bitwise-media-group/dotty має індекс здоров’я 67 зі 100, що відповідає смузі «Помірний». Найвищий показник — AI Readiness (95/100), найнижчий — Community & Adoption (43/100). Останнє оновлення було 1 день тому. Більшість нещодавньої роботи виконує один учасник.
67
загалом / 100
Помірний
Індекс здоров'я програмного забезпечення
Метрики згруповано у зважені категорії на шкалі 1–100. Загальна оцінка починається як їхнє середнє; коли публічні дані активують Політику юрисдикцій високого ризику, рейтинг коригується й отримує верхню межу 49 («Під ризиком»). Готовність до ШІ не входить до індексу.
67
Відмінний85-100Зразковий; відповідає практично всім перевіреним критеріям
Добрий70-84Здоровий; незначні прогалини
Помірний50-69Прийнятний, але з помітними прогалинами; рекомендовано перевірку
У зоні ризику30-49Суттєві слабкі місця; впровадження потребує обережності
Критичний1-29Серйозні проблеми (покинутий, єдиний мейнтейнер, без базової гігієни)
Профіль оцінок
Кожна вісь — окрема категорія. Форма важить більше, ніж середнє: здоровий об'єкт заповнює всю фігуру, тоді як профіль із піками та провалами означає, що сила в одному вимірі маскує ризик в іншому.
Прямі залежності без відомих сповіщень — жодна пряма залежність не має відомих сповіщень
0/25
Непрямі залежності без відомих сповіщень — транзитивний набір не відокремлюється від залежностей розробки й тестування в цьому обсязі
0/40
Немає задавнених сповіщень — жодне сповіщення не має дати публікації
Використані вхідні дані
source
osv
advisories
0
affected_packages
0
assessed_packages
45
unassessed_packages
0
affected_by_severity
none
direct_affected_packages
0
Виключено з оцінювання (немає даних або не застосовно): Непрямі залежності без відомих сповіщень, Немає задавнених сповіщень. Залишкові ваги перенормовано. Звірено 45 резолвлених залежностей із OSV. Цей репозиторій не публікує пакета, який резолвить індекс, тож натомість оцінено граф залежностей репозиторію. Цей граф змішує закріплені версії для розробки й тестування зі справді постачаними залежностями, тож оцінюються лише задекларовані runtime-залежності; транзитивні знахідки подаються як контекст і в оцінку не входять. Досяжність не аналізується.
Наскільки репозиторій оснащений для розробки та супроводу за участі ШІ-агентів? Незалежний, експериментальний бейдж — вага 0.0, тож він подається окремо і не впливає на загальний індекс здоров'я.
Керовані розміри файлів — 0/218 файлів вихідного коду понад 60 КБ
Використані вхідні дані
primary_language
Go
largest_source_bytes
27 093
source_files_sampled
218
oversized_source_files
0
Ключові факти
2зірок GitHub
3контриб'юторів
121комітів за останні 12 місяців
1днів від останнього пушу
8релізів
1бас-фактор
5відкритих issue
Go, PyPIпакетних екосистем
Попередження щодо збору даних
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
pypi package 'dotty' points at a different repository (http://scrace.org/software/dotty.html); excluded from ecosystem scoring
Докладніше
Історія зірок і форків 0 ★ / 2 ⇿
0Зірки
2Форки
2Релізи
Коли додано кожну зірку й форк — зібрано з GitHub і згруповано за днями. Кумулятивне зростання розміщено просто над денними додаваннями, з яких воно складається, тож їх видно одне проти одного: рівномірне органічне накопичення виглядає зовсім інакше, ніж різкий короткочасний сплеск. Там, де цю різницю можна виміряти, її подано як автентичність росту.
Мажорні 0Мінорні 1Патчі 1
OpenSSF Scorecard 8.5 / 10
8.5сукупно
Незалежна, не прив'язана до інструментів оцінка безпеки від відкритого проєкту OpenSSF Scorecard. Кожна перевірка винагороджує практику безпеки, а не інструмент конкретного постачальника. Перевірки, які Scorecard не зміг визначити, позначено н/д і виключено з оцінки безпеки (вони ніколи не зараховуються як нуль).Scorecard v5.5.0 · 2026-07-28 07:16 UTC
Повний розв'язаний набір залежностей із графа залежностей GitHub: 9 прямих і 36 непрямих (транзитивних) пакетів. Транзитивне замикання є повним, коли в репозиторії закомічено lockfile.
Реєстр
Пакет
Версія
Зв'язок
Go
charm.land/bubbles/v2
v2.1.1
пряма
Go
charm.land/bubbletea/v2
v2.0.8
пряма
Go
charm.land/huh/v2
v2.0.3
пряма
Go
charm.land/lipgloss/v2
v2.0.5
пряма
Go
github.com/sahilm/fuzzy
v0.1.3
пряма
Go
github.com/spf13/cobra
v1.10.2
пряма
Go
github.com/spf13/pflag
v1.0.10
пряма
Go
golang.org/x/term
v0.45.0
пряма
PyPI
zensical
0.0.46
пряма
Go
github.com/atotto/clipboard
v0.1.4
непряма
Go
github.com/catppuccin/go
v0.3.0
непряма
Go
github.com/charmbracelet/colorprofile
v0.4.3
непряма
Go
github.com/charmbracelet/ultraviolet
v0.0.0-20260703014108-f5a850f9c2b7
непряма
Go
github.com/charmbracelet/x/ansi
v0.11.7
непряма
Go
github.com/charmbracelet/x/exp/ordered
v0.1.0
непряма
Go
github.com/charmbracelet/x/exp/strings
v0.0.0-20240722160745-212f7b056ed0
непряма
Go
github.com/charmbracelet/x/term
v0.2.2
непряма
Go
github.com/charmbracelet/x/termios
v0.1.1
непряма
Go
github.com/charmbracelet/x/windows
v0.2.2
непряма
Go
github.com/clipperhouse/displaywidth
v0.11.0
непряма
Go
github.com/clipperhouse/uax29/v2
v2.7.0
непряма
Go
github.com/cpuguy83/go-md2man/v2
v2.0.6
непряма
Go
github.com/dustin/go-humanize
v1.0.1
непряма
Go
github.com/inconshreveable/mousetrap
v1.1.0
непряма
Go
github.com/lucasb-eyer/go-colorful
v1.4.0
непряма
Go
github.com/mattn/go-runewidth
v0.0.24
непряма
Go
github.com/mitchellh/hashstructure/v2
v2.0.2
непряма
Go
github.com/muesli/cancelreader
v0.2.2
непряма
Go
github.com/rivo/uniseg
v0.4.7
непряма
Go
github.com/russross/blackfriday/v2
v2.1.0
непряма
Go
github.com/xo/terminfo
v0.0.0-20220910002029-abceb7e1c41e
непряма
Go
go.yaml.in/yaml/v3
v3.0.4
непряма
Go
golang.org/x/sync
v0.21.0
непряма
Go
golang.org/x/sys
v0.47.0
непряма
PyPI
click
8.4.2
непряма
PyPI
colorama
0.4.6
непряма
PyPI
deepmerge
2.1.0
непряма
PyPI
dotty
0.1.0
непряма
PyPI
jinja2
3.1.6
непряма
PyPI
markdown
3.10.2
непряма
PyPI
markupsafe
3.0.3
непряма
PyPI
pygments
2.20.0
непряма
PyPI
pymdown-extensions
11.0
непряма
PyPI
pyyaml
6.0.3
непряма
PyPI
tomli
2.4.1
непряма
Сповіщення про залежності 0
Цей репозиторій не публікує пакета, який розпізнає індекс, тож оцінено його власний граф залежностей — 45 пакетів, серед яких є й піниї розробки та тестування, що ніколи не постачаються: 0 мають відомі сповіщення, з них 0 прямі.
Жодне відоме сповіщення не стосується оцінених залежностей.
Сповіщення означає, що версія, записана в графі залежностей, потрапляє в уражений діапазон. Досяжність не аналізується, а граф містить піниї розробки й тестування — знахідка може стосуватися інструментів, а не поставленого коду.
Звіт у форматі JSON машиночитний
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 962,
"has_wiki": false,
"homepage": null,
"languages": {
"Go": 832749,
"Lua": 30689,
"HTML": 32434,
"Shell": 44748,
"Makefile": 442,
"JavaScript": 1668
},
"pushed_at": "2026-07-26T10:28:29Z",
"created_at": "2026-06-18T19:59:06Z",
"owner_type": "Organization",
"updated_at": "2026-07-26T10:29:05Z",
"description": "A CLI tool for managing system profiles, including dotfiles, security keys, singing keys, packages, and secrets",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": "https://oss.bitwisemedia.uk",
"name": "Bitwise Media Group Ltd.",
"type": "Organization",
"login": "bitwise-media-group",
"company": null,
"location": "United Kingdom",
"followers": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/282673588?v=4",
"created_at": "2026-05-07T18:23:54Z",
"is_verified": null,
"public_repos": 14,
"account_age_days": 81
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.2.6",
"kind": "patch",
"published_at": "2026-07-22T09:00:02Z"
},
{
"tag": "v0.2.5",
"kind": "patch",
"published_at": "2026-07-21T16:07:50Z"
},
{
"tag": "v0.2.4",
"kind": "patch",
"published_at": "2026-07-20T21:22:40Z"
},
{
"tag": "v0.2.3",
"kind": "patch",
"published_at": "2026-07-19T03:05:55Z"
},
{
"tag": "v0.2.2",
"kind": "patch",
"published_at": "2026-07-18T15:14:42Z"
},
{
"tag": "v0.2.1",
"kind": "patch",
"published_at": "2026-07-18T14:18:31Z"
},
{
"tag": "v0.1.1",
"kind": "patch",
"published_at": "2026-07-01T00:39:36Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2026-06-29T22:39:09Z"
}
],
"recent_commits": [
{
"oid": "fa9db18403fcfc450aed862bf8ad949d05f91862",
"body": "Two ways propose lost to a pull request it had not opened itself.\n\nA branch whose PR was opened by hand — or before it joined a stack — has no\ndotty.branch.<name>.pr recorded, so propose took the create path and gh\nrefused: \"a pull request for branch ... already exists\". That aborted the whole\nrun, \n[…]\nPR and carries the title too; PRBodyText becomes\nPRText and reads both, so an edit that would change neither is still skipped.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(git): own the pull request of every branch in a stack",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-26T10:26:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3341663df8f2ffaecd549d3920aa28f7be850de3",
"body": "A layer that lands by fast-forward leaves its branch tip equal to trunk,\nwhich classifies as \"identical\" — indistinguishable in local history from an\nempty layer freshly cut from trunk. Propose therefore kept the dead layer,\npushed it, and failed with \"no commits unique to this layer\"; sync left it \n[…]\nto-merge default is ignored for the run; proposing again without --draft\ntakes the PR out of draft before applying auto-merge.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(git): drop landed layers before proposing, add propose --draft",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-26T09:37:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b65c6a0b7305dfc32f4e917c827c035227e50cea",
"body": "The generated CLI reference had drifted from the command help since the\nimplicit-tap fix; regenerating the whole tree picks it up.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "docs(brewfile): regenerate the add reference after the tap fix",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-26T09:37:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d9e20994ccbd4bd0051a7114c8f47236db3f8c74",
"body": "Grant the scaffolded Claude and Grok agent configs permission to drive the\nSwift toolchain (swift, swiftc, xcodebuild, xcrun, simctl) and mise, and add\n~/Library/Caches and ~/Library/org.swift.swiftpm to both sandbox read/write\nlists so swift build can reach its SwiftPM state and caches.\n\nNo Xcode D\n[…]\nl permission entries are kept for agents\nlaunched unsandboxed.\n\nFollows on from Swift language support in the Neovim template.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(scaffold): allow Swift and mise tooling in agent sandboxes",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-24T12:17:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5cf83c4e1a4596725e0b3e6745ab229cc4d9a54f",
"body": "Bind opt+shift+c/g/x alongside the existing c/g/x agent launchers, opening\nthe same agent with its OS-level sandbox disabled:\n\n claude --settings {\"sandbox\":{\"enabled\":false}}\n grok --sandbox off (built-in profile, bypasses \"dotfiles\")\n codex --sandbox danger-full-access\n\nPermi\n[…]\nd character, and tmux keeps both -- so M-G and M-S-g are\ndistinct key names that never match what the terminal actually sends.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(scaffold): add keybinds to launch coding agents unsandboxed",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-24T12:17:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "68a2fd5e1dd4215d5d5665148b0d56249d03bd50",
"body": "Adds a LazyVim lang plugin for Swift: treesitter grammar, sourcekit-lsp\n(Mason-disabled, toolchain-provided), swift-format via conform, and an\nnvim-dap lldb-dap adapter resolved through xcrun on macOS with a PATH\nfallback.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(scaffold): add Swift language support to the Neovim template",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-24T12:17:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "240f36776b950e50a93bedcb3d9f73c192c84980",
"body": null,
"is_bot": true,
"headline": "chore(main): release 0.2.6",
"author_name": "bitwise-fast-forward-merge[bot]",
"author_login": "bitwise-fast-forward-merge[bot]",
"committed_at": "2026-07-22T08:54:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ca843e3d7fa69932dc363edf12ad1970233e12cc",
"body": "Homebrew 6 stopped installing taps implicitly when a fully-qualified\nname is loaded (Homebrew/brew@2b56e218f7), and brew bundle add loads\neach formula or cask to read its description — so adding a name from an\nuntapped tap failed before the Brewfile was touched, even with the\nformula already trusted\n[…]\n, after the trust flow (installing a tap can\nload its packages, which trips Homebrew's trust gate) and before brew\nbundle add.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(brewfile): tap missing third-party taps before brew bundle add",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-22T03:16:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1d80a4348e2d47bd90703e00fcd6d52a75066266",
"body": null,
"is_bot": true,
"headline": "chore(main): release 0.2.5",
"author_name": "bitwise-fast-forward-merge[bot]",
"author_login": "bitwise-fast-forward-merge[bot]",
"committed_at": "2026-07-21T15:27:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2b782d3d0e32f7288333b2f10769b09aa57cc6b8",
"body": "Bumps [github.com/spf13/pflag](https://github.com/spf13/pflag) from 1.0.9 to 1.0.10.\n- [Release notes](https://github.com/spf13/pflag/releases)\n- [Commits](https://github.com/spf13/pflag/compare/v1.0.9...v1.0.10)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/spf13/pflag\n dependency-versi\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "deps(deps): Bump github.com/spf13/pflag from 1.0.9 to 1.0.10 (#94)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-21T15:27:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ac80160099d6e077d786f82e5caf7938b67a838d",
"body": "Bumps the bitwise-media-group group with 8 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [bitwise-media-group/github-workflows/.github/workflows/add-to-project.yaml](https://github.com/bitwise-media-group/github-workflows) | `6.0.0` | `6.0.1` |\n| [bitwise-media-group/github-workflows/.gith\n[…]\nupdate:semver-patch\n dependency-group: bitwise-media-group\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "build(deps): Bump the bitwise-media-group group with 8 updates (#93)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-21T15:26:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f2b841bd61d22d4fe910aba8ad7ce3da2479d6cd",
"body": "dotty git start and dotty git append now publish the freshly created\nbranch with git push -u <remote> <branch>, so the remote branch and its\nupstream tracking exist from birth. A repo with no push remote skips the\npush; an unreachable remote downgrades to a warning — the branch already\ntracks origin\n[…]\nig pair, so a later bare git push completes\npublication. Append now writes the same track-from-birth config Start\nalready did.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(git): push new stack branches to origin on start/append",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-21T05:16:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e924bbd00bb558f908a7efbc250f39949e5d15c7",
"body": "Set no_equals in the rendered .zshrc so a leading = in a word (e.g.\n--flag=value passed as a bare argument) is not expanded to a command\npath, which errors out when no matching command exists.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(scaffold): disable EQUALS expansion in the zsh template",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-21T05:10:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eeab1afc05606b11e64d36a48f6800ed6f928a61",
"body": null,
"is_bot": true,
"headline": "chore(main): release 0.2.4",
"author_name": "bitwise-fast-forward-merge[bot]",
"author_login": "bitwise-fast-forward-merge[bot]",
"committed_at": "2026-07-20T21:18:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b906b1412949fb0ece3a196228b7c929fbef84a4",
"body": "Flag each proposed PR to merge automatically once its requirements\npass, with an explicit method: --auto-merge=merge|rebase|squash. The\nmode =comment instead posts a /auto-merge comment for repositories\nwhere a merge bot gates merges rather than GitHub's native auto-merge.\nThe flag also reads a pers\n[…]\ning propose stays idempotent: a pending auto-merge\nrequest is left alone and an existing /auto-merge comment is not\nre-posted.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(git): add --auto-merge flag to propose",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-20T21:16:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c9a64e5cf531dd09ede3ccc3c39299a47657ed77",
"body": "Every git verb's flags now pick up persistent defaults from git config:\nflag --<name> on verb <verb> reads dotty.<verb>.<name> (for example\ndotty.propose.browse and dotty.propose.copy). Config supplies defaults,\nnot arguments — an explicit command-line flag always wins, and a\nconfig-sourced value do\n[…]\nn annotation\nwhere a persistent default is destructive (resign --root) or meaningless\n(merge --up, a stack-relative quantity).\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(git): read flag defaults from git configuration",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-20T19:30:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4172f6071195acdedcc47348147853c0324a84c9",
"body": "Open each proposed pull request in the browser with --browse, and put the\nPR URL(s) (one per line) on the clipboard with --copy. Adds a cross-platform\nclipboard helper to internal/cli (pbcopy / clip / wl-copy / xclip / xsel).\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(git): add --browse and --copy flags to propose",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-20T19:09:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4bf4b6afbae4c75f9a39b978ab35fbe651e89db0",
"body": "Files like ~/.gitconfig and ~/.zshrc override or bypass the rendered XDG\nconfiguration (git reads ~/.gitconfig after ~/.config/git/config; the bare\nzsh startup files predate the ~/.zshenv ZDOTDIR redirect) but never occupy\na link site, so conflict resolution never saw them. LinkHome now moves\nthem into the timestamped backup set — restorable with dotty dotfiles\nrestore — and reports them as retired.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(linker): retire legacy files that shadow the rendered config",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-20T18:21:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4a86b41634201b14c24b4e13a8e71033d810caef",
"body": "With SSH_ASKPASS_REQUIRE=force every OpenSSH prompt reaches the ask-pass\nbridge, which treated anything that wasn't a FIDO2 user-presence prompt\nas a PIN request — so the host-authenticity question surfaced as a\npinentry PIN box showing only the prompt's first line.\n\nDispatch on $SSH_ASKPASS_PROMPT \n[…]\n only genuine secrets reach GETPIN. Also percent-escape SETDESC so\nmulti-line prompts no longer truncate at the first newline.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(signing-key): answer ssh yes/no prompts with CONFIRM, not GETPIN",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-20T18:01:02Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cd6423c4de73a11b3dfc610048678c0f417b7864",
"body": "Pin every caller to github-workflows 3636c830f0b00c591f8b27401c45786d08466f18\n(v6.0.0). The v6 release workflow adds container-image publishing (goreleaser\ndockers_v2 -> ghcr) and attestation, so the release caller now also grants\npackages: write -- GitHub validates a reusable workflow permissions ceiling as\nthe union of every job, even skipped ones.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "ci: bump org reusable workflows to v6.0.0",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-20T16:30:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "669c341eec458e58c99f6f2fe9ed254c26b851ed",
"body": "Every third-party tap reference already carries entry-level\ntrusted: true (oh-my-posh, k9s, opencode), keeping exposure scoped to\nthe single formula each tap provides. The first-party tap is ours to\ntrust wholesale, so mark the tap line itself trusted — which also covers\nthe dotty cask it ships without a redundant entry-level flag.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(scaffold): trust the bitwise-media-group tap in core.Brewfile",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-20T13:43:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a538d9b6f796021ace1cd16960e0ea40c2feb9f2",
"body": null,
"is_bot": true,
"headline": "chore(main): release 0.2.3",
"author_name": "bitwise-fast-forward-merge[bot]",
"author_login": "bitwise-fast-forward-merge[bot]",
"committed_at": "2026-07-19T01:35:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a31c87a05405950ee9e0b61931c4a9dfb2c7e501",
"body": "Homebrew 6's `brew bundle add` appends blindly: no duplicate detection\nand no way to emit the `trusted: true` entry option. The latter matters\nbecause `dotty brewfile sync` runs `brew bundle install --force-cleanup`,\nwhich resets Homebrew's trust store to exactly what the Brewfile declares\n— trust g\n[…]\nxcluded from the gate.\n\nThe internal/brewfile -> internal/cli import is new but acyclic;\nscaffold already layers the same way.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(brewfile): dedupe adds and record trusted: true on new entries",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-19T01:29:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "930edf32a8ae4e5b8f6077bd2e603a30bbd4b919",
"body": "runInit tripped gocyclo (24 > 20) once the identity and security-key\nquestions moved ahead of the confirmation; the whole pre-action interview\n— wizard, identity, key plan, summary — now lives in collectInterview,\nleaving runInit with just the actions.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "refactor(init): extract the interview into collectInterview",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T23:52:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "48ccadd87b05018f84effaedb130d2060d43869b",
"body": "- the git-identity and security-key questions (setup choice, allowlist)\n move ahead of the confirmation summary, so no action — render, profile\n creation, brew dump, key enrollment — happens until the wizard's final\n confirm, and backing out of any question leaves the machine untouched\n- a cancel\n[…]\n core Brewfile taps bitwise-media-group/tap and installs the dotty\n cask, so `dotty brewfile sync` keeps dotty itself managed\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(init): finish the interview before acting, and brew dotty itself",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T23:47:54Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c4d8f16d4601ac285f34b057a67a8e4a62284339",
"body": "- `dotty git done` pushes the trunk branch to origin after a successful\n fast-forward, keeping a fork's main in step with upstream\n- `dotty git start` points the new branch's tracking at origin/<branch>\n from birth, so a bare `git push` / `git pull` targets the push remote\n before the first push exists\n- the template git config gains a `done` alias invoking `dotty git done`\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(git): push trunk from done and track origin from start",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T23:47:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8de7008effcacf16db728d7ade464cd49c5bdfbb",
"body": null,
"is_bot": false,
"headline": "docs: add socials to footer",
"author_name": "Tiffany Wang",
"author_login": "tiffanywang3",
"committed_at": "2026-07-18T16:39:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "64d478faf350c601ac97df9de6c6eb1bcd63d12e",
"body": null,
"is_bot": true,
"headline": "chore(main): release 0.2.2",
"author_name": "bitwise-fast-forward-merge[bot]",
"author_login": "bitwise-fast-forward-merge[bot]",
"committed_at": "2026-07-18T15:10:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "16cb6e9a73d90a96555cccac9e61f3a89b5cc1fd",
"body": "The cask used generate_completions_from_executable, which makes Homebrew\nexecute the freshly staged binary at install time. Homebrew installs\ncask artifacts in a fixed type-based order, but GeneratedCompletion is\nmissing from that sort table (brew 6.0, and still on master), so its\nposition falls to \n[…]\nxecuting\nthe binary. The preflight stays: it still clears quarantine so the\ninstalled binary runs without a Gatekeeper prompt.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(release): ship static shell completions in the Homebrew cask",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T15:08:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b8fc971a128b70a46a72052340e793e0e3a64c7d",
"body": null,
"is_bot": true,
"headline": "chore(main): release 0.2.1",
"author_name": "bitwise-fast-forward-merge[bot]",
"author_login": "bitwise-fast-forward-merge[bot]",
"committed_at": "2026-07-18T14:13:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2a2e57e9ce2ae010a4a132314918cf5022c43391",
"body": "Signed-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(build): ignore bin so goreleaer does not detect a dirty branch",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T14:10:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7196c1b32ca11a27be5975aa1a800fd2197def72",
"body": null,
"is_bot": true,
"headline": "chore(main): release 0.2.0",
"author_name": "bitwise-fast-forward-merge[bot]",
"author_login": "bitwise-fast-forward-merge[bot]",
"committed_at": "2026-07-18T14:06:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "38af6e03432c76211cbcab79c6766ad74474da25",
"body": "Bumps [.mise](https://github.com/bitwise-media-group/toolchain) from `ecbb149` to `3a2f989`.\n- [Release notes](https://github.com/bitwise-media-group/toolchain/releases)\n- [Commits](https://github.com/bitwise-media-group/toolchain/compare/ecbb1499b86e94720b0de9d997fec1b9d3f07772...3a2f98941fa50c0c91\n[…]\nd8db27e27b30c4f3b60fbb\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "build(deps): Bump .mise from `ecbb149` to `3a2f989` (#55)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-18T14:05:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b1b8cc02486d40b6d78504427a7f07f85d54012b",
"body": "The stack-versus-trunk view is now dotty git status, matching what it\nshows. stack becomes an alias of dotty git switch, so dotty git stack\nnow opens the layer picker. The scaffolded git alias follows suit and\npoints stack at dotty git switch; there is no git-level alias for the\nstatus view because \n[…]\nHANGE: dotty git stack now opens the switch picker instead of\nprinting stack status; use dotty git status for the status view.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(git)!: rename dotty git stack to dotty git status",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:55:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b775164b8b9f2a8a509d29124c007d148704f608",
"body": "…re HEAD\n\nThree sync behaviour fixes:\n\n- Force-push only the branches the stack rebase actually rewrote. The\n rewritten set is tracked in the persisted rebase state so --continue\n resumes with the branches finished before the conflict; no-op layers\n are no longer pushed at all.\n- Fetch each PR bo\n[…]\nwhen the rebase finishes, resumes via --continue, or aborts.\n propose relies on the same restore instead of its own checkout.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(git): push only rewritten branches, skip current PR bodies, resto…",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:54:42Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d1dab30afe40ae55c955affdc8936d27e8ce20f1",
"body": "A layer with a PR renders as its linked PR number plus the commit\nsubject — the branch name code span next to it was noise. Layers not\nyet proposed keep the branch as their identifier, and a titleless\nunproposed layer no longer prints its branch twice.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(git): drop redundant branch names from the PR stack map",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:42:26Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "16d04363e8361e12bc079d69b601638d4adb5a2a",
"body": "CLAUDE.md points every Go edit at the go-style skill, AGENTS.md\nmirrors it for other coding agents, and .claude/settings.json enables\nthe bitwise workflow plugin alongside golang.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "chore(claude): add agent instructions and enable the workflow plugin",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:42:25Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "96cfaaa9ebae1ecf95ca1131a500a7e828c21caf",
"body": "Signed-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: fix prettier formatting",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:42:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2cf51a1e663ffa1c3bb3285789a514207643a70d",
"body": "Bring DESIGN.md in line with the shipped scaffold, init, dotfiles,\nsecurity-key, worktree, and stacked-git work, reflowed to the\nprettier width.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "docs(design): update the design document",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:41:00Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "9f61eef25c54735c13823284818fc909aafb3e05",
"body": "Allow the pymdownx keyboard element (<leader>) under MD033 — Material\nrenders ++\"<leader>\"+f+s++ as keys, but a CommonMark parser reads the\nplaceholder as inline HTML. Realign the tmux reference tables and rewrap\nprose via make fmt to satisfy MD060 and clear pending prettier drift.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: fix markdownlint MD033/MD060 failures",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:39:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3484709d436d0650885de2a4602b20465d75f0e2",
"body": "Add a multi-page getting-started guide (install, init, signing keys,\nagents and hardening, daily workflow), task guides (profiles,\nBrewfile, credentials, stacked branches, agent worktrees and\nre-signing), and reference pages (layout, macOS defaults, agent\nsandboxing, tmux, Neovim, shell and terminal\n[…]\nust\nstep required by brew v6, and key caps follow the current branding.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: overhaul the documentation site",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:35:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3c1615c0931579c928a4ff2cbb2711890f85686f",
"body": "Signed-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "style(wizard): wrap collectFeatureConfirms signature within line limit",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:35:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "377f2c05b4fd25444e0690e846d1e0580f96cf1f",
"body": "dotty init scaffolds a dotfiles repository from the embedded\ntemplate: a flag-mirrored interview (repos dir, repo path, profile,\nBrewfile seeding, add-ons, agents, hardening, security keys, macOS\ndefaults, wallpaper, and PIV enforcement), confirmation before any\nwrite, the profile rendered into the \n[…]\n with the template-composed\nBrewfile instead of dying after the render.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(init): add the dotty init wizard",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:14:18Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "24157bd489aa6aacdb8cce522401a65632ef4cfe",
"body": "dotty worktree start creates (or reuses) a worktree on an\nagent/<repo>-<suffix> branch at the profile-configured location\n(DOTTY_WORKTREES → active profile answers → the repo-relative\n.worktrees default) and prints its path; end reports uncommitted and\nunpushed work, kills the worktree's tmux sessio\n[…]\nches via\nthe profile's worktrees.gitconfig, ready for dotty git resign.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(worktree): add agent worktree lifecycle commands",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:13:43Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "44ca8955ed85a08117378f21b83f76e95847c4b4",
"body": "A profile can now restrict which security keys its machines accept,\nso personal keys are never used against work devices and vice versa.\nThe allowlist lives beside the alias store in the active profile's\nprivate data directory (serials identify hardware and never enter the\nshareable repo); an absent\n[…]\nlicit parameters, so\ninit's security-key step can drive the same flows.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(security-key): add a per-profile serial allowlist",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:13:24Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "073d5141a522326b022ed41d330425f99d433c2d",
"body": "internal/linker links a dotfiles repository's trees into $HOME:\nfolded file/dir symlinks, unfolding into existing real directories,\nand stale symlinks replaced in place — removing a symlink never\ndestroys the file it names. Real files in the way resolve through a\ncaller-supplied Resolver — backup (m\n[…]\n the\nactive profile's stored paths instead of guessing from $REPOS_DIR.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(dotfiles): add the stow-style linker and dotfiles commands",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:12:14Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "27f6a0138d4673ff21a68fc14f676ab6c67126e9",
"body": "A ~90-file go:embed template derived from the legacy dotfiles,\nscrubbed of runtime state and PII, with legacy applet calls rewritten\nto dotty noun-verb commands. A Go manifest maps wizard answers onto\ncomponents (core, add-ons, agents, security keys), per-component\nBrewfile fragments compose and ded\n[…]\nr against the\nresolved .git/worktrees path, ready for dotty git resign.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(scaffold): embed the dotfiles template with repo-shared profiles",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:11:40Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d9447a63a6ecec85dcfbedbd40fcb5a233032771",
"body": "One internal/git package covers commit re-signing and fork-friendly\nstacked branches behind a single three-method Runner. Stacks land via\ntrue fast-forward merges only, because GitHub's built-in merge methods\ncreate new commits and break the chain's signatures. The verbs:\n\n- start and append record \n[…]\ng\n them from any recorded lineage), and fast-forwards the local trunk.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(git): add the signature-preserving stacked branch workflow",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T13:09:03Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "054eb0cf14ddb58aa977f7b6c0fe446a0d4a8944",
"body": "Option gains a Selected field: MultiSelect renders preselected entries\nand FuzzySelect starts its cursor on the single selected option while\nthe filter is empty. ConfirmDefault lets callers preset the yes/no\nanswer, and InputSuggest adds tab-completable suggestions on top of\nInput — both for intervi\n[…]\ne field total, giving every option a row while long\nlists still scroll.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(tui): grow the prompt helpers for interview flows",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-18T12:09:26Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "755a2388a5390d8f83311b9982fb06d3b70d917b",
"body": "Bumps [golang.org/x/term](https://github.com/golang/term) from 0.44.0 to 0.45.0.\n- [Commits](https://github.com/golang/term/compare/v0.44.0...v0.45.0)\n\n---\nupdated-dependencies:\n- dependency-name: golang.org/x/term\n dependency-version: 0.45.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "deps(deps): Bump golang.org/x/term from 0.44.0 to 0.45.0 (#60)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-16T15:26:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6004b213314dcdfce0d63b57837ce1f530821485",
"body": "rewriteTrailers only replaced the exact \"oldName <oldEmail>\" identity, so\na trailer written with an empty email (\"Name <>\") never matched and was\nleft behind while --reset-author still fixed the commit author. Match\nempty-email identities by name — for the old and new names both — and fill\nthem in with the current user.name/user.email.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(git): populate empty sign-off emails during resign --reset-author",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-13T22:56:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2f6d055bd653724357a48014aa9dc1588b564d93",
"body": "Bumps [charm.land/bubbles/v2](https://github.com/charmbracelet/bubbles) from 2.1.0 to 2.1.1.\n- [Release notes](https://github.com/charmbracelet/bubbles/releases)\n- [Commits](https://github.com/charmbracelet/bubbles/compare/v2.1.0...v2.1.1)\n\n---\nupdated-dependencies:\n- dependency-name: charm.land/bub\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "deps(deps): Bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 (#51)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-13T15:27:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f95e89dba07db2545cf6f15b08bdf4869585e1c6",
"body": "Bumps [charm.land/bubbletea/v2](https://github.com/charmbracelet/bubbletea) from 2.0.7 to 2.0.8.\n- [Release notes](https://github.com/charmbracelet/bubbletea/releases)\n- [Commits](https://github.com/charmbracelet/bubbletea/compare/v2.0.7...v2.0.8)\n\n---\nupdated-dependencies:\n- dependency-name: charm.\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "deps(deps): Bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 (#50)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-10T11:30:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "841aac01c5e93590b9a04ec34ea0e18df43b1248",
"body": "mise run docs picked up drift: the tmux reference pages predate the\ngrok agent window (dotty tmux now lists opencode, grok, codex, claude).\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: regenerate the CLI reference",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-10T11:08:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ac63aeff24d8bac1ed6cac4b020c563663543b23",
"body": "Migrate from the Makefile-fragment library (make/ submodule, go-cli.mk)\nto bitwise-media-group/toolchain v2: the submodule remounts at .mise/\n(new repo name in .gitmodules; GitHub redirects the old URL), a root\nmise.toml selects the go-cli archetype and carries the [vars] knobs\n(app, app_pkg), and t\n[…]\nlows v5.0.0, the mise-task-aware\npipeline generation that discovers which canonical tasks the repo\ndefines and skips the rest.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "build: adopt the toolchain mise-task layout",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-10T11:08:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "25ca10561a98ccf807287e4cf967b9e67b6615c1",
"body": "Add grok to the agent windows created by dotty tmux new, placed\nbetween codex and opencode, and mention it in the command help text.\n\nAlso align the TestNewSession expectations with the nerd-font glyphs\nsession.go actually uses for the editor and zsh window names; the\nplain-space expectations had the layout tests failing.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(tmux): launch grok in its own agent window",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-10T00:34:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "09b9d4a17e2784bc0fd71b31c8b330a6491f8f9e",
"body": "profile activate and both YubiKey pickers move from tui.Select to\ntui.FuzzySelect (same ErrAborted / ErrNotInteractive contract, and the\nsecuritykey docs already promised a fuzzy picker). That leaves tui.Select\nwith no callers, so it and its huh-specific tests go; the fuzzy widget's own\nbenchmarks replace them (48us/frame vs huh's 3.2ms — it only styles the\nvisible window). MultiSelect stays on huh for the checklist flows.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "refactor(tui): migrate the remaining pickers to FuzzySelect",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-10T00:21:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "471f9f1e13816d8824fd451581fc8baf608fe7d1",
"body": "huh's Select filter is a plain case-insensitive substring match with no\ncustomization hook, so `dotty tmux new` could not match scattered queries\nlike bmgdot -> bitwise-media-group/dotty. Add tui.FuzzySelect, a bubbletea\nwidget in the treeselect mould built on the sahilm/fuzzy matcher already in\nthe\n[…]\nighted, enter accepts the cursor row, esc aborts, and long lists scroll\ninside the maxPromptRows window with an overflow hint.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(tui): add fzf-style fuzzy picker and use it for tmux new",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-10T00:21:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f7223a9e3d88bfddbdeeb1480f181571ca291b75",
"body": "500 repos across 20 orgs plus depth-pruned noise; the walk sits around\n1.7ms, confirming the tmux-new picker's latency lives in rendering, not\ndiscovery.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "test(tmux): add FindRepos benchmark over a realistic repo tree",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-10T00:21:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f886dd3db72192980badc0b3fcdacf53fd55b3cb",
"body": "huh only applies its 10-row default height to dynamic options; a Select or\nMultiSelect built from static options sizes its viewport to the full option\ncount, so `dotty tmux new` painted all ~130 repositories on every frame —\n1,392 lines into scrollback for a single prompt. Cap fields longer than\nmax\n[…]\nTests pin the sizing\nrule and the filter-reaches-unrendered contract; benchmarks compare the\ncapped and uncapped frame render.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "perf(tui): cap picklist height so long lists render a viewport",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-10T00:21:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6041bb04ad13260f071cbdd8d906e135d79dd8a0",
"body": "Re-implement the legacy tmux-session start flow as a visible\n`dotty tmux new [query]`: pick a repository under $REPOS_DIR (default\n~/Repos, four levels deep; \".\" resolves the enclosing repo) and\ncreate-or-attach a session laid out with the editor over a small shell\nsplit, one window per installed co\n[…]\nwitch-client\ninstead of a failing nested attach, and the worktree integration and\nattach/end subcommands are not carried over.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(tmux): add tmux new session launcher",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-10T00:21:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "139e70ba38ca7ec16761a6596b448a894537f1ac",
"body": "Port the legacy agent-tmux-status helper into dotty as a hidden\n`dotty tmux set-status [waiting|attention|clear]` verb. Inside tmux it sets\nthe per-window @agent_status option the tmux theme renders; outside tmux it\nfalls back to an OSC 0 terminal title on /dev/tty. The command is no-op-safe\n(always\n[…]\nause Claude Code / Codex hooks\ntreat a non-zero exit as a failure. Hook configs invoke it directly; no\nlegacy symlink is kept.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(tmux): add hidden set-status command for agent lifecycle hooks",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-09T23:13:37Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0df2bfc144932001bce8c60d108b46f06606ab36",
"body": "Bumps the dev-tooling group with 2 updates: [markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2) and [prettier](https://github.com/prettier/prettier).\n\n\nUpdates `markdownlint-cli2` from 0.22.1 to 0.23.0\n- [Changelog](https://github.com/DavidAnson/markdownlint-cli2/blob/main/CHANGELOG\n[…]\nversion-update:semver-patch\n dependency-group: dev-tooling\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "build(deps-dev): Bump the dev-tooling group with 2 updates (#47)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-09T15:28:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1873972459468d7e5a84570aec3140385590b33b",
"body": "Bumps the bitwise-media-group group with 8 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [bitwise-media-group/github-workflows/.github/workflows/add-to-project.yaml](https://github.com/bitwise-media-group/github-workflows) | `4.3.1` | `4.4.0` |\n| [bitwise-media-group/github-workflows/.gith\n[…]\nupdate:semver-minor\n dependency-group: bitwise-media-group\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "build(deps): Bump the bitwise-media-group group with 8 updates (#46)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-06T15:28:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7ab2c215a07efb1ca67e2d8019e564edd20012bc",
"body": "Advance the SHA pin from d8af26d (v4.3.0) to a28e6738 (v4.3.1); no caller-contract changes.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "build(deps): bump github-workflows reusable workflows to v4.3.1",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-04T19:57:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8ff60c94bd2c135bd7a09cefdf772e5c693f6ea0",
"body": "The library migration (eeca3b3) deleted tools/go.mod but left the goreleaser\nsboms config invoking syft through it, so the next tagged release would fail\nat the SBOM step. Generate SBOMs with the plain `syft` from PATH instead: the\nmake/ library's snapshot/release targets install it from the .syft-v\n[…]\nLIs come from the make/ submodule's .<tool>-version pins,\n and the pr gate is the archetype's tidy fmt lint test build commit\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(release): finish the make-library migration for SBOM generation",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-04T19:01:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fc1627169d06fbcafa0f98a2b2a9931aa6affc09",
"body": "Bumps the dev-tooling group with 1 update: [prettier](https://github.com/prettier/prettier).\n\n\nUpdates `prettier` from 3.8.4 to 3.9.0\n- [Release notes](https://github.com/prettier/prettier/releases)\n- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)\n- [Commits](https://github\n[…]\nversion-update:semver-minor\n dependency-group: dev-tooling\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "build(deps-dev): Bump prettier in the dev-tooling group (#41)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-04T14:34:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "eeca3b3d9d3f206bbb44d02264e770e7a76b435f",
"body": "Replace dotty's hand-written Makefile with a one-line include of the shared\ngo-cli.mk archetype from bitwise-media-group/make, mounted as the make/ submodule\n(tracking the release branch). The canonical lint/build/test/ci/pr contract now\ncomes from the library; only dotty's repo-local targets (docs,\n[…]\nholder to the canonical \"BitWise Media Group Ltd\"\n\nmake lint/build/test stay byte-for-byte equivalent to the previous recipes.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "build(make): adopt shared Makefile library via submodule",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-04T14:29:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "bb85ad1c36faa1a55f6109727a4d54e0d3211727",
"body": "Signed-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "ci: update all pipelines to latest",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-04T14:26:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f335ec62f5142bdea302e1f28dbdf5778ca545bf",
"body": "Bumps [charm.land/lipgloss/v2](https://github.com/charmbracelet/lipgloss) from 2.0.4 to 2.0.5.\n- [Release notes](https://github.com/charmbracelet/lipgloss/releases)\n- [Commits](https://github.com/charmbracelet/lipgloss/compare/v2.0.4...v2.0.5)\n\n---\nupdated-dependencies:\n- dependency-name: charm.land/lipgloss/v2\n dependency-version: 2.0.5\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "deps(deps): Bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-03T16:22:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "319b45bf686ddf6565c381d1158ddcbc3f249825",
"body": "…th 7 updates\n\nBumps the bitwise-media-group group with 7 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [bitwise-media-group/github-workflows/.github/workflows/ci.yaml](https://github.com/bitwise-media-group/github-workflows) | `4.0.3` | `4.1.0` |\n| [bitwise-media-group/\n[…]\npendency-version: 4.1.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: bitwise-media-group\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "build(deps): Bump the bitwise-media-group group across 1 directory wi…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-03T15:35:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f56c7f71eed60006713073c2485052a260049d19",
"body": "Replace the placeholder light palette with the .theme-dotty-light tokens\n(design-system/tokens/themes.css): warm paper canvas, near-white cards,\nsunken cream terminals, and warm-tinted shadows.\n\nSplit the accent per the design system: the yellow ramp stays bright in\nboth modes and is only used as fi\n[…]\nnstead of\npinning the dark canvas, and the light-mode footer sits on the paper\nsurface with a hairline top border.\n\nCloses #28\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: implement the light theme from the design-system dotty kit",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-03T15:26:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ab67274db2769728f2de4245257185f61d1775f7",
"body": "Prettier fallout from make fmt: the section prose now fills the\n80-column prose width.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: rewrap signing-key trust section in DESIGN.md",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-03T00:32:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e2da8d1355aba1dc2f1e852b261f0fcf59fe2a91",
"body": "Wrap the AskPassReply signature under the 120-column limit (lll) and\ntidy the Trust tests: extract wantCounts/wantPerm helpers to bring\nTestTrust under the gocyclo threshold — wantPerm also stops ignoring\nthe os.Stat error the inline checks discarded — drop the writeStubPub\nparameters that only ever received one value (unparam), and wrap the\nover-long parseAllowedSigner table rows (lll).\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "style(signing-key): resolve make fmt lint findings",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-03T00:01:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c9cf9f5e86c385964e79c8da10e1d7f0dca03c8a",
"body": "The ask-pass bridge only enabled pinentry-mac's keychain cache when the\nkey's fingerprint arrived out-of-band ($DOTTY_SSH_KEYINFO, set by\n`signing-key sign`) or embedded in an agent-style prompt (SHA256:<fp>).\nssh's own pubkey-auth prompt — \"Enter PIN for <TYPE> key <path>: \" —\nnames the key by file\n[…]\ningerprints it, which\nresolves to the same keychain item the sign path caches — one saved PIN\nserves both git signing and ssh.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(signing-key): cache ssh client-auth PINs in the macOS keychain",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-03T00:01:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f9cb2afa8e710429e8871f00fcb185111abbeb81",
"body": "Recognize a dotty-ssh-askpass argv[0] basename in the argv dispatcher —\nalongside the existing DOTTY_ASKPASS=1 sentinel — so a globally-exported\nSSH_ASKPASS routes every OpenSSH PIN prompt to the pinentry bridge,\nincluding the ssh-keygen spawned by `signing-key new`/`import`, which\ninherits no senti\n[…]\nk` now installs the shim symlink under\n~/.local/share/dotty. While here, swap errors.As for the generic\nerrors.AsType in main.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(signing-key): route the dotty-ssh-askpass shim to ask-pass",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-03T00:01:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a8eb4b0e4c0471e8698e20f0b0b1765e29e0a508",
"body": "Add `dotty signing-key trust`: append every signing key on the\nplugged-in YubiKeys to the OpenSSH allowed_signers file so git can\nverify the commits and tags they sign. Entries pair the committer email\n(git config user.email) with the key blob; the path comes from\ngpg.ssh.allowedSignersFile, falling\n[…]\n reading git config,\ncli.ExpandHome for ~ paths captured from git config, a DESIGN.md\nsection, and the generated CLI/man docs.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(signing-key): trust enrolled keys in git allowed_signers",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-03T00:01:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cb06801a37676602e045229d4052822544087b94",
"body": "Set extra.scope = \"/\" so preference storage (the __consent choice,\ncolour palette) is keyed to the domain root instead of /dotty/. One\nconsent answer on any oss.bitwisemedia.uk site now applies here too.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: share cookie-consent choice across oss.bitwisemedia.uk",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-03T00:01:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8376362816f8e55ca116a177097d63ebb6c7dbe9",
"body": "Homebrew removed the --no-cleanup flag from `brew bundle install`, so\n`dotty brewfile upgrade` failed with \"ambiguous option: --no-cleanup\"\n(prefix-matching --no-cleanup-go / --no-cleanup-uv). brew bundle install\ndoes not clean up unless asked, so dropping the flag preserves the\n\"without removing anything\" behaviour.\n\nFixes #27\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(brewfile): drop obsolete --no-cleanup from brew bundle upgrade",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-03T00:01:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9eadc3ce0d98f829bd26261b992b2d0d3a88c275",
"body": "Signed-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "style: fmt add to project",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-02T23:58:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f6fa25a798f2cf30d9f4f6d36687af0841cb9c56",
"body": "Swap the borrowed Charm palette in the huh forms and the custom bubbletea\nprompts for dotty's own brand tokens from the design system\n(bitwise-media-group/design-system, tokens/themes.css .theme-dotty): a warm\nnear-black surface with a yellow (#F5C518) primary. Titles, selectors, cursors,\nprompts an\n[…]\n notices adopt the shared earthy semantic set from tokens/colors.css\n:root so standalone messages match the forms.\n\nCloses #13\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(tui): theme huh/bubbletea prompts with design-system dotty colours",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-01T09:19:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9aff775b26edd83797f478b1f6efacdde9d545a1",
"body": "Signed-off-by: BitWise Admins <270485327+admin-bitwise@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: sync .github/workflows/add-to-project.yaml from github-settings",
"author_name": "BitWise Admins",
"author_login": "admin-bitwise",
"committed_at": "2026-07-01T09:15:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "385edf3ccbe74e5cc0aebf1abf6eeabc32916905",
"body": "Signed-off-by: BitWise Admins <270485327+admin-bitwise@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: sync .github/workflows/add-to-project.yaml from github-settings",
"author_name": "BitWise Admins",
"author_login": "admin-bitwise",
"committed_at": "2026-07-01T07:54:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2b9ac001ded10c598236dfda90be0732024489f5",
"body": null,
"is_bot": true,
"headline": "chore(main): release 0.1.1",
"author_name": "bitwise-fast-forward-merge[bot]",
"author_login": "bitwise-fast-forward-merge[bot]",
"committed_at": "2026-07-01T00:26:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "248d1f6f820f613806c3fdce1b59a9ab7e6e6ce0",
"body": "Signing through dotty prompted for the PIN on every git commit because the\nsign path never told pinentry to cache it. The predecessor `dot` cooperated\nwith its own ssh-askpass bridge: it exported the key fingerprint and forced\nSSH_ASKPASS so pinentry-mac received SETKEYINFO + allow-external-password\n[…]\nfull env replacement, needed because appending\n cannot remove or reliably override a variable) and RunAssuan (pinentry pipe).\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(signing-key): cache the YubiKey PIN in the macOS keychain",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-01T00:22:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "246421cc0ca637e52ae61a1a0454ea63149dff2c",
"body": "`dotty signing-key link [path]` resolves the connected YubiKey's signing-key\nstub and atomically repoints a stable symlink (and its .pub) at it, printing the\nlink path. This lets ssh name one fixed IdentityFile that follows whichever\nYubiKey is plugged in, with no keys loaded into the agent:\n\n Matc\n[…]\na Match exec prompt would hang) and prefers\ned25519, narrowing with --security-key/--username when several keys are\nconnected.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(signing-key): add link verb to select the plugged-in key for ssh",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-01T00:11:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "56586a83387f51274a6d8d47ed51fcb6dec22c2c",
"body": "GenManHeader left Date unset, so cobra stamped time.Now() and every man page's\n.TH header churned by month on each `make docs`. Pin it to a fixed date — as\nDisableAutoGenTag already does for the markdown output — so generation is\nbyte-for-byte reproducible.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(docs): pin man-page .TH date for reproducible generation",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-07-01T00:11:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d917296dc2dac0720e7933ec1e833fca560af475",
"body": "Add a `signing-key authorize <[user@]host>` verb that appends a signing\nkey's public key to a remote authorized_keys over the system ssh client.\n\nOnly keys on a currently plugged-in YubiKey are selectable (a single match\nis used directly; several present a fuzzy picker), honouring --security-key\nand\n[…]\nure unless\nthe authorized_keys line carries the matching option. --path overrides the\ndefault ~/.ssh/authorized_keys location.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(signing-key): authorize a key on a remote host's authorized_keys",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-06-30T23:26:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4c1f12272f051f0c3c66e3b968add25867648daa",
"body": "Make Homebrew the primary install path on the landing page: the hero and the\n\"Install\" step now run 'brew install bitwise-media-group/tap/dotty', and the\nstep links through to a new install page as \"Alternative methods\".\n\nAdd docs/install.md, modelled on GoReleaser's OSS install page — Homebrew, go\n\n[…]\n(pymdownx admonition bodies read as indented code\nblocks) and ignore the vendored .venv markdown so the lint gate stays green.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: add an install page with brew, cosign and attestation verification",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-06-30T22:26:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "71dcb0787bb001d8a283286874abcce537a5e59a",
"body": "Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.5.1 to 1.5.2.\n- [Release notes](https://github.com/sigstore/rekor/releases)\n- [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/sigstore/rekor/compare/v1.5.1...v1.5.2)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/sigstore/rekor\n dependency-version: 1.5.2\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "build(deps): Bump github.com/sigstore/rekor in /tools",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-30T22:12:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "64a892d6f59b212bdc19c92da2bcc130b4b828de",
"body": "Bumps [github.com/sigstore/timestamp-authority/v2](https://github.com/sigstore/timestamp-authority) from 2.0.6 to 2.1.0.\n- [Release notes](https://github.com/sigstore/timestamp-authority/releases)\n- [Changelog](https://github.com/sigstore/timestamp-authority/blob/main/CHANGELOG.md)\n- [Commits](https\n[…]\n---\nupdated-dependencies:\n- dependency-name: github.com/sigstore/timestamp-authority/v2\n dependency-version: 2.1.0\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "build(deps): Bump github.com/sigstore/timestamp-authority/v2 in /tools",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-30T22:07:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2f2ed30cca45a00790340164629887e849e4228f",
"body": "Import key-handle stubs from elsewhere on disk into the private data\nstore, verifying each against a connected YubiKey: ssh-keygen -K downloads\nthe resident credentials from the hardware and only stubs whose public key\nis actually resident on a connected key are filed, under that key's serial.\nUnmat\n[…]\nID, plus\ncli.RunInteractiveDir so ssh-keygen -K can run in a scratch dir (it writes\ndownloaded keys to the working directory).\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(signing-key): add import command for existing key stubs",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-06-30T18:12:45Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f7748c2c6112b59e17edd9e079464116578aa57a",
"body": "Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.3.1 to 2.3.2.\n- [Release notes](https://github.com/containerd/containerd/releases)\n- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)\n- [Commits](https://github.com/containerd/cont\n[…]\n.3.2)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/containerd/containerd/v2\n dependency-version: 2.3.2\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "build(deps): Bump github.com/containerd/containerd/v2 in /tools",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-30T18:07:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "501869f12605291ee9f7ccd8f1ca73188e065794",
"body": "Bumps [github.com/sahilm/fuzzy](https://github.com/sahilm/fuzzy) from 0.1.1 to 0.1.3.\n- [Release notes](https://github.com/sahilm/fuzzy/releases)\n- [Commits](https://github.com/sahilm/fuzzy/compare/v0.1.1...v0.1.3)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/sahilm/fuzzy\n dependency-version: 0.1.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "deps(deps): Bump github.com/sahilm/fuzzy from 0.1.1 to 0.1.3",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-30T17:59:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f9c4d5a68a107de286ac5a8240d9ff6fab5e556f",
"body": "Move the Charm TUI stack to its v2 line, which also relocates the module\nimport paths to the charm.land vanity domain:\n\n github.com/charmbracelet/bubbletea -> charm.land/bubbletea/v2 (v2.0.7)\n github.com/charmbracelet/huh -> charm.land/huh/v2 (v2.0.3)\n github.com/charmbracelet/bubbles\n[…]\nompt accent\n colours now use the dark-background variants of the former pairs; huh forms\n stay adaptive via the theme above.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "build(deps): upgrade bubbletea and huh to v2",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-06-30T14:38:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b41d37ce9a0902bf255e2ef3504710c231a6566b",
"body": "… v4.0.3\n\nPin every reusable-workflow caller to 83b83722 (v4.0.3), up from dd3767c5 (v4.0.2). The only change is a fix in the reusable dependabot-merge workflow to match modern gh and indirect deps; caller inputs and permissions are unchanged.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "build(deps): bump bitwise-media-group/github-workflows from v4.0.2 to…",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-06-29T23:16:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5d344f032479881aa6333750a293f1b33812101c",
"body": null,
"is_bot": true,
"headline": "chore(main): release 0.1.0",
"author_name": "bitwise-fast-forward-merge[bot]",
"author_login": "bitwise-fast-forward-merge[bot]",
"committed_at": "2026-06-29T22:34:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "836f6bb723af0ed9956d0f869f76a0c0a3db412c",
"body": "Signed-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: ignore changelog in markdown lint",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-06-29T22:31:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5204656509cfa50136127e900ada6773c5e0d739",
"body": "Bump the pinned reusable workflows from v4.0.0 (4a154ff) to v4.0.2 (dd3767c) to resolve the merge issue.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "ci: bump bitwise-media-group/github-workflows to v4.0.2",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-06-29T22:18:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e640fa9e52ab78153aa21094e417d61f0e121e6a",
"body": "serviceName lived in the build-tag-neutral keychain.go but is only called by the\ndarwin backend (keychain_darwin.go), so on non-darwin builds it is dead code and\nthe `unused` linter fails the Linux lint the reusable CI now runs. Move it next\nto its only caller behind //go:build darwin; the neutral file keeps just the\nshared Keychain/CommandRunner interfaces and sentinel errors.\n\nSigned-off-by: Deavon M. McCaffery <dmccaffery@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(env): move serviceName into the darwin keychain backend",
"author_name": "Deavon M. McCaffery",
"author_login": "dmccaffery",
"committed_at": "2026-06-29T18:55:02Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 8,
"commits_last_year": 121,
"latest_release_at": "2026-07-22T09:00:02Z",
"latest_release_tag": "v0.2.6",
"releases_from_tags": false,
"days_since_last_push": 1,
"active_weeks_last_year": 7,
"days_since_latest_release": 5,
"mean_days_between_releases": 3.2
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 100,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"ecosystem": {
"packages": [
{
"name": "github.com/bitwise-media-group/dotty",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/bitwise-media-group/dotty",
"is_deprecated": false,
"latest_version": "v0.2.6",
"repository_url": "https://github.com/bitwise-media-group/dotty",
"versions_count": 9,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-22T08:54:06Z",
"latest_version_yanked": null,
"days_since_latest_publish": 5
},
{
"name": "dotty",
"exists": true,
"license": "UNKNOWN",
"keywords": [
"Development Status :: 4 - Beta",
"Intended Audience :: Developers",
"Intended Audience :: End Users/Desktop",
"Intended Audience :: System Administrators",
"License :: Public Domain",
"Operating System :: MacOS :: MacOS X",
"Operating System :: POSIX",
"Operating System :: Unix",
"Programming Language :: Python",
"Topic :: System :: Installation/Setup",
"Topic :: System :: Systems Administration"
],
"ecosystem": "pypi",
"matches_repo": false,
"registry_url": "https://pypi.org/project/dotty/",
"is_deprecated": false,
"latest_version": "0.1.0",
"repository_url": "http://scrace.org/software/dotty.html",
"versions_count": 1,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": "2013-02-23T21:16:11.038764Z",
"latest_published_at": "2013-02-23T21:16:11.038764Z",
"latest_version_yanked": null,
"days_since_latest_publish": 4902
}
]
},
"popularity": {
"forks": 2,
"stars": 2,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2026-06-20",
"count": 1
},
{
"date": "2026-07-18",
"count": 1
}
],
"complete": true,
"collected": 2,
"total_forks": 2
},
"star_history": null,
"open_issues_and_prs": 7
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile",
"mise.toml"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"go.mod"
],
"largest_source_bytes": 27093,
"source_files_sampled": 218,
"oversized_source_files": 0,
"agent_instruction_files": [
"AGENTS.md",
"CLAUDE.md",
"docs/getting-started/agents.md",
"internal/scaffold/template/shared/AGENTS.md"
],
"agent_instruction_max_bytes": 2897
},
"dependencies": {
"manifests": [
"go.mod",
"pyproject.toml"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 45,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go",
"pypi"
],
"dependencies": [
{
"name": "charm.land/bubbles/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.1.1"
},
{
"name": "charm.land/bubbletea/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.8"
},
{
"name": "charm.land/huh/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.3"
},
{
"name": "charm.land/lipgloss/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.5"
},
{
"name": "github.com/sahilm/fuzzy",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.1.3"
},
{
"name": "github.com/spf13/cobra",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.2"
},
{
"name": "github.com/spf13/pflag",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.10"
},
{
"name": "golang.org/x/term",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.45.0"
},
{
"name": "zensical",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=0.0.46"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "charm.land/bubbles/v2",
"direct": true,
"version": "v2.1.1",
"ecosystem": "go"
},
{
"name": "charm.land/bubbletea/v2",
"direct": true,
"version": "v2.0.8",
"ecosystem": "go"
},
{
"name": "charm.land/huh/v2",
"direct": true,
"version": "v2.0.3",
"ecosystem": "go"
},
{
"name": "charm.land/lipgloss/v2",
"direct": true,
"version": "v2.0.5",
"ecosystem": "go"
},
{
"name": "github.com/sahilm/fuzzy",
"direct": true,
"version": "v0.1.3",
"ecosystem": "go"
},
{
"name": "github.com/spf13/cobra",
"direct": true,
"version": "v1.10.2",
"ecosystem": "go"
},
{
"name": "github.com/spf13/pflag",
"direct": true,
"version": "v1.0.10",
"ecosystem": "go"
},
{
"name": "golang.org/x/term",
"direct": true,
"version": "v0.45.0",
"ecosystem": "go"
},
{
"name": "zensical",
"direct": true,
"version": "0.0.46",
"ecosystem": "pypi"
},
{
"name": "github.com/atotto/clipboard",
"direct": false,
"version": "v0.1.4",
"ecosystem": "go"
},
{
"name": "github.com/catppuccin/go",
"direct": false,
"version": "v0.3.0",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/colorprofile",
"direct": false,
"version": "v0.4.3",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/ultraviolet",
"direct": false,
"version": "v0.0.0-20260703014108-f5a850f9c2b7",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/ansi",
"direct": false,
"version": "v0.11.7",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/exp/ordered",
"direct": false,
"version": "v0.1.0",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/exp/strings",
"direct": false,
"version": "v0.0.0-20240722160745-212f7b056ed0",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/term",
"direct": false,
"version": "v0.2.2",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/termios",
"direct": false,
"version": "v0.1.1",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/windows",
"direct": false,
"version": "v0.2.2",
"ecosystem": "go"
},
{
"name": "github.com/clipperhouse/displaywidth",
"direct": false,
"version": "v0.11.0",
"ecosystem": "go"
},
{
"name": "github.com/clipperhouse/uax29/v2",
"direct": false,
"version": "v2.7.0",
"ecosystem": "go"
},
{
"name": "github.com/cpuguy83/go-md2man/v2",
"direct": false,
"version": "v2.0.6",
"ecosystem": "go"
},
{
"name": "github.com/dustin/go-humanize",
"direct": false,
"version": "v1.0.1",
"ecosystem": "go"
},
{
"name": "github.com/inconshreveable/mousetrap",
"direct": false,
"version": "v1.1.0",
"ecosystem": "go"
},
{
"name": "github.com/lucasb-eyer/go-colorful",
"direct": false,
"version": "v1.4.0",
"ecosystem": "go"
},
{
"name": "github.com/mattn/go-runewidth",
"direct": false,
"version": "v0.0.24",
"ecosystem": "go"
},
{
"name": "github.com/mitchellh/hashstructure/v2",
"direct": false,
"version": "v2.0.2",
"ecosystem": "go"
},
{
"name": "github.com/muesli/cancelreader",
"direct": false,
"version": "v0.2.2",
"ecosystem": "go"
},
{
"name": "github.com/rivo/uniseg",
"direct": false,
"version": "v0.4.7",
"ecosystem": "go"
},
{
"name": "github.com/russross/blackfriday/v2",
"direct": false,
"version": "v2.1.0",
"ecosystem": "go"
},
{
"name": "github.com/xo/terminfo",
"direct": false,
"version": "v0.0.0-20220910002029-abceb7e1c41e",
"ecosystem": "go"
},
{
"name": "go.yaml.in/yaml/v3",
"direct": false,
"version": "v3.0.4",
"ecosystem": "go"
},
{
"name": "golang.org/x/sync",
"direct": false,
"version": "v0.21.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sys",
"direct": false,
"version": "v0.47.0",
"ecosystem": "go"
},
{
"name": "click",
"direct": false,
"version": "8.4.2",
"ecosystem": "pypi"
},
{
"name": "colorama",
"direct": false,
"version": "0.4.6",
"ecosystem": "pypi"
},
{
"name": "deepmerge",
"direct": false,
"version": "2.1.0",
"ecosystem": "pypi"
},
{
"name": "dotty",
"direct": false,
"version": "0.1.0",
"ecosystem": "pypi"
},
{
"name": "jinja2",
"direct": false,
"version": "3.1.6",
"ecosystem": "pypi"
},
{
"name": "markdown",
"direct": false,
"version": "3.10.2",
"ecosystem": "pypi"
},
{
"name": "markupsafe",
"direct": false,
"version": "3.0.3",
"ecosystem": "pypi"
},
{
"name": "pygments",
"direct": false,
"version": "2.20.0",
"ecosystem": "pypi"
},
{
"name": "pymdown-extensions",
"direct": false,
"version": "11.0",
"ecosystem": "pypi"
},
{
"name": "pyyaml",
"direct": false,
"version": "6.0.3",
"ecosystem": "pypi"
},
{
"name": "tomli",
"direct": false,
"version": "2.4.1",
"ecosystem": "pypi"
}
],
"collected": true,
"truncated": false,
"total_count": 45,
"direct_count": 9,
"indirect_count": 36
}
},
"maintainership": {
"issues": {
"open_prs": 2,
"merged_prs": 74,
"open_issues": 5,
"closed_ratio": 0.545,
"closed_issues": 6,
"closed_unmerged_prs": 14
},
"bus_factor": 1,
"bot_contributors": 2,
"top_contributors": [
{
"type": "User",
"login": "dmccaffery",
"commits": 86,
"avatar_url": "https://avatars.githubusercontent.com/u/1803684?v=4"
},
{
"type": "User",
"login": "admin-bitwise",
"commits": 10,
"avatar_url": "https://avatars.githubusercontent.com/u/270485327?v=4"
},
{
"type": "User",
"login": "tiffanywang3",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/5248989?v=4"
}
],
"contributors_sampled": 3,
"top_contributor_share": 0.887
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"add-to-project.yaml",
"ci.yaml",
"dependabot-merge.yaml",
"merge-notice.yaml",
"merge-review-ack.yaml",
"merge.yaml",
"release.yaml",
"security.yaml"
],
"has_docs_dir": true,
"linter_configs": [
".golangci.yaml"
],
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum",
"uv.lock"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 6,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "23 out of 23 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 10,
"reason": "all changesets reviewed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 3 contributing companies or organizations -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 10,
"reason": "project is fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 10,
"reason": "all dependencies are pinned",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 10,
"reason": "SAST tool is run on all commits",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 10,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 8,
"reason": "5 out of the last 5 releases have a total of 5 signed artifacts.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 9,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 10,
"reason": "0 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "fa9db18403fcfc450aed862bf8ad949d05f91862",
"ran_at": "2026-07-28T07:16:12Z",
"aggregate_score": 8.5,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": true
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-28T06:43:18Z",
"oldest_open_prs": [
{
"number": 98,
"created_at": "2026-07-24T12:19:53Z",
"last_comment_at": "2026-07-24T12:21:29Z",
"last_comment_author": "codecov"
},
{
"number": 101,
"created_at": "2026-07-27T01:30:59Z",
"last_comment_at": "2026-07-27T01:32:40Z",
"last_comment_author": "codecov"
}
],
"last_merged_pr_at": "2026-07-26T10:28:14Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 54,
"created_at": "2026-07-14T23:41:40Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 56,
"created_at": "2026-07-15T16:46:42Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 57,
"created_at": "2026-07-15T16:53:45Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 58,
"created_at": "2026-07-15T16:57:49Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 59,
"created_at": "2026-07-15T18:28:47Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/bitwise-media-group/dotty",
"host": "github.com",
"name": "dotty",
"owner": "bitwise-media-group"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 67,
"inputs": {
"security": 88,
"vitality": 75,
"community": 43,
"governance": 57,
"engineering": 76
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 75,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 59,
"inputs": {
"commits_last_year": 121,
"human_commit_share": 0.76,
"days_since_last_push": 1,
"active_weeks_last_year": 7
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 1 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 1
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "7/52 weeks with commits",
"points": 4.8,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 7
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "121 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 121
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 98,
"inputs": {
"releases_count": 8,
"latest_release_tag": "v0.2.6",
"releases_from_tags": false,
"days_since_latest_release": 5,
"mean_days_between_releases": 3.2
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "8 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 8
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 5 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 5
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~3.2 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 3.2
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "5 out of the last 5 releases have a total of 5 signed artifacts.",
"points": 8,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 43,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"forks": 2,
"stars": 2,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "2 stars",
"points": 0,
"status": "missed",
"details": [
{
"code": "stars",
"params": {
"count": 2
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "2 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 2
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "excellent",
"name": "Community health",
"note": null,
"notes": [],
"value": 92,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 13.5,
"status": "met",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 6.3,
"status": "met",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 57,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 26,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 3,
"top_contributor_share": 0.887
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 89% of commits",
"points": 2.5,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 89
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "3 contributors",
"points": 4.1,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 3
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 3 contributing companies or organizations -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 73,
"inputs": {
"merged_prs": 74,
"open_issues": 5,
"closed_issues": 6,
"issue_closed_ratio": 0.545,
"closed_unmerged_prs": 14
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "55% of issues closed",
"points": 25.5,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 55
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "74/88 decided PRs merged",
"points": 32.2,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 74,
"decided": 88
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "all changesets reviewed",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 43,
"inputs": {
"followers": 3,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "bitwise-media-group",
"public_repos": 14,
"account_age_days": 81
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "3 followers of bitwise-media-group",
"points": 4.3,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 3,
"login": "bitwise-media-group"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "14 public repos, account ~0 yr old",
"points": 9,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 14
}
},
{
"code": "account_age_years",
"params": {
"years": 0
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"github.com/bitwise-media-group/dotty"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 5
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 5 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 5
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "9 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 9
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 76,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 84,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "8 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 8
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": ".golangci.yaml",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yaml"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "23 out of 23 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"topics": [],
"has_wiki": false,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "excellent",
"name": "Security",
"value": 88,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "excellent",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Packaging. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"packaging"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 85,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 17,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 1,
"scorecard_aggregate": 8.5
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 4.5,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "23 out of 23 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "all changesets reviewed",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 3 contributing companies or organizations -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is fuzzed",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "all dependencies are pinned",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is run on all commits",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "5 out of the last 5 releases have a total of 5 signed artifacts.",
"points": 6,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "0 existing vulnerabilities detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 45 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories",
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 45
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 0,
"affected_packages": 0,
"assessed_packages": 45,
"unassessed_packages": 0,
"affected_by_severity": "none",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 45,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 3
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "excellent",
"name": "AI Readiness",
"value": 95,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "excellent",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 1,
"agent_instruction_files": [
"AGENTS.md",
"CLAUDE.md",
"docs/getting-started/agents.md",
"internal/scaffold/template/shared/AGENTS.md"
],
"agent_instruction_max_bytes": 2897
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "AGENTS.md, CLAUDE.md, docs/getting-started/agents.md, internal/scaffold/template/shared/AGENTS.md",
"points": 45,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "AGENTS.md, CLAUDE.md, docs/getting-started/agents.md, internal/scaffold/template/shared/AGENTS.md"
}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "76 of 76 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 76,
"sampled": 76
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "excellent",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum",
"uv.lock"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [
"Makefile",
"mise.toml"
],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [],
"agent_commit_share": 0.11,
"toolchain_manifests": [
"go.mod"
],
"dependency_bot_commit_share": 0.15
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile, mise.toml",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile, mise.toml"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": ".golangci.yaml",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yaml"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "11 of the last 100 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 11,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "15 of the last 100 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 15,
"sampled": 100
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "all dependencies are pinned",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 27093,
"source_files_sampled": 218,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/218 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 218,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"pypi package 'dotty' points at a different repository (http://scrace.org/software/dotty.html); excluded from ecosystem scoring"
],
"report_type": "repository",
"generated_at": "2026-07-28T07:16:32.098678Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/b/bitwise-media-group/dotty.svg",
"full_name": "bitwise-media-group/dotty",
"license_state": "standard",
"license_spdx": "MIT"
}
Пов’язані записи
Перевірені репозиторії, що мають спільні каталожні теги або екосистеми з bitwise-media-group/dotty. Читати поруч →
Оцінки — це сигнали, а не гарантії. Вони відображають публічно видимі практики на GitHub — це не аудит коду й не гарантія безпеки.
Відсутні дані виключаються, а ваги перенормовуються — нуль за відсутність ніколи не ставиться. Методологія версіонована й відкрита: метрики v1.13.0, схема v0.27.0 — повна методологія · вікі метрик.
