osscontainertools / kaniko

When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.

Full resolved dependency set from the GitHub dependency graph: 39 direct and 122 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.

This repository publishes no package the index resolves, so its own dependency graph was assessed — 161 packages, which also include development and test pins that never ship: 1 carry known advisories, of which 0 are direct.

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 75337,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Go": 907108,
        "Shell": 25758,
        "Python": 5941,
        "Makefile": 4149,
        "Starlark": 2545,
        "Dockerfile": 13490
      },
      "pushed_at": "2026-07-29T21:05:02Z",
      "created_at": "2024-10-10T11:26:54Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-29T19:46:35Z",
      "description": "Build Container Images In Kubernetes",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": null,
      "name": "OSS Container Tools",
      "type": "Organization",
      "login": "osscontainertools",
      "company": null,
      "location": null,
      "followers": 11,
      "avatar_url": "https://avatars.githubusercontent.com/u/231562002?v=4",
      "created_at": "2025-09-10T20:13:16Z",
      "is_verified": null,
      "public_repos": 1,
      "account_age_days": 322
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v1.28.1",
          "kind": "patch",
          "published_at": "2026-07-18T23:26:17Z"
        },
        {
          "tag": "v1.28.0",
          "kind": "minor",
          "published_at": "2026-06-28T09:07:24Z"
        },
        {
          "tag": "v1.27.6",
          "kind": "patch",
          "published_at": "2026-06-05T21:36:14Z"
        },
        {
          "tag": "v1.27.5",
          "kind": "patch",
          "published_at": "2026-05-15T18:10:01Z"
        },
        {
          "tag": "v1.27.4",
          "kind": "patch",
          "published_at": "2026-04-30T22:34:20Z"
        },
        {
          "tag": "v1.27.3",
          "kind": "patch",
          "published_at": "2026-04-17T10:08:26Z"
        },
        {
          "tag": "v1.27.2",
          "kind": "patch",
          "published_at": "2026-04-02T20:37:27Z"
        },
        {
          "tag": "v1.27.1",
          "kind": "patch",
          "published_at": "2026-03-19T21:03:40Z"
        },
        {
          "tag": "v1.27.0",
          "kind": "minor",
          "published_at": "2026-03-05T22:42:10Z"
        },
        {
          "tag": "v1.26.6",
          "kind": "patch",
          "published_at": "2026-02-19T20:38:49Z"
        },
        {
          "tag": "v1.26.5",
          "kind": "patch",
          "published_at": "2026-02-05T21:32:41Z"
        },
        {
          "tag": "v1.26.4",
          "kind": "patch",
          "published_at": "2026-01-09T23:58:22Z"
        },
        {
          "tag": "v1.26.3",
          "kind": "patch",
          "published_at": "2025-12-05T17:48:22Z"
        },
        {
          "tag": "v1.26.2",
          "kind": "patch",
          "published_at": "2025-11-20T20:37:40Z"
        },
        {
          "tag": "v1.26.1",
          "kind": "patch",
          "published_at": "2025-11-07T09:42:00Z"
        },
        {
          "tag": "v1.26.0",
          "kind": "minor",
          "published_at": "2025-10-16T04:29:25Z"
        },
        {
          "tag": "v1.25.6",
          "kind": "patch",
          "published_at": "2025-10-08T03:32:44Z"
        },
        {
          "tag": "v1.25.5",
          "kind": "patch",
          "published_at": "2025-09-18T21:13:32Z"
        },
        {
          "tag": "v1.25.4",
          "kind": "patch",
          "published_at": "2025-09-02T17:28:17Z"
        },
        {
          "tag": "v1.25.3",
          "kind": "patch",
          "published_at": "2025-08-20T21:34:40Z"
        },
        {
          "tag": "v1.25.2",
          "kind": "patch",
          "published_at": "2025-08-08T20:08:14Z"
        },
        {
          "tag": "v1.25.1",
          "kind": "patch",
          "published_at": "2025-07-17T22:25:49Z"
        },
        {
          "tag": "v1.25.0",
          "kind": "minor",
          "published_at": "2025-07-08T21:08:15Z"
        },
        {
          "tag": "v1.24.3",
          "kind": "patch",
          "published_at": "2025-06-29T21:09:48Z"
        },
        {
          "tag": "v1.24.2",
          "kind": "patch",
          "published_at": "2025-06-19T21:22:40Z"
        },
        {
          "tag": "v1.24.1",
          "kind": "patch",
          "published_at": "2025-06-12T10:51:28Z"
        },
        {
          "tag": "v1.24.0-5",
          "kind": "prerelease",
          "published_at": "2025-06-01T21:34:26Z"
        },
        {
          "tag": "v1.24.0-4",
          "kind": "prerelease",
          "published_at": "2025-05-31T08:24:24Z"
        },
        {
          "tag": "v1.24.0-3",
          "kind": "prerelease",
          "published_at": "2025-05-27T22:56:32Z"
        },
        {
          "tag": "v1.24.0-2",
          "kind": "prerelease",
          "published_at": "2025-05-25T19:54:48Z"
        },
        {
          "tag": "1.24.0-1",
          "kind": "prerelease",
          "published_at": "2025-05-24T20:12:22Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "f273820387a6b0c853f974a19ff5c74ed585e6b7",
          "body": "…ive user (#867)\n\n* mz864: integration test for WORKDIR chown on implicit parent dirs\n\n* mz864: chown implicitly created WORKDIR parent directories to the active user",
          "is_bot": false,
          "headline": "mz864: chown implicitly created WORKDIR parent directories to the act…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-29T19:45:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "96cd11bbdcff21233cb99d82be55ff55a0051b31",
          "body": "…ons/actions-6382876e44\n\nbuild(deps): bump docker/login-action from 4.5.2 to 4.6.0 in the actions group",
          "is_bot": false,
          "headline": "Merge pull request #952 from osscontainertools/dependabot/github_acti…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-29T19:15:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a645fa24cfdd7cc744d76539497d4f175e03978f",
          "body": "…gomod-d183fd77f4\n\nbuild(deps): bump the gomod group with 5 updates",
          "is_bot": false,
          "headline": "Merge pull request #953 from osscontainertools/dependabot/go_modules/…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-29T19:14:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4ba80ff35d31fb09ca2d4a8c5ea0a29f8ab11713",
          "body": "…google.golang.org/api-0.291.0\n\nbuild(deps): bump google.golang.org/api from 0.290.0 to 0.291.0",
          "is_bot": false,
          "headline": "Merge pull request #954 from osscontainertools/dependabot/go_modules/…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-29T19:13:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1026baad95989cad07c379603fe260fd6aaab845",
          "body": "Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.290.0 to 0.291.0.\n- [Release notes](https://github.com/googleapis/google-api-go-client/releases)\n- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)\n- [Commits](https://github.\n[…]\ndency-name: google.golang.org/api\n  dependency-version: 0.291.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump google.golang.org/api from 0.290.0 to 0.291.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-29T15:39:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2c13fd3e72e892fdac559025e6db757a3cebe541",
          "body": "Bumps the gomod group with 5 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.43.0` | `1.43.1` |\n| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.32.31` | `1.32.32` |\n| [github.com/aws/\n[…]\no-git/v5\n  dependency-version: 5.19.2\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: gomod\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the gomod group with 5 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-29T15:39:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "104253d43b10c70a96c05d27d17b1d6496af74ea",
          "body": "Bumps the actions group with 1 update: [docker/login-action](https://github.com/docker/login-action).\n\n\nUpdates `docker/login-action` from 4.5.2 to 4.6.0\n- [Release notes](https://github.com/docker/login-action/releases)\n- [Commits](https://github.com/docker/login-action/compare/371161bbe7024a29a25c\n[…]\n-action\n  dependency-version: 4.6.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n  dependency-group: actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump docker/login-action in the actions group",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-29T15:33:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5ac8f3bdc78d119028023187697d0d77f4f783df",
          "body": "mz334: eliminate and squash fully cached stages",
          "is_bot": false,
          "headline": "Merge pull request #871 from osscontainertools/mz334-stage-elimination",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-29T11:14:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c9f9f5d3961ce582eba283a7045a990d0111b13a",
          "body": null,
          "is_bot": false,
          "headline": "eliminate and squash fully cached stages after the cache lookahead",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-29T10:45:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5be296bc51a7b014acfb6e95c9f8355063426a68",
          "body": "…ailures\n\ntracing: log export failures at debug, not warn",
          "is_bot": false,
          "headline": "Merge pull request #951 from osscontainertools/tracing-quiet-export-f…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-29T10:44:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7639f65d2e87ee03ddb79d7ed5b59f01338007db",
          "body": "Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "tracing: log export failures at debug, not warn",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-29T10:26:40Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "7875272d9c2799895ce4e538f39ff86abeb482f8",
          "body": "* add opt-in OpenTelemetry build tracing\n\n* fix(tracing): harden span export\n\n- stop timers on all error paths so failed builds and --dryrun export\n  their spans; the failing command's span was the one being dropped\n- bound the exit flush to 5s and print the error before flushing\n- flush on logrus.F\n[…]\ns and\nbuilds still pass.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Damien Degois <damien@degois.info>\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add opt-in OpenTelemetry build tracing (#902)",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-29T07:12:16Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "73d51d663cbad953d7828912e435eda74c38d0f2",
          "body": "…ion-tests\n\nadd integration tests for --image-format layer relabeling",
          "is_bot": false,
          "headline": "Merge pull request #943 from osscontainertools/mz849-relabel-integrat…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-29T07:11:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2825556e3d29bbbcd9ed65ed1407a07918f91954",
          "body": "…ons/actions-85123b4e12\n\nbuild(deps): bump docker/login-action from 4.5.1 to 4.5.2 in the actions group",
          "is_bot": false,
          "headline": "Merge pull request #950 from osscontainertools/dependabot/github_acti…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-29T07:11:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "80f5e7a2776176c7c39d41d11b04b15400bec041",
          "body": "Bumps the actions group with 1 update: [docker/login-action](https://github.com/docker/login-action).\n\n\nUpdates `docker/login-action` from 4.5.1 to 4.5.2\n- [Release notes](https://github.com/docker/login-action/releases)\n- [Commits](https://github.com/docker/login-action/compare/abd2ef45e78c5afb21d6\n[…]\n-action\n  dependency-version: 4.5.2\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump docker/login-action in the actions group",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-28T15:33:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "25146d0be68bcf9b6ec7b3ee6dbd895931b93815",
          "body": "…gomod-c010b5513e\n\nbuild(deps): bump the gomod group with 2 updates",
          "is_bot": false,
          "headline": "Merge pull request #945 from osscontainertools/dependabot/go_modules/…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-24T19:47:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "739009a4b783db58b527ef3ce04fb75e4deb71b3",
          "body": "…google.golang.org/api-0.290.0\n\nbuild(deps): bump google.golang.org/api from 0.289.0 to 0.290.0",
          "is_bot": false,
          "headline": "Merge pull request #946 from osscontainertools/dependabot/go_modules/…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-24T16:38:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "99c3d447d5f76e6edb6c03057afbc3c22112c16f",
          "body": "…ons/actions-dee7dd5463\n\nbuild(deps): bump docker/login-action from 4.5.0 to 4.5.1 in the actions group",
          "is_bot": false,
          "headline": "Merge pull request #944 from osscontainertools/dependabot/github_acti…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-24T16:18:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1ed0e13992e1498ca4d346991aab90f8d45a6f4f",
          "body": "Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.289.0 to 0.290.0.\n- [Release notes](https://github.com/googleapis/google-api-go-client/releases)\n- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)\n- [Commits](https://github.\n[…]\ndency-name: google.golang.org/api\n  dependency-version: 0.290.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump google.golang.org/api from 0.289.0 to 0.290.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-24T15:33:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8d586953abc7808e0b3eac167336396b7773a98a",
          "body": "Bumps the gomod group with 2 updates: [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy) and [github.com/moby/go-archive](https://github.com/moby/go-archive).\n\n\nUpdates `github.com/go-git/go-billy/v5` from 5.9.0 to 5.9.1\n- [Release notes](https://github.com/go-git/go-billy/releases)\n[…]\no-archive\n  dependency-version: 0.2.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: gomod\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the gomod group with 2 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-24T15:33:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "77d26fff62886bd963fa47769bfd98e059c23392",
          "body": "Bumps the actions group with 1 update: [docker/login-action](https://github.com/docker/login-action).\n\n\nUpdates `docker/login-action` from 4.5.0 to 4.5.1\n- [Release notes](https://github.com/docker/login-action/releases)\n- [Commits](https://github.com/docker/login-action/compare/06fb636fac595d6fb4b2\n[…]\n-action\n  dependency-version: 4.5.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump docker/login-action in the actions group",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-24T15:33:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e29a1fe69c6e0f5278d6493e630857fc822693f7",
          "body": null,
          "is_bot": false,
          "headline": "add integration tests for --image-format layer relabeling",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-24T12:46:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d88aab9de00297fc13e775a8df935cea64bef4b4",
          "body": "…gomod-de499d9fe1\n\nbuild(deps): bump the gomod group with 3 updates",
          "is_bot": false,
          "headline": "Merge pull request #939 from osscontainertools/dependabot/go_modules/…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-23T22:02:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7067ad9150d13ae737cbf43f9c029a7506923089",
          "body": "…google.golang.org/grpc-1.82.1\n\nbuild(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1",
          "is_bot": false,
          "headline": "Merge pull request #942 from osscontainertools/dependabot/go_modules/…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-23T22:01:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7f999c44ae2225d76630e63814966e3c3b13adb4",
          "body": "Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.0 to 1.82.1.\n- [Release notes](https://github.com/grpc/grpc-go/releases)\n- [Commits](https://github.com/grpc/grpc-go/compare/v1.82.0...v1.82.1)\n\n---\nupdated-dependencies:\n- dependency-name: google.golang.org/grpc\n  dependency-version: 1.82.1\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-23T21:22:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "682a4e8ba9d9cda5da1f063b8c6fab837e76d252",
          "body": "…ons/actions-d1d1d125f8\n\nbuild(deps): bump the actions group across 1 directory with 2 updates",
          "is_bot": false,
          "headline": "Merge pull request #941 from osscontainertools/dependabot/github_acti…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-23T21:19:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bc618b4e51b3d2ea2e56e51e2d8adff13498afe9",
          "body": "Bumps the actions group with 2 updates in the / directory: [docker/login-action](https://github.com/docker/login-action) and [docker/setup-docker-action](https://github.com/docker/setup-docker-action).\n\n\nUpdates `docker/login-action` from 4.4.0 to 4.5.0\n- [Release notes](https://github.com/docker/lo\n[…]\n-action\n  dependency-version: 5.4.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n  dependency-group: actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the actions group across 1 directory with 2 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-23T15:33:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8c343ad2f573511b237ecd5f7212ea5ea33829a6",
          "body": "Bumps the gomod group with 3 updates: [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2), [github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager](https://github.com/aws/aws-sdk-go-v2) and [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2).\n\n\nUp\n[…]\nvice/s3\n  dependency-version: 1.106.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n  dependency-group: gomod\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the gomod group with 3 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-22T15:37:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9616444a624111bace0318d23b3468b013f5ff5d",
          "body": "…cloud.google.com/go/storage-1.64.0\n\nbuild(deps): bump cloud.google.com/go/storage from 1.63.1 to 1.64.0",
          "is_bot": false,
          "headline": "Merge pull request #935 from osscontainertools/dependabot/go_modules/…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-21T20:16:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "48e9ade20fb1c1b7015684a15e09e0e8d353cc93",
          "body": "Bumps [cloud.google.com/go/storage](https://github.com/googleapis/google-cloud-go) from 1.63.1 to 1.64.0.\n- [Release notes](https://github.com/googleapis/google-cloud-go/releases)\n- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md)\n- [Commits](https://github.com/googlea\n[…]\n-name: cloud.google.com/go/storage\n  dependency-version: 1.64.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump cloud.google.com/go/storage from 1.63.1 to 1.64.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-21T15:33:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ec6d0901c28348f3c88153b1db8f0ad187c1c8d4",
          "body": "…oy/golang-3aff665\n\nbuild(deps): bump golang from `ae5a231` to `3aff665` in /deploy",
          "is_bot": false,
          "headline": "Merge pull request #932 from osscontainertools/dependabot/docker/depl…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-20T19:31:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c6093b221b2f48e01c13d0c0cb925de5c6dab795",
          "body": "…gomod-675ab1b9df\n\nbuild(deps): bump github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager from 0.3.3 to 0.3.4 in the gomod group",
          "is_bot": false,
          "headline": "Merge pull request #933 from osscontainertools/dependabot/go_modules/…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-20T19:30:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f9db7a524831d8aee124b423bdd153687a049082",
          "body": "…ons/actions-7a5a078ad4\n\nbuild(deps): bump actions/checkout from 7.0.0 to 7.0.1 in the actions group",
          "is_bot": false,
          "headline": "Merge pull request #934 from osscontainertools/dependabot/github_acti…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-20T19:29:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c37486a2cefe2503c212579f8c23e90eb9faac46",
          "body": "Bumps the actions group with 1 update: [actions/checkout](https://github.com/actions/checkout).\n\n\nUpdates `actions/checkout` from 7.0.0 to 7.0.1\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https\n[…]\nheckout\n  dependency-version: 7.0.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump actions/checkout in the actions group",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-20T15:34:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dcf034fa8e9aca0770d352549c36781ce06bf4d0",
          "body": "…ager\n\nBumps the gomod group with 1 update: [github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager](https://github.com/aws/aws-sdk-go-v2).\n\n\nUpdates `github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager` from 0.3.3 to 0.3.4\n- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)\n- [Com\n[…]\nermanager\n  dependency-version: 0.3.4\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: gomod\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump github.com/aws/aws-sdk-go-v2/feature/s3/transferman…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-20T09:50:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "40adcd888e86bb53c2f71ef2ab62a722f3d78ad4",
          "body": "Bumps golang from `ae5a231` to `3aff665`.\n\n---\nupdated-dependencies:\n- dependency-name: golang\n  dependency-version: 1.26.5\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump golang from `ae5a231` to `3aff665` in /deploy",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-20T09:48:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3ac857f5bd14cada1d1f6c1596a87dd83d7c2d4f",
          "body": "release v1.28.1",
          "is_bot": false,
          "headline": "Merge pull request #930 from osscontainertools/release-v1.28.1",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-18T23:24:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fed8457005411e9ba985f6fa8f4868685b5dc844",
          "body": null,
          "is_bot": false,
          "headline": "release",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-18T23:23:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6102559521a979c1461b75a4292becdf12384b7e",
          "body": "* Document Preview and BuildKit compatibility feature flag profiles\n\n* Note integration tests run BuildKit compatibility on top of Preview\n\n* Enable skip-write-whiteouts and skip-relabel-recompress globally in integration tests\n\n* Drop redundant Preview lead sentence",
          "is_bot": false,
          "headline": "Document feature flag profiles (#929)",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-18T22:20:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "78ae9961f4b765b4a07c17ee0e7d7523b7a4d312",
          "body": "…ink-twice-corrupts-i\n\nmz921: preserve symlink COPY destinations",
          "is_bot": false,
          "headline": "Merge pull request #926 from Dodothereal/fix/921-copy-a-relative-syml…",
          "author_name": "Giorgio Maria Federico Birnthaler",
          "author_login": "Dodothereal",
          "committed_at": "2026-07-17T22:12:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7259709a7b5943648e6f46b8c5fc8cc274f236c2",
          "body": "…google.golang.org/api-0.289.0\n\nbuild(deps): bump google.golang.org/api from 0.288.0 to 0.289.0",
          "is_bot": false,
          "headline": "Merge pull request #925 from osscontainertools/dependabot/go_modules/…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-17T21:37:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d81b42473b8d834410ee6cacb0b80e9e64e236ff",
          "body": "…gomod-1a8a545a89\n\nbuild(deps): bump the gomod group with 3 updates",
          "is_bot": false,
          "headline": "Merge pull request #924 from osscontainertools/dependabot/go_modules/…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-17T18:54:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "714139d78175f6239819e35e2edac7c0edd86ef0",
          "body": "Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.288.0 to 0.289.0.\n- [Release notes](https://github.com/googleapis/google-api-go-client/releases)\n- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)\n- [Commits](https://github.\n[…]\ndency-name: google.golang.org/api\n  dependency-version: 0.289.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump google.golang.org/api from 0.288.0 to 0.289.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-17T15:36:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "12f900068dc0a25fd0f395ccb86c708281ef36f6",
          "body": "Bumps the gomod group with 3 updates: [github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager](https://github.com/aws/aws-sdk-go-v2), [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) and [github.com/docker/cli](https://github.com/docker/cli).\n\n\nUpdates `github.com/aws\n[…]\npendency-version: 29.6.2+incompatible\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: gomod\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the gomod group with 3 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-17T15:36:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ffe0b7a425451dc2c25e123b6c8b1403b555f9c8",
          "body": "address review follow-ups from the feature-flag PR",
          "is_bot": false,
          "headline": "Merge pull request #918 from osscontainertools/mz854-review-followups",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-17T08:41:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "21133d41d9b0bcb24d676638d386f28e9f60c8d7",
          "body": "* add --image-format flag to pin output media type\n\n* reject --image-format=docker with --compression=zstd\n\n* warn when zstd compression is dropped for docker format\n\n* relabel base layers to the selected image format\n\n* relabel layer accessors so Layer.MediaType matches the relabeled manifest\n\n* fixup",
          "is_bot": false,
          "headline": "add --image-format flag to pin output media type (#850)",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-17T07:00:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6e259a646c81b138a507c36a3dde751d46ed8f3c",
          "body": "* mz911: frame directory cache hash inputs\n\nDirectory cache hashes previously concatenated variable-length paths and file hashes without boundaries, so distinct entry sequences could collide. Add opt-in fixed-width length framing while preserving legacy keys when the feature flag is disabled.\n\n* frame directory hash fields as len:data like COPY and RUN\n\n* inline directory hash framing and drop its unit test\n\n---------\n\nCo-authored-by: Martin Zihlmann <martizih@outlook.com>",
          "is_bot": false,
          "headline": "mz911: frame directory cache hash inputs (#912)",
          "author_name": "JSap0914",
          "author_login": "JSap0914",
          "committed_at": "2026-07-16T22:38:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1e460bc81b546d0f4d53ef206fc5539ae946bd24",
          "body": "…test flag restore",
          "is_bot": false,
          "headline": "address PR review: transport nil-deref, EXPOSE parts, CMD assertion, …",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-16T22:27:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7e83fa1629910c2eb928b04bd0ee26f96bbbac3b",
          "body": "…866)\n\n* mz863: integration test for COPY --chmod on implicit parent dirs\n\n* mz863: apply COPY --chmod to implicitly created parent directories\n\n* Update integration/dockerfiles/Dockerfile_test_issue_mz863\n\nCo-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>\n\n---------\n\nCo-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>",
          "is_bot": false,
          "headline": "mz863: apply COPY --chmod to implicitly created parent directories (#…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-16T21:58:24Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e542307fa00e4ebe54d821022f545d5131f818e7",
          "body": "* mz824: fold heredoc bodies into RUN cache key\n\n* frame heredoc fields in the RUN cache key to prevent collisions\n\n* replace RUN heredoc cache key unit test with an integration test\n\n* update golden\n\n* use the local registry base in the mz824 test so kaniko and docker media types match\n\n* fixup\n\n* limit integration test parallelism to 8",
          "is_bot": false,
          "headline": "mz824: fold heredoc bodies into RUN cache key (#825)",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-16T21:33:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7a845d9d7e7671012269bc300f3262f9c75cbd41",
          "body": "…-parallelism\n\nlimit integration test parallelism to 8",
          "is_bot": false,
          "headline": "Merge pull request #919 from osscontainertools/limit-integration-test…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-16T21:33:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1b35cc052afc5e02aa553702d90ad66384a856a9",
          "body": null,
          "is_bot": false,
          "headline": "limit integration test parallelism to 8",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-16T21:14:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1d3845b4ae2c46f32d07d6b4cf7a2bd92987bf78",
          "body": "* consolidate feature flags into a single registry and extract assert package\n\n* register expected feature-flag warning for mz793 integration test\n\n* migrate FF_KANIKO_RUN_HONOR_GROUP and FF_KANIKO_PRECOMPILE_DOCKERIGNORE into the flag registry\n\n* migrate FF_KANIKO_EXPAND_HEREDOC and FF_KANIKO_ROLLING_CACHE_KEY into the flag registry",
          "is_bot": false,
          "headline": "Consolidate feature flags into a single registry (#854)",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-16T21:09:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2f3eab798f6ea671813cb5bfe0142c083112f531",
          "body": "…ons/actions/setup-go-7.0.0\n\nbuild(deps): bump actions/setup-go from 6.5.0 to 7.0.0",
          "is_bot": false,
          "headline": "Merge pull request #916 from osscontainertools/dependabot/github_acti…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-16T19:31:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7e17d522bf0cedfb65afeef42cf4e9eb53bf7149",
          "body": "…gomod-e9132f6a95\n\nbuild(deps): bump github.com/moby/buildkit from 0.31.1 to 0.31.2 in the gomod group",
          "is_bot": false,
          "headline": "Merge pull request #915 from osscontainertools/dependabot/go_modules/…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-16T19:31:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2c4b5a0c464370e6334f35b5814b9e4366df5c96",
          "body": "…oy/golang-ae5a231\n\nbuild(deps): bump golang from `d52df9c` to `ae5a231` in /deploy",
          "is_bot": false,
          "headline": "Merge pull request #914 from osscontainertools/dependabot/docker/depl…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-16T19:30:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c85bb1edfb37eec83440f475938ceb383088cde0",
          "body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0.\n- [Release notes](https://github.com/actions/setup-go/releases)\n- [Commits](https://github.com/actions/setup-go/compare/924ae3a1cded613372ab5595356fb5720e22ba16...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e)\n\n---\nupdated\n[…]\n- dependency-name: actions/setup-go\n  dependency-version: 7.0.0\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump actions/setup-go from 6.5.0 to 7.0.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-16T15:33:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "73f0f406c015c446ac0fbecf25892bea32b4e423",
          "body": "Bumps the gomod group with 1 update: [github.com/moby/buildkit](https://github.com/moby/buildkit).\n\n\nUpdates `github.com/moby/buildkit` from 0.31.1 to 0.31.2\n- [Release notes](https://github.com/moby/buildkit/releases)\n- [Commits](https://github.com/moby/buildkit/compare/v0.31.1...v0.31.2)\n\n---\nupda\n[…]\nbuildkit\n  dependency-version: 0.31.2\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: gomod\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump github.com/moby/buildkit in the gomod group",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-16T15:33:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b433ab9ae6839be21ef966e38b97f701fd900d56",
          "body": "Bumps golang from `d52df9c` to `ae5a231`.\n\n---\nupdated-dependencies:\n- dependency-name: golang\n  dependency-version: 1.26.5\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump golang from `d52df9c` to `ae5a231` in /deploy",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-16T15:33:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "33c0264a62a4ec6910ab2398a01faf9c94876a72",
          "body": "* mz822: fold resolved heredoc contents into COPY/ADD cache key\n\n* mz822: gate heredoc cache-key expansion behind FF_KANIKO_EXPAND_HEREDOC\n\n* frame COPY/ADD heredoc cache key components to prevent collisions\n\n* add integration test for COPY heredoc cache key collision\n\n* assert the heredoc cache key collision in the shared unresolved golden plan\n\n* golden tests\n\n* use the local registry base in the mz822 test so kaniko and docker media types match",
          "is_bot": false,
          "headline": "mz822: fold resolved heredoc contents into COPY/ADD cache key (#823)",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-16T07:32:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d02a890ed7949b318207e85c02f4ae8ea4bd95e0",
          "body": "* add single build cache key collision test\n\n* hash composite cache keys recursively behind FF_KANIKO_ROLLING_CACHE_KEY",
          "is_bot": false,
          "headline": "mz873: hash composite cache keys recursively (#875)",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-16T06:40:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ad043888aba083a81a23f8bf27e3585adbde74e4",
          "body": "* mz817: integration test\n\n* mz817: expand variables in COPY/ADD heredoc content\n\n* mz817: gate COPY/ADD heredoc expansion behind FF_KANIKO_EXPAND_HEREDOC",
          "is_bot": false,
          "headline": "mz817: expand variables in COPY/ADD heredoc content (#821)",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-15T21:56:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "26f4fa498deb00cdd532256295f4ef324b9d599d",
          "body": "* add integration test for mz879 runv2 mount bind cache crash\n\n* mz879: give runv2 mount commands the build context for cache keys",
          "is_bot": false,
          "headline": "mz879: give runv2 mount commands the build context for cache keys (#900)",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-15T10:21:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "72588e0d23209087722693ca126d6ea6fbb956ab",
          "body": "* drop GCS-specific integration test scaffolding\n\n* address review: read-only host-uid docker config mount, drop orphaned gcb benchmark config, doc cleanup\n\n* address review: read-only host-uid docker config mount and doc cleanup\n\n* mount integration docker config at /root and drop it from the warmer path\n\n* restore the docker config mount on the warmer path",
          "is_bot": false,
          "headline": "drop GCS-specific integration test scaffolding (#709)",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-15T10:20:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "82f78646706015b5dab88a8fdc7e0c4c133e49d6",
          "body": "Bumps golang from `983a082` to `d52df9c`.\n\n---\nupdated-dependencies:\n- dependency-name: golang\n  dependency-version: 1.26.5\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": false,
          "headline": "build(deps): bump golang from `983a082` to `d52df9c` in /deploy (#910)",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-15T08:48:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "759107a3a14704095f80d1d2955a9141345e5ebc",
          "body": "Bumps golang from `983a082` to `d52df9c`.\n\n---\nupdated-dependencies:\n- dependency-name: golang\n  dependency-version: 1.26.5\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump golang from `983a082` to `d52df9c` in /deploy",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-15T07:30:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "54ec113d7d84b4b29156943dcf9cff2e10a4aa23",
          "body": "* mz843: generate integration tar fixtures on the fly\n\n* remove generated tar fixtures after integration suite\n\n* check bzip2 prerequisite and register fixture cleanup before generating",
          "is_bot": false,
          "headline": "mz843: generate integration tar fixtures on the fly (#844)",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-15T07:22:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5935c66a864b9b9ec772d69886e2f674fb4e71ac",
          "body": "…cher-reuse\n\nmz882: precompile the .dockerignore matcher",
          "is_bot": false,
          "headline": "Merge pull request #887 from osscontainertools/mz882-dockerignore-mat…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-15T07:16:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "be61ab75f4fc348f9589f364479965ca064dfb85",
          "body": "* add Chris Boot as an individual sponsor\n\n* list sponsor by github handle\n\n* show individual sponsor avatars\n\n* lay out individual sponsors side by side\n\n* label individual sponsors with visible handles\n\n* use html table for sponsor avatars",
          "is_bot": false,
          "headline": "add Chris Boot as an individual sponsor (#908)",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-15T07:14:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f554098c835dbd2c7faf0fbd7ac3ab184b80ac99",
          "body": "…security\n\ndocument --secret security semantics",
          "is_bot": false,
          "headline": "Merge pull request #909 from osscontainertools/mz892-document-secret-…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-15T07:13:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "03550cef3cc1bd5362fbd9160b8156de31d1f875",
          "body": null,
          "is_bot": false,
          "headline": "document --secret security semantics",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-14T21:30:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e440d322eaaf714d2f3bd0cd7c0ab5caecec18fc",
          "body": null,
          "is_bot": false,
          "headline": "precompile dockerignore matcher behind FF_KANIKO_PRECOMPILE_DOCKERIGNORE",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-14T21:18:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "03b464351094a3f13415bb5613da797342b5d09c",
          "body": "* make naked returns explicit\n\n* close downloaded tar file in https build context",
          "is_bot": false,
          "headline": "linter: nakedret (#831)",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-14T21:02:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8c4166b0578bdb27b02bb4933e95138f170a470c",
          "body": "unpin FF_KANIKO_NO_PROPAGATE_ANNOTATIONS in golden and rotate cache keys",
          "is_bot": false,
          "headline": "Merge pull request #874 from osscontainertools/rotate-golden-cache-keys",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-14T20:48:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e9a11f1724a9aed0d2bbcc4594b939d85d8ab127",
          "body": "* mz851: assert reproducible builds never emit split-mediatype images\n\n* mz851: relabel preserved base layers to dockerv2",
          "is_bot": false,
          "headline": "mz851: keep reproducible output a consistent dockerv2 manifest (#858)",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-14T20:34:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "075a1a51f405c566d5efaa9d3eab54145f3e2004",
          "body": "* mz839: reproduce RUN dropping explicit group from USER\n\n* mz839: RUN honors explicit group from USER behind FF_KANIKO_RUN_HONOR_GROUP",
          "is_bot": false,
          "headline": "mz839: RUN ignores explicit group (#840)",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-14T20:32:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "674bc72b87115a89b2b5b50959d610ae3647afd8",
          "body": "* add integration test for mz896 cross-stage infer panic\n\n* mz896: skip cross-stage infer when run layers are uncached",
          "is_bot": false,
          "headline": "mz896: skip cross-stage infer when run layers are uncached (#899)",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-14T20:23:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "082cd3dd7eb46ccf29b17f8398c764adb8e9a1a1",
          "body": "* stop ignoring layer-length mismatch in integration tests\n\n* stop resolving paths when scanning the full filesystem\n\n* prepare busybox base with /proc and /sys for minimal-base tests\n\n* drop full-filesystem resolve change, ignore layer-length on volume tests\n\n* build prepared busybox and alpine bases for minimal-base tests\n\n* ignore layer-length mismatch on tests with known buildkit divergences\n\n* drop provenance=false from tests now on the prepared OCI busybox/alpine base",
          "is_bot": false,
          "headline": "stop ignoring layer-length mismatch in integration tests (#847)",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-14T20:20:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "12c0e86713cb36b0919a1e65947a0dbbea0c0239",
          "body": "linter: unused-parameter",
          "is_bot": false,
          "headline": "Merge pull request #832 from osscontainertools/lint-unused-param",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-14T19:40:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "736ae49ccdb04856be0d8bc985c18e2cd137970f",
          "body": "* remove unnecessary whitespace in function bodies\n\n* modernize: use strings.SplitSeq\n\n* remove ineffectual assignments\n\n* remove wasted assignment in fs_util_test",
          "is_bot": false,
          "headline": "linter: whitespace, modernize, ineffassign, wastedassign (#833)",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-14T19:36:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3d71a6102c499316b3b9d7222d0aaa12720b53ff",
          "body": "…se-kanikoenv\n\nuse KanikoEnv in all integration executor invocations",
          "is_bot": false,
          "headline": "Merge pull request #808 from osscontainertools/mz-integration-tests-u…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-14T19:35:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c04630c3a9e2d35bccac7419813e9c0200caccb3",
          "body": "…e-skip-mkdir-default\n\nFix inconsistent feature flag defaults",
          "is_bot": false,
          "headline": "Merge pull request #853 from osscontainertools/mz852-consistent-volum…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-14T16:17:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "555972f0203e828571313d2fa06da9b377f04c56",
          "body": "remove dead code found by reachability analysis",
          "is_bot": false,
          "headline": "Merge pull request #901 from osscontainertools/drop-snapshotter-key",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-14T16:14:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6f11a134d9c538c86146dd8bf811028866e68fd1",
          "body": "…oy/golang-983a082\n\nbuild(deps): bump golang from `079e598` to `983a082` in /deploy",
          "is_bot": false,
          "headline": "Merge pull request #905 from osscontainertools/dependabot/docker/depl…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-14T16:14:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "57eeede5742cd8bcd5f50ab125c71fad36e02b15",
          "body": "…oy/debian-020c0d2\n\nbuild(deps): bump debian from `28de087` to `020c0d2` in /deploy",
          "is_bot": false,
          "headline": "Merge pull request #906 from osscontainertools/dependabot/docker/depl…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-14T16:13:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cdd970dba82789fd942d2fe8a1cdf1ad179cea67",
          "body": "…gomod-963cc51d00\n\nbuild(deps): bump the gomod group with 3 updates",
          "is_bot": false,
          "headline": "Merge pull request #907 from osscontainertools/dependabot/go_modules/…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-14T16:13:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "eadde77e6d4f0fe6ce43b259fd50877e66be9fc1",
          "body": "Bumps the gomod group with 3 updates: [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2), [github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager](https://github.com/aws/aws-sdk-go-v2) and [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2).\n\n\nUp\n[…]\nvice/s3\n  dependency-version: 1.105.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: gomod\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump the gomod group with 3 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-14T15:38:02Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4fa10fecc1b6167f998e9c2fcdc27f39a44d7d0a",
          "body": "Bumps debian from `28de087` to `020c0d2`.\n\n---\nupdated-dependencies:\n- dependency-name: debian\n  dependency-version: trixie-slim\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump debian from `28de087` to `020c0d2` in /deploy",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-14T15:33:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2eec45bf0d017a13d267005378ab459b6ed0e456",
          "body": "Bumps golang from `079e598` to `983a082`.\n\n---\nupdated-dependencies:\n- dependency-name: golang\n  dependency-version: 1.26.5\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump golang from `079e598` to `983a082` in /deploy",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-14T15:32:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "603c49380a19b8a3f641b1dc5240121a9f949d57",
          "body": "…gomod-2df5e89b0a\n\nbuild(deps): bump cloud.google.com/go/storage from 1.63.0 to 1.63.1 in the gomod group",
          "is_bot": false,
          "headline": "Merge pull request #903 from osscontainertools/dependabot/go_modules/…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-13T21:55:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1eb9e030c461dd69b89f241c3116f61a9b3b5df5",
          "body": "Bumps the gomod group with 1 update: [cloud.google.com/go/storage](https://github.com/googleapis/google-cloud-go).\n\n\nUpdates `cloud.google.com/go/storage` from 1.63.0 to 1.63.1\n- [Release notes](https://github.com/googleapis/google-cloud-go/releases)\n- [Changelog](https://github.com/googleapis/googl\n[…]\n/storage\n  dependency-version: 1.63.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: gomod\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump cloud.google.com/go/storage in the gomod group",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-13T15:34:45Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "323185cc69d4f40ac93fbd9d59df700a6d3acac3",
          "body": "…ogging",
          "is_bot": false,
          "headline": "remove dead warmer Warm methods and unused timing.Summary benchmark l…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-11T22:33:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "43b1455155c09a6bdb6330e09502d2e94eba3745",
          "body": null,
          "is_bot": false,
          "headline": "remove dead Snapshotter.Key and LayeredMap.Key",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-11T22:17:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2e022c83c17bb5779b21657522f0654b7c772c8a",
          "body": "…google.golang.org/api-0.288.0\n\nbuild(deps): bump google.golang.org/api from 0.287.1 to 0.288.0",
          "is_bot": false,
          "headline": "Merge pull request #898 from osscontainertools/dependabot/go_modules/…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-10T15:55:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6439095959ae273575c01e0ce26cce81a84dd644",
          "body": "Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.287.1 to 0.288.0.\n- [Release notes](https://github.com/googleapis/google-api-go-client/releases)\n- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)\n- [Commits](https://github.\n[…]\ndency-name: google.golang.org/api\n  dependency-version: 0.288.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump google.golang.org/api from 0.287.1 to 0.288.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-10T15:33:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e5a8332eaa305a9226e45f304197e3b744dfbc78",
          "body": "…oy/golang-1.26.5\n\nbuild(deps): bump golang from 1.26.4 to 1.26.5 in /deploy",
          "is_bot": false,
          "headline": "Merge pull request #893 from osscontainertools/dependabot/docker/depl…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-09T22:11:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "797797fc797a13af62311d6332cce55aa3a4050f",
          "body": "Bumps golang from 1.26.4 to 1.26.5.\n\n---\nupdated-dependencies:\n- dependency-name: golang\n  dependency-version: 1.26.5\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump golang from 1.26.4 to 1.26.5 in /deploy",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-09T21:51:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f0de19c06fab7180b95fc1fc84e5d921e8842a94",
          "body": "…github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager-0.3.1\n\nbuild(deps): bump github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager from 0.2.14 to 0.3.1",
          "is_bot": false,
          "headline": "Merge pull request #895 from osscontainertools/dependabot/go_modules/…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-09T21:47:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "05ebc2d4415c5a2c2bb9dca46f13bca265873827",
          "body": "…ager\n\nBumps [github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager](https://github.com/aws/aws-sdk-go-v2) from 0.2.14 to 0.3.1.\n- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)\n- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/feature/s3/transfermanager/v0.2.14...service/in\n[…]\ndk-go-v2/feature/s3/transfermanager\n  dependency-version: 0.3.1\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump github.com/aws/aws-sdk-go-v2/feature/s3/transferman…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-09T15:36:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "10719e20e4a76a33afc42520be7129a24faea6ef",
          "body": "…gomod-0223ea245f\n\nbuild(deps): bump google.golang.org/api from 0.287.0 to 0.287.1 in the gomod group across 1 directory",
          "is_bot": false,
          "headline": "Merge pull request #889 from osscontainertools/dependabot/go_modules/…",
          "author_name": "Martin Zihlmann",
          "author_login": "mzihlmann",
          "committed_at": "2026-07-08T21:31:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 31,
      "commits_last_year": 1154,
      "latest_release_at": "2026-07-18T23:26:17Z",
      "latest_release_tag": "v1.28.1",
      "releases_from_tags": false,
      "days_since_last_push": 0,
      "active_weeks_last_year": 52,
      "days_since_latest_release": 10,
      "mean_days_between_releases": 16.6
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 87,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": true
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/osscontainertools/kaniko",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/osscontainertools/kaniko",
          "is_deprecated": false,
          "latest_version": "v1.28.1",
          "repository_url": "https://github.com/osscontainertools/kaniko",
          "versions_count": 30,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-18T23:24:49Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 10
        }
      ]
    },
    "popularity": {
      "forks": 20,
      "stars": 334,
      "watchers": 4,
      "fork_history": {
        "days": [
          {
            "date": "2025-06-30",
            "count": 1
          },
          {
            "date": "2025-08-26",
            "count": 1
          },
          {
            "date": "2025-09-18",
            "count": 1
          },
          {
            "date": "2025-10-10",
            "count": 1
          },
          {
            "date": "2025-10-19",
            "count": 1
          },
          {
            "date": "2025-10-22",
            "count": 1
          },
          {
            "date": "2025-10-27",
            "count": 1
          },
          {
            "date": "2025-11-08",
            "count": 1
          },
          {
            "date": "2025-12-17",
            "count": 1
          },
          {
            "date": "2026-01-06",
            "count": 1
          },
          {
            "date": "2026-01-12",
            "count": 1
          },
          {
            "date": "2026-03-20",
            "count": 1
          },
          {
            "date": "2026-04-27",
            "count": 1
          },
          {
            "date": "2026-05-13",
            "count": 1
          },
          {
            "date": "2026-05-15",
            "count": 1
          },
          {
            "date": "2026-05-31",
            "count": 1
          },
          {
            "date": "2026-06-05",
            "count": 1
          },
          {
            "date": "2026-07-14",
            "count": 1
          },
          {
            "date": "2026-07-15",
            "count": 1
          },
          {
            "date": "2026-07-17",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 20,
        "total_forks": 20
      },
      "star_history": null,
      "open_issues_and_prs": 44
    },
    "ai_readiness": {
      "has_nix": true,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile",
        "vendor/github.com/Azure/go-autorest/GNUmakefile",
        "vendor/github.com/aws/smithy-go/Makefile",
        "vendor/github.com/chrismellard/docker-credential-acr-env/Makefile",
        "vendor/github.com/felixge/httpsnoop/Makefile",
        "vendor/github.com/go-git/gcfg/Makefile",
        "vendor/github.com/go-git/go-billy/v5/Makefile",
        "vendor/github.com/go-git/go-git/v5/Makefile",
        "vendor/github.com/hashicorp/hcl/Makefile",
        "vendor/github.com/kevinburke/ssh_config/Makefile",
        "vendor/github.com/pjbgf/sha1cd/Makefile",
        "vendor/github.com/pkg/errors/Makefile",
        "vendor/github.com/sagikazarmark/locafero/justfile",
        "vendor/github.com/spf13/cast/Makefile",
        "vendor/github.com/spf13/cobra/Makefile",
        "vendor/github.com/spf13/viper/Makefile",
        "vendor/go.opentelemetry.io/otel/Makefile",
        "vendor/go.uber.org/multierr/Makefile",
        "vendor/google.golang.org/grpc/Makefile",
        "vendor/gopkg.in/ini.v1/Makefile"
      ],
      "api_schema_files": [
        "vendor/github.com/envoyproxy/protoc-gen-validate/validate/validate.proto",
        "vendor/github.com/googleapis/gax-go/v2/apierror/internal/proto/custom_error.proto",
        "vendor/github.com/googleapis/gax-go/v2/apierror/internal/proto/error.proto",
        "vendor/github.com/moby/buildkit/util/stack/stack.proto"
      ],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 58700,
      "source_files_sampled": 150,
      "oversized_source_files": 0,
      "agent_instruction_files": [
        "vendor/github.com/aws/smithy-go/AGENTS.md",
        "vendor/github.com/pelletier/go-toml/v2/AGENTS.md",
        "vendor/go.opentelemetry.io/otel/AGENTS.md",
        "vendor/go.opentelemetry.io/otel/CLAUDE.md"
      ],
      "agent_instruction_max_bytes": 6768
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.54.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5932"
            ],
            "fixed_version": null,
            "advisory_count": 1,
            "oldest_advisory_days": 22
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "unknown": 1
        },
        "advisory_count": 1,
        "affected_count": 1,
        "assessed_count": 161,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "cloud.google.com/go/storage",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.64.0"
        },
        {
          "name": "github.com/Azure/azure-sdk-for-go/sdk/storage/azblob",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.0"
        },
        {
          "name": "github.com/GoogleCloudPlatform/docker-credential-gcr/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.1.32"
        },
        {
          "name": "github.com/aws/aws-sdk-go-v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.43.1"
        },
        {
          "name": "github.com/aws/aws-sdk-go-v2/config",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.32.32"
        },
        {
          "name": "github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.6"
        },
        {
          "name": "github.com/aws/aws-sdk-go-v2/service/s3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.106.1"
        },
        {
          "name": "github.com/awslabs/amazon-ecr-credential-helper/ecr-login",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.12.0"
        },
        {
          "name": "github.com/chrismellard/docker-credential-acr-env",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230304212654-82a0ddb27589"
        },
        {
          "name": "github.com/containerd/platforms",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0-rc.4"
        },
        {
          "name": "github.com/cyphar/filepath-securejoin",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.0"
        },
        {
          "name": "github.com/docker/cli",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v29.6.2+incompatible"
        },
        {
          "name": "github.com/docker/docker-credential-helpers",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.9.8"
        },
        {
          "name": "github.com/ePirat/docker-credential-gitlabci",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/go-git/go-billy/v5",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.9.1"
        },
        {
          "name": "github.com/go-git/go-git/v5",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.19.2"
        },
        {
          "name": "github.com/golang/mock",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/google/go-cmp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.0"
        },
        {
          "name": "github.com/google/go-containerregistry",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.21.7"
        },
        {
          "name": "github.com/google/slowjam",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.2"
        },
        {
          "name": "github.com/minio/highwayhash",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.4"
        },
        {
          "name": "github.com/moby/buildkit",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.31.2"
        },
        {
          "name": "github.com/moby/go-archive",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.2.1"
        },
        {
          "name": "github.com/moby/moby/api",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.55.0"
        },
        {
          "name": "github.com/moby/patternmatcher",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.1"
        },
        {
          "name": "github.com/moby/sys/signal",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.1"
        },
        {
          "name": "github.com/otiai10/copy",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.14.1"
        },
        {
          "name": "github.com/sirupsen/logrus",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.9.4"
        },
        {
          "name": "github.com/spf13/afero",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.15.0"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.2"
        },
        {
          "name": "github.com/spf13/pflag",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.10"
        },
        {
          "name": "github.com/tonistiigi/dchapes-mode",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20250318174251-73d941a28323"
        },
        {
          "name": "go.opentelemetry.io/otel",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/sdk",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/trace",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "golang.org/x/sync",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.22.0"
        },
        {
          "name": "golang.org/x/sys",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.47.0"
        },
        {
          "name": "google.golang.org/api",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.291.0"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "cloud.google.com/go/storage",
            "direct": true,
            "version": "v1.64.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2",
            "direct": true,
            "version": "v1.43.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/config",
            "direct": true,
            "version": "v1.32.32",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager",
            "direct": true,
            "version": "v0.3.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/s3",
            "direct": true,
            "version": "v1.106.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/awslabs/amazon-ecr-credential-helper/ecr-login",
            "direct": true,
            "version": "v0.12.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/storage/azblob",
            "direct": true,
            "version": "v1.8.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/chrismellard/docker-credential-acr-env",
            "direct": true,
            "version": "v0.0.0-20230304212654-82a0ddb27589",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/platforms",
            "direct": true,
            "version": "v1.0.0-rc.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyphar/filepath-securejoin",
            "direct": true,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/cli",
            "direct": true,
            "version": "v29.6.2+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/docker-credential-helpers",
            "direct": true,
            "version": "v0.9.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/epirat/docker-credential-gitlabci",
            "direct": true,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/go-billy/v5",
            "direct": true,
            "version": "v5.9.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/go-git/v5",
            "direct": true,
            "version": "v5.19.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/mock",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-cmp",
            "direct": true,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-containerregistry",
            "direct": true,
            "version": "v0.21.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/slowjam",
            "direct": true,
            "version": "v1.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/docker-credential-gcr/v2",
            "direct": true,
            "version": "v2.1.32",
            "ecosystem": "go"
          },
          {
            "name": "github.com/minio/highwayhash",
            "direct": true,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/buildkit",
            "direct": true,
            "version": "v0.31.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/go-archive",
            "direct": true,
            "version": "v0.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/moby/api",
            "direct": true,
            "version": "v1.55.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/patternmatcher",
            "direct": true,
            "version": "v0.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/signal",
            "direct": true,
            "version": "v0.7.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/otiai10/copy",
            "direct": true,
            "version": "v1.14.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sirupsen/logrus",
            "direct": true,
            "version": "v1.9.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/afero",
            "direct": true,
            "version": "v1.15.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cobra",
            "direct": true,
            "version": "v1.10.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": true,
            "version": "v1.0.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tonistiigi/dchapes-mode",
            "direct": true,
            "version": "v0.0.0-20250318174251-73d941a28323",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/trace",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sync",
            "direct": true,
            "version": "v0.22.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": true,
            "version": "v0.47.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/api",
            "direct": true,
            "version": "v0.291.0",
            "ecosystem": "go"
          },
          {
            "name": "cel.dev/expr",
            "direct": false,
            "version": "v0.25.1",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go",
            "direct": false,
            "version": "v0.123.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/auth",
            "direct": false,
            "version": "v0.22.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/auth/oauth2adapt",
            "direct": false,
            "version": "v0.2.8",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/compute/metadata",
            "direct": false,
            "version": "v0.9.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/iam",
            "direct": false,
            "version": "v1.11.0",
            "ecosystem": "go"
          },
          {
            "name": "cloud.google.com/go/monitoring",
            "direct": false,
            "version": "v1.29.0",
            "ecosystem": "go"
          },
          {
            "name": "dario.cat/mergo",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/agext/levenshtein",
            "direct": false,
            "version": "v1.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream",
            "direct": false,
            "version": "v1.7.15",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/credentials",
            "direct": false,
            "version": "v1.19.31",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds",
            "direct": false,
            "version": "v1.18.32",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/configsources",
            "direct": false,
            "version": "v1.4.32",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2",
            "direct": false,
            "version": "v2.7.32",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/v4a",
            "direct": false,
            "version": "v1.4.33",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/ecr",
            "direct": false,
            "version": "v1.55.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/ecrpublic",
            "direct": false,
            "version": "v1.38.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding",
            "direct": false,
            "version": "v1.13.14",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/checksum",
            "direct": false,
            "version": "v1.9.25",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url",
            "direct": false,
            "version": "v1.13.32",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/s3shared",
            "direct": false,
            "version": "v1.19.33",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/signin",
            "direct": false,
            "version": "v1.5.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sso",
            "direct": false,
            "version": "v1.33.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/ssooidc",
            "direct": false,
            "version": "v1.38.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sts",
            "direct": false,
            "version": "v1.45.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/smithy-go",
            "direct": false,
            "version": "v1.27.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go",
            "direct": false,
            "version": "v68.0.0+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/azcore",
            "direct": false,
            "version": "v1.22.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/azure-sdk-for-go/sdk/internal",
            "direct": false,
            "version": "v1.12.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/go-autorest",
            "direct": false,
            "version": "v14.2.0+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/go-autorest/autorest",
            "direct": false,
            "version": "v0.11.30",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/go-autorest/autorest/adal",
            "direct": false,
            "version": "v0.9.24",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/go-autorest/autorest/azure/auth",
            "direct": false,
            "version": "v0.5.13",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/go-autorest/autorest/azure/cli",
            "direct": false,
            "version": "v0.4.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/go-autorest/autorest/date",
            "direct": false,
            "version": "v0.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/go-autorest/logger",
            "direct": false,
            "version": "v0.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/go-autorest/tracing",
            "direct": false,
            "version": "v0.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cenkalti/backoff/v5",
            "direct": false,
            "version": "v5.0.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cespare/xxhash/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cloudflare/circl",
            "direct": false,
            "version": "v1.6.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cncf/xds/go",
            "direct": false,
            "version": "v0.0.0-20260202195803-dba9d589def2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/log",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/typeurl/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dimchansky/utfbom",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-units",
            "direct": false,
            "version": "v0.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/emirpasic/gods",
            "direct": false,
            "version": "v1.18.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/envoyproxy/go-control-plane/envoy",
            "direct": false,
            "version": "v1.37.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/envoyproxy/protoc-gen-validate",
            "direct": false,
            "version": "v1.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/felixge/httpsnoop",
            "direct": false,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fsnotify/fsnotify",
            "direct": false,
            "version": "v1.9.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/gcfg",
            "direct": false,
            "version": "v1.5.1-0.20230307220236-3a3c6141e376",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-jose/go-jose/v4",
            "direct": false,
            "version": "v4.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/logr",
            "direct": false,
            "version": "v1.4.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/stdr",
            "direct": false,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang-jwt/jwt/v4",
            "direct": false,
            "version": "v4.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/groupcache",
            "direct": false,
            "version": "v0.0.0-20241129210726-2c02b8208cf8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/s2a-go",
            "direct": false,
            "version": "v0.1.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/subcommands",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/uuid",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googleapis/enterprise-certificate-proxy",
            "direct": false,
            "version": "v0.3.19",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googleapis/gax-go/v2",
            "direct": false,
            "version": "v2.23.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/detectors/gcp",
            "direct": false,
            "version": "v1.32.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/exporter/metric",
            "direct": false,
            "version": "v0.57.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/googlecloudplatform/opentelemetry-operations-go/internal/resourcemapping",
            "direct": false,
            "version": "v0.57.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/grpc-ecosystem/grpc-gateway/v2",
            "direct": false,
            "version": "v2.29.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/hcl",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/inconshreveable/mousetrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jbenet/go-context",
            "direct": false,
            "version": "v0.0.0-20150711004518-d14ea06fba99",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kevinburke/ssh_config",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/compress",
            "direct": false,
            "version": "v1.18.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/cpuid/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/magiconair/properties",
            "direct": false,
            "version": "v1.8.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/microsoft/go-winio",
            "direct": false,
            "version": "v0.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/go-homedir",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/mapstructure",
            "direct": false,
            "version": "v1.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/docker-image-spec",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/sequential",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/user",
            "direct": false,
            "version": "v0.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/userns",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/go-digest",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/image-spec",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/otiai10/mint",
            "direct": false,
            "version": "v1.6.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml/v2",
            "direct": false,
            "version": "v2.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pjbgf/sha1cd",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/errors",
            "direct": false,
            "version": "v0.9.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/planetscale/vtprotobuf",
            "direct": false,
            "version": "v0.6.1-0.20240319094008-0393e58bdf10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/protonmail/go-crypto",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sagikazarmark/locafero",
            "direct": false,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sagikazarmark/slog-shim",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sergi/go-diff",
            "direct": false,
            "version": "v1.3.2-0.20230802210424-5b0b94c5c0d3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/skeema/knownhosts",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sourcegraph/conc",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cast",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/viper",
            "direct": false,
            "version": "v1.18.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spiffe/go-spiffe/v2",
            "direct": false,
            "version": "v2.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/subosito/gotenv",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tonistiigi/go-csvvalue",
            "direct": false,
            "version": "v0.0.0-20240814133006-030d3b2625d0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/toqueteos/webbrowser",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xanzy/ssh-agent",
            "direct": false,
            "version": "v0.3.3",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/auto/sdk",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/detectors/gcp",
            "direct": false,
            "version": "v1.43.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
            "direct": false,
            "version": "v0.69.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
            "direct": false,
            "version": "v0.69.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/metric",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk/metric",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/proto/otlp",
            "direct": false,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/multierr",
            "direct": false,
            "version": "v1.11.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.54.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/exp",
            "direct": false,
            "version": "v0.0.0-20260603202125-055de637280b",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.57.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/oauth2",
            "direct": false,
            "version": "v0.36.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.40.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/time",
            "direct": false,
            "version": "v0.15.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto",
            "direct": false,
            "version": "v0.0.0-20260519071638-aa98bba5eb94",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/api",
            "direct": false,
            "version": "v0.0.0-20260630182238-925bb5da69e7",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/rpc",
            "direct": false,
            "version": "v0.0.0-20260724162435-b2f20204f0df",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/grpc",
            "direct": false,
            "version": "v1.82.1",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/protobuf",
            "direct": false,
            "version": "v1.36.11",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/ini.v1",
            "direct": false,
            "version": "v1.67.0",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/warnings.v0",
            "direct": false,
            "version": "v0.1.2",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": false,
            "version": "v3.0.1",
            "ecosystem": "go"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 161,
        "direct_count": 39,
        "indirect_count": 122
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 28,
        "merged_prs": 747,
        "open_issues": 16,
        "closed_ratio": 0.856,
        "closed_issues": 95,
        "closed_unmerged_prs": 59
      },
      "bus_factor": 2,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "mzihlmann",
          "commits": 1019,
          "avatar_url": "https://avatars.githubusercontent.com/u/68678250?v=4"
        },
        {
          "type": "User",
          "login": "tejal29",
          "commits": 467,
          "avatar_url": "https://avatars.githubusercontent.com/u/1534539?v=4"
        },
        {
          "type": "User",
          "login": "cvgw",
          "commits": 90,
          "avatar_url": "https://avatars.githubusercontent.com/u/6496969?v=4"
        },
        {
          "type": "User",
          "login": "dlorenc",
          "commits": 70,
          "avatar_url": "https://avatars.githubusercontent.com/u/1714486?v=4"
        },
        {
          "type": "User",
          "login": "aaron-prindle",
          "commits": 60,
          "avatar_url": "https://avatars.githubusercontent.com/u/1951658?v=4"
        },
        {
          "type": "User",
          "login": "greut",
          "commits": 43,
          "avatar_url": "https://avatars.githubusercontent.com/u/1388?v=4"
        },
        {
          "type": "User",
          "login": "imjasonh",
          "commits": 42,
          "avatar_url": "https://avatars.githubusercontent.com/u/210737?v=4"
        },
        {
          "type": "User",
          "login": "sharifelgamal",
          "commits": 39,
          "avatar_url": "https://avatars.githubusercontent.com/u/20781941?v=4"
        },
        {
          "type": "User",
          "login": "samos123",
          "commits": 20,
          "avatar_url": "https://avatars.githubusercontent.com/u/388784?v=4"
        },
        {
          "type": "User",
          "login": "caarlos0",
          "commits": 20,
          "avatar_url": "https://avatars.githubusercontent.com/u/245435?v=4"
        }
      ],
      "contributors_sampled": 99,
      "top_contributor_share": 0.444
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "images.yaml",
        "integration-tests.yaml",
        "nightly-vulnerability-scan.yml",
        "unit-tests.yaml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        ".golangci.yaml",
        ".golangci.yml"
      ],
      "has_editorconfig": true,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum",
        "package-lock.json"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": null,
            "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "16 out of 16 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 8,
            "reason": "Found 4/5 approved changesets -- score normalized to 8",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 62 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 29 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 1,
            "reason": "dependency not pinned by hash detected -- score normalized to 1",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 9,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 10,
            "reason": "GitHub workflow tokens follow principle of least privilege",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 8,
            "reason": "2 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "f273820387a6b0c853f974a19ff5c74ed585e6b7",
        "ran_at": "2026-07-29T23:21:42Z",
        "aggregate_score": 7.7,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-29T19:58:26Z",
      "oldest_open_prs": [
        {
          "number": 90,
          "created_at": "2025-06-29T22:09:34Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 106,
          "created_at": "2025-07-06T19:03:50Z",
          "last_comment_at": "2026-06-28T21:50:18Z",
          "last_comment_author": "codecov"
        },
        {
          "number": 126,
          "created_at": "2025-07-17T07:14:06Z",
          "last_comment_at": "2025-07-17T07:23:16Z",
          "last_comment_author": "mzihlmann"
        },
        {
          "number": 172,
          "created_at": "2025-08-08T22:34:43Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 197,
          "created_at": "2025-08-24T09:24:49Z",
          "last_comment_at": "2025-08-24T10:11:47Z",
          "last_comment_author": "mzihlmann"
        },
        {
          "number": 231,
          "created_at": "2025-09-07T11:48:55Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 237,
          "created_at": "2025-09-08T21:20:57Z",
          "last_comment_at": "2025-10-11T15:34:02Z",
          "last_comment_author": "mzihlmann"
        },
        {
          "number": 243,
          "created_at": "2025-09-09T20:53:46Z",
          "last_comment_at": "2026-02-27T15:10:52Z",
          "last_comment_author": "mzihlmann"
        },
        {
          "number": 322,
          "created_at": "2025-10-18T09:08:16Z",
          "last_comment_at": "2025-10-18T09:09:42Z",
          "last_comment_author": "mzihlmann"
        },
        {
          "number": 323,
          "created_at": "2025-10-19T03:10:16Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 481,
          "created_at": "2026-01-28T18:12:09Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 524,
          "created_at": "2026-02-24T22:28:19Z",
          "last_comment_at": "2026-02-25T22:01:05Z",
          "last_comment_author": "mzihlmann"
        },
        {
          "number": 539,
          "created_at": "2026-03-01T18:38:29Z",
          "last_comment_at": "2026-03-02T00:04:20Z",
          "last_comment_author": "mzihlmann"
        },
        {
          "number": 582,
          "created_at": "2026-03-16T22:47:54Z",
          "last_comment_at": "2026-03-31T19:56:44Z",
          "last_comment_author": "mzihlmann"
        },
        {
          "number": 626,
          "created_at": "2026-04-06T22:46:14Z",
          "last_comment_at": "2026-07-26T20:51:32Z",
          "last_comment_author": "mzihlmann"
        },
        {
          "number": 648,
          "created_at": "2026-04-18T12:29:34Z",
          "last_comment_at": "2026-06-26T14:32:25Z",
          "last_comment_author": "codecov"
        },
        {
          "number": 672,
          "created_at": "2026-05-02T17:35:09Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 708,
          "created_at": "2026-05-16T20:10:31Z",
          "last_comment_at": "2026-05-16T20:31:56Z",
          "last_comment_author": "codecov"
        },
        {
          "number": 773,
          "created_at": "2026-06-08T17:42:22Z",
          "last_comment_at": "2026-06-08T17:55:44Z",
          "last_comment_author": "codecov"
        },
        {
          "number": 869,
          "created_at": "2026-07-03T16:45:26Z",
          "last_comment_at": "2026-07-03T16:56:30Z",
          "last_comment_author": "codecov"
        }
      ],
      "last_merged_pr_at": "2026-07-29T19:45:04Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 389,
          "created_at": "2025-11-13T07:26:44Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 440,
          "created_at": "2025-12-23T20:21:12Z",
          "last_comment_at": "2026-02-25T20:36:07Z",
          "last_comment_author": "mzihlmann"
        },
        {
          "number": 474,
          "created_at": "2026-01-25T18:48:01Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 523,
          "created_at": "2026-02-24T22:14:36Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 772,
          "created_at": "2026-06-08T17:41:23Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 868,
          "created_at": "2026-07-03T16:31:37Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 872,
          "created_at": "2026-07-05T11:07:43Z",
          "last_comment_at": "2026-07-09T11:39:14Z",
          "last_comment_author": "mzihlmann"
        },
        {
          "number": 876,
          "created_at": "2026-07-05T19:47:50Z",
          "last_comment_at": "2026-07-07T07:28:04Z",
          "last_comment_author": "mzihlmann"
        },
        {
          "number": 878,
          "created_at": "2026-07-06T08:06:19Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 880,
          "created_at": "2026-07-06T19:43:41Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 881,
          "created_at": "2026-07-06T20:19:13Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 883,
          "created_at": "2026-07-06T20:48:45Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 897,
          "created_at": "2026-07-10T15:29:06Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 904,
          "created_at": "2026-07-14T14:03:02Z",
          "last_comment_at": "2026-07-14T14:06:58Z",
          "last_comment_author": "mzihlmann"
        },
        {
          "number": 922,
          "created_at": "2026-07-17T14:28:50Z",
          "last_comment_at": "2026-07-17T14:45:17Z",
          "last_comment_author": "mzihlmann"
        },
        {
          "number": 936,
          "created_at": "2026-07-21T20:47:14Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/osscontainertools/kaniko",
    "host": "github.com",
    "name": "kaniko",
    "owner": "osscontainertools"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "good",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 82,
      "inputs": {
        "security": 82,
        "vitality": 100,
        "community": 72,
        "governance": 71,
        "engineering": 84
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "excellent",
        "name": "Vitality",
        "value": 100,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "excellent",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "commits_last_year": 1154,
              "human_commit_share": 0.73,
              "days_since_last_push": 0,
              "active_weeks_last_year": 52
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "52/52 weeks with commits",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 52
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "1154 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 1154
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 29 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "releases_count": 31,
              "latest_release_tag": "v1.28.1",
              "releases_from_tags": false,
              "days_since_latest_release": 10,
              "mean_days_between_releases": 16.6
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "31 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 31
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 10 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 10
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~16.6 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 16.6
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "maintained",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 0,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "last human commit 0 days ago",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_maintained",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "good",
        "name": "Community & Adoption",
        "value": 72,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "moderate",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 54,
            "inputs": {
              "forks": 20,
              "stars": 334,
              "watchers": 4,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "334 stars",
                "points": 40.9,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 334
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "20 forks",
                "points": 10.7,
                "status": "partial",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 20
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "4 watchers",
                "points": 2.7,
                "status": "partial",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "excellent",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 92,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "has_pull_request_template": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 6.3,
                "status": "met",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "good",
        "name": "Sustainability & Governance",
        "value": 71,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "moderate",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 61,
            "inputs": {
              "bus_factor": 2,
              "contributors_sampled": 99,
              "top_contributor_share": 0.444
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "2 contributor(s) cover half of all commits",
                "points": 25.2,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 44% of commits",
                "points": 12.5,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 44
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "99 contributors",
                "points": 13.5,
                "status": "met",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 99
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 62 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "excellent",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 88,
            "inputs": {
              "merged_prs": 747,
              "open_issues": 16,
              "closed_issues": 95,
              "issue_closed_ratio": 0.856,
              "closed_unmerged_prs": 59
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "86% of issues closed",
                "points": 40,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 86
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "747/806 decided PRs merged",
                "points": 35.5,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 747,
                      "decided": 806
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 4/5 approved changesets -- score normalized to 8",
                "points": 12,
                "status": "partial",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 42,
            "inputs": {
              "followers": 11,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "osscontainertools",
              "public_repos": 1,
              "account_age_days": 322
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "11 followers of osscontainertools",
                "points": 7.8,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 11,
                      "login": "osscontainertools"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "1 public repos, account ~0 yr old",
                "points": 4,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 1
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 0
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/osscontainertools/kaniko"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 10
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 10 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 10
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "30 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 30
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 84,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "excellent",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": true,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "4 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yaml, .golangci.yml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml, .golangci.yml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 6.4,
                "status": "met",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "16 out of 16 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "good",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 75,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "good",
        "name": "Security",
        "value": 82,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "good",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Branch-Protection, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "branch_protection",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 77,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 7.7
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "16 out of 16 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 4/5 approved changesets -- score normalized to 8",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 62 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 29 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 1",
                "points": 0.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 4.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "GitHub workflow tokens follow principle of least privilege",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "2 existing vulnerabilities detected",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 161 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories",
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 161
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 1,
              "affected_packages": 1,
              "assessed_packages": 161,
              "unassessed_packages": 0,
              "affected_by_severity": "unknown 1",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 161,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 16
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "excellent",
        "name": "AI Readiness",
        "value": 87,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.877,
              "agent_instruction_files": [
                "vendor/github.com/aws/smithy-go/AGENTS.md",
                "vendor/github.com/pelletier/go-toml/v2/AGENTS.md",
                "vendor/go.opentelemetry.io/otel/AGENTS.md",
                "vendor/go.opentelemetry.io/otel/CLAUDE.md"
              ],
              "agent_instruction_max_bytes": 6768
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "vendor/github.com/aws/smithy-go/AGENTS.md, vendor/github.com/pelletier/go-toml/v2/AGENTS.md, vendor/go.opentelemetry.io/otel/AGENTS.md, vendor/go.opentelemetry.io/otel/CLAUDE.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "vendor/github.com/aws/smithy-go/AGENTS.md, vendor/github.com/pelletier/go-toml/v2/AGENTS.md, vendor/go.opentelemetry.io/otel/AGENTS.md, vendor/go.opentelemetry.io/otel/CLAUDE.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "64 of 73 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 64,
                      "sampled": 73
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "excellent",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 87,
            "inputs": {
              "has_nix": true,
              "has_tests": true,
              "lockfiles": [
                "go.sum",
                "package-lock.json"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile",
                "vendor/github.com/Azure/go-autorest/GNUmakefile",
                "vendor/github.com/aws/smithy-go/Makefile",
                "vendor/github.com/chrismellard/docker-credential-acr-env/Makefile",
                "vendor/github.com/felixge/httpsnoop/Makefile",
                "vendor/github.com/go-git/gcfg/Makefile",
                "vendor/github.com/go-git/go-billy/v5/Makefile",
                "vendor/github.com/go-git/go-git/v5/Makefile",
                "vendor/github.com/hashicorp/hcl/Makefile",
                "vendor/github.com/kevinburke/ssh_config/Makefile",
                "vendor/github.com/pjbgf/sha1cd/Makefile",
                "vendor/github.com/pkg/errors/Makefile",
                "vendor/github.com/sagikazarmark/locafero/justfile",
                "vendor/github.com/spf13/cast/Makefile",
                "vendor/github.com/spf13/cobra/Makefile",
                "vendor/github.com/spf13/viper/Makefile",
                "vendor/go.opentelemetry.io/otel/Makefile",
                "vendor/go.uber.org/multierr/Makefile",
                "vendor/google.golang.org/grpc/Makefile",
                "vendor/gopkg.in/ini.v1/Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0.03,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0.27
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile, vendor/github.com/Azure/go-autorest/GNUmakefile, vendor/github.com/aws/smithy-go/Makefile, vendor/github.com/chrismellard/docker-credential-acr-env/Makefile, vendor/github.com/felixge/httpsnoop/Makefile, vendor/github.com/go-git/gcfg/Makefile, vendor/github.com/go-git/go-billy/v5/Makefile, vendor/github.com/go-git/go-git/v5/Makefile, vendor/github.com/hashicorp/hcl/Makefile, vendor/github.com/kevinburke/ssh_config/Makefile, vendor/github.com/pjbgf/sha1cd/Makefile, vendor/github.com/pkg/errors/Makefile, vendor/github.com/sagikazarmark/locafero/justfile, vendor/github.com/spf13/cast/Makefile, vendor/github.com/spf13/cobra/Makefile, vendor/github.com/spf13/viper/Makefile, vendor/go.opentelemetry.io/otel/Makefile, vendor/go.uber.org/multierr/Makefile, vendor/google.golang.org/grpc/Makefile, vendor/gopkg.in/ini.v1/Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile, vendor/github.com/Azure/go-autorest/GNUmakefile, vendor/github.com/aws/smithy-go/Makefile, vendor/github.com/chrismellard/docker-credential-acr-env/Makefile, vendor/github.com/felixge/httpsnoop/Makefile, vendor/github.com/go-git/gcfg/Makefile, vendor/github.com/go-git/go-billy/v5/Makefile, vendor/github.com/go-git/go-git/v5/Makefile, vendor/github.com/hashicorp/hcl/Makefile, vendor/github.com/kevinburke/ssh_config/Makefile, vendor/github.com/pjbgf/sha1cd/Makefile, vendor/github.com/pkg/errors/Makefile, vendor/github.com/sagikazarmark/locafero/justfile, vendor/github.com/spf13/cast/Makefile, vendor/github.com/spf13/cobra/Makefile, vendor/github.com/spf13/viper/Makefile, vendor/go.opentelemetry.io/otel/Makefile, vendor/go.uber.org/multierr/Makefile, vendor/google.golang.org/grpc/Makefile, vendor/gopkg.in/ini.v1/Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yaml, .golangci.yml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml, .golangci.yml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, Nix, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, Nix, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "3 of the last 100 commits agent-authored or agent-credited",
                "points": 6,
                "status": "partial",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 3,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "27 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 27,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 1",
                "points": 1,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 58700,
              "source_files_sampled": 150,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/150 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 150,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "good",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 80,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": [
                "vendor/github.com/envoyproxy/protoc-gen-validate/validate/validate.proto",
                "vendor/github.com/googleapis/gax-go/v2/apierror/internal/proto/custom_error.proto",
                "vendor/github.com/googleapis/gax-go/v2/apierror/internal/proto/error.proto",
                "vendor/github.com/moby/buildkit/util/stack/stack.proto"
              ]
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": "vendor/github.com/envoyproxy/protoc-gen-validate/validate/validate.proto, vendor/github.com/googleapis/gax-go/v2/apierror/internal/proto/custom_error.proto, vendor/github.com/googleapis/gax-go/v2/apierror/internal/proto/error.proto, vendor/github.com/moby/buildkit/util/stack/stack.proto",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "vendor/github.com/envoyproxy/protoc-gen-validate/validate/validate.proto, vendor/github.com/googleapis/gax-go/v2/apierror/internal/proto/custom_error.proto, vendor/github.com/googleapis/gax-go/v2/apierror/internal/proto/error.proto, vendor/github.com/moby/buildkit/util/stack/stack.proto"
                    }
                  }
                ],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-29T23:23:35.483613Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/o/osscontainertools/kaniko.svg",
  "full_name": "osscontainertools/kaniko",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}