull request #3559 from dgannon991/chore/replace-docker-docker",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-23T20:53:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d2182f53c458664bba12ad10b05e8141ecee3823",
          "body": "Signed-off-by: David Gannon <19214156+dgannon991@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Bumped dependencies",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-22T21:01:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "571549f5af4d875960dc0ea954c4bc2f9df159d4",
          "body": "Signed-off-by: David Gannon <19214156+dgannon991@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Addressed PR feedback",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-21T22:58:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fa3483024df65fde70c673190e48d2d72e298766",
          "body": "Signed-off-by: David Gannon <19214156+dgannon991@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Migrated from docker/docker to moby/moby/x",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-21T22:58:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7024fd98431fa39b4e2d50bc31b98aa9f9cd206b",
          "body": "Signed-off-by: David Gannon <19214156+dgannon991@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Moved away from docker/docker to moby/moby/x",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-21T22:58:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5aa52bf6dfdf2485a4e704e19b654377ef63dd3f",
          "body": "Adds a references/glossary.md page covering 12 terms used in\nPorter and CNAB documentation (Bundle, CNAB, Config File,\nDigest, Docker Host/Daemon, Installation, Manifest, Mixin,\nPlugin, Registry, Repository, Tag).\n\nCloses #1886\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "docs: add glossary page (#3573)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-03-21T22:50:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1b73bb4049c69961b656fdb2d6e78deaceddc30d",
          "body": "Bumped to go1.25",
          "is_bot": false,
          "headline": "Merge pull request #3566 from dgannon991/chore/go-1.25-upgrade",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-21T22:20:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "79756757d7977939e8aefdd53f0bf2c3e1b67b96",
          "body": "Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.79.1 to 1.79.3.\n- [Release notes](https://github.com/grpc/grpc-go/releases)\n- [Commits](https://github.com/grpc/grpc-go/compare/v1.79.1...v1.79.3)\n\n---\nupdated-dependencies:\n- dependency-name: google.golang.org/grpc\n  dependency-version: 1.79.3\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump google.golang.org/grpc from 1.79.1 to 1.79.3 (#3570)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-20T20:12:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8b9f641715530d0dfec3190e9b32126ff96d5dba",
          "body": "Signed-off-by: David Gannon <19214156+dgannon991@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Bumped to go1.25",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-16T21:25:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "39ad175691f1cb302b31c0264420e476888f968d",
          "body": "Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 8.0.0 to 8.0.1.\n- [Release notes](https://github.com/actions/download-artifact/releases)\n- [Commits](https://github.com/actions/download-artifact/compare/v8.0.0...v8.0.1)\n\n---\nupdated-dependencies:\n- dependency-name\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump actions/download-artifact from 8.0.0 to 8.0.1 (#3567)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-16T13:01:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cfac0dd993c2e26e7bf3e566d1801b250d26afef",
          "body": "…ker/setup-buildx-action-4\n\nChore(deps): Bump docker/setup-buildx-action from 3 to 4",
          "is_bot": false,
          "headline": "Merge pull request #3563 from getporter/dependabot/github_actions/doc…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-10T20:31:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "56207ecca4eee6fcc0092bb3845cba29ec03977d",
          "body": "…x-action-4",
          "is_bot": false,
          "headline": "Merge branch 'main' into dependabot/github_actions/docker/setup-build…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-09T22:05:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "460de1dbda90e45806fc841f0073a486866696a1",
          "body": "…ker/login-action-4.0.0\n\nChore(deps): Bump docker/login-action from 3.7.0 to 4.0.0",
          "is_bot": false,
          "headline": "Merge pull request #3562 from getporter/dependabot/github_actions/doc…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-08T19:59:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "45b2bd8e48ad14e3a1ab801e32e8658ad5db875b",
          "body": "Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3 to 4.\n- [Release notes](https://github.com/docker/setup-buildx-action/releases)\n- [Commits](https://github.com/docker/setup-buildx-action/compare/v3...v4)\n\n---\nupdated-dependencies:\n- dependency-name: docker/setup-buildx-action\n  dependency-version: '4'\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump docker/setup-buildx-action from 3 to 4",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-08T04:52:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "33896f187fa4b34584e5123853d27984da0beac5",
          "body": "Bumps [docker/login-action](https://github.com/docker/login-action) from 3.7.0 to 4.0.0.\n- [Release notes](https://github.com/docker/login-action/releases)\n- [Commits](https://github.com/docker/login-action/compare/v3.7.0...v4.0.0)\n\n---\nupdated-dependencies:\n- dependency-name: docker/login-action\n  dependency-version: 4.0.0\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump docker/login-action from 3.7.0 to 4.0.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-08T04:52:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "da4b9fcec91c2075928740f294b8614279de2d13",
          "body": "Only v-prefix tags with at least a major and minor version",
          "is_bot": false,
          "headline": "Merge pull request #3554 from erikced/fix-do-not-v-prefix-digits",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-02T21:33:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "407bb5777e3ab5bfb01f24cc339036bbc03da9f9",
          "body": "Update `tagIsSemverLike` to make it validate that the tag has nonzero\nlength instead of assuming the calling code has done this.\nSubsequently, remove `TasTag` check from `ensureVPrefix`. \n\nSigned-off-by: Erik Cederberg <erik.cederberg@sectra.com>",
          "is_bot": false,
          "headline": "refactor: move tag existence check",
          "author_name": "Erik Cederberg",
          "author_login": "erikced",
          "committed_at": "2026-03-02T11:20:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "327308c18f36acae16633de4dd3459f3c7e7c89f",
          "body": "Update auto v-prefixing on pull: only prefix tags with at least major\nand minor version, to avoid enforcing v-prefix on all-digit refs like\nhashes and build numbers.\n\nSigned-off-by: Erik Cederberg <erik.cederberg@sectra.com>",
          "is_bot": false,
          "headline": "fix: only v-prefix tags with at least a major and minor version",
          "author_name": "Erik Cederberg",
          "author_login": "erikced",
          "committed_at": "2026-03-02T11:20:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "424ae2c502f3b2e9c9aeb8546862f856dddb0962",
          "body": "* feat: multi-environment config via named contexts\n\nAdd kubectl-style multi-context support to the Porter config\nfile using a new schemaVersion: \"2.0.0\" format. Users can\ndefine multiple named contexts in a single config file and\nselect between them at runtime.\n\nChanges:\n- New config format: schema\n[…]\ned-off-by: Kim Christensen <kimworking@gmail.com>\n\n* docs: Update documentation\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Multi-environment config via named contexts (#3547)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-03-01T22:18:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "572620077caa39e9f475dce8a50723491aec6c81",
          "body": "…ions/download-artifact-8.0.0\n\nChore(deps): Bump actions/download-artifact from 7.0.0 to 8.0.0",
          "is_bot": false,
          "headline": "Merge pull request #3556 from getporter/dependabot/github_actions/act…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-01T15:10:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7f4f8a3ccc9837374d148bdb9214207d30dd3ce8",
          "body": "…rtifact-8.0.0",
          "is_bot": false,
          "headline": "Merge branch 'main' into dependabot/github_actions/actions/download-a…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-01T12:42:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "590aca0125d4d12fbfb265d938944fbed2642a20",
          "body": "…ions/upload-artifact-7.0.0\n\nChore(deps): Bump actions/upload-artifact from 6.0.0 to 7.0.0",
          "is_bot": false,
          "headline": "Merge pull request #3557 from getporter/dependabot/github_actions/act…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-01T12:40:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4203f68adb6a5dca8fb702e83c3cfed009f1a079",
          "body": "Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.0.\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-artifact/compare/v6.0.0...v7.0.0)\n\n---\nupdated-dependencies:\n- dependency-name: actions/upload-artifact\n  dependency-version: 7.0.0\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump actions/upload-artifact from 6.0.0 to 7.0.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-01T04:57:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9171c49ab25024e0072728fe1f1b68100cb6b24d",
          "body": "Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7.0.0 to 8.0.0.\n- [Release notes](https://github.com/actions/download-artifact/releases)\n- [Commits](https://github.com/actions/download-artifact/compare/v7.0.0...v8.0.0)\n\n---\nupdated-dependencies:\n- dependency-name: actions/download-artifact\n  dependency-version: 8.0.0\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump actions/download-artifact from 7.0.0 to 8.0.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-01T04:57:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e73c5056bc1b14b124c49b5b1f0326e38cf97114",
          "body": "chore: Update dependencies\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Update dependencies (#3552)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-02-25T12:36:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ea50a94feb3397fe97f46e67023b20fc862caeb7",
          "body": "chore(deps): Update OpenTelemetry dependencies\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Update OpenTelemetry dependencies (#3550)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-02-22T22:08:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "50754d279fe3f4db44b55229a627936493c26975",
          "body": "…#3549)\n\n* feat: add installation.id template var\n\nExpose installation UUID as PORTER_INSTALLATION_ID env var\nand installation.id template variable, giving bundles a\nglobally unique value for resource naming.\n\nCloses #2006\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n* docs: document inst\n[…]\nithin an installation's\nlifecycle but changes if the installation is recreated.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Add installation.id template var and PORTER_INSTALLATION_ID env var (…",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-02-22T22:07:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cb7f33cfe4a0a0d8f1411c9b33083426713a9109",
          "body": "chore: bump Go to 1.24.13\n\nUpdate Go version from 1.24.11 to 1.24.13 across all\nworkflows, go.mod, and Netlify config.\n\nResolves security vulnerabilities in the Go standard\nlibrary fixed in 1.24.13.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Bump Go to 1.24.13 (#3548)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-02-20T22:27:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "475ca03ca6fb10a0276daa991b26f530a1ab121c",
          "body": "* feat: add porter config show/edit commands\n\nAdd CLI commands to view and edit porter config file.\n- show: displays raw config, preserves template vars\n- edit: opens in $EDITOR, creates default if missing\n\nCloses #1077\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n* docs: Update documenta\n[…]\nned-off-by: Kim Christensen <kimworking@gmail.com>\n\n* fix: Use Fprintln instead\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Add porter config show/edit commands (#3544)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-02-11T21:06:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "23f826d183d62e0dd92a06dfd9d9c8d3b08f1b3c",
          "body": "…ker/login-action-3.7.0\n\nChore(deps): Bump docker/login-action from 3.6.0 to 3.7.0",
          "is_bot": false,
          "headline": "Merge pull request #3545 from getporter/dependabot/github_actions/doc…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-02-01T14:57:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "969bcd843f32a0d71bd94e61f5ce6f2871f67d52",
          "body": "Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.\n- [Release notes](https://github.com/docker/login-action/releases)\n- [Commits](https://github.com/docker/login-action/compare/v3.6.0...v3.7.0)\n\n---\nupdated-dependencies:\n- dependency-name: docker/login-action\n  dependency-version: 3.7.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump docker/login-action from 3.6.0 to 3.7.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-01T05:01:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "32e0799e4800d8c9b5cde248503b64b96cfc698f",
          "body": "* feat: optimize bundle image size by restructuring build\n\nChange build context from project root to .cnab directory and use\nnamed build context for user files. This eliminates duplicate COPY\nlayers and unnecessary RUN commands for file deletion.\n\nKey changes:\n- Build from .cnab directory instead of\n[…]\nigned-off-by: Claude <noreply@anthropic.com>\nSigned-off-by: Kim Christensen <2461567+kichristensen@users.noreply.github.com>\nCo-authored-by: David Gannon <19214156+dgannon991@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Optimize bundle size (#3488)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-01-28T22:50:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "24f608b02404749233bd860f47e102b128fcfd27",
          "body": "Pass in context to cnab-go Run()",
          "is_bot": false,
          "headline": "Merge pull request #3253 from dgannon991/feat/2234/cancel-context",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-01-19T22:00:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "25124b5dc57fd803993d7abd9bc97a77811263a3",
          "body": "Signed-off-by: David Gannon <19214156+dgannon991@users.noreply.github.com>",
          "is_bot": false,
          "headline": "#2234: Use the new published cnab-go library and provide our context",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-01-14T20:11:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d6f1fe95adc29f6b0bee889ba596aec96cfafac1",
          "body": "fix: validate porter file/dir conflicts\n\nDetect if file/directory named \"porter\" exists in bundle\ndirectory during build validation. Return clear error before\nconfusing runtime failure occurs.\n\nFixes #3536\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Validate porter file/dir conflicts (#3539)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-01-14T08:43:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b311a089b320758991d84dc0ac971d184669de2d",
          "body": "Expand paths-ignore filters to skip running CI/CD pipelines when only\ndocumentation files are modified. This includes:\n- All markdown files (*.md)\n- docs/ directory\n- LICENSE file\n- netlify.toml\n\nPreviously, paths-ignore was inconsistently applied - some workflows\nonly ignored docs/ on push events b\n[…]\nrkflows:\n- porter.yml\n- porter-integration-pr.yml\n- porter-canary.yml\n- porter-install-check.yml\n- codeql.yaml\n- trivy.yaml\n- check-licenses.yaml\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Skip CI pipelines for documentation-only changes (#3538)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-01-13T21:52:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 100,
      "commits_last_year": 265,
      "latest_release_at": "2021-04-06T21:29:46Z",
      "latest_release_tag": "canary",
      "releases_from_tags": false,
      "days_since_last_push": 0,
      "active_weeks_last_year": 48,
      "days_since_latest_release": 1933,
      "mean_days_between_releases": -141.3
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 100,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": true
    },
    "ecosystem": {
      "packages": [
        {
          "name": "get.porter.sh/porter",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": null,
          "registry_url": "https://pkg.go.dev/get.porter.sh/porter",
          "is_deprecated": false,
          "latest_version": "v1.6.1",
          "repository_url": null,
          "versions_count": 136,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-17T12:27:11Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 5
        }
      ]
    },
    "popularity": {
      "forks": 222,
      "stars": 1422,
      "watchers": 24,
      "fork_history": {
        "days": [
          {
            "date": "2018-12-10",
            "count": 1
          },
          {
            "date": "2018-12-11",
            "count": 2
          },
          {
            "date": "2018-12-13",
            "count": 1
          },
          {
            "date": "2018-12-15",
            "count": 1
          },
          {
            "date": "2019-01-02",
            "count": 2
          },
          {
            "date": "2019-01-11",
            "count": 1
          },
          {
            "date": "2019-01-14",
            "count": 1
          },
          {
            "date": "2019-02-12",
            "count": 1
          },
          {
            "date": "2019-02-20",
            "count": 1
          },
          {
            "date": "2019-02-23",
            "count": 1
          },
          {
            "date": "2019-03-05",
            "count": 1
          },
          {
            "date": "2019-04-19",
            "count": 1
          },
          {
            "date": "2019-05-29",
            "count": 1
          },
          {
            "date": "2019-05-30",
            "count": 1
          },
          {
            "date": "2019-07-17",
            "count": 1
          },
          {
            "date": "2019-07-25",
            "count": 2
          },
          {
            "date": "2019-08-06",
            "count": 2
          },
          {
            "date": "2019-08-09",
            "count": 1
          },
          {
            "date": "2019-09-12",
            "count": 1
          },
          {
            "date": "2019-09-17",
            "count": 1
          },
          {
            "date": "2019-09-21",
            "count": 1
          },
          {
            "date": "2019-09-24",
            "count": 1
          },
          {
            "date": "2019-09-26",
            "count": 2
          },
          {
            "date": "2019-09-27",
            "count": 1
          },
          {
            "date": "2019-09-28",
            "count": 1
          },
          {
            "date": "2019-10-01",
            "count": 1
          },
          {
            "date": "2019-10-12",
            "count": 1
          },
          {
            "date": "2019-10-16",
            "count": 1
          },
          {
            "date": "2019-10-24",
            "count": 1
          },
          {
            "date": "2019-10-25",
            "count": 1
          },
          {
            "date": "2019-11-04",
            "count": 1
          },
          {
            "date": "2019-11-06",
            "count": 1
          },
          {
            "date": "2019-11-07",
            "count": 1
          },
          {
            "date": "2019-11-20",
            "count": 1
          },
          {
            "date": "2019-11-24",
            "count": 1
          },
          {
            "date": "2019-12-11",
            "count": 1
          },
          {
            "date": "2020-01-02",
            "count": 1
          },
          {
            "date": "2020-01-15",
            "count": 1
          },
          {
            "date": "2020-01-24",
            "count": 1
          },
          {
            "date": "2020-01-29",
            "count": 1
          },
          {
            "date": "2020-02-07",
            "count": 2
          },
          {
            "date": "2020-02-10",
            "count": 2
          },
          {
            "date": "2020-02-18",
            "count": 1
          },
          {
            "date": "2020-03-16",
            "count": 1
          },
          {
            "date": "2020-03-20",
            "count": 1
          },
          {
            "date": "2020-06-03",
            "count": 1
          },
          {
            "date": "2020-06-08",
            "count": 1
          },
          {
            "date": "2020-06-09",
            "count": 1
          },
          {
            "date": "2020-06-15",
            "count": 1
          },
          {
            "date": "2020-06-22",
            "count": 1
          },
          {
            "date": "2020-07-01",
            "count": 1
          },
          {
            "date": "2020-07-08",
            "count": 1
          },
          {
            "date": "2020-08-13",
            "count": 1
          },
          {
            "date": "2020-09-03",
            "count": 1
          },
          {
            "date": "2020-10-14",
            "count": 1
          },
          {
            "date": "2020-10-17",
            "count": 1
          },
          {
            "date": "2020-10-18",
            "count": 1
          },
          {
            "date": "2020-10-28",
            "count": 1
          },
          {
            "date": "2020-11-12",
            "count": 1
          },
          {
            "date": "2020-11-22",
            "count": 1
          },
          {
            "date": "2020-12-15",
            "count": 1
          },
          {
            "date": "2020-12-20",
            "count": 1
          },
          {
            "date": "2021-01-20",
            "count": 1
          },
          {
            "date": "2021-02-08",
            "count": 1
          },
          {
            "date": "2021-02-24",
            "count": 1
          },
          {
            "date": "2021-02-26",
            "count": 1
          },
          {
            "date": "2021-04-08",
            "count": 2
          },
          {
            "date": "2021-04-21",
            "count": 1
          },
          {
            "date": "2021-05-05",
            "count": 1
          },
          {
            "date": "2021-05-23",
            "count": 1
          },
          {
            "date": "2021-05-26",
            "count": 1
          },
          {
            "date": "2021-06-04",
            "count": 1
          },
          {
            "date": "2021-06-12",
            "count": 1
          },
          {
            "date": "2021-06-15",
            "count": 1
          },
          {
            "date": "2021-06-16",
            "count": 1
          },
          {
            "date": "2021-06-18",
            "count": 1
          },
          {
            "date": "2021-06-22",
            "count": 1
          },
          {
            "date": "2021-06-23",
            "count": 1
          },
          {
            "date": "2021-06-25",
            "count": 1
          },
          {
            "date": "2021-07-22",
            "count": 1
          },
          {
            "date": "2021-07-24",
            "count": 2
          },
          {
            "date": "2021-07-26",
            "count": 1
          },
          {
            "date": "2021-08-23",
            "count": 3
          },
          {
            "date": "2021-09-22",
            "count": 1
          },
          {
            "date": "2021-09-28",
            "count": 1
          },
          {
            "date": "2021-10-07",
            "count": 1
          },
          {
            "date": "2021-10-08",
            "count": 1
          },
          {
            "date": "2021-10-26",
            "count": 1
          },
          {
            "date": "2021-10-30",
            "count": 1
          },
          {
            "date": "2021-10-31",
            "count": 1
          },
          {
            "date": "2021-11-03",
            "count": 1
          },
          {
            "date": "2021-11-05",
            "count": 3
          },
          {
            "date": "2021-11-27",
            "count": 1
          },
          {
            "date": "2021-12-13",
            "count": 1
          },
          {
            "date": "2021-12-17",
            "count": 1
          },
          {
            "date": "2021-12-30",
            "count": 1
          },
          {
            "date": "2022-01-08",
            "count": 1
          },
          {
            "date": "2022-01-09",
            "count": 2
          },
          {
            "date": "2022-01-14",
            "count": 1
          },
          {
            "date": "2022-02-17",
            "count": 1
          },
          {
            "date": "2022-02-18",
            "count": 2
          },
          {
            "date": "2022-04-16",
            "count": 1
          },
          {
            "date": "2022-04-20",
            "count": 1
          },
          {
            "date": "2022-05-24",
            "count": 1
          },
          {
            "date": "2022-05-25",
            "count": 1
          },
          {
            "date": "2022-05-31",
            "count": 2
          },
          {
            "date": "2022-06-10",
            "count": 1
          },
          {
            "date": "2022-06-14",
            "count": 1
          },
          {
            "date": "2022-06-18",
            "count": 1
          },
          {
            "date": "2022-07-25",
            "count": 1
          },
          {
            "date": "2022-08-04",
            "count": 1
          },
          {
            "date": "2022-08-08",
            "count": 1
          },
          {
            "date": "2022-08-10",
            "count": 1
          },
          {
            "date": "2022-08-19",
            "count": 1
          },
          {
            "date": "2022-09-30",
            "count": 1
          },
          {
            "date": "2022-10-07",
            "count": 1
          },
          {
            "date": "2022-10-22",
            "count": 1
          },
          {
            "date": "2022-11-07",
            "count": 1
          },
          {
            "date": "2022-11-16",
            "count": 1
          },
          {
            "date": "2022-11-30",
            "count": 1
          },
          {
            "date": "2022-12-08",
            "count": 1
          },
          {
            "date": "2022-12-12",
            "count": 1
          },
          {
            "date": "2022-12-26",
            "count": 1
          },
          {
            "date": "2022-12-30",
            "count": 1
          },
          {
            "date": "2023-01-09",
            "count": 1
          },
          {
            "date": "2023-02-02",
            "count": 1
          },
          {
            "date": "2023-03-29",
            "count": 1
          },
          {
            "date": "2023-04-04",
            "count": 1
          },
          {
            "date": "2023-04-10",
            "count": 1
          },
          {
            "date": "2023-04-18",
            "count": 1
          },
          {
            "date": "2023-05-03",
            "count": 1
          },
          {
            "date": "2023-05-09",
            "count": 1
          },
          {
            "date": "2023-05-22",
            "count": 1
          },
          {
            "date": "2023-06-08",
            "count": 3
          },
          {
            "date": "2023-06-10",
            "count": 1
          },
          {
            "date": "2023-06-20",
            "count": 1
          },
          {
            "date": "2023-06-22",
            "count": 1
          },
          {
            "date": "2023-06-30",
            "count": 1
          },
          {
            "date": "2023-07-04",
            "count": 1
          },
          {
            "date": "2023-07-24",
            "count": 2
          },
          {
            "date": "2023-07-25",
            "count": 1
          },
          {
            "date": "2023-08-18",
            "count": 2
          },
          {
            "date": "2023-08-20",
            "count": 1
          },
          {
            "date": "2023-08-21",
            "count": 1
          },
          {
            "date": "2023-08-29",
            "count": 1
          },
          {
            "date": "2023-09-13",
            "count": 1
          },
          {
            "date": "2023-09-24",
            "count": 1
          },
          {
            "date": "2023-09-27",
            "count": 1
          },
          {
            "date": "2023-11-09",
            "count": 1
          },
          {
            "date": "2023-11-17",
            "count": 1
          },
          {
            "date": "2023-12-08",
            "count": 1
          },
          {
            "date": "2023-12-24",
            "count": 1
          },
          {
            "date": "2024-01-05",
            "count": 1
          },
          {
            "date": "2024-01-24",
            "count": 1
          },
          {
            "date": "2024-02-05",
            "count": 1
          },
          {
            "date": "2024-02-09",
            "count": 1
          },
          {
            "date": "2024-02-13",
            "count": 2
          },
          {
            "date": "2024-03-14",
            "count": 1
          },
          {
            "date": "2024-03-21",
            "count": 2
          },
          {
            "date": "2024-04-04",
            "count": 1
          },
          {
            "date": "2024-04-18",
            "count": 1
          },
          {
            "date": "2024-06-04",
            "count": 1
          },
          {
            "date": "2024-06-06",
            "count": 1
          },
          {
            "date": "2024-06-18",
            "count": 1
          },
          {
            "date": "2024-07-11",
            "count": 1
          },
          {
            "date": "2024-08-14",
            "count": 1
          },
          {
            "date": "2024-08-17",
            "count": 1
          },
          {
            "date": "2024-08-26",
            "count": 1
          },
          {
            "date": "2024-09-04",
            "count": 1
          },
          {
            "date": "2024-09-17",
            "count": 1
          },
          {
            "date": "2024-10-08",
            "count": 1
          },
          {
            "date": "2024-10-28",
            "count": 1
          },
          {
            "date": "2024-11-08",
            "count": 1
          },
          {
            "date": "2024-11-12",
            "count": 1
          },
          {
            "date": "2024-12-03",
            "count": 1
          },
          {
            "date": "2025-02-12",
            "count": 1
          },
          {
            "date": "2025-02-20",
            "count": 1
          },
          {
            "date": "2025-02-28",
            "count": 1
          },
          {
            "date": "2025-03-25",
            "count": 1
          },
          {
            "date": "2025-03-26",
            "count": 1
          },
          {
            "date": "2025-03-29",
            "count": 1
          },
          {
            "date": "2025-04-08",
            "count": 1
          },
          {
            "date": "2025-04-16",
            "count": 1
          },
          {
            "date": "2025-04-26",
            "count": 1
          },
          {
            "date": "2025-05-03",
            "count": 1
          },
          {
            "date": "2025-05-24",
            "count": 1
          },
          {
            "date": "2025-06-13",
            "count": 1
          },
          {
            "date": "2025-07-02",
            "count": 1
          },
          {
            "date": "2025-07-21",
            "count": 1
          },
          {
            "date": "2025-07-30",
            "count": 1
          },
          {
            "date": "2025-09-07",
            "count": 1
          },
          {
            "date": "2025-09-09",
            "count": 1
          },
          {
            "date": "2025-11-17",
            "count": 1
          },
          {
            "date": "2025-12-28",
            "count": 1
          },
          {
            "date": "2026-02-28",
            "count": 1
          },
          {
            "date": "2026-03-08",
            "count": 1
          },
          {
            "date": "2026-05-26",
            "count": 1
          },
          {
            "date": "2026-07-12",
            "count": 1
          },
          {
            "date": "2026-07-19",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 221,
        "total_forks": 222
      },
      "star_history": null,
      "open_issues_and_prs": 129
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": true,
      "bootstrap_files": [],
      "api_schema_files": [
        "pkg/secrets/plugins/proto/secrets_protocol.proto",
        "pkg/signing/plugins/proto/signing_protocol.proto",
        "pkg/storage/plugins/proto/storage_protocol.proto",
        "proto/porterapis/installation/v1alpha1/installation.proto",
        "proto/porterapis/porter/v1alpha1/porter.proto"
      ],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "docs/go.mod",
        "go.mod"
      ],
      "largest_source_bytes": 55257,
      "source_files_sampled": 584,
      "oversized_source_files": 0,
      "agent_instruction_files": [
        "docs/content/docs/references/docker-images/agent.md"
      ],
      "agent_instruction_max_bytes": 4506
    },
    "dependencies": {
      "manifests": [
        "docs/go.mod",
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "github.com/distribution/distribution",
            "direct": false,
            "version": "v2.8.3+incompatible",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-3p65-76g6-3w7r",
              "GHSA-6pjf-3r9x-m592",
              "GHSA-f2g3-hh2r-cwgc",
              "GO-2025-3460",
              "GO-2026-5094",
              "GO-2026-5185"
            ],
            "fixed_version": "3.1.1",
            "advisory_count": 6,
            "oldest_advisory_days": 506
          },
          {
            "name": "github.com/docker/docker",
            "direct": false,
            "version": "v28.5.2+incompatible",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 8.8,
            "advisory_ids": [
              "GHSA-pxq6-2prw-chj9",
              "GHSA-rg2x-37c3-w2rh",
              "GHSA-vp62-88p7-qqf5",
              "GHSA-x744-4wpc-v9h2",
              "GHSA-x86f-5xw2-fm2r",
              "GO-2026-4883",
              "GO-2026-4887",
              "GO-2026-5617",
              "GO-2026-5668",
              "GO-2026-5746"
            ],
            "fixed_version": "29.3.1",
            "advisory_count": 10,
            "oldest_advisory_days": 117
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.53.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5932"
            ],
            "fixed_version": null,
            "advisory_count": 1,
            "oldest_advisory_days": 15
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.38.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 8
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "high": 2,
          "unknown": 2
        },
        "advisory_count": 18,
        "affected_count": 4,
        "assessed_count": 293,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "get.porter.sh/magefiles",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.14"
        },
        {
          "name": "github.com/Masterminds/semver/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.5.0"
        },
        {
          "name": "github.com/PaesslerAG/jsonpath",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.1"
        },
        {
          "name": "github.com/carolynvs/aferox",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.0"
        },
        {
          "name": "github.com/carolynvs/datetime-printer",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.2.0"
        },
        {
          "name": "github.com/cbroglie/mustache",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.0"
        },
        {
          "name": "github.com/cnabio/cnab-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.26.4"
        },
        {
          "name": "github.com/cnabio/cnab-to-oci",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.1"
        },
        {
          "name": "github.com/cnabio/image-relocation",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.9.2"
        },
        {
          "name": "github.com/containerd/containerd/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.3.3"
        },
        {
          "name": "github.com/davecgh/go-spew",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.2-0.20180830191138-d8f796af33cc"
        },
        {
          "name": "github.com/distribution/reference",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.1-0.20240718132515-8c942b0459df"
        },
        {
          "name": "github.com/docker/buildx",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.35.0"
        },
        {
          "name": "github.com/docker/cli",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v29.6.2+incompatible"
        },
        {
          "name": "github.com/dustin/go-humanize",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.1"
        },
        {
          "name": "github.com/ghodss/yaml",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/google/go-cmp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.0"
        },
        {
          "name": "github.com/google/go-containerregistry",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.21.7"
        },
        {
          "name": "github.com/google/uuid",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/grpc-ecosystem/go-grpc-middleware",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.0"
        },
        {
          "name": "github.com/grpc-ecosystem/go-grpc-prometheus",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.0"
        },
        {
          "name": "github.com/hashicorp/go-hclog",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.3"
        },
        {
          "name": "github.com/hashicorp/go-multierror",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1"
        },
        {
          "name": "github.com/hashicorp/go-plugin",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.7.0"
        },
        {
          "name": "github.com/jeremywohl/flatten",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.1"
        },
        {
          "name": "github.com/magefile/mage",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.17.2"
        },
        {
          "name": "github.com/mattn/go-colorable",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.15"
        },
        {
          "name": "github.com/mattn/go-isatty",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.23"
        },
        {
          "name": "github.com/mikefarah/yq/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.0-20201202084205-8846255d1c37"
        },
        {
          "name": "github.com/mitchellh/mapstructure",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.5.0"
        },
        {
          "name": "github.com/mmcdole/gofeed",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.0"
        },
        {
          "name": "github.com/moby/buildkit",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.31.2"
        },
        {
          "name": "github.com/moby/moby/api",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.55.0"
        },
        {
          "name": "github.com/moby/moby/client",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.0"
        },
        {
          "name": "github.com/moby/term",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.2"
        },
        {
          "name": "github.com/modelcontextprotocol/go-sdk",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.1"
        },
        {
          "name": "github.com/olekukonko/tablewriter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.4"
        },
        {
          "name": "github.com/opencontainers/go-digest",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/opencontainers/image-spec",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1"
        },
        {
          "name": "github.com/osteele/liquid",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.1"
        },
        {
          "name": "github.com/pelletier/go-toml",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.9.5"
        },
        {
          "name": "github.com/prometheus/client_golang",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.23.2"
        },
        {
          "name": "github.com/spf13/afero",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.15.0"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.2"
        },
        {
          "name": "github.com/spf13/pflag",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.10"
        },
        {
          "name": "github.com/spf13/viper",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.21.0"
        },
        {
          "name": "github.com/stretchr/testify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.11.1"
        },
        {
          "name": "github.com/tidwall/gjson",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.19.0"
        },
        {
          "name": "github.com/tidwall/sjson",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.5"
        },
        {
          "name": "github.com/uwu-tools/magex",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.10.1"
        },
        {
          "name": "github.com/xeipuuv/gojsonschema",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.0"
        },
        {
          "name": "go.mongodb.org/mongo-driver",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.17.9"
        },
        {
          "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.69.0"
        },
        {
          "name": "go.opentelemetry.io/otel",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/exporters/stdout/stdouttrace",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/sdk",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/trace",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.uber.org/zap",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.28.0"
        },
        {
          "name": "golang.org/x/sync",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.22.0"
        },
        {
          "name": "google.golang.org/grpc",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.82.1"
        },
        {
          "name": "google.golang.org/protobuf",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.36.12-0.20260120151049-f2248ac996af"
        },
        {
          "name": "gopkg.in/AlecAivazis/survey.v1",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.8"
        },
        {
          "name": "gopkg.in/op/go-logging.v1",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0-20160211212156-b2cb9fa56473"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        },
        {
          "name": "k8s.io/utils",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20260319190234-28399d86e0b5"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "get.porter.sh/magefiles",
            "direct": true,
            "version": "v0.6.14",
            "ecosystem": "go"
          },
          {
            "name": "github.com/carolynvs/aferox",
            "direct": true,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/carolynvs/datetime-printer",
            "direct": true,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cbroglie/mustache",
            "direct": true,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cnabio/cnab-go",
            "direct": true,
            "version": "v0.26.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cnabio/cnab-to-oci",
            "direct": true,
            "version": "v0.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cnabio/image-relocation",
            "direct": true,
            "version": "v0.9.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/containerd/v2",
            "direct": true,
            "version": "v2.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": true,
            "version": "v1.1.2-0.20180830191138-d8f796af33cc",
            "ecosystem": "go"
          },
          {
            "name": "github.com/distribution/reference",
            "direct": true,
            "version": "v0.6.1-0.20240718132515-8c942b0459df",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/buildx",
            "direct": true,
            "version": "v0.35.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/cli",
            "direct": true,
            "version": "v29.6.2+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dustin/go-humanize",
            "direct": true,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ghodss/yaml",
            "direct": true,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-cmp",
            "direct": true,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-containerregistry",
            "direct": true,
            "version": "v0.21.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/uuid",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/grpc-ecosystem/go-grpc-middleware",
            "direct": true,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/grpc-ecosystem/go-grpc-prometheus",
            "direct": true,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-hclog",
            "direct": true,
            "version": "v1.6.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-multierror",
            "direct": true,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jeremywohl/flatten",
            "direct": true,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/magefile/mage",
            "direct": true,
            "version": "v1.17.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/semver/v3",
            "direct": true,
            "version": "v3.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-colorable",
            "direct": true,
            "version": "v0.1.15",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-isatty",
            "direct": true,
            "version": "v0.0.23",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mikefarah/yq/v3",
            "direct": true,
            "version": "v3.0.0-20201202084205-8846255d1c37",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/mapstructure",
            "direct": true,
            "version": "v1.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mmcdole/gofeed",
            "direct": true,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/buildkit",
            "direct": true,
            "version": "v0.31.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/moby/api",
            "direct": true,
            "version": "v1.55.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/moby/client",
            "direct": true,
            "version": "v0.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/term",
            "direct": true,
            "version": "v0.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modelcontextprotocol/go-sdk",
            "direct": true,
            "version": "v1.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/tablewriter",
            "direct": true,
            "version": "v1.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/go-digest",
            "direct": true,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/image-spec",
            "direct": true,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/osteele/liquid",
            "direct": true,
            "version": "v1.8.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/paesslerag/jsonpath",
            "direct": true,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml",
            "direct": true,
            "version": "v1.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/client_golang",
            "direct": true,
            "version": "v1.23.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/afero",
            "direct": true,
            "version": "v1.15.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cobra",
            "direct": true,
            "version": "v1.10.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": true,
            "version": "v1.0.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/viper",
            "direct": true,
            "version": "v1.21.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/testify",
            "direct": true,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/gjson",
            "direct": true,
            "version": "v1.19.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/sjson",
            "direct": true,
            "version": "v1.2.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/uwu-tools/magex",
            "direct": true,
            "version": "v0.10.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonschema",
            "direct": true,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "go.mongodb.org/mongo-driver",
            "direct": true,
            "version": "v1.17.9",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
            "direct": true,
            "version": "v0.69.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/stdout/stdouttrace",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/trace",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/zap",
            "direct": true,
            "version": "v1.28.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sync",
            "direct": true,
            "version": "v0.22.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/grpc",
            "direct": true,
            "version": "v1.82.1",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/protobuf",
            "direct": true,
            "version": "v1.36.12-0.20260120151049-f2248ac996af",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/alecaivazis/survey.v1",
            "direct": true,
            "version": "v1.8.8",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/op/go-logging.v1",
            "direct": true,
            "version": "v1.0.0-20160211212156-b2cb9fa56473",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": true,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/utils",
            "direct": true,
            "version": "v0.0.0-20260319190234-28399d86e0b5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/agnivade/levenshtein",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/apparentlymart/go-textseg/v15",
            "direct": false,
            "version": "v15.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/asaskevich/govalidator",
            "direct": false,
            "version": "v0.0.0-20230301143203-a9d515a09cc2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2",
            "direct": false,
            "version": "v1.42.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/config",
            "direct": false,
            "version": "v1.32.24",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/credentials",
            "direct": false,
            "version": "v1.19.23",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds",
            "direct": false,
            "version": "v1.18.29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/configsources",
            "direct": false,
            "version": "v1.4.29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2",
            "direct": false,
            "version": "v2.7.29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/v4a",
            "direct": false,
            "version": "v1.4.30",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding",
            "direct": false,
            "version": "v1.13.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url",
            "direct": false,
            "version": "v1.13.29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/signin",
            "direct": false,
            "version": "v1.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sso",
            "direct": false,
            "version": "v1.31.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/ssooidc",
            "direct": false,
            "version": "v1.36.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sts",
            "direct": false,
            "version": "v1.43.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/smithy-go",
            "direct": false,
            "version": "v1.27.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/go-ansiterm",
            "direct": false,
            "version": "v0.0.0-20250102033503-faa5f7b0171c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/beorn7/perks",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/blang/semver",
            "direct": false,
            "version": "v3.5.1+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cenkalti/backoff/v5",
            "direct": false,
            "version": "v5.0.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cespare/xxhash/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/displaywidth",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/uax29/v2",
            "direct": false,
            "version": "v2.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cloudflare/circl",
            "direct": false,
            "version": "v1.6.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/console",
            "direct": false,
            "version": "v1.0.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/containerd/api",
            "direct": false,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/continuity",
            "direct": false,
            "version": "v0.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/errdefs",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/errdefs/pkg",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/log",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/platforms",
            "direct": false,
            "version": "v1.0.0-rc.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/ttrpc",
            "direct": false,
            "version": "v1.2.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/typeurl/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cpuguy83/go-md2man/v2",
            "direct": false,
            "version": "v2.0.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyberphone/json-canonicalization",
            "direct": false,
            "version": "v0.0.0-20241213102144-19d51d7fe467",
            "ecosystem": "go"
          },
          {
            "name": "github.com/decred/dcrd/dcrec/secp256k1/v4",
            "direct": false,
            "version": "v4.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/digitorus/pkcs7",
            "direct": false,
            "version": "v0.0.0-20250730155240-ffadbf3f398c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/digitorus/timestamp",
            "direct": false,
            "version": "v0.0.0-20250524132541-c45532741eea",
            "ecosystem": "go"
          },
          {
            "name": "github.com/distribution/distribution",
            "direct": false,
            "version": "v2.8.3+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/distribution",
            "direct": false,
            "version": "v2.8.3+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/docker",
            "direct": false,
            "version": "v28.5.2+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/docker-credential-helpers",
            "direct": false,
            "version": "v0.9.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-connections",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-metrics",
            "direct": false,
            "version": "v0.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-units",
            "direct": false,
            "version": "v0.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/emicklei/go-restful/v3",
            "direct": false,
            "version": "v3.13.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fatih/color",
            "direct": false,
            "version": "v1.19.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/felixge/httpsnoop",
            "direct": false,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fsnotify/fsnotify",
            "direct": false,
            "version": "v1.9.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fvbommel/sortorder",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fxamacker/cbor/v2",
            "direct": false,
            "version": "v2.9.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/logr",
            "direct": false,
            "version": "v1.4.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/stdr",
            "direct": false,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/analysis",
            "direct": false,
            "version": "v0.25.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/errors",
            "direct": false,
            "version": "v0.22.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/jsonpointer",
            "direct": false,
            "version": "v0.23.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/jsonreference",
            "direct": false,
            "version": "v0.21.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/loads",
            "direct": false,
            "version": "v0.23.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/runtime",
            "direct": false,
            "version": "v0.32.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/runtime/server-middleware",
            "direct": false,
            "version": "v0.30.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/spec",
            "direct": false,
            "version": "v0.22.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/strfmt",
            "direct": false,
            "version": "v0.26.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/cmdutils",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/conv",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/fileutils",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/jsonname",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/jsonutils",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/loading",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/mangling",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/netutils",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/stringutils",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/typeutils",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/yamlutils",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/validate",
            "direct": false,
            "version": "v0.25.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-viper/mapstructure/v2",
            "direct": false,
            "version": "v2.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gobwas/glob",
            "direct": false,
            "version": "v0.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/goccy/go-json",
            "direct": false,
            "version": "v0.10.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/goccy/go-yaml",
            "direct": false,
            "version": "v1.19.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gofrs/flock",
            "direct": false,
            "version": "v0.13.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/protobuf",
            "direct": false,
            "version": "v1.5.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/snappy",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/certificate-transparency-go",
            "direct": false,
            "version": "v1.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/gnostic-models",
            "direct": false,
            "version": "v0.7.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/jsonschema-go",
            "direct": false,
            "version": "v0.4.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/shlex",
            "direct": false,
            "version": "v0.0.0-20191202100458-e7afc7fbc510",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gorilla/mux",
            "direct": false,
            "version": "v1.8.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/grpc-ecosystem/grpc-gateway/v2",
            "direct": false,
            "version": "v2.29.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/errwrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-cleanhttp",
            "direct": false,
            "version": "v0.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/yamux",
            "direct": false,
            "version": "v0.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hiddeco/sshsig",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/imfing/hextra",
            "direct": false,
            "version": "v0.7.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/in-toto/attestation",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/in-toto/in-toto-golang",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/inconshreveable/mousetrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/json-iterator/go",
            "direct": false,
            "version": "v1.1.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kballard/go-shellquote",
            "direct": false,
            "version": "v0.0.0-20180428030007-95032a82bc51",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/compress",
            "direct": false,
            "version": "v1.18.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kr/pty",
            "direct": false,
            "version": "v1.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/blackmagic",
            "direct": false,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/dsig",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/dsig-secp256k1",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/httpcc",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/httprc/v3",
            "direct": false,
            "version": "v3.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/jwx/v3",
            "direct": false,
            "version": "v3.0.13",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/option/v2",
            "direct": false,
            "version": "v2.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/semver",
            "direct": false,
            "version": "v1.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-runewidth",
            "direct": false,
            "version": "v0.0.23",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mgutz/ansi",
            "direct": false,
            "version": "v0.0.0-20200706080929-d51e80ef957d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/microsoft/go-winio",
            "direct": false,
            "version": "v0.6.3-0.20251027160822-ad3df93bed29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/copystructure",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/go-testing-interface",
            "direct": false,
            "version": "v1.14.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/hashstructure/v2",
            "direct": false,
            "version": "v2.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/reflectwalk",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mmcdole/goxpp/v2",
            "direct": false,
            "version": "v2.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/docker-image-spec",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/go-archive",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/locker",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/patternmatcher",
            "direct": false,
            "version": "v0.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/policy-helpers",
            "direct": false,
            "version": "v0.0.0-20260612073044-d5411a945cfc",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/atomicwriter",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/mountinfo",
            "direct": false,
            "version": "v0.7.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/sequential",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/signal",
            "direct": false,
            "version": "v0.7.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/user",
            "direct": false,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/userns",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/concurrent",
            "direct": false,
            "version": "v0.0.0-20180306012644-bacd9c7ef1dd",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/reflect2",
            "direct": false,
            "version": "v1.0.3-0.20250322232337-35a7c28c31ee",
            "ecosystem": "go"
          },
          {
            "name": "github.com/montanaflynn/stats",
            "direct": false,
            "version": "v0.8.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/morikuni/aec",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/munnerz/goautoneg",
            "direct": false,
            "version": "v0.0.0-20191010083416-a7dc8b61c822",
            "ecosystem": "go"
          },
          {
            "name": "github.com/oklog/run",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/oklog/ulid",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/oklog/ulid/v2",
            "direct": false,
            "version": "v2.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/cat",
            "direct": false,
            "version": "v0.0.0-20250911104152-50322a0618f6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/errors",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/ll",
            "direct": false,
            "version": "v0.1.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/open-policy-agent/opa",
            "direct": false,
            "version": "v1.14.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/osteele/tuesday",
            "direct": false,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/package-url/packageurl-go",
            "direct": false,
            "version": "v0.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/paesslerag/gval",
            "direct": false,
            "version": "v1.2.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml/v2",
            "direct": false,
            "version": "v2.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/errors",
            "direct": false,
            "version": "v0.9.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/planetscale/vtprotobuf",
            "direct": false,
            "version": "v0.6.1-0.20240319094008-0393e58bdf10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.1-0.20181226105442-5d4384ee4fb2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/client_model",
            "direct": false,
            "version": "v0.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/common",
            "direct": false,
            "version": "v0.67.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/procfs",
            "direct": false,
            "version": "v0.20.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/protonmail/go-crypto",
            "direct": false,
            "version": "v1.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/qri-io/jsonpointer",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/qri-io/jsonschema",
            "direct": false,
            "version": "v0.2.2-0.20210831022256-780655b2ba0e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rcrowley/go-metrics",
            "direct": false,
            "version": "v0.0.0-20250401214520-65e299d6c5c9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/russross/blackfriday/v2",
            "direct": false,
            "version": "v2.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sagikazarmark/locafero",
            "direct": false,
            "version": "v0.12.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/secure-systems-lab/go-securesystemslib",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/segmentio/asm",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/segmentio/encoding",
            "direct": false,
            "version": "v0.5.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/shibumi/go-pathspec",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/shopspring/decimal",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/protobuf-specs",
            "direct": false,
            "version": "v0.5.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/rekor",
            "direct": false,
            "version": "v1.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/rekor-tiles/v2",
            "direct": false,
            "version": "v2.2.2-0.20260601073857-5d098a2b6443",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/sigstore",
            "direct": false,
            "version": "v1.10.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/sigstore-go",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/timestamp-authority/v2",
            "direct": false,
            "version": "v2.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sirupsen/logrus",
            "direct": false,
            "version": "v1.9.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cast",
            "direct": false,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/subosito/gotenv",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tchap/go-patricia/v2",
            "direct": false,
            "version": "v2.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/theupdateframework/go-tuf/v2",
            "direct": false,
            "version": "v2.4.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/match",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/pretty",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tonistiigi/dchapes-mode",
            "direct": false,
            "version": "v0.0.0-20250318174251-73d941a28323",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tonistiigi/fsutil",
            "direct": false,
            "version": "v0.0.0-20260716115106-30cd4fc5d911",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tonistiigi/go-csvvalue",
            "direct": false,
            "version": "v0.0.0-20240814133006-030d3b2625d0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tonistiigi/units",
            "direct": false,
            "version": "v0.0.0-20180711220420-6950e57a87ea",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tonistiigi/vt100",
            "direct": false,
            "version": "v0.0.0-20240514184818-90bafcd6abab",
            "ecosystem": "go"
          },
          {
            "name": "github.com/transparency-dev/formats",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/transparency-dev/merkle",
            "direct": false,
            "version": "v0.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/valyala/fastjson",
            "direct": false,
            "version": "v1.6.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vektah/gqlparser/v2",
            "direct": false,
            "version": "v2.5.32",
            "ecosystem": "go"
          },
          {
            "name": "github.com/x448/float16",
            "direct": false,
            "version": "v0.8.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xdg-go/pbkdf2",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xdg-go/scram",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xdg-go/stringprep",
            "direct": false,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonpointer",
            "direct": false,
            "version": "v0.0.0-20190905194746-02993c407bfb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonreference",
            "direct": false,
            "version": "v0.0.0-20180127040603-bd5ef7bd5415",
            "ecosystem": "go"
          },
          {
            "name": "github.com/yashtewari/glob-intersection",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/yosida95/uritemplate/v3",
            "direct": false,
            "version": "v3.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/youmark/pkcs8",
            "direct": false,
            "version": "v0.0.0-20240726163527-a2c0da244d78",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zclconf/go-cty",
            "direct": false,
            "version": "v1.18.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/auto/sdk",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace",
            "direct": false,
            "version": "v0.69.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
            "direct": false,
            "version": "v0.69.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/metric",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk/metric",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/proto/otlp",
            "direct": false,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/multierr",
            "direct": false,
            "version": "v1.11.0",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v2",
            "direct": false,
            "version": "v2.4.4",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v3",
            "direct": false,
            "version": "v3.0.4",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.53.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/mod",
            "direct": false,
            "version": "v0.37.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.56.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/oauth2",
            "direct": false,
            "version": "v0.36.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.46.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/term",
            "direct": false,
            "version": "v0.44.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.38.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/time",
            "direct": false,
            "version": "v0.15.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/tools",
            "direct": false,
            "version": "v0.46.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/api",
            "direct": false,
            "version": "v0.0.0-20260526163538-3dc84a4a5aaa",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/rpc",
            "direct": false,
            "version": "v0.0.0-20260526163538-3dc84a4a5aaa",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/evanphx/json-patch.v4",
            "direct": false,
            "version": "v4.13.0",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/inf.v0",
            "direct": false,
            "version": "v0.9.1",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v2",
            "direct": false,
            "version": "v2.4.0",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/api",
            "direct": false,
            "version": "v0.36.2",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/apimachinery",
            "direct": false,
            "version": "v0.36.2",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/client-go",
            "direct": false,
            "version": "v0.36.2",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/klog/v2",
            "direct": false,
            "version": "v2.140.0",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/kube-openapi",
            "direct": false,
            "version": "v0.0.0-20260319004828-5883c5ee87b9",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/json",
            "direct": false,
            "version": "v0.0.0-20250730193827-2d320260d730",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/randfill",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/structured-merge-diff/v6",
            "direct": false,
            "version": "v6.3.2",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/yaml",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 293,
        "direct_count": 67,
        "indirect_count": 226
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 6,
        "merged_prs": 1967,
        "open_issues": 123,
        "closed_ratio": 0.901,
        "closed_issues": 1116,
        "closed_unmerged_prs": 305
      },
      "bus_factor": 2,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "carolynvs",
          "commits": 1363,
          "avatar_url": "https://avatars.githubusercontent.com/u/1368985?v=4"
        },
        {
          "type": "User",
          "login": "carolynvs-msft",
          "commits": 974,
          "avatar_url": "https://avatars.githubusercontent.com/u/100001070?v=4"
        },
        {
          "type": "User",
          "login": "kichristensen",
          "commits": 220,
          "avatar_url": "https://avatars.githubusercontent.com/u/2461567?v=4"
        },
        {
          "type": "User",
          "login": "vdice",
          "commits": 214,
          "avatar_url": "https://avatars.githubusercontent.com/u/9322017?v=4"
        },
        {
          "type": "User",
          "login": "dgannon991",
          "commits": 159,
          "avatar_url": "https://avatars.githubusercontent.com/u/19214156?v=4"
        },
        {
          "type": "User",
          "login": "jeremyrickard",
          "commits": 83,
          "avatar_url": "https://avatars.githubusercontent.com/u/33884483?v=4"
        },
        {
          "type": "User",
          "login": "schristoff",
          "commits": 72,
          "avatar_url": "https://avatars.githubusercontent.com/u/28318173?v=4"
        },
        {
          "type": "User",
          "login": "VinozzZ",
          "commits": 48,
          "avatar_url": "https://avatars.githubusercontent.com/u/22300958?v=4"
        },
        {
          "type": "User",
          "login": "Arhell",
          "commits": 32,
          "avatar_url": "https://avatars.githubusercontent.com/u/26163841?v=4"
        },
        {
          "type": "User",
          "login": "dev-drprasad",
          "commits": 29,
          "avatar_url": "https://avatars.githubusercontent.com/u/22687681?v=4"
        }
      ],
      "contributors_sampled": 99,
      "top_contributor_share": 0.392
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "build_pipelinesrelease_template.yml",
        "check-licenses.yaml",
        "codeql.yaml",
        "integ-reuseable-workflow.yml",
        "porter-canary.yml",
        "porter-install-check.yml",
        "porter-integration-pr.yml",
        "porter-integration-release.yml",
        "porter-release.yml",
        "porter.yml",
        "trivy.yaml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        ".golangci.yml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": null,
            "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 8,
            "reason": "26 out of 29 merged PRs checked by a CI test -- score normalized to 8",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 5,
            "reason": "badge detected: Passing",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 1/19 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 70 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 9,
            "reason": "SAST tool detected but not run on all commits",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "11 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "cd545ed2901976b77590f03b695dc63df2acc3f2",
        "ran_at": "2026-07-23T00:45:40Z",
        "aggregate_score": 5.4,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": true,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-22T12:33:13Z",
      "oldest_open_prs": [
        {
          "number": 2099,
          "created_at": "2022-05-25T04:14:12Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 2216,
          "created_at": "2022-06-30T23:30:13Z",
          "last_comment_at": "2022-06-30T23:38:14Z",
          "last_comment_author": "carolynvs"
        },
        {
          "number": 2218,
          "created_at": "2022-07-04T16:08:41Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 3542,
          "created_at": "2026-01-22T23:11:10Z",
          "last_comment_at": "2026-04-05T21:27:22Z",
          "last_comment_author": "dgannon991"
        },
        {
          "number": 3637,
          "created_at": "2026-07-20T13:49:16Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 3638,
          "created_at": "2026-07-21T13:29:00Z",
          "last_comment_at": "2026-07-21T13:29:12Z",
          "last_comment_author": "kichristensen"
        }
      ],
      "last_merged_pr_at": "2026-07-22T12:31:53Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 70,
          "created_at": "2018-12-03T15:49:24Z",
          "last_comment_at": "2021-05-22T19:31:19Z",
          "last_comment_author": "carolynvs"
        },
        {
          "number": 143,
          "created_at": "2019-02-06T00:17:29Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 202,
          "created_at": "2019-03-04T15:12:19Z",
          "last_comment_at": "2019-09-23T21:59:41Z",
          "last_comment_author": "carolynvs"
        },
        {
          "number": 256,
          "created_at": "2019-04-08T19:10:59Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 326,
          "created_at": "2019-05-08T20:50:32Z",
          "last_comment_at": "2022-09-29T15:45:40Z",
          "last_comment_author": "carolynvs"
        },
        {
          "number": 496,
          "created_at": "2019-08-05T15:25:44Z",
          "last_comment_at": "2020-03-11T13:43:06Z",
          "last_comment_author": "ferantivero"
        },
        {
          "number": 531,
          "created_at": "2019-08-19T22:36:18Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 532,
          "created_at": "2019-08-20T14:39:31Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 584,
          "created_at": "2019-09-06T21:03:25Z",
          "last_comment_at": "2019-12-31T19:39:15Z",
          "last_comment_author": "squillace"
        },
        {
          "number": 676,
          "created_at": "2019-10-01T18:03:11Z",
          "last_comment_at": "2019-10-01T19:44:47Z",
          "last_comment_author": "carolynvs"
        },
        {
          "number": 679,
          "created_at": "2019-10-02T20:12:17Z",
          "last_comment_at": "2022-03-11T18:44:06Z",
          "last_comment_author": "carolynvs"
        },
        {
          "number": 855,
          "created_at": "2020-01-14T15:12:43Z",
          "last_comment_at": "2022-07-26T16:18:10Z",
          "last_comment_author": "VinozzZ"
        },
        {
          "number": 897,
          "created_at": "2020-02-11T16:41:01Z",
          "last_comment_at": "2020-02-11T16:48:01Z",
          "last_comment_author": "carolynvs"
        },
        {
          "number": 939,
          "created_at": "2020-03-05T18:37:17Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 964,
          "created_at": "2020-04-01T12:45:04Z",
          "last_comment_at": "2020-05-08T12:09:29Z",
          "last_comment_author": "dev-drprasad"
        },
        {
          "number": 1002,
          "created_at": "2020-04-20T21:33:37Z",
          "last_comment_at": "2020-06-23T18:49:59Z",
          "last_comment_author": "vdice"
        },
        {
          "number": 1019,
          "created_at": "2020-04-30T16:22:38Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 1082,
          "created_at": "2020-06-11T15:34:18Z",
          "last_comment_at": "2023-09-22T23:52:49Z",
          "last_comment_author": "schristoff"
        },
        {
          "number": 1089,
          "created_at": "2020-06-16T14:30:25Z",
          "last_comment_at": "2020-06-16T14:43:47Z",
          "last_comment_author": "carolynvs"
        },
        {
          "number": 1220,
          "created_at": "2020-08-20T17:02:23Z",
          "last_comment_at": "2022-02-28T22:09:06Z",
          "last_comment_author": "carolynvs"
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/getporter/porter",
    "host": "github.com",
    "name": "porter",
    "owner": "getporter"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "good",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 78,
      "inputs": {
        "security": 63,
        "vitality": 80,
        "community": 85,
        "governance": 74,
        "engineering": 84
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 80,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "excellent",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 97,
            "inputs": {
              "commits_last_year": 265,
              "human_commit_share": 0.68,
              "days_since_last_push": 0,
              "active_weeks_last_year": 48
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "48/52 weeks with commits",
                "points": 33.2,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 48
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "265 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 265
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "moderate",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 54,
            "inputs": {
              "releases_count": 100,
              "latest_release_tag": "canary",
              "releases_from_tags": false,
              "days_since_latest_release": 1933,
              "mean_days_between_releases": -141.3
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "100 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 100
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 1933 days ago",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 1933
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~-141.3 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": -141.3
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "maintained",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 0,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "last human commit 0 days ago",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_maintained",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "excellent",
        "name": "Community & Adoption",
        "value": 85,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "good",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 78,
            "inputs": {
              "forks": 222,
              "stars": 1422,
              "watchers": 24,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "1,422 stars",
                "points": 51.1,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 1422
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "222 forks",
                "points": 19.5,
                "status": "partial",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 222
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "24 watchers",
                "points": 7.6,
                "status": "partial",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 24
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "excellent",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 92,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "has_pull_request_template": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 6.3,
                "status": "met",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "good",
        "name": "Sustainability & Governance",
        "value": 74,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "moderate",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 62,
            "inputs": {
              "bus_factor": 2,
              "contributors_sampled": 99,
              "top_contributor_share": 0.392
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "2 contributor(s) cover half of all commits",
                "points": 25.2,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 39% of commits",
                "points": 13.7,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 39
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "99 contributors",
                "points": 13.5,
                "status": "met",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 99
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 70 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "good",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 75,
            "inputs": {
              "merged_prs": 1967,
              "open_issues": 123,
              "closed_issues": 1116,
              "issue_closed_ratio": 0.901,
              "closed_unmerged_prs": 305
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "90% of issues closed",
                "points": 42.1,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 90
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "1967/2272 decided PRs merged",
                "points": 33.1,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 1967,
                      "decided": 2272
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 1/19 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 66,
            "inputs": {
              "followers": 48,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "getporter",
              "public_repos": 48,
              "account_age_days": 2457
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "48 followers of getporter",
                "points": 12.2,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 48,
                      "login": "getporter"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "48 public repos, account ~6 yr old",
                "points": 24.3,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 48
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 6
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "get.porter.sh/porter"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 5
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 5 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "136 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 136
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 84,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 80,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "11 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 11
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "26 out of 29 merged PRs checked by a CI test -- score normalized to 8",
                "points": 16,
                "status": "partial",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "topics": [
                "porter",
                "cnab",
                "cncf"
              ],
              "has_wiki": false,
              "homepage": "https://porter.sh",
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://porter.sh",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "3 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 63,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Branch-Protection, Packaging. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "branch_protection",
                    "packaging"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 54,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 5.4
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "26 out of 29 merged PRs checked by a CI test -- score normalized to 8",
                "points": 2,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "badge detected: Passing",
                "points": 1.2,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 1/19 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 70 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool detected but not run on all commits",
                "points": 4.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "11 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 293 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories",
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 293
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 18,
              "affected_packages": 4,
              "assessed_packages": 293,
              "unassessed_packages": 0,
              "affected_by_severity": "high 2, unknown 2",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 293,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 11
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "excellent",
        "name": "AI Readiness",
        "value": 86,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.853,
              "agent_instruction_files": [
                "docs/content/docs/references/docker-images/agent.md"
              ],
              "agent_instruction_max_bytes": 4506
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "docs/content/docs/references/docker-images/agent.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "docs/content/docs/references/docker-images/agent.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "58 of 68 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 58,
                      "sampled": 68
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 77,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0.01,
              "toolchain_manifests": [
                "docs/go.mod",
                "go.mod"
              ],
              "dependency_bot_commit_share": 0.32
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "docs/go.mod, go.mod (toolchain convention, no task runner)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "toolchain_convention",
                    "params": {
                      "files": "docs/go.mod, go.mod"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "1 of the last 100 commits agent-authored or agent-credited",
                "points": 2,
                "status": "partial",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 1,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "32 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 32,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 55257,
              "source_files_sampled": 584,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/584 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 584,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "excellent",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": true,
              "api_schema_files": [
                "pkg/secrets/plugins/proto/secrets_protocol.proto",
                "pkg/signing/plugins/proto/signing_protocol.proto",
                "pkg/storage/plugins/proto/storage_protocol.proto",
                "proto/porterapis/installation/v1alpha1/installation.proto",
                "proto/porterapis/porter/v1alpha1/porter.proto"
              ]
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": "pkg/secrets/plugins/proto/secrets_protocol.proto, pkg/signing/plugins/proto/signing_protocol.proto, pkg/storage/plugins/proto/storage_protocol.proto, proto/porterapis/installation/v1alpha1/installation.proto, proto/porterapis/porter/v1alpha1/porter.proto",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "pkg/secrets/plugins/proto/secrets_protocol.proto, pkg/signing/plugins/proto/signing_protocol.proto, pkg/storage/plugins/proto/storage_protocol.proto, proto/porterapis/installation/v1alpha1/installation.proto, proto/porterapis/porter/v1alpha1/porter.proto"
                    }
                  }
                ],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-23T00:46:07.976484Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/g/getporter/porter.svg",
  "full_name": "getporter/porter",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}

Related records

Inspected repositories sharing catalogue tags or ecosystems with getporter/porter. Read them side by side →

92envoyproxy/envoyCloud-native high-performance edge/middle/service proxyExcellent91lyft/envoyCloud-native high-performance edge/middle/service proxyExcellent91rook/rookStorage Orchestration for KubernetesExcellent90thanos-io/thanosHighly available Prometheus setup with long term storage capabilities. A CNCF Incubating project.Excellent89cilium/ciliumeBPF-based Networking, Security, and ObservabilityExcellent89kubeedge/kubeedgeKubernetes Native Edge Computing Framework (project under CNCF)Excellent

Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.

Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.

How one result sits in the wider record: aggregate statistics — Go.