privateerproj/privateer holds a health index of 84 out of 100, placing it in the Excellent band. It scores highest on Vitality (90/100) and lowest on Community & Adoption (56/100). It was last updated 4 days ago. 2 contributors account for most of its recent work.
84
overall / 100
Excellent
Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean, calibrated against the distribution of the public record so bands carry percentile meaning; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At Risk ceiling of 34.
84
Exceptional93-100The record's top tier (≈ top 5%); essentially all checked criteria met
Excellent80-92Strong across the board; minor gaps
Good65-79Healthy; gaps are limited and manageable
Moderate50-64Acceptable with notable gaps; review recommended
Weak35-49Material weaknesses across several areas
At Risk20-34Significant weaknesses; adoption warrants caution
Critical1-19Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
The weighted overall 71 is calibrated to 84 on the published index scale (record calibration 2026-08-02).
Direct dependencies free of known advisories — no direct dependency carries a known advisory
0/25
Indirect dependencies free of known advisories — transitive set not separable from development and test dependencies in this scope
0/40
No advisories left outstanding — no advisory carries a publication date
Inputs used
source
osv
advisories
1
affected_packages
1
assessed_packages
125
unassessed_packages
0
affected_by_severity
unknown 1
direct_affected_packages
0
Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 125 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.
How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight (4%): agent tooling is a real maintenance signal, but a repository with none can still reach 100/100.
Type-checkable code — Shell without a type-check config
55/55
Manageable file sizes — 0/12 source files over 60KB
Inputs used
primary_language
Shell
largest_source_bytes
4,427
source_files_sampled
12
oversized_source_files
0
Key facts
23GitHub stars
13contributors
151commits, last 12 months
4days since last push
44releases
2bus factor
10open issues
Gopackage ecosystems
Data collection warnings
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
More detail
Star and fork history 0 ★ / 9 ⇿
0Stars
9Forks
42Releases
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Major 0Minor 22Patch 19
Each point covers 3 days.
OpenSSF Scorecard 7.7 / 10
7.7aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-08-01 03:04 UTC
Full resolved dependency set from the GitHub dependency graph: 5 direct and 120 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.
Registry
Package
Version
Relation
Go
github.com/hashicorp/go-hclog
v1.6.3
direct
Go
github.com/hashicorp/go-plugin
v1.8.0
direct
Go
github.com/privateerproj/privateer-sdk
v1.32.0
direct
Go
github.com/spf13/cobra
v1.10.2
direct
Go
github.com/spf13/viper
v1.21.0
direct
Go
dario.cat/mergo
v1.0.1
indirect
Go
github.com/asaskevich/govalidator
v0.0.0-20230301143203-a9d515a09cc2
indirect
Go
github.com/blang/semver
v3.5.1+incompatible
indirect
Go
github.com/cenkalti/backoff/v5
v5.0.3
indirect
Go
github.com/cespare/xxhash/v2
v2.3.0
indirect
Go
github.com/cloudflare/circl
v1.6.3
indirect
Go
github.com/coreos/go-oidc/v3
v3.17.0
indirect
Go
github.com/cyberphone/json-canonicalization
v0.0.0-20241213102144-19d51d7fe467
indirect
Go
github.com/cyphar/filepath-securejoin
v0.6.1
indirect
Go
github.com/defenseunicorns/go-oscal
v0.7.0
indirect
Go
github.com/digitorus/pkcs7
v0.0.0-20230818184609-3a137a874352
indirect
Go
github.com/digitorus/timestamp
v0.0.0-20231217203849-220c5c2851b7
indirect
Go
github.com/emirpasic/gods
v1.18.1
indirect
Go
github.com/fatih/color
v1.18.0
indirect
Go
github.com/fsnotify/fsnotify
v1.9.0
indirect
Go
github.com/gemaraproj/go-gemara
v0.8.0
indirect
Go
github.com/go-git/gcfg
v1.5.1-0.20230307220236-3a3c6141e376
indirect
Go
github.com/go-git/go-billy/v5
v5.9.0
indirect
Go
github.com/go-git/go-git/v5
v5.19.1
indirect
Go
github.com/go-jose/go-jose/v4
v4.1.4
indirect
Go
github.com/go-logr/logr
v1.4.3
indirect
Go
github.com/go-logr/stdr
v1.2.2
indirect
Go
github.com/go-openapi/analysis
v0.25.2
indirect
Go
github.com/go-openapi/errors
v0.22.8
indirect
Go
github.com/go-openapi/jsonpointer
v0.23.1
indirect
Go
github.com/go-openapi/jsonreference
v0.21.6
indirect
Go
github.com/go-openapi/loads
v0.24.0
indirect
Go
github.com/go-openapi/runtime
v0.32.4
indirect
Go
github.com/go-openapi/runtime/server-middleware
v0.30.0
indirect
Go
github.com/go-openapi/spec
v0.22.6
indirect
Go
github.com/go-openapi/strfmt
v0.26.4
indirect
Go
github.com/go-openapi/swag
v0.26.1
indirect
Go
github.com/go-openapi/swag/cmdutils
v0.26.1
indirect
Go
github.com/go-openapi/swag/conv
v0.27.0
indirect
Go
github.com/go-openapi/swag/fileutils
v0.26.1
indirect
Go
github.com/go-openapi/swag/jsonname
v0.26.1
indirect
Go
github.com/go-openapi/swag/jsonutils
v0.26.1
indirect
Go
github.com/go-openapi/swag/loading
v0.26.1
indirect
Go
github.com/go-openapi/swag/mangling
v0.26.1
indirect
Go
github.com/go-openapi/swag/netutils
v0.26.1
indirect
Go
github.com/go-openapi/swag/stringutils
v0.26.1
indirect
Go
github.com/go-openapi/swag/typeutils
v0.27.0
indirect
Go
github.com/go-openapi/swag/yamlutils
v0.26.1
indirect
Go
github.com/go-openapi/validate
v0.26.0
indirect
Go
github.com/go-viper/mapstructure/v2
v2.5.0
indirect
Go
github.com/goccy/go-yaml
v1.19.2
indirect
Go
github.com/golang/groupcache
v0.0.0-20241129210726-2c02b8208cf8
indirect
Go
github.com/golang/protobuf
v1.5.4
indirect
Go
github.com/google/certificate-transparency-go
v1.3.3
indirect
Go
github.com/google/go-containerregistry
v0.21.7
indirect
Go
github.com/google/uuid
v1.6.0
indirect
Go
github.com/grpc-ecosystem/grpc-gateway/v2
v2.29.0
indirect
Go
github.com/hashicorp/go-cleanhttp
v0.5.2
indirect
Go
github.com/hashicorp/go-retryablehttp
v0.7.8
indirect
Go
github.com/hashicorp/yamux
v0.1.2
indirect
Go
github.com/in-toto/attestation
v1.2.0
indirect
Go
github.com/in-toto/in-toto-golang
v0.11.0
indirect
Go
github.com/inconshreveable/mousetrap
v1.1.0
indirect
Go
github.com/jbenet/go-context
v0.0.0-20150711004518-d14ea06fba99
indirect
Go
github.com/jedisct1/go-minisign
v0.0.0-20211028175153-1c139d1cc84b
indirect
Go
github.com/kevinburke/ssh_config
v1.2.0
indirect
Go
github.com/klauspost/cpuid/v2
v2.3.0
indirect
Go
github.com/mattn/go-colorable
v0.1.14
indirect
Go
github.com/mattn/go-isatty
v0.0.20
indirect
Go
github.com/microsoft/go-winio
v0.6.2
indirect
Go
github.com/oklog/run
v1.1.0
indirect
Go
github.com/oklog/ulid/v2
v2.1.1
indirect
Go
github.com/opencontainers/go-digest
v1.0.0
indirect
Go
github.com/opencontainers/image-spec
v1.1.1
indirect
Go
github.com/pelletier/go-toml/v2
v2.2.4
indirect
Go
github.com/pjbgf/sha1cd
v0.6.0
indirect
Go
github.com/pkg/browser
v0.0.0-20240102092130-5ac0b6a4141c
indirect
Go
github.com/pkg/errors
v0.9.1
indirect
Go
github.com/protonmail/go-crypto
v1.1.6
indirect
Go
github.com/revanite-io/grc-store-protocol
v0.5.0
indirect
Go
github.com/sagikazarmark/locafero
v0.11.0
indirect
Go
github.com/santhosh-tekuri/jsonschema/v6
v6.0.2
indirect
Go
github.com/sassoftware/relic
v7.2.1+incompatible
indirect
Go
github.com/secure-systems-lab/go-securesystemslib
v0.11.0
indirect
Go
github.com/sergi/go-diff
v1.4.0
indirect
Go
github.com/shibumi/go-pathspec
v1.3.0
indirect
Go
github.com/sigstore/protobuf-specs
v0.5.1
indirect
Go
github.com/sigstore/rekor
v1.5.3
indirect
Go
github.com/sigstore/rekor-tiles/v2
v2.3.0
indirect
Go
github.com/sigstore/sigstore
v1.10.8
indirect
Go
github.com/sigstore/sigstore-go
v1.2.2
indirect
Go
github.com/sigstore/timestamp-authority/v2
v2.1.2
indirect
Go
github.com/skeema/knownhosts
v1.3.1
indirect
Go
github.com/sourcegraph/conc
v0.3.1-0.20240121214520-5f936abd7ae8
indirect
Go
github.com/spf13/afero
v1.15.0
indirect
Go
github.com/spf13/cast
v1.10.0
indirect
Go
github.com/spf13/pflag
v1.0.10
indirect
Go
github.com/subosito/gotenv
v1.6.0
indirect
Go
github.com/theupdateframework/go-tuf
v0.7.0
indirect
Go
github.com/theupdateframework/go-tuf/v2
v2.4.2
indirect
Go
github.com/transparency-dev/formats
v0.1.1
indirect
Go
github.com/transparency-dev/merkle
v0.0.2
indirect
Go
github.com/xanzy/ssh-agent
v0.3.3
indirect
Go
github.com/youmark/pkcs8
v0.0.0-20240726163527-a2c0da244d78
indirect
Go
go.opentelemetry.io/auto/sdk
v1.2.1
indirect
Go
go.opentelemetry.io/otel
v1.44.0
indirect
Go
go.opentelemetry.io/otel/metric
v1.44.0
indirect
Go
go.opentelemetry.io/otel/trace
v1.44.0
indirect
Go
go.yaml.in/yaml/v3
v3.0.4
indirect
Go
golang.org/x/crypto
v0.54.0
indirect
Go
golang.org/x/mod
v0.38.0
indirect
Go
golang.org/x/net
v0.56.0
indirect
Go
golang.org/x/oauth2
v0.36.0
indirect
Go
golang.org/x/sync
v0.22.0
indirect
Go
golang.org/x/sys
v0.47.0
indirect
Go
golang.org/x/term
v0.45.0
indirect
Go
golang.org/x/text
v0.40.0
indirect
Go
google.golang.org/genproto/googleapis/api
v0.0.0-20260526163538-3dc84a4a5aaa
indirect
Go
google.golang.org/genproto/googleapis/rpc
v0.0.0-20260523011958-0a33c5d7ca68
indirect
Go
google.golang.org/grpc
v1.82.1
indirect
Go
google.golang.org/protobuf
v1.36.11
indirect
Go
gopkg.in/warnings.v0
v0.1.2
indirect
Go
gopkg.in/yaml.v3
v3.0.1
indirect
Go
k8s.io/klog/v2
v2.140.0
indirect
Go
oras.land/oras-go/v2
v2.6.2
indirect
Dependency advisories 1
This repository publishes no package the index resolves, so its own dependency graph was assessed — 125 packages, which also include development and test pins that never ship: 1 carry known advisories, of which 0 are direct.
Package
Version
Relation
Severity
Advisories
Fixed in
golang.org/x/crypto
v0.54.0
indirect
unknown
1
—
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 13358,
"has_wiki": false,
"homepage": null,
"languages": {
"Go": 18668,
"Shell": 18975,
"Makefile": 2552,
"Dockerfile": 377
},
"pushed_at": "2026-07-27T17:13:46Z",
"created_at": "2022-10-26T12:14:52Z",
"owner_type": "Organization",
"updated_at": "2026-07-27T17:14:33Z",
"description": "Privateer is a plugin-based framework for security & compliance evaluations.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "main",
"license_spdx_raw": "Apache-2.0",
"primary_language": "Shell",
"significant_languages": [
"Shell",
"Go"
]
},
"owner": {
"blog": null,
"name": "Privateer Project",
"type": "Organization",
"login": "privateerproj",
"company": null,
"location": null,
"followers": 9,
"avatar_url": "https://avatars.githubusercontent.com/u/116728460?v=4",
"created_at": "2022-10-26T12:10:18Z",
"is_verified": null,
"public_repos": 7,
"account_age_days": 1374
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.22.0",
"kind": "minor",
"published_at": "2026-07-20T14:10:11Z"
},
{
"tag": "v0.21.2",
"kind": "patch",
"published_at": "2026-05-18T22:57:37Z"
},
{
"tag": "v0.21.1",
"kind": "patch",
"published_at": "2026-05-12T13:41:40Z"
},
{
"tag": "v0.21.0",
"kind": "minor",
"published_at": "2026-05-01T04:53:14Z"
},
{
"tag": "v0.20.3",
"kind": "patch",
"published_at": "2026-04-26T21:26:14Z"
},
{
"tag": "v0.20.2",
"kind": "patch",
"published_at": "2026-04-12T23:15:45Z"
},
{
"tag": "v0.20.1",
"kind": "patch",
"published_at": "2026-04-12T21:39:55Z"
},
{
"tag": "v0.20.0",
"kind": "minor",
"published_at": "2026-04-12T03:33:41Z"
},
{
"tag": "v0.19.0",
"kind": "minor",
"published_at": "2026-04-07T20:04:56Z"
},
{
"tag": "v0.18.1",
"kind": "patch",
"published_at": "2026-03-31T13:35:41Z"
},
{
"tag": "v0.18.0",
"kind": "minor",
"published_at": "2026-03-16T06:54:32Z"
},
{
"tag": "v0.17.0",
"kind": "minor",
"published_at": "2026-03-16T01:38:04Z"
},
{
"tag": "v0.16.1",
"kind": "patch",
"published_at": "2026-03-14T21:44:41Z"
},
{
"tag": "v0.16.0",
"kind": "minor",
"published_at": "2026-03-14T15:44:55Z"
},
{
"tag": "v0.15.1",
"kind": "patch",
"published_at": "2026-03-13T06:54:32Z"
},
{
"tag": "v0.15.0",
"kind": "minor",
"published_at": "2026-02-15T17:14:18Z"
},
{
"tag": "v0.14.3",
"kind": "patch",
"published_at": "2026-02-15T15:15:30Z"
},
{
"tag": "v0.14.2",
"kind": "patch",
"published_at": "2026-02-15T07:26:29Z"
},
{
"tag": "v0.14.1",
"kind": "patch",
"published_at": "2026-02-15T07:12:17Z"
},
{
"tag": "v0.14.0",
"kind": "minor",
"published_at": "2026-02-15T06:46:51Z"
},
{
"tag": "v0.13.2",
"kind": "patch",
"published_at": "2026-02-15T00:12:08Z"
},
{
"tag": "v0.13.1",
"kind": "patch",
"published_at": "2026-02-14T16:40:40Z"
},
{
"tag": "v0.13.0",
"kind": "minor",
"published_at": "2025-11-06T23:37:47Z"
},
{
"tag": "v0.12.0",
"kind": "minor",
"published_at": "2025-11-04T19:45:06Z"
},
{
"tag": "v0.11.0",
"kind": "minor",
"published_at": "2025-11-03T02:57:40Z"
},
{
"tag": "v0.10.0",
"kind": "minor",
"published_at": "2025-10-10T15:05:42Z"
},
{
"tag": "v0.9.1",
"kind": "patch",
"published_at": "2025-09-27T16:03:22Z"
},
{
"tag": "v0.9.0",
"kind": "minor",
"published_at": "2025-09-25T18:50:37Z"
},
{
"tag": "v0.8.0",
"kind": "minor",
"published_at": "2025-03-30T12:03:15Z"
},
{
"tag": "v0.7.0",
"kind": "minor",
"published_at": "2025-03-06T00:57:49Z"
},
{
"tag": "v0.6.0",
"kind": "minor",
"published_at": "2025-02-23T23:49:52Z"
},
{
"tag": "v0.5.0",
"kind": "minor",
"published_at": "2025-01-28T20:05:52Z"
},
{
"tag": "v0.4.1",
"kind": "patch",
"published_at": "2025-01-27T22:02:35Z"
},
{
"tag": "v0.4.0",
"kind": "minor",
"published_at": "2025-01-20T22:00:39Z"
},
{
"tag": "v0.3.1",
"kind": "patch",
"published_at": "2025-01-19T15:52:00Z"
},
{
"tag": "v0.3.0",
"kind": "minor",
"published_at": "2025-01-15T23:37:34Z"
},
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2025-01-14T11:58:22Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2025-01-07T08:02:43Z"
},
{
"tag": "v0.0.4",
"kind": "patch",
"published_at": "2025-01-03T20:09:00Z"
},
{
"tag": "v0.0.3",
"kind": "patch",
"published_at": "2024-12-23T01:55:34Z"
},
{
"tag": "v0.0.3-rc",
"kind": "prerelease",
"published_at": "2024-12-02T11:03:14Z"
},
{
"tag": "v0.0.2",
"kind": "patch",
"published_at": "2024-09-27T20:00:42Z"
},
{
"tag": "v0.0.1",
"kind": "patch",
"published_at": "2023-09-01T16:14:29Z"
},
{
"tag": "v0.0.0",
"kind": "major",
"published_at": "2023-02-27T16:28:34Z"
}
],
"recent_commits": [
{
"oid": "76500f5556acfac22f0009e8ca3bab1bae324ce4",
"body": "## What/Why\nBump the transitive google.golang.org/grpc dependency to v1.82.1 to\nresolve high-severity advisory GHSA-hrxh-6v49-42gf (xDS RBAC auth\nbypass, HTTP/2 Rapid Reset DoS, and RBAC engine panic).\n\n## Proof it works\n`make test` passes (go vet + go test ok), `golangci-lint run` reports\n0 issues,\n[…]\ned by Claude Opus 4.8.\n\n## Review focus\nConfirm no other module needs a matching bump and that the indirect\nconstraint holds after downstream go mod tidy.\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 (#292)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-07-27T17:13:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "73d087e5a2fda2ea18b9396dbd65de73890c9de7",
"body": "GoReleaser derives ProjectName from the repo/module name when it is not set,\nso every release archive shipped as privateer_* even though the binary, the\nCLI and the formula are all named pvtr. Set project_name explicitly.\n\nThe homebrew job is updated in step: it fetches the renamed archives, and the\n[…]\ns that\nno longer resolve.\n\nVerified with a snapshot build: archives are pvtr_Darwin_all.tar.gz,\npvtr_Linux_{x86_64,arm64,i386}.tar.gz and pvtr_Windows_*.zip, each still\ncontaining a binary named pvtr.",
"is_bot": false,
"headline": "chore: name release archives pvtr_* instead of privateer_* (#290)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-07-23T21:19:06Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3d841a925c2af4ea518aa42c450f479138d69a7f",
"body": "Bumps the dependencies group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action).\n\n\nUpdates `actions/checkout` from 7.0.0 to 7.0.1\n- [Release notes](https://github.com/actions/checko\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump the dependencies group with 2 updates (#291)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-23T21:06:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "babef723cb379d0eefeb397966ec66d5336ced21",
"body": "Signed-off-by: Eddie Knight <knight@linux.com>",
"is_bot": false,
"headline": "feat: added benchmark command (#289)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-07-20T13:35:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3a9214b9e0757780272f9164bed9de8c0c68aab6",
"body": null,
"is_bot": true,
"headline": "chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 (#288)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-16T21:05:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1450a1a1ac449b4abb23d9956c543fa40b030490",
"body": "Signed-off-by: Eddie Knight <knight@linux.com>",
"is_bot": false,
"headline": "chore: upgrade privateer-sdk to v1.31.3 (#287)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-07-16T04:17:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "161c680cf2b25e83291bf70f9bfc627d76aff522",
"body": "…285)",
"is_bot": false,
"headline": "chore(deps): bump privateer-sdk to v1.31.2 and go-gemara to v0.8.0 (#…",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-07-12T04:29:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "255a3988e772a47bd3897a23aa88b797059770e0",
"body": "…(#284)",
"is_bot": false,
"headline": "ci: harden GitHub Actions workflows and resolve code-scanning alerts …",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-07-12T04:28:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "52ac984ef2e6d7b3294bfdc5f0437dab23a97fb3",
"body": "Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.52.0 to 0.54.0.\n- [Commits](https://github.com/golang/crypto/compare/v0.52.0...v0.54.0)\n\n---\nupdated-dependencies:\n- dependency-name: golang.org/x/crypto\n dependency-version: 0.54.0\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.54.0 (#283)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-11T02:16:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e27f3182cf3ab5c71ec7f9a6aa9cf9e7d3302d8d",
"body": "Bumps the dependencies group with 4 updates: [github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml](https://github.com/github-community-projects/ospo-reusable-workflows), [github-community-projects/ospo-reusable-workflows/.github/workflows/pr-title.yaml](https://gith\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump the dependencies group with 4 updates (#280)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-10T18:59:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6e55ec0d12dccc5828ba315cfcf9f68bff32d8f9",
"body": "Bumps [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action) from 23.2.0 to 24.0.0.\n- [Release notes](https://github.com/davidanson/markdownlint-cli2-action/releases)\n- [Commits](https://github.com/davidanson/markdownlint-cli2-action/compare/ded1f9488f68a970bc6\n[…]\nirect:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump DavidAnson/markdownlint-cli2-action (#281)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-10T18:59:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c9736a91054a16f27c8437c29047b22f2bb43030",
"body": "Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.51.0 to 0.52.0.\n- [Commits](https://github.com/golang/crypto/compare/v0.51.0...v0.52.0)\n\n---\nupdated-dependencies:\n- dependency-name: golang.org/x/crypto\n dependency-version: 0.52.0\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#282)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-10T18:59:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c79ccb2ea8c3f19cca03a10675f103d8e3927f5f",
"body": "Bumps [golang.org/x/net](https://github.com/golang/net) from 0.53.0 to 0.55.0.\n- [Commits](https://github.com/golang/net/compare/v0.53.0...v0.55.0)\n\n---\nupdated-dependencies:\n- dependency-name: golang.org/x/net\n dependency-version: 0.55.0\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump golang.org/x/net from 0.53.0 to 0.55.0 (#279)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-04T00:20:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "34430423ac68b9074f1867e6b146ac81b3ac9718",
"body": "Bumps the dependencies group with 1 update: [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action).\n\n\nUpdates `golangci/golangci-lint-action` from 9.2.1 to 9.3.0\n- [Release notes](https://github.com/golangci/golangci-lint-action/releases)\n- [Commits](https://github.com/gol\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump golangci/golangci-lint-action (#278)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-03T17:21:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e5439ed75fb21d59cdc81767b936055c824be098",
"body": "- Only run homebrew update when a release occurred\n- Only release when release label is used",
"is_bot": false,
"headline": "fix: Update release.yml (#277)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-06-26T14:35:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4c4fe36d6c9dea0e07deaf2518b8cb1cdbfdeb0b",
"body": "Bumps the dependencies group with 4 updates: [github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml](https://github.com/github-community-projects/ospo-reusable-workflows), [actions/setup-go](https://github.com/actions/setup-go), [github-community-projects/ospo-reusabl\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump the dependencies group with 4 updates (#276)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-26T03:18:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9d0fd9cf89c1cd1a37db5f942bd2c8c05853b711",
"body": "Bumps alpine from `a2d49ea` to `28bd5fe`.\n\n---\nupdated-dependencies:\n- dependency-name: alpine\n dependency-version: '3.24'\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump alpine from `a2d49ea` to `28bd5fe` (#275)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-20T08:22:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2ff9715533923a371de69d87eabfbda3f9dce810",
"body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b43\n[…]\nirect:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#274)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-20T08:21:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "776bb3f1c5357512eaf639c88bc4684e16c64731",
"body": "Bumps alpine from 3.23 to 3.24.\n\n---\nupdated-dependencies:\n- dependency-name: alpine\n dependency-version: '3.24'\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump alpine from 3.23 to 3.24 (#273)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-12T05:03:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2a94c7febfd3e722250bd3a1aae25523ecc85f01",
"body": "…(#270)\n\n* chore(deps): bump golang from 1.26.3-alpine3.22 to 1.26.4-alpine3.22\n\nBumps golang from 1.26.3-alpine3.22 to 1.26.4-alpine3.22.\n\n---\nupdated-dependencies:\n- dependency-name: golang\n dependency-version: 1.26.4-alpine3.22\n dependency-type: direct:production\n update-type: version-update:s\n[…]\n[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: Jason Meridth <jmeridth@gmail.com>",
"is_bot": true,
"headline": "chore(deps): bump golang from 1.26.3-alpine3.22 to 1.26.4-alpine3.22 …",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-05T18:48:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "bfa3a7d3f1e7a63252f65a0a87733779d57a4b00",
"body": "Bumps the dependencies group with 1 update: [actions/checkout](https://github.com/actions/checkout).\n\n\nUpdates `actions/checkout` from 6.0.2 to 6.0.3\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](\n[…]\nersion-update:semver-patch\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump actions/checkout in the dependencies group (#269)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-04T21:16:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e739edca322cd49ec9fbcf7ec3fa32e142f79778",
"body": "Bumps the dependencies group with 1 update: [github.com/privateerproj/privateer-sdk](https://github.com/privateerproj/privateer-sdk).\n\n\nUpdates `github.com/privateerproj/privateer-sdk` from 1.24.1 to 1.25.0\n- [Release notes](https://github.com/privateerproj/privateer-sdk/releases)\n- [Commits](https:\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/privateerproj/privateer-sdk (#268)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-04T21:16:10Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "782385d60c935d842c7a773faeb6ce78b51696ca",
"body": "Bumps the dependencies group with 6 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml](https://github.com/github-community-projects/ospo-reusable-workflows) | `1.0.1` | `1.1.0` |\n| [golangci/golangci-lint-ac\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump the dependencies group with 6 updates (#266)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-28T23:26:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "982c3b2fa6b5d1b85d89ca7950cb7c482b696977",
"body": "* fix: enforce LF on shell scripts to fix make build on Windows\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* add new line\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* add new line\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* add newline\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n---------\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>",
"is_bot": false,
"headline": "fix: enforce LF on shell scripts to fix make build on Windows (#265)",
"author_name": "Satarupa Deb",
"author_login": "Satarupa22-SD",
"committed_at": "2026-05-28T23:26:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ded766dc2804172485af8dd3e2d41c29e1fb8538",
"body": "Signed-off-by: Satarupa22-SD <satarupa2212@gmail.com>",
"is_bot": false,
"headline": "drop viper dependency (#264)",
"author_name": "Satarupa Deb",
"author_login": "Satarupa22-SD",
"committed_at": "2026-05-27T04:09:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fd98bf16ead2f150439fd4cd18e0708c09ba6247",
"body": "…up (#263)",
"is_bot": true,
"headline": "chore(deps): bump step-security/harden-runner in the dependencies gro…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-23T20:58:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7d5e157fc3a9c93bf15f56410aa53e005f656bb4",
"body": "…(#254)",
"is_bot": true,
"headline": "chore(deps): bump golang from 1.26.2-alpine3.22 to 1.26.3-alpine3.22 …",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-23T12:52:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5097a97949d50a35134ed7675bd329d0d4863eee",
"body": "…#262)\n\nBumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.19.0 to 5.19.1.\n- [Release notes](https://github.com/go-git/go-git/releases)\n- [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md)\n- [Commits](https://github.com/go-git/go-git/compare/v5.19.0...v5.19.\n[…]\nv5\n dependency-version: 5.19.1\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-19T18:39:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9589b4500a119312b7eff8d51649723e8db281f7",
"body": "contents:write, which is the minimum needed for the RubbaBoy/BYOB\naction to push badge data to the shields branch.\n\nSigned-off-by: Vinaya Damle <vinayada@mac.lan>\nCo-authored-by: Vinaya Damle <vinayada@mac.lan>",
"is_bot": false,
"headline": "Add a top-level permissions block restricting the GITHUB_TOKEN to (#245)",
"author_name": "vinayada1",
"author_login": "vinayada1",
"committed_at": "2026-05-18T23:20:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7b623b9a509b26a7a3a66114715f64262712664c",
"body": "Bumps the dependencies group with 1 update: [github.com/privateerproj/privateer-sdk](https://github.com/privateerproj/privateer-sdk).\n\n\nUpdates `github.com/privateerproj/privateer-sdk` from 1.24.0 to 1.24.1\n- [Release notes](https://github.com/privateerproj/privateer-sdk/releases)\n- [Commits](https:\n[…]\nersion-update:semver-patch\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/privateerproj/privateer-sdk (#258)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-18T22:54:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7f76ab950168f9f9af5bf7b01f8f7bd784258ed8",
"body": "…github/workflows/pr-title.yaml (#260)\n\nBumps [github-community-projects/ospo-reusable-workflows/.github/workflows/pr-title.yaml](https://github.com/github-community-projects/ospo-reusable-workflows) from 0.6.0 to 1.0.1.\n- [Release notes](https://github.com/github-community-projects/ospo-reusable-wo\n[…]\nirect:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github-community-projects/ospo-reusable-workflows/.…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-18T22:53:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "81719b61060006ed8812b7334d219e04ddf26429",
"body": "…github/workflows/auto-labeler.yaml (#261)\n\nBumps [github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml](https://github.com/github-community-projects/ospo-reusable-workflows) from 0.6.0 to 1.0.1.\n- [Release notes](https://github.com/github-community-projects/ospo-reu\n[…]\nirect:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github-community-projects/ospo-reusable-workflows/.…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-18T22:53:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7d460680e3b1af269a2ca81bccd5da092fb50748",
"body": "…239)\n\n* update logger\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* fix: initialize writer and logger in NewCLI\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* update cli tests\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* guard writer init in persistentPreRun(fixe\n[…]\nby: Satarupa22-SD <satarupa2212@gmail.com>\n\n* test: regression test for run cmd\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n---------\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>",
"is_bot": false,
"headline": "fix: initialize logger to null logger to prevent nil pointer panic (#…",
"author_name": "Satarupa Deb",
"author_login": "Satarupa22-SD",
"committed_at": "2026-05-18T22:53:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "be3ed48dd725b6aa557e5ddc9e67c79b18c42786",
"body": "…up (#259)\n\nBumps the dependencies group with 1 update: [step-security/harden-runner](https://github.com/step-security/harden-runner).\n\n\nUpdates `step-security/harden-runner` from 2.16.1 to 2.19.2\n- [Release notes](https://github.com/step-security/harden-runner/releases)\n- [Commits](https://github.c\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump step-security/harden-runner in the dependencies gro…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-18T16:18:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3d2130a9b553c79334c969fe9a38dfeb4d0f253a",
"body": null,
"is_bot": false,
"headline": "ci: Update catalog version in security assessment workflow (#257)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-05-12T14:55:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d63cd550cbddb7c0ead7708692535c6fc5557697",
"body": null,
"is_bot": false,
"headline": "ci: adopt consolidated ospo-reusable-workflows release.yaml (#255)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-05-12T13:36:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cecdb19db58c0498d46640b01ef5a5120aff46c9",
"body": "…#256)",
"is_bot": true,
"headline": "chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 (…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-12T13:28:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c024ee800a072dd8fe94c89b4b70027d83d15e05",
"body": "Bumps the dependencies group with 1 update: [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action).\n\n\nUpdates `DavidAnson/markdownlint-cli2-action` from 23.1.0 to 23.2.0\n- [Release notes](https://github.com/davidanson/markdownlint-cli2-action/releases)\n- [Commi\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump DavidAnson/markdownlint-cli2-action (#253)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-08T18:39:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2f742993544870b95ccefdd8c9f9f59a2e5caadb",
"body": "…dates (#251)\n\nBumps the dependencies group with 2 updates in the / directory: [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action) and [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action).\n\n\nUpdates `DavidAnson/markdownlint-cli2-ac\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump the dependencies group across 1 directory with 2 up…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-01T20:44:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fb9aada448bcd2ad2d34371025689b58eb5e107a",
"body": "Bumps the dependencies group with 1 update in the / directory: [github.com/hashicorp/go-plugin](https://github.com/hashicorp/go-plugin).\n\n\nUpdates `github.com/hashicorp/go-plugin` from 1.7.0 to 1.8.0\n- [Release notes](https://github.com/hashicorp/go-plugin/releases)\n- [Changelog](https://github.com/\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/hashicorp/go-plugin (#252)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-01T20:43:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "15222a0b252a7cd3a19d3e334e674df09c31c98f",
"body": "* chore: upgrade sdk to v1.24.0; accept 0 or 1 as successful exit codes\n\nSigned-off-by: Eddie Knight <knight@linux.com>",
"is_bot": false,
"headline": "chore: upgrade sdk (#249)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-05-01T04:52:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e4cb71d947ce01ec5bc1e43eb02d519e16bd8ad2",
"body": "* fix: update to use the latest patch from privateer-sdk for exit code handling\n\nSigned-off-by: Eddie Knight <knight@linux.com>",
"is_bot": false,
"headline": "chore: Update generator to use SDK fix for exit codes (#248)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-04-26T21:03:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2657f8fe2a825ca335d18ce7a3977aa32727b905",
"body": null,
"is_bot": true,
"headline": "chore(deps): bump golang from `c259ff7` to `7ef9411` (#247)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-23T23:11:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7f50ea0cfb0cbd817c1c67a91e70f5387a58ad45",
"body": "…oup (#246)",
"is_bot": true,
"headline": "chore(deps): bump goreleaser/goreleaser-action in the dependencies gr…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-23T23:11:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b8495b940293070f2b461c3622229895d10028d3",
"body": "…#242)",
"is_bot": true,
"headline": "chore(deps): bump github.com/go-git/go-git/v5 from 5.17.2 to 5.18.0 (…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-18T11:22:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b3fcab9833ccc6c8a293fac41e175ee151c6b239",
"body": "Bumps alpine from `2510918` to `5b10f43`.\n\n---\nupdated-dependencies:\n- dependency-name: alpine\n dependency-version: '3.23'\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump alpine from `2510918` to `5b10f43` (#241)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-16T22:25:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "10cd3acbababcb419196736c9280025b3e72c985",
"body": "…#240)\n\nBumps the dependencies group with 1 update: [actions/upload-artifact](https://github.com/actions/upload-artifact).\n\n\nUpdates `actions/upload-artifact` from 7.0.0 to 7.0.1\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-arti\n[…]\nersion-update:semver-patch\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump actions/upload-artifact in the dependencies group (…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-16T22:24:54Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4dedfc05e93e049df14ef2388745155df71ebd4c",
"body": "* update version test\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* update go.mod\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n---------\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>",
"is_bot": false,
"headline": "fix: test --verbose flag via SetArgs instead of viper.Set (#238)",
"author_name": "Satarupa Deb",
"author_login": "Satarupa22-SD",
"committed_at": "2026-04-16T22:24:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "09a57e5b7cea5ac2cfde4c10cec46983c0ed51b4",
"body": "Signed-off-by: Eddie Knight <knight@linux.com>",
"is_bot": false,
"headline": "chore: update SDK dependency (#237)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-04-15T16:59:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d24b6b2d2e0d3c04be1e5b6ad5b9b749f91b2a68",
"body": "* chore: upgrade sdk\n\n- silence downloads in install test\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n* fix: capture install output in success tests for debuggability\n\n## What\n\nReplace `> /dev/null` with output capture in the two success test cases\n(`test_installs_when_checksum_matches` and `test\n[…]\nhe failure test cases in the\nsame file.\n\n## Notes\n\n- Addresses Copilot review comments on PR #236\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "chore: upgrade sdk (#236)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-04-12T23:15:26Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7b74f17612a506857f47df97e06297d411732de6",
"body": "Bumps the dependencies group with 1 update: [github.com/privateerproj/privateer-sdk](https://github.com/privateerproj/privateer-sdk).\n\n\nUpdates `github.com/privateerproj/privateer-sdk` from 1.23.0 to 1.23.1\n- [Release notes](https://github.com/privateerproj/privateer-sdk/releases)\n- [Commits](https:\n[…]\nersion-update:semver-patch\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/privateerproj/privateer-sdk (#235)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-12T21:39:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "afb24075cf8a8bc4a59fce55214562cc33301657",
"body": null,
"is_bot": false,
"headline": "feat: Add install command (#204)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-04-12T03:33:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "20306d0cf8f62a5d61ca5ddbac381ba3b498a801",
"body": "* fix: add mandatory checksum verification to install.sh\n\nThe installer previously piped the downloaded archive directly into tar\nwithout any integrity check, allowing a compromised release asset or\nMITM to silently deliver a tampered binary.\n\nChanges:\n- Download the release archive to a temp file b\n[…]\nigned-off-by: Vinaya Damle <vinayada@mac.lan>\n\n---------\n\nSigned-off-by: Vinaya Damle <vinayada@mac.lan>\nCo-authored-by: Vinaya Damle <vinayada@mac.lan>\nCo-authored-by: Eddie Knight <knight@linux.com>",
"is_bot": false,
"headline": "fix: add mandatory SHA-256 checksum verification to install.sh (#226)",
"author_name": "vinayada1",
"author_login": "vinayada1",
"committed_at": "2026-04-11T15:02:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1709ffeb6dd6b6b4fc80c37c0644739861f72694",
"body": "Signed-off-by: Satarupa22-SD <satarupa2212@gmail.com>",
"is_bot": false,
"headline": "fix: filter .exe binaries from plugin list (#234)",
"author_name": "Satarupa Deb",
"author_login": "Satarupa22-SD",
"committed_at": "2026-04-10T19:33:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7b249ae1d59b159354982a3a92e03a36ca9de77d",
"body": "* chore: upgrade go to 1.26.2\n\n## What\n\nUpgrade Go from 1.26.1 to 1.26.2 in go.mod and the Dockerfile base image.\n\n## Why\n\ngo1.26.2 fixes 4 vulnerabilities in the standard library:\n\n- GO-2026-4947: unexpected work during chain building (crypto/x509)\n- GO-2026-4946: inefficient policy validation (cry\n[…]\n>\n\n* Revert \"fix(ci): add dependency-graph read permission to integration tests\"\n\nThis reverts commit c89483144ababdde6fda911ec873b74006e50a09.\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "chore: upgrade go to 1.26.2 (#233)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-04-09T15:49:57Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "838059da7ba95da56f1aa15519835b71b3894da9",
"body": "The integration test script enables shell tracing globally and writes\nGITHUB_TOKEN into a temporary config file via heredoc. With tracing\nleft on, the expanded token value can appear in CI logs.\n\nDisable tracing only around the config-generation block so secret\nvalues are not echoed while preserving the rest of the script's\ntrace output.\n\nCo-authored-by: Vinaya Damle <vinayada@mac.lan>\nCo-authored-by: Jason Meridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "fix: disable shell tracing around token config generation (#227)",
"author_name": "vinayada1",
"author_login": "vinayada1",
"committed_at": "2026-04-08T23:13:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e48c4d2d2b02cd7c8d9608fc742bb30519d79182",
"body": "## What\n\nExtracted the integration test job from ci.yml into a dedicated\nintegration.yml workflow and replaced octo-sts OIDC token exchange with\nthe default GITHUB_TOKEN in both integration.yml and\nosps-security-assessment.yml. Deleted the STS policy file.\n\n## Why\n\nBoth workflows only perform read-o\n[…]\n\n- Removed id-token:write from both workflows, reducing privilege scope\n- Added explicit permissions: contents: read to the changes job in integration.yml\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "ci: remove octo-sts from repo, use default GITHUB_TOKEN (#232)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-04-08T23:10:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "38b125a0045ef7be590e6466eca276db751a3549",
"body": "…(#229)\n\n* chore(deps): bump golang from 1.25.1-alpine3.22 to 1.26.1-alpine3.22\n\nBumps golang from 1.25.1-alpine3.22 to 1.26.1-alpine3.22.\n\n---\nupdated-dependencies:\n- dependency-name: golang\n dependency-version: 1.26.1-alpine3.22\n dependency-type: direct:production\n update-type: version-update:s\n[…]\nbot] <support@github.com>\nSigned-off-by: jmeridth <jmeridth@gmail.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: jmeridth <jmeridth@gmail.com>",
"is_bot": true,
"headline": "chore(deps): bump golang from 1.25.1-alpine3.22 to 1.26.1-alpine3.22 …",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-07T20:04:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1a090f35c591287ec2f5a66ad0591a2996929537",
"body": "Bumps the dependencies group with 1 update: [github.com/privateerproj/privateer-sdk](https://github.com/privateerproj/privateer-sdk).\n\n\nUpdates `github.com/privateerproj/privateer-sdk` from 1.22.0 to 1.22.1\n- [Release notes](https://github.com/privateerproj/privateer-sdk/releases)\n- [Commits](https:\n[…]\nersion-update:semver-patch\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/privateerproj/privateer-sdk (#230)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-07T19:10:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c7d33693c705679a21a5b81c862ab488673bdc90",
"body": "Bumps alpine from 3.22 to 3.23.\n\n---\nupdated-dependencies:\n- dependency-name: alpine\n dependency-version: '3.23'\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump alpine from 3.22 to 3.23 (#231)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-07T19:00:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cbdaff6b7cc299528806c386969de045842461d0",
"body": "Co-authored-by: Vinaya Damle <vinayada@mac.lan>",
"is_bot": false,
"headline": "chore(deps): pin docker images for privateer (#228)",
"author_name": "vinayada1",
"author_login": "vinayada1",
"committed_at": "2026-04-07T18:51:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fb6262ed9427c2a290e0444f9257a6882fd393de",
"body": "…jection (#219)\n\n* refactor: replace package-level globals with CLI struct dependency injection\n\n## What\n\nIntroduce a CLI struct that holds logger, writer, build info, and\nrootCmd. Convert all command files from init() with package-level vars\nto methods on CLI. Delete execute.go and replace with cli\n[…]\ne buffer and that verbose-only fields (Commit:) are absent, rather than asserting an empty buffer\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "refactor: replace package-level globals with CLI struct dependency in…",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-03-31T13:35:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "01a2188061860fca260c3add552ba9d0bb30b01c",
"body": "## What\n\nAdd `fetch-depth: 0` to the integration test job's checkout step so\nthat git tags are available during the build.\n\n## Why\n\nThe Makefile uses `git describe --tags` to inject the version at build\ntime via ldflags. Without full git history in a shallow clone, this\nfails with:\n\n fatal: No na\n[…]\nd — the CI job doesn't need tags since it doesn't build the binary via ldflags\n- The \"Detect Changes\" job already uses `fetch-depth: 0` for its diff logic\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "fix(ci): add fetch-depth 0 to integration test checkout (#218)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-03-31T01:31:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "88191d60b51d777df7894a827c35596edab1a28f",
"body": "…a flag types (#217)\n\n* refactor: clean up dead tests, fix verbose flag, and use correct Cobra flag types\n\n## What\n\nRemove dead commented-out test in main_test.go, register the missing\n--verbose/-v flag on the version command, switch generate-plugin from\nPersistentFlags to Flags since it has no subc\n[…]\ns to stdout via fmt.Println rather than the tabwriter, so the test asserts the buffer stays empty\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "refactor: clean up dead tests, fix verbose flag, and use correct Cobr…",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-03-31T01:11:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6cf09e5fd82e2e3e8f4b3c98ebcd389d980b2e4b",
"body": "* refactor: improve Go idioms in run, env, and execute commands\n\n## What\n\nUse cobra.NoArgs for declarative argument validation in the run command,\nhandle previously swallowed errors from hcplugin.Discover and\nos.UserHomeDir, and switch from path.Join to filepath.Join for OS-aware\nfilesystem paths.\n\n\n[…]\n behavior added in the previous commit.\n\n## Notes\n\n- Addresses Copilot review feedback on PR #216\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "refactor: improve Go idioms in run, env, and execute commands (#216)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-03-31T00:36:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "883a247ee9f0c34816a6565f551ceaf2abfaea5d",
"body": "Bumps the dependencies group with 1 update: [github.com/privateerproj/privateer-sdk](https://github.com/privateerproj/privateer-sdk).\n\n\nUpdates `github.com/privateerproj/privateer-sdk` from 1.21.0 to 1.22.0\n- [Release notes](https://github.com/privateerproj/privateer-sdk/releases)\n- [Commits](https:\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/privateerproj/privateer-sdk (#215)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-30T21:56:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "aaf1907f7a26503f5fe868736d2cb94383cf82f6",
"body": "…#213)\n\nBumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.17.0 to 5.17.1.\n- [Release notes](https://github.com/go-git/go-git/releases)\n- [Commits](https://github.com/go-git/go-git/compare/v5.17.0...v5.17.1)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/go-git/go\n[…]\nv5\n dependency-version: 5.17.1\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/go-git/go-git/v5 from 5.17.0 to 5.17.1 (…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-30T21:27:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fb8c919c0474490e5fa57d2238f60e9d02b0191c",
"body": "* chore(deps): pin GitHub Actions to latest release SHAs\n\n## What\n\nPin all GitHub Actions references to full commit SHAs of their latest\nreleases, replacing bare version tags (v6, v7) and updating stale SHAs.\n\n## Why\n\nBare version tags are mutable and can be force-pushed, which is a supply\nchain ris\n[…]\nfuture catalog version bumps\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\nCo-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "chore(deps): pin GitHub Actions to latest release SHAs (#214)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-03-30T21:20:51Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1993290288c08404a121ea5c60610afe3aa19259",
"body": "* docs: add contributing.md\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* update links\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* docs: add contributing.md\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* docs: add contributing.md\n\nSigned-off-by: Satarupa22-SD <sa\n[…]\n linting errors\n\nUpdated formatting for tables and notes in the contributing guide.\n\n---------\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\nCo-authored-by: Jason Meridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "docs: add contributing.md file to pvtr (#211)",
"author_name": "Satarupa Deb",
"author_login": "Satarupa22-SD",
"committed_at": "2026-03-21T04:01:10Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5fc9f80de6312ffb7ab033357f02298028c05ba6",
"body": "Bumps the dependencies group with 3 updates: [github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml](https://github.com/github-community-projects/ospo-reusable-workflows), [github-community-projects/ospo-reusable-workflows/.github/workflows/pr-title.yaml](https://gith\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump the dependencies group with 3 updates (#212)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-20T20:24:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a1f2fbaec520f1704e763431fa8afed891d77792",
"body": "Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.71.0 to 1.79.3.\n- [Release notes](https://github.com/grpc/grpc-go/releases)\n- [Commits](https://github.com/grpc/grpc-go/compare/v1.71.0...v1.79.3)\n\n---\nupdated-dependencies:\n- dependency-name: google.golang.org/grpc\n dependency-version: 1.79.3\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump google.golang.org/grpc from 1.71.0 to 1.79.3 (#209)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-19T02:26:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3abeb94c9824591e8b9789c17bd41546ce3af389",
"body": "Bumps the dependencies group with 3 updates: [github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml](https://github.com/github-community-projects/ospo-reusable-workflows), [github-community-projects/ospo-reusable-workflows/.github/workflows/pr-title.yaml](https://gith\n[…]\nersion-update:semver-patch\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump the dependencies group with 3 updates (#208)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-17T03:49:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9dd1e795b5500646bdd2fb011661ea91d3185b55",
"body": null,
"is_bot": true,
"headline": "chore(deps): bump the dependencies group with 3 updates (#207)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-16T21:22:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "df3bda3224b29d73a915205df90de566e7332cdc",
"body": "* feat: add --organization flag and adapt to SDK PluginConfig\n\n## What\n\nAdded the --organization / -g flag to the generate-plugin command and updated\nthe generatePlugin function to use the SDK's new PluginConfig struct return\nfrom SetupTemplatingEnvironment.\n\n## Why\n\nThe SDK now returns a PluginConf\n[…]\n changes. Also updated the generatePlugin function\ncomment to reflect the current implementation.\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "feat: add --organization flag and adapt to SDK PluginConfig (#206)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-03-16T06:54:22Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "afa4f98ad505ecd7113d5906cab8b5a5f39aa091",
"body": "…#205)\n\n* feat: replace goreleaser brews with custom homebrew update workflow\n\n## What\n\nRemove the brews section from .goreleaser.yaml and add a new update-homebrew job to the release workflow that updates the homebrew-tap formula by patching URLs and SHA256 checksums directly.\n\n## Why\n\nGoReleaser's\n[…]\n3.0 (4b73464bb391d4059bd26b0524d20df3927bd417)\n- Version comments retained inline for readability\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "feat: replace goreleaser brews with custom homebrew update workflow (…",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-03-16T01:37:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "013a03b098ac11dd19ea55fb4f85295e83d38054",
"body": "…(#203)\n\n## What\n\nSet the name_template field on universal_binaries in .goreleaser.yaml to \"pvtr\" so the macOS universal binary matches the configured build binary name.\n\n## Why\n\nThe universal_binaries name_template defaults to {{ .ProjectName }}, which resolves to the repo name \"privateer\". With re\n[…]\n- The archive filenames will still use \"privateer\" (e.g., privateer_Darwin_all.tar.gz) since ProjectName is unchanged — only the binary inside is affected\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "fix: set universal_binaries name_template to match build binary name …",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-03-14T21:44:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d6147b78d90d5a8458a7113ba5708bad44a39c1b",
"body": "* feat: rename binary from privateer to pvtr\n\n## What\n\nRenamed the CLI binary and all build artifacts from privateer to pvtr.\nThe cobra root command, GoReleaser config, Makefile, Dockerfile, install\nscript, and integration tests all reference the new binary name. A\nbackward-compatible symlink (priva\n[…]\nr\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n* fix: rename build output executables to 'privateer' to match articts generated by goreleaser\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "feat: rename binary from privateer to pvtr (#202)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-03-14T15:44:42Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b5f4bb600d39047c19d6175ff8bd854d433d0f5f",
"body": "* chore: upgrade dependencies\n\nSigned-off-by: Eddie Knight <knight@linux.com>\n\n* replace\n\nSigned-off-by: Eddie Knight <knight@linux.com>\n\n* sdk v1.20.0\n\nSigned-off-by: Eddie Knight <knight@linux.com>\n\n---------\n\nSigned-off-by: Eddie Knight <knight@linux.com>",
"is_bot": false,
"headline": "chore: upgrade dependencies (#201)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-03-13T06:54:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "84ebc5c5a3c1f8aca773167d2a612470885c19f7",
"body": "Signed-off-by: Eddie Knight <knight@linux.com>",
"is_bot": false,
"headline": "docs: initial threats for Privateer CLI (#200)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-03-11T13:33:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "40f0a6f10898433e520ca01ff56f17e81dffd9a3",
"body": "…(#199)\n\n## What\n\nUpdated the organization path for ospo-reusable-workflows from `github` to\n`github-community-projects` across auto-labeler, pr-title, and release workflows.\n\n## Why\n\nThe ospo-reusable-workflows repository has been transferred to the\ngithub-community-projects organization, making th\n[…]\nsolves correctly under the new org\n- All three workflows (auto-labeler, pr-title, release) are affected; if any were missed, CI will break on next trigger\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "fix: update ospo-reusable-workflows org to github-community-projects …",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-03-10T06:47:57Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e1de9b5958543cff04b96ed9a67def3bacd18ddb",
"body": null,
"is_bot": true,
"headline": "chore(deps): bump actions/upload-artifact from 6 to 7 (#198)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-02T23:32:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2844396e5c373f5dc22de9a2806df4041832d5c8",
"body": null,
"is_bot": true,
"headline": "chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 (#197)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-02-25T19:38:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0bc10a33e70fc70c57324b2ab55a5d94d12f7d14",
"body": "Signed-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "chore: upgrade osps github action to latest release SHA (#196)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-24T20:27:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "388838e78de435ff7861d30f5303e6f1b2d21eeb",
"body": null,
"is_bot": false,
"headline": "chore: Update OSPS baseline action version in workflow (#195)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-24T17:30:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "15918ae2bf27666c1730cd8352530738c0922ba9",
"body": null,
"is_bot": false,
"headline": "chore: Add workflow_dispatch trigger to security insights (#194)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-24T16:09:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "755b4a333d18fec9418b6e76f1ce2f13bb3495f2",
"body": "Bumps the dependencies group with 1 update: [github.com/privateerproj/privateer-sdk](https://github.com/privateerproj/privateer-sdk).\n\n\nUpdates `github.com/privateerproj/privateer-sdk` from 1.18.0 to 1.19.0\n- [Release notes](https://github.com/privateerproj/privateer-sdk/releases)\n- [Commits](https:\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/privateerproj/privateer-sdk (#192)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-02-24T02:15:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b47a0dca2ea92c95225e427f5ee92d4007c99afb",
"body": "…193)",
"is_bot": true,
"headline": "chore(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 (#…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-02-23T23:05:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "15643b4ea7b9d34ea27259d02cd689b03178de8c",
"body": "… v1.2.0 (#191)\n\n## What\n\nAdded a new workflow to validate the security-insights.yml file on pushes and PRs\nto main, and bumped the osps-baseline-action from v1.0.0 to v1.2.0.\n\n## Why\n\nThe security insights validation ensures the security-insights.yml file stays\nwell-formed as it's updated. The acti\n[…]\nd to a full commit SHA rather than a\nsemver tag — this is intentional for supply chain safety but means future\nupdates require manually updating the hash.\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "ci: add security insights validation and bump osps-baseline-action to…",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-21T17:54:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3013672eff6b12bd06e41e9d1f4c22f25544e285",
"body": "… (#190)\n\n* ci: replace stored secret with octo-sts for security assessment token\n\n## What\n\nSwitch the OSPS security assessment workflow from using a stored\n`PRIVATEER_GITHUB_TOKEN` secret to dynamically generated tokens via\nocto-sts/action, and add `.claude/` to `.gitignore`.\n\n## Why\n\nOcto-sts prov\n[…]\ned-off-by: jmeridth <jmeridth@gmail.com>\n\n* fix: don't persist credentials when checking out code\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "ci: replace stored secret with octo-sts for security assessment token…",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-21T05:42:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e3c8c521673dd5d9295b06533b141438eeebca0e",
"body": "* ci: skip CI on markdown-only PRs and add markdown linting\n\n## What\n\nReplaced `paths-ignore` with a change-detection job that gates CI and\nintegration jobs so they skip but still satisfy required checks on\nmarkdown-only PRs. Added a markdown lint job using markdownlint-cli2 to\nthe lint workflow, wi\n[…]\n.yml\n\nCo-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\nCo-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "ci: skip CI on markdown-only PRs and add markdown linting (#189)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-19T19:02:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "98090aeabc2c1726295890747aaa01a00c62bebe",
"body": "## What:\n\nAdded Homebrew as the first installation option via the\nprivateerproj/tap tap, and promoted installation options from bold text\nto h4 headings for consistency (markdown linting)\n\n## Why:\n\nHomebrew is the most ergonomic installation method for macOS and Linux\nusers, and should be discoverable as the primary option.\n\n## Notes:\n\nNone\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "docs: add Homebrew tap installation method to README (#188)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-19T18:31:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "70f7268fb372e04cd08e8b2df60a6b79d253d359",
"body": "* fix: update acceptance test to use correct test data filename\n\n## What\n\nUpdate the generate-plugin source path in the acceptance test from\nCCC.VPC_2025.01.yaml to OSPS_Baseline_AC_2025_02.yaml.\n\n## Why\n\nThe test data file was renamed but the acceptance test was not updated,\ncausing the generate-pl\n[…]\nolder and is a reference template, not used directly by CI.\n- This will be handled in a future PR\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "fix: propagate generate-plugin errors to exit code (#187)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-17T02:30:26Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ccadcab717965212b00e7f15ffab62c4c7791340",
"body": "- update to run on push to main, just to double check everything after it\n integrates with default/main branch\n- update octo-sts permissions to include read permissions to run plugin\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "fix: ci (#186)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-16T03:27:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "48f67b66a0432b575c697a6fc273c422e43c3b56",
"body": "## What\n\nAdd an integration test that downloads the latest pvtr-github-repo plugin\nrelease and runs it against the privateer repository using the OSPS\nbaseline catalog at Maturity Level 1.\n\n## Why\n\nValidates that privateer can discover, load, and execute a real plugin\nend-to-end in CI, catching inte\n[…]\n verification step greps for the summary line pattern rather than\n asserting specific pass/fail counts, so it won't break as the plugin\n or repo evolves\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "feat: add pvtr-github-repo plugin integration test (#185)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-16T03:11:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8781dad6bd9439da02facb869356b49d700a3a9a",
"body": "Closes https://github.com/privateerproj/privateer/issues/181\n\n## What\n\nAdd a new `env` command (aliased as `info`) that displays the binary\npath, config location, plugins directory, discovered plugins, version,\ncommit, build time, Go version, and OS/arch.\n\n## Why\n\nThere was no way to quickly see whi\n[…]\nbinaries, matching\n existing behavior in the SDK\n- Config path comes from viper's \"config\" key which defaults to\n {cwd}/config.yml via the SDK's SetBase\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "feat: add env command to display runtime environment info (#182)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-15T17:14:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e5692bd2fa64670b3adf9b9bd3a1c07eb0b52356",
"body": "Bumps the dependencies group with 1 update: [github.com/privateerproj/privateer-sdk](https://github.com/privateerproj/privateer-sdk).\n\n\nUpdates `github.com/privateerproj/privateer-sdk` from 1.17.2 to 1.18.0\n- [Release notes](https://github.com/privateerproj/privateer-sdk/releases)\n- [Commits](https:\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/privateerproj/privateer-sdk (#184)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-02-15T17:12:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4ae5557c6f18739380757d1bcea21610582f295f",
"body": "* chore: refactored entrypoint logic\n\nSigned-off-by: Eddie Knight <knight@linux.com>\n\n* linting\n\nSigned-off-by: Eddie Knight <knight@linux.com>\n\n---------\n\nSigned-off-by: Eddie Knight <knight@linux.com>",
"is_bot": false,
"headline": "chore: refactored entrypoint logic (#183)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-02-15T17:07:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "53226ed7521a60edf71d55a80923bea00b1443b2",
"body": "## What\n\nAdd ldflags to the goreleaser build config to set Version,\nVersionPostfix, GitCommitHash, and BuiltAt at build time.\n\n## Why\n\nReleased binaries report \"0.0.0-dev\" because the default values in\nmain.go are never overridden during the goreleaser build. Without\nldflags, the Go linker has no in\n[…]\nreducing binary size\n but making stack traces less detailed if users report panics\n- Existing releases are unaffected; only future tags will pick this up\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "fix: inject version info into binaries via goreleaser ldflags (#180)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-15T15:15:20Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b64b4d5fbc86d13bb26d2a3d6b43a365faba58f0",
"body": "## What\n\nReplace verbose if/then blocks with idiomatic shell || operator for\ntracking command failures in the acceptance test script.\n\n## Why\n\nThe repeated $? check pattern is unnecessarily verbose. The || idiom\nis the standard shell approach for \"run but record failure\" and\nreduces the script from \n[…]\ndentical behavior.\n\n## Notes\n\n- No behavioral change — all commands still run regardless of\n earlier failures, and the aggregate exit status is preserved\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "refactor: simplify acceptance test error handling (#178)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-15T07:26:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c1925cd3ec03f47db2d138b38d73c65185f0ef46",
"body": "## What\n\nUpdate the security-insights.yml file to conform to the OSSF Security\nInsights 2.2.0 schema specification, correct stale metadata, and\nupdate the core team roster.\n\n## Why\n\nThe file was using schema version 2.0.0 with outdated dates, a\nplaceholder release license block, and a stale contribu\n[…]\n\n when release license differs from repo license)\n- Rudra Gupta was removed from core-team; Jason Meridth affiliation\n updated from GitHub to Chainguard\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "chore: update security-insights.yml to 2.2.0 schema (#177)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-15T07:12:07Z",
"body_truncated": true,
"is_coding_agent": false
}
],
"releases_count": 44,
"commits_last_year": 151,
"latest_release_at": "2026-07-20T14:10:11Z",
"latest_release_tag": "v0.22.0",
"releases_from_tags": false,
"days_since_last_push": 4,
"active_weeks_last_year": 37,
"days_since_latest_release": 11,
"mean_days_between_releases": 12.3
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 75,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "github.com/privateerproj/privateer",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/privateerproj/privateer",
"is_deprecated": false,
"latest_version": "v0.22.0",
"repository_url": "https://github.com/privateerproj/privateer",
"versions_count": 46,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-20T13:35:45Z",
"latest_version_yanked": null,
"days_since_latest_publish": 11
}
]
},
"popularity": {
"forks": 9,
"stars": 23,
"watchers": 3,
"fork_history": {
"days": [
{
"date": "2023-10-08",
"count": 1
},
{
"date": "2024-09-10",
"count": 1
},
{
"date": "2025-03-16",
"count": 1
},
{
"date": "2025-04-09",
"count": 1
},
{
"date": "2025-09-25",
"count": 1
},
{
"date": "2025-11-26",
"count": 1
},
{
"date": "2026-03-11",
"count": 1
},
{
"date": "2026-04-03",
"count": 1
},
{
"date": "2026-07-21",
"count": 1
}
],
"complete": true,
"collected": 9,
"total_forks": 9
},
"star_history": null,
"open_issues_and_prs": 11
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"go.mod"
],
"largest_source_bytes": 4427,
"source_files_sampled": 12,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"go.mod"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.54.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5932"
],
"fixed_version": null,
"advisory_count": 1,
"oldest_advisory_days": 24
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"unknown": 1
},
"advisory_count": 1,
"affected_count": 1,
"assessed_count": 125,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "github.com/hashicorp/go-hclog",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.6.3"
},
{
"name": "github.com/hashicorp/go-plugin",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.8.0"
},
{
"name": "github.com/privateerproj/privateer-sdk",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.32.0"
},
{
"name": "github.com/spf13/cobra",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.2"
},
{
"name": "github.com/spf13/viper",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.21.0"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "github.com/hashicorp/go-hclog",
"direct": true,
"version": "v1.6.3",
"ecosystem": "go"
},
{
"name": "github.com/hashicorp/go-plugin",
"direct": true,
"version": "v1.8.0",
"ecosystem": "go"
},
{
"name": "github.com/privateerproj/privateer-sdk",
"direct": true,
"version": "v1.32.0",
"ecosystem": "go"
},
{
"name": "github.com/spf13/cobra",
"direct": true,
"version": "v1.10.2",
"ecosystem": "go"
},
{
"name": "github.com/spf13/viper",
"direct": true,
"version": "v1.21.0",
"ecosystem": "go"
},
{
"name": "dario.cat/mergo",
"direct": false,
"version": "v1.0.1",
"ecosystem": "go"
},
{
"name": "github.com/asaskevich/govalidator",
"direct": false,
"version": "v0.0.0-20230301143203-a9d515a09cc2",
"ecosystem": "go"
},
{
"name": "github.com/blang/semver",
"direct": false,
"version": "v3.5.1+incompatible",
"ecosystem": "go"
},
{
"name": "github.com/cenkalti/backoff/v5",
"direct": false,
"version": "v5.0.3",
"ecosystem": "go"
},
{
"name": "github.com/cespare/xxhash/v2",
"direct": false,
"version": "v2.3.0",
"ecosystem": "go"
},
{
"name": "github.com/cloudflare/circl",
"direct": false,
"version": "v1.6.3",
"ecosystem": "go"
},
{
"name": "github.com/coreos/go-oidc/v3",
"direct": false,
"version": "v3.17.0",
"ecosystem": "go"
},
{
"name": "github.com/cyberphone/json-canonicalization",
"direct": false,
"version": "v0.0.0-20241213102144-19d51d7fe467",
"ecosystem": "go"
},
{
"name": "github.com/cyphar/filepath-securejoin",
"direct": false,
"version": "v0.6.1",
"ecosystem": "go"
},
{
"name": "github.com/defenseunicorns/go-oscal",
"direct": false,
"version": "v0.7.0",
"ecosystem": "go"
},
{
"name": "github.com/digitorus/pkcs7",
"direct": false,
"version": "v0.0.0-20230818184609-3a137a874352",
"ecosystem": "go"
},
{
"name": "github.com/digitorus/timestamp",
"direct": false,
"version": "v0.0.0-20231217203849-220c5c2851b7",
"ecosystem": "go"
},
{
"name": "github.com/emirpasic/gods",
"direct": false,
"version": "v1.18.1",
"ecosystem": "go"
},
{
"name": "github.com/fatih/color",
"direct": false,
"version": "v1.18.0",
"ecosystem": "go"
},
{
"name": "github.com/fsnotify/fsnotify",
"direct": false,
"version": "v1.9.0",
"ecosystem": "go"
},
{
"name": "github.com/gemaraproj/go-gemara",
"direct": false,
"version": "v0.8.0",
"ecosystem": "go"
},
{
"name": "github.com/go-git/gcfg",
"direct": false,
"version": "v1.5.1-0.20230307220236-3a3c6141e376",
"ecosystem": "go"
},
{
"name": "github.com/go-git/go-billy/v5",
"direct": false,
"version": "v5.9.0",
"ecosystem": "go"
},
{
"name": "github.com/go-git/go-git/v5",
"direct": false,
"version": "v5.19.1",
"ecosystem": "go"
},
{
"name": "github.com/go-jose/go-jose/v4",
"direct": false,
"version": "v4.1.4",
"ecosystem": "go"
},
{
"name": "github.com/go-logr/logr",
"direct": false,
"version": "v1.4.3",
"ecosystem": "go"
},
{
"name": "github.com/go-logr/stdr",
"direct": false,
"version": "v1.2.2",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/analysis",
"direct": false,
"version": "v0.25.2",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/errors",
"direct": false,
"version": "v0.22.8",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/jsonpointer",
"direct": false,
"version": "v0.23.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/jsonreference",
"direct": false,
"version": "v0.21.6",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/loads",
"direct": false,
"version": "v0.24.0",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/runtime",
"direct": false,
"version": "v0.32.4",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/runtime/server-middleware",
"direct": false,
"version": "v0.30.0",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/spec",
"direct": false,
"version": "v0.22.6",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/strfmt",
"direct": false,
"version": "v0.26.4",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag",
"direct": false,
"version": "v0.26.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/cmdutils",
"direct": false,
"version": "v0.26.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/conv",
"direct": false,
"version": "v0.27.0",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/fileutils",
"direct": false,
"version": "v0.26.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/jsonname",
"direct": false,
"version": "v0.26.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/jsonutils",
"direct": false,
"version": "v0.26.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/loading",
"direct": false,
"version": "v0.26.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/mangling",
"direct": false,
"version": "v0.26.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/netutils",
"direct": false,
"version": "v0.26.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/stringutils",
"direct": false,
"version": "v0.26.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/typeutils",
"direct": false,
"version": "v0.27.0",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/yamlutils",
"direct": false,
"version": "v0.26.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/validate",
"direct": false,
"version": "v0.26.0",
"ecosystem": "go"
},
{
"name": "github.com/go-viper/mapstructure/v2",
"direct": false,
"version": "v2.5.0",
"ecosystem": "go"
},
{
"name": "github.com/goccy/go-yaml",
"direct": false,
"version": "v1.19.2",
"ecosystem": "go"
},
{
"name": "github.com/golang/groupcache",
"direct": false,
"version": "v0.0.0-20241129210726-2c02b8208cf8",
"ecosystem": "go"
},
{
"name": "github.com/golang/protobuf",
"direct": false,
"version": "v1.5.4",
"ecosystem": "go"
},
{
"name": "github.com/google/certificate-transparency-go",
"direct": false,
"version": "v1.3.3",
"ecosystem": "go"
},
{
"name": "github.com/google/go-containerregistry",
"direct": false,
"version": "v0.21.7",
"ecosystem": "go"
},
{
"name": "github.com/google/uuid",
"direct": false,
"version": "v1.6.0",
"ecosystem": "go"
},
{
"name": "github.com/grpc-ecosystem/grpc-gateway/v2",
"direct": false,
"version": "v2.29.0",
"ecosystem": "go"
},
{
"name": "github.com/hashicorp/go-cleanhttp",
"direct": false,
"version": "v0.5.2",
"ecosystem": "go"
},
{
"name": "github.com/hashicorp/go-retryablehttp",
"direct": false,
"version": "v0.7.8",
"ecosystem": "go"
},
{
"name": "github.com/hashicorp/yamux",
"direct": false,
"version": "v0.1.2",
"ecosystem": "go"
},
{
"name": "github.com/in-toto/attestation",
"direct": false,
"version": "v1.2.0",
"ecosystem": "go"
},
{
"name": "github.com/in-toto/in-toto-golang",
"direct": false,
"version": "v0.11.0",
"ecosystem": "go"
},
{
"name": "github.com/inconshreveable/mousetrap",
"direct": false,
"version": "v1.1.0",
"ecosystem": "go"
},
{
"name": "github.com/jbenet/go-context",
"direct": false,
"version": "v0.0.0-20150711004518-d14ea06fba99",
"ecosystem": "go"
},
{
"name": "github.com/jedisct1/go-minisign",
"direct": false,
"version": "v0.0.0-20211028175153-1c139d1cc84b",
"ecosystem": "go"
},
{
"name": "github.com/kevinburke/ssh_config",
"direct": false,
"version": "v1.2.0",
"ecosystem": "go"
},
{
"name": "github.com/klauspost/cpuid/v2",
"direct": false,
"version": "v2.3.0",
"ecosystem": "go"
},
{
"name": "github.com/mattn/go-colorable",
"direct": false,
"version": "v0.1.14",
"ecosystem": "go"
},
{
"name": "github.com/mattn/go-isatty",
"direct": false,
"version": "v0.0.20",
"ecosystem": "go"
},
{
"name": "github.com/microsoft/go-winio",
"direct": false,
"version": "v0.6.2",
"ecosystem": "go"
},
{
"name": "github.com/oklog/run",
"direct": false,
"version": "v1.1.0",
"ecosystem": "go"
},
{
"name": "github.com/oklog/ulid/v2",
"direct": false,
"version": "v2.1.1",
"ecosystem": "go"
},
{
"name": "github.com/opencontainers/go-digest",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/opencontainers/image-spec",
"direct": false,
"version": "v1.1.1",
"ecosystem": "go"
},
{
"name": "github.com/pelletier/go-toml/v2",
"direct": false,
"version": "v2.2.4",
"ecosystem": "go"
},
{
"name": "github.com/pjbgf/sha1cd",
"direct": false,
"version": "v0.6.0",
"ecosystem": "go"
},
{
"name": "github.com/pkg/browser",
"direct": false,
"version": "v0.0.0-20240102092130-5ac0b6a4141c",
"ecosystem": "go"
},
{
"name": "github.com/pkg/errors",
"direct": false,
"version": "v0.9.1",
"ecosystem": "go"
},
{
"name": "github.com/protonmail/go-crypto",
"direct": false,
"version": "v1.1.6",
"ecosystem": "go"
},
{
"name": "github.com/revanite-io/grc-store-protocol",
"direct": false,
"version": "v0.5.0",
"ecosystem": "go"
},
{
"name": "github.com/sagikazarmark/locafero",
"direct": false,
"version": "v0.11.0",
"ecosystem": "go"
},
{
"name": "github.com/santhosh-tekuri/jsonschema/v6",
"direct": false,
"version": "v6.0.2",
"ecosystem": "go"
},
{
"name": "github.com/sassoftware/relic",
"direct": false,
"version": "v7.2.1+incompatible",
"ecosystem": "go"
},
{
"name": "github.com/secure-systems-lab/go-securesystemslib",
"direct": false,
"version": "v0.11.0",
"ecosystem": "go"
},
{
"name": "github.com/sergi/go-diff",
"direct": false,
"version": "v1.4.0",
"ecosystem": "go"
},
{
"name": "github.com/shibumi/go-pathspec",
"direct": false,
"version": "v1.3.0",
"ecosystem": "go"
},
{
"name": "github.com/sigstore/protobuf-specs",
"direct": false,
"version": "v0.5.1",
"ecosystem": "go"
},
{
"name": "github.com/sigstore/rekor",
"direct": false,
"version": "v1.5.3",
"ecosystem": "go"
},
{
"name": "github.com/sigstore/rekor-tiles/v2",
"direct": false,
"version": "v2.3.0",
"ecosystem": "go"
},
{
"name": "github.com/sigstore/sigstore",
"direct": false,
"version": "v1.10.8",
"ecosystem": "go"
},
{
"name": "github.com/sigstore/sigstore-go",
"direct": false,
"version": "v1.2.2",
"ecosystem": "go"
},
{
"name": "github.com/sigstore/timestamp-authority/v2",
"direct": false,
"version": "v2.1.2",
"ecosystem": "go"
},
{
"name": "github.com/skeema/knownhosts",
"direct": false,
"version": "v1.3.1",
"ecosystem": "go"
},
{
"name": "github.com/sourcegraph/conc",
"direct": false,
"version": "v0.3.1-0.20240121214520-5f936abd7ae8",
"ecosystem": "go"
},
{
"name": "github.com/spf13/afero",
"direct": false,
"version": "v1.15.0",
"ecosystem": "go"
},
{
"name": "github.com/spf13/cast",
"direct": false,
"version": "v1.10.0",
"ecosystem": "go"
},
{
"name": "github.com/spf13/pflag",
"direct": false,
"version": "v1.0.10",
"ecosystem": "go"
},
{
"name": "github.com/subosito/gotenv",
"direct": false,
"version": "v1.6.0",
"ecosystem": "go"
},
{
"name": "github.com/theupdateframework/go-tuf",
"direct": false,
"version": "v0.7.0",
"ecosystem": "go"
},
{
"name": "github.com/theupdateframework/go-tuf/v2",
"direct": false,
"version": "v2.4.2",
"ecosystem": "go"
},
{
"name": "github.com/transparency-dev/formats",
"direct": false,
"version": "v0.1.1",
"ecosystem": "go"
},
{
"name": "github.com/transparency-dev/merkle",
"direct": false,
"version": "v0.0.2",
"ecosystem": "go"
},
{
"name": "github.com/xanzy/ssh-agent",
"direct": false,
"version": "v0.3.3",
"ecosystem": "go"
},
{
"name": "github.com/youmark/pkcs8",
"direct": false,
"version": "v0.0.0-20240726163527-a2c0da244d78",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/auto/sdk",
"direct": false,
"version": "v1.2.1",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/metric",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/trace",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.yaml.in/yaml/v3",
"direct": false,
"version": "v3.0.4",
"ecosystem": "go"
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.54.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/mod",
"direct": false,
"version": "v0.38.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/net",
"direct": false,
"version": "v0.56.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/oauth2",
"direct": false,
"version": "v0.36.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sync",
"direct": false,
"version": "v0.22.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sys",
"direct": false,
"version": "v0.47.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/term",
"direct": false,
"version": "v0.45.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/text",
"direct": false,
"version": "v0.40.0",
"ecosystem": "go"
},
{
"name": "google.golang.org/genproto/googleapis/api",
"direct": false,
"version": "v0.0.0-20260526163538-3dc84a4a5aaa",
"ecosystem": "go"
},
{
"name": "google.golang.org/genproto/googleapis/rpc",
"direct": false,
"version": "v0.0.0-20260523011958-0a33c5d7ca68",
"ecosystem": "go"
},
{
"name": "google.golang.org/grpc",
"direct": false,
"version": "v1.82.1",
"ecosystem": "go"
},
{
"name": "google.golang.org/protobuf",
"direct": false,
"version": "v1.36.11",
"ecosystem": "go"
},
{
"name": "gopkg.in/warnings.v0",
"direct": false,
"version": "v0.1.2",
"ecosystem": "go"
},
{
"name": "gopkg.in/yaml.v3",
"direct": false,
"version": "v3.0.1",
"ecosystem": "go"
},
{
"name": "k8s.io/klog/v2",
"direct": false,
"version": "v2.140.0",
"ecosystem": "go"
},
{
"name": "oras.land/oras-go/v2",
"direct": false,
"version": "v2.6.2",
"ecosystem": "go"
}
],
"collected": true,
"truncated": false,
"total_count": 125,
"direct_count": 5,
"indirect_count": 120
}
},
"maintainership": {
"issues": {
"open_prs": 1,
"merged_prs": 238,
"open_issues": 10,
"closed_ratio": 0.677,
"closed_issues": 21,
"closed_unmerged_prs": 23
},
"bus_factor": 2,
"bot_contributors": 1,
"top_contributors": [
{
"type": "User",
"login": "eddie-knight",
"commits": 95,
"avatar_url": "https://avatars.githubusercontent.com/u/21176439?v=4"
},
{
"type": "User",
"login": "jmeridth",
"commits": 68,
"avatar_url": "https://avatars.githubusercontent.com/u/35014?v=4"
},
{
"type": "User",
"login": "lluuiissoo",
"commits": 16,
"avatar_url": "https://avatars.githubusercontent.com/u/13456333?v=4"
},
{
"type": "User",
"login": "zohayb23",
"commits": 11,
"avatar_url": "https://avatars.githubusercontent.com/u/97380019?v=4"
},
{
"type": "User",
"login": "grudra7714",
"commits": 6,
"avatar_url": "https://avatars.githubusercontent.com/u/12394597?v=4"
},
{
"type": "User",
"login": "Satarupa22-SD",
"commits": 6,
"avatar_url": "https://avatars.githubusercontent.com/u/84276219?v=4"
},
{
"type": "User",
"login": "pascalstockert",
"commits": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/29748149?v=4"
},
{
"type": "User",
"login": "vinayada1",
"commits": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/28875764?v=4"
},
{
"type": "User",
"login": "trumant",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/599706?v=4"
},
{
"type": "User",
"login": "speas038",
"commits": 2,
"avatar_url": "https://avatars.githubusercontent.com/u/3419863?v=4"
}
],
"contributors_sampled": 13,
"top_contributor_share": 0.434
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"auto-labeler.yaml",
"ci.yaml",
"integration.yaml",
"lint.yaml",
"osps-security-assessment.yaml",
"post-merge.yaml",
"pr-title.yaml",
"release.yaml",
"security-insights.yaml",
"sync-go-version.yaml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 4,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 2,
"reason": "badge detected: InProgress",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 8,
"reason": "Found 8/10 approved changesets -- score normalized to 8",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 20 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 9,
"reason": "dependency not pinned by hash detected -- score normalized to 9",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 8,
"reason": "SAST tool is not run on all commits -- score normalized to 8",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 10,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 0,
"reason": "Project has not signed or included provenance with any releases.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 10,
"reason": "GitHub workflow tokens follow principle of least privilege",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 9,
"reason": "1 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "76500f5556acfac22f0009e8ca3bab1bae324ce4",
"ran_at": "2026-08-01T03:04:52Z",
"aggregate_score": 7.7,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": true
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-30T21:04:23Z",
"oldest_open_prs": [
{
"number": 293,
"created_at": "2026-07-28T05:33:15Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": "2026-07-27T17:13:07Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 2,
"created_at": "2023-02-27T17:31:10Z",
"last_comment_at": "2026-02-25T20:15:02Z",
"last_comment_author": "jmeridth"
},
{
"number": 67,
"created_at": "2025-01-09T04:42:45Z",
"last_comment_at": "2025-01-20T03:39:10Z",
"last_comment_author": "jmeridth"
},
{
"number": 103,
"created_at": "2025-03-17T13:39:41Z",
"last_comment_at": "2026-06-01T19:42:44Z",
"last_comment_author": "Satarupa22-SD"
},
{
"number": 118,
"created_at": "2025-08-30T11:32:25Z",
"last_comment_at": "2026-02-06T12:13:19Z",
"last_comment_author": "eddie-knight"
},
{
"number": 179,
"created_at": "2026-02-15T07:29:11Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 243,
"created_at": "2026-04-20T15:19:26Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 244,
"created_at": "2026-04-20T15:21:33Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 267,
"created_at": "2026-06-01T20:05:28Z",
"last_comment_at": "2026-06-07T15:34:40Z",
"last_comment_author": "jmeridth"
},
{
"number": 271,
"created_at": "2026-06-08T19:36:20Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 286,
"created_at": "2026-07-12T00:58:05Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/privateerproj/privateer",
"host": "github.com",
"name": "privateer",
"owner": "privateerproj"
},
"metrics": {
"overall": {
"key": "overall",
"band": "excellent",
"name": "Overall health",
"note": "The weighted overall 71 is calibrated to 84 on the published index scale (record calibration 2026-08-02).",
"notes": [
{
"code": "overall_calibration",
"params": {
"raw": 71,
"calibrated": 84,
"calibration": "2026-08-02"
}
}
],
"value": 84,
"inputs": {
"security": 82,
"vitality": 90,
"community": 56,
"governance": 71,
"calibration": "2026-08-02",
"engineering": 57,
"ai_readiness": 57,
"weighted_overall_raw": 71
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "excellent",
"name": "Vitality",
"value": 90,
"weight": 0.21,
"metrics": [
{
"key": "development_activity",
"band": "excellent",
"name": "Development activity",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"commits_last_year": 151,
"human_commit_share": 0.53,
"days_since_last_push": 4,
"active_weeks_last_year": 37
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 4 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 4
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "37/52 weeks with commits",
"points": 25.6,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 37
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "151 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 151
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"releases_count": 44,
"latest_release_tag": "v0.22.0",
"releases_from_tags": false,
"days_since_latest_release": 11,
"mean_days_between_releases": 12.3
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "44 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 44
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 11 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 11
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~12.3 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 12.3
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "exceptional",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 6,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 6 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 6
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "moderate",
"name": "Community & Adoption",
"value": 56,
"weight": 0.17,
"metrics": [
{
"key": "popularity",
"band": "at_risk",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 31,
"inputs": {
"forks": 9,
"stars": 23,
"watchers": 3,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "23 stars",
"points": 21.8,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 23
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "9 forks",
"points": 7.5,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 9
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "3 watchers",
"points": 1.7,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 3
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "excellent",
"name": "Community health",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_readme": true,
"has_license": true,
"readme_badges": null,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": true,
"readme_badge_services": [],
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 13.5,
"status": "met",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "good",
"name": "Sustainability & Governance",
"value": 71,
"weight": 0.23,
"metrics": [
{
"key": "maintainer_resilience",
"band": "moderate",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 61,
"inputs": {
"bus_factor": 2,
"contributors_sampled": 13,
"top_contributor_share": 0.434
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "2 contributor(s) cover half of all commits",
"points": 25.2,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 2
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 43% of commits",
"points": 12.7,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 43
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "13 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 13
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 20 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Newcomer PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"newcomer_pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 78,
"inputs": {
"merged_prs": 238,
"open_issues": 10,
"closed_issues": 21,
"prs_merged_7d": null,
"prs_decided_7d": null,
"prs_merged_30d": null,
"prs_decided_30d": null,
"issue_closed_ratio": 0.677,
"closed_unmerged_prs": 23,
"first_time_authors_30d": null,
"first_time_prs_merged_30d": null,
"first_time_prs_decided_30d": null
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "68% of issues closed",
"points": 28.4,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 68
}
}
],
"max_points": 42
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "238/261 decided PRs merged",
"points": 27.4,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 238,
"decided": 261
}
}
],
"max_points": 30
},
{
"key": "newcomer_pr_acceptance",
"name": "Newcomer PR acceptance",
"detail": "no first-time contributor's PR decided in 30d",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_newcomer_prs",
"params": {
"days": 30
}
}
],
"max_points": 13
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 8/10 approved changesets -- score normalized to 8",
"points": 12,
"status": "partial",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 51,
"inputs": {
"followers": 9,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "privateerproj",
"public_repos": 7,
"account_age_days": 1374
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "9 followers of privateerproj",
"points": 7.2,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 9,
"login": "privateerproj"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "7 public repos, account ~3 yr old",
"points": 14.1,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 7
}
},
{
"code": "account_age_years",
"params": {
"years": 3
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "exceptional",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"github.com/privateerproj/privateer"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 11
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 11 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 11
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "46 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 46
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 57,
"weight": 0.19,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 68,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "10 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 10
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "weak",
"name": "Documentation",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"topics": [],
"has_wiki": false,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "excellent",
"name": "Security",
"value": 82,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "good",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Packaging. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"packaging"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 77,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 17,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 1,
"scorecard_aggregate": 7.7
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 3,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "badge detected: InProgress",
"points": 0.5,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 8/10 approved changesets -- score normalized to 8",
"points": 6,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 20 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 9",
"points": 4.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 8",
"points": 4,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "GitHub workflow tokens follow principle of least privilege",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "1 existing vulnerabilities detected",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "exceptional",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 125 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories",
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 125
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 1,
"affected_packages": 1,
"assessed_packages": 125,
"unassessed_packages": 0,
"affected_by_severity": "unknown 1",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "exceptional",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 125,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "exceptional",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"commit_weight_rule": {
"min_commits": 50,
"min_commit_share": 0.1
},
"review_only_matches": 0,
"below_threshold_exposures": [],
"assessed_self_published_locations": 17
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 57,
"weight": 0.04,
"metrics": [
{
"key": "ai_agent_context",
"band": "weak",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 1,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "53 of 53 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 53,
"sampled": 53
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "good",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 71,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": true,
"typed_language": false,
"bootstrap_files": [
"Makefile"
],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0.02,
"toolchain_manifests": [
"go.mod"
],
"dependency_bot_commit_share": 0.47
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "2 of the last 100 commits agent-authored or agent-credited",
"points": 4,
"status": "partial",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 2,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "47 of the last 100 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 47,
"sampled": 100
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 9",
"points": 9,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "moderate",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"primary_language": "Shell",
"largest_source_bytes": 4427,
"source_files_sampled": 12,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Shell without a type-check config",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_typecheck_config_language",
"params": {
"language": "Shell"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/12 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 12,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight: agent tooling is a real maintenance signal, but its absence must never gate the top of the scale (calibration saturates at raw 91, so 100/100 remains reachable with AI Readiness at zero)."
}
],
"classification": {
"labels": [
"library",
"cli"
],
"scores": {
"cli": 4,
"plugin": 2,
"library": 6,
"framework": 2
},
"primary": "library",
"evidence": [
{
"tier": "distribution",
"label": "library",
"source": "registry:go",
"weight": 6
},
{
"tier": "dependencies",
"label": "cli",
"source": "dep:github.com/spf13/cobra",
"weight": 4
},
{
"tier": "description",
"label": "framework",
"source": "description:framework",
"weight": 2
},
{
"tier": "description",
"label": "plugin",
"source": "description:plugin",
"weight": 2
}
],
"artifacts": [],
"confidence": "medium",
"host_extension": false,
"runs_as_process": true,
"consumed_by_code": true
},
"metrics_version": "2.3.1"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-08-01T03:05:21.696716Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/p/privateerproj/privateer.svg",
"full_name": "privateerproj/privateer",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}
Related records
Inspected repositories sharing catalogue tags or ecosystems with privateerproj/privateer. Read them side by side →
Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v2.3.1, schema v0.27.0 — full methodology · metrics wiki.
