carabiner-dev / bnd

Коли додано кожну зірку й форк — зібрано з GitHub і згруповано за днями. Кумулятивне зростання розміщено просто над денними додаваннями, з яких воно складається, тож їх видно одне проти одного: рівномірне органічне накопичення виглядає зовсім інакше, ніж різкий короткочасний сплеск. Там, де цю різницю можна виміряти, її подано як автентичність росту.

Повний розв'язаний набір залежностей із графа залежностей GitHub: 18 прямих і 139 непрямих (транзитивних) пакетів. Транзитивне замикання є повним, коли в репозиторії закомічено lockfile.

Цей репозиторій не публікує пакета, який розпізнає індекс, тож оцінено його власний граф залежностей — 157 пакетів, серед яких є й піниї розробки та тестування, що ніколи не постачаються: 3 мають відомі сповіщення, з них 0 прямі.

Сповіщення означає, що версія, записана в графі залежностей, потрапляє в уражений діапазон. Досяжність не аналізується, а граф містить піниї розробки й тестування — знахідка може стосуватися інструментів, а не поставленого коду.

{
  "data": {
    "repo": {
      "topics": [
        "attestation",
        "attestations",
        "intoto",
        "signature-verification",
        "signatures",
        "sigstore",
        "slsa",
        "slsa-provenance"
      ],
      "is_fork": false,
      "size_kb": 895,
      "has_wiki": false,
      "homepage": null,
      "languages": {
        "Go": 118440
      },
      "pushed_at": "2026-07-21T04:45:11Z",
      "created_at": "2025-01-31T04:07:01Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-21T04:45:24Z",
      "description": "Sign and package attestations in sigstore bundles",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": "carabiner.dev",
      "name": "Carabiner Systems",
      "type": "Organization",
      "login": "carabiner-dev",
      "company": null,
      "location": "United States of America",
      "followers": 17,
      "avatar_url": "https://avatars.githubusercontent.com/u/193936921?v=4",
      "created_at": "2025-01-06T16:55:54Z",
      "is_verified": null,
      "public_repos": 58,
      "account_age_days": 562
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.4.4",
          "kind": "patch",
          "published_at": "2026-07-18T01:41:19Z"
        },
        {
          "tag": "v0.4.3",
          "kind": "patch",
          "published_at": "2026-06-05T07:37:48Z"
        },
        {
          "tag": "v0.4.2",
          "kind": "patch",
          "published_at": "2026-04-22T23:09:55Z"
        },
        {
          "tag": "v0.4.1",
          "kind": "patch",
          "published_at": "2026-03-19T08:18:00Z"
        },
        {
          "tag": "v0.4.0",
          "kind": "minor",
          "published_at": "2026-03-18T00:54:43Z"
        },
        {
          "tag": "v0.3.2",
          "kind": "patch",
          "published_at": "2025-09-15T13:05:35Z"
        },
        {
          "tag": "v0.3.1",
          "kind": "patch",
          "published_at": "2025-09-12T19:56:36Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2025-09-04T22:21:43Z"
        },
        {
          "tag": "v0.2.3",
          "kind": "patch",
          "published_at": "2025-08-28T13:24:08Z"
        },
        {
          "tag": "v0.2.2",
          "kind": "patch",
          "published_at": "2025-06-25T06:57:48Z"
        },
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2025-05-21T01:31:08Z"
        },
        {
          "tag": "v0.1.4",
          "kind": "patch",
          "published_at": "2025-05-21T00:43:42Z"
        },
        {
          "tag": "v0.1.3",
          "kind": "patch",
          "published_at": "2025-04-15T04:30:27Z"
        },
        {
          "tag": "v0.1.2",
          "kind": "patch",
          "published_at": "2025-04-15T03:33:38Z"
        },
        {
          "tag": "v0.1.1",
          "kind": "patch",
          "published_at": "2025-04-15T00:40:47Z"
        },
        {
          "tag": "v0.0.1",
          "kind": "patch",
          "published_at": "2025-04-02T11:57:32Z"
        },
        {
          "tag": "v0.0.1-pre2",
          "kind": "prerelease",
          "published_at": "2025-03-18T18:37:55Z"
        },
        {
          "tag": "v0.0.1-pre1",
          "kind": "prerelease",
          "published_at": "2025-02-12T05:53:03Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "bc7a4fa1405e5cad4bc9e5762a352954e4f1ac4c",
          "body": "…actions-7a5a078ad4\n\nMerged by miniprow\n\nSigned-off-by: miniprow <3418766+miniprow[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Merge pull request #158 from carabiner-dev/dependabot/github_actions/…",
          "author_name": "miniprow[bot]",
          "author_login": "miniprow[bot]",
          "committed_at": "2026-07-21T04:45:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c662c238bd7658a978d4615d7618de85ea387dab",
          "body": "Bumps the actions group with 1 update: [actions/checkout](https://github.com/actions/checkout).\n\n\nUpdates `actions/checkout` from 7.0.0 to 7.0.1\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https\n[…]\nheckout\n  dependency-version: 7.0.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump actions/checkout from 7.0.0 to 7.0.1 in the actions group",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-21T04:43:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "909ac19c0c1b4e987dfb5fbb584c84ed3251467d",
          "body": "…actions-5d17bc2aea\n\nMerged by miniprow\n\nSigned-off-by: miniprow <3418766+miniprow[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Merge pull request #156 from carabiner-dev/dependabot/github_actions/…",
          "author_name": "miniprow[bot]",
          "author_login": "miniprow[bot]",
          "committed_at": "2026-07-20T06:34:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ac7af23b84131b3d06aae125e488324819f58d07",
          "body": "…d-b3d1eaee99\n\nMerged by miniprow\n\nSigned-off-by: miniprow <3418766+miniprow[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Merge pull request #157 from carabiner-dev/dependabot/go_modules/gomo…",
          "author_name": "miniprow[bot]",
          "author_login": "miniprow[bot]",
          "committed_at": "2026-07-20T06:33:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "26f3ca29298c21fb5738a73fff88af581e491315",
          "body": "Bumps the gomod group with 1 update: [github.com/carabiner-dev/collector](https://github.com/carabiner-dev/collector).\n\n\nUpdates `github.com/carabiner-dev/collector` from 0.3.8 to 0.3.9\n- [Release notes](https://github.com/carabiner-dev/collector/releases)\n- [Commits](https://github.com/carabiner-de\n[…]\ncollector\n  dependency-version: 0.3.9\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: gomod\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump github.com/carabiner-dev/collector in the gomod group",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-20T04:43:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "65d473e5331e91ed349af3175c9643cf2994d535",
          "body": "Bumps the actions group with 2 updates: [carabiner-dev/actions/go/versions](https://github.com/carabiner-dev/actions) and [carabiner-dev/actions/unpack/sbom](https://github.com/carabiner-dev/actions).\n\n\nUpdates `carabiner-dev/actions/go/versions` from 1.2.1 to 1.2.3\n- [Release notes](https://github.\n[…]\nck/sbom\n  dependency-version: 1.2.3\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump the actions group with 2 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-20T04:43:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8343d1b22a4a2ed43e2afad4fb8a2b9f2145749e",
          "body": "Merged by miniprow\n\nSigned-off-by: miniprow <3418766+miniprow[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Merge pull request #155 from puerco/release-provenance",
          "author_name": "miniprow[bot]",
          "author_login": "miniprow[bot]",
          "committed_at": "2026-07-18T01:33:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "079418502e7eead89443b88817234d843596ab3a",
          "body": "Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>",
          "is_bot": false,
          "headline": "Fix slsa generation with new action",
          "author_name": "Adolfo García Veytia (Puerco)",
          "author_login": "puerco",
          "committed_at": "2026-07-18T01:30:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "be2c8fae35400e9c195c316499a18d3460b52fff",
          "body": "…carabiner-dev/actions/unpack/sbom-40e7a533857ac0f530b0fe2945c77042fabe1902\n\nMerged by miniprow\n\nSigned-off-by: miniprow <3418766+miniprow[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Merge pull request #154 from carabiner-dev/dependabot/github_actions/…",
          "author_name": "miniprow[bot]",
          "author_login": "miniprow[bot]",
          "committed_at": "2026-07-17T01:09:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e1f55cbcbad85e242ed1fad9b0b8884ae136d391",
          "body": "Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>",
          "is_bot": false,
          "headline": "Pin to tagged version",
          "author_name": "Adolfo García Veytia (Puerco)",
          "author_login": "puerco",
          "committed_at": "2026-07-17T01:06:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7a5329ad26f9e8ce97592a00045bac5038091d73",
          "body": "…actions/setup-go-7.0.0\n\nMerged by miniprow\n\nSigned-off-by: miniprow <3418766+miniprow[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Merge pull request #153 from carabiner-dev/dependabot/github_actions/…",
          "author_name": "miniprow[bot]",
          "author_login": "miniprow[bot]",
          "committed_at": "2026-07-17T01:00:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e353123e141bae050a348f445d83474041c8cdaf",
          "body": "Bumps [carabiner-dev/actions/unpack/sbom](https://github.com/carabiner-dev/actions) from f882fa9eb795141737eecac4ffb056df5ad14954 to 40e7a533857ac0f530b0fe2945c77042fabe1902.\n- [Release notes](https://github.com/carabiner-dev/actions/releases)\n- [Commits](https://github.com/carabiner-dev/actions/com\n[…]\nncy-name: carabiner-dev/actions/unpack/sbom\n  dependency-version: 40e7a533857ac0f530b0fe2945c77042fabe1902\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump carabiner-dev/actions/unpack/sbom",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-16T04:43:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "241395d9903ecfe8a974692871e11e7e7cc84a3e",
          "body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0.\n- [Release notes](https://github.com/actions/setup-go/releases)\n- [Commits](https://github.com/actions/setup-go/compare/924ae3a1cded613372ab5595356fb5720e22ba16...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e)\n\n---\nupdated\n[…]\n- dependency-name: actions/setup-go\n  dependency-version: 7.0.0\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump actions/setup-go from 6.5.0 to 7.0.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-16T04:43:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9bd6dab002a17e26a3e50e5077cc57bf0841f50e",
          "body": "…d-4f315c0608\n\nMerged by miniprow\n\nSigned-off-by: miniprow <3418766+miniprow[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Merge pull request #151 from carabiner-dev/dependabot/go_modules/gomo…",
          "author_name": "miniprow[bot]",
          "author_login": "miniprow[bot]",
          "committed_at": "2026-07-08T20:23:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "faa396380cf4f85df772f6d226322b6809ee6bf1",
          "body": "Bumps the gomod group with 1 update: [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go).\n\n\nUpdates `github.com/sigstore/sigstore-go` from 1.2.1 to 1.2.2\n- [Release notes](https://github.com/sigstore/sigstore-go/releases)\n- [Commits](https://github.com/sigstore/sigstore-go/com\n[…]\ngstore-go\n  dependency-version: 1.2.2\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: gomod\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump github.com/sigstore/sigstore-go in the gomod group",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-07T04:43:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "07eaf2adbe94bc27cd2610fab6daebe1c1c637ea",
          "body": "Merged by miniprow\n\nSigned-off-by: miniprow <3418766+miniprow[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Merge pull request #150 from carabiner-dev/b",
          "author_name": "miniprow[bot]",
          "author_login": "miniprow[bot]",
          "committed_at": "2026-07-03T21:36:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "faafaf819fa1f4e93cf7abafa84b92e2bb9d9395",
          "body": "Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>",
          "is_bot": false,
          "headline": "Bump collector",
          "author_name": "Adolfo García Veytia (Puerco)",
          "author_login": "puerco",
          "committed_at": "2026-07-03T21:31:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "535f094ffbf8d44cff2654f944f143b248446a2d",
          "body": "…actions-5d65eb5e87\n\nMerged by miniprow\n\nSigned-off-by: miniprow <3418766+miniprow[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Merge pull request #149 from carabiner-dev/dependabot/github_actions/…",
          "author_name": "miniprow[bot]",
          "author_login": "miniprow[bot]",
          "committed_at": "2026-07-01T01:11:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0a2fdc6df9e7c0158b5ca14690f40c2e07e27719",
          "body": "Bumps the actions group with 2 updates: [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) and [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action).\n\n\nUpdates `golangci/golangci-lint-action` from 9.2.1 to 9.3.0\n- [Release notes](https://githu\n[…]\n-action\n  dependency-version: 7.2.3\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump the actions group with 2 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-30T04:42:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "903973341de17eb94ba4a7e40fa9a2ccaa80a7b3",
          "body": "…carabiner-dev/actions/unpack/sbom-f882fa9eb795141737eecac4ffb056df5ad14954\n\nMerged by miniprow\n\nSigned-off-by: miniprow <3418766+miniprow[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Merge pull request #148 from carabiner-dev/dependabot/github_actions/…",
          "author_name": "miniprow[bot]",
          "author_login": "miniprow[bot]",
          "committed_at": "2026-06-26T06:32:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d91ff3e243f128d8a65b16525754fd0b5481c691",
          "body": "Bumps [carabiner-dev/actions/unpack/sbom](https://github.com/carabiner-dev/actions) from b60791af41423360b892a1a3cee90cd4e131f381 to f882fa9eb795141737eecac4ffb056df5ad14954.\n- [Release notes](https://github.com/carabiner-dev/actions/releases)\n- [Commits](https://github.com/carabiner-dev/actions/com\n[…]\nncy-name: carabiner-dev/actions/unpack/sbom\n  dependency-version: f882fa9eb795141737eecac4ffb056df5ad14954\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump carabiner-dev/actions/unpack/sbom",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-26T04:42:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bcda40edcf10f2e8bcaa412ca00a888c8a0be840",
          "body": "…actions-9b7bde0b82\n\nMerged by miniprow\n\nSigned-off-by: miniprow <3418766+miniprow[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Merge pull request #147 from carabiner-dev/dependabot/github_actions/…",
          "author_name": "miniprow[bot]",
          "author_login": "miniprow[bot]",
          "committed_at": "2026-06-24T19:06:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9f755a1dd93420843175a6919401c802ec642ff6",
          "body": "Bumps the actions group with 1 update: [actions/setup-go](https://github.com/actions/setup-go).\n\n\nUpdates `actions/setup-go` from 6.4.0 to 6.5.0\n- [Release notes](https://github.com/actions/setup-go/releases)\n- [Commits](https://github.com/actions/setup-go/compare/4a3601121dd01d1626a1e23e37211e3254c\n[…]\netup-go\n  dependency-version: 6.5.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n  dependency-group: actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump actions/setup-go from 6.4.0 to 6.5.0 in the actions group",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-24T04:43:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1eaa2d147302137f6bc0e4915bad71c0bcf336d0",
          "body": "…actions/checkout-7.0.0\n\nMerged by miniprow\n\nSigned-off-by: miniprow <3418766+miniprow[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Merge pull request #145 from carabiner-dev/dependabot/github_actions/…",
          "author_name": "miniprow[bot]",
          "author_login": "miniprow[bot]",
          "committed_at": "2026-06-23T00:43:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b9386638bbc56f17ef450a4adac0c5ef385b2773",
          "body": "…d-386cb081a4\n\nMerged by miniprow\n\nSigned-off-by: miniprow <3418766+miniprow[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Merge pull request #146 from carabiner-dev/dependabot/go_modules/gomo…",
          "author_name": "miniprow[bot]",
          "author_login": "miniprow[bot]",
          "committed_at": "2026-06-22T23:25:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e5fe8ecd089bfd11c86a34b2766610a339350a20",
          "body": "Bumps the gomod group with 1 update: [sigs.k8s.io/release-sdk](https://github.com/kubernetes-sigs/release-sdk).\n\n\nUpdates `sigs.k8s.io/release-sdk` from 0.12.6 to 0.12.7\n- [Release notes](https://github.com/kubernetes-sigs/release-sdk/releases)\n- [Commits](https://github.com/kubernetes-sigs/release-\n[…]\nease-sdk\n  dependency-version: 0.12.7\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: gomod\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump sigs.k8s.io/release-sdk from 0.12.6 to 0.12.7 in the gomod group",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-22T04:43:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7331af7c88d2bee20310198911a5caf47b4ee60e",
          "body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b43\n[…]\n- dependency-name: actions/checkout\n  dependency-version: 7.0.0\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump actions/checkout from 6.0.3 to 7.0.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-19T04:43:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6724c34cfc08a03908efb83ccd0b6210098754bd",
          "body": "…d-a4e47bd3bd\n\nMerged by miniprow\n\nSigned-off-by: miniprow <3418766+miniprow[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Merge pull request #144 from carabiner-dev/dependabot/go_modules/gomo…",
          "author_name": "miniprow[bot]",
          "author_login": "miniprow[bot]",
          "committed_at": "2026-06-10T23:07:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "88b247a6401c1d26453477f1f6a54c7ff6fa4b1f",
          "body": "Bumps the gomod group with 2 updates: [github.com/carabiner-dev/signer](https://github.com/carabiner-dev/signer) and [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go).\n\n\nUpdates `github.com/carabiner-dev/signer` from 0.5.1 to 0.5.2\n- [Release notes](https://github.com/carabi\n[…]\ngstore-go\n  dependency-version: 1.2.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: gomod\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump the gomod group with 2 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-10T04:43:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f100f6a17cf80f174d81a10e0402a79c84018775",
          "body": "…d-3248eb9844\n\nMerged by miniprow\n\nSigned-off-by: miniprow <3418766+miniprow[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Merge pull request #143 from carabiner-dev/dependabot/go_modules/gomo…",
          "author_name": "miniprow[bot]",
          "author_login": "miniprow[bot]",
          "committed_at": "2026-06-10T01:51:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8310aae48f3377fdf4c4fd6a18fc3e7d62ae0875",
          "body": "Bumps the gomod group with 2 updates: [github.com/carabiner-dev/collector](https://github.com/carabiner-dev/collector) and [github.com/carabiner-dev/signer](https://github.com/carabiner-dev/signer).\n\n\nUpdates `github.com/carabiner-dev/collector` from 0.3.6 to 0.3.7\n- [Release notes](https://github.c\n[…]\nev/signer\n  dependency-version: 0.5.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: gomod\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump the gomod group with 2 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-08T04:43:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "111406286ed0a90edf46056010c92c9dd28c47f8",
          "body": "Merged by miniprow",
          "is_bot": true,
          "headline": "Merge pull request #142 from puerco/bumps",
          "author_name": "miniprow[bot]",
          "author_login": "miniprow[bot]",
          "committed_at": "2026-06-05T07:17:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b97881ccbe099b61302201810386036ad22ceb00",
          "body": "Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>",
          "is_bot": false,
          "headline": "Add install instructions to readme",
          "author_name": "Adolfo García Veytia (Puerco)",
          "author_login": "puerco",
          "committed_at": "2026-06-05T06:20:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f7cbb9aef2aaa311fec7a35ced14e08f46a032b8",
          "body": "Merged by miniprow",
          "is_bot": true,
          "headline": "Merge pull request #141 from puerco/bumps",
          "author_name": "miniprow[bot]",
          "author_login": "miniprow[bot]",
          "committed_at": "2026-06-05T06:16:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d3623aff3f6664c0b8d019f2e3d21399dee0dad3",
          "body": "Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>",
          "is_bot": false,
          "headline": "Bump collector and signer",
          "author_name": "Adolfo García Veytia (Puerco)",
          "author_login": "puerco",
          "committed_at": "2026-06-05T06:12:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7fb9ff7623c7b3a6dd4216f53c81535ff6348b8b",
          "body": "Update deps",
          "is_bot": false,
          "headline": "Merge pull request #139 from TomHennen/update_deps",
          "author_name": "Puerco",
          "author_login": "puerco",
          "committed_at": "2026-06-05T04:49:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cb981b6262f192b173d6955a121c8fb45e46ba03",
          "body": "…actions-eeb28e38c8\n\nMerged by miniprow",
          "is_bot": true,
          "headline": "Merge pull request #140 from carabiner-dev/dependabot/github_actions/…",
          "author_name": "miniprow[bot]",
          "author_login": "miniprow[bot]",
          "committed_at": "2026-06-04T20:21:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fa3f83c949ce5631f3b19c989f876717f54108d4",
          "body": "Bumps the actions group with 4 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [carabiner-dev/actions](https://github.com/carabiner-dev/actions), [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) and [goreleaser/goreleaser-action](\n[…]\n-action\n  dependency-version: 7.2.2\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump the actions group across 1 directory with 4 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-03T22:13:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8aa1239e6b29fc529e6d9b25e6b015b24868e6e2",
          "body": "Signed-off-by: Tom Hennen <tom.hennen@gmail.com>",
          "is_bot": false,
          "headline": "update net, gitsign, in-toto",
          "author_name": "Tom Hennen",
          "author_login": "TomHennen",
          "committed_at": "2026-05-31T11:49:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c3e90e2e547d756744db3a83b15a1b7aec129587",
          "body": "Signed-off-by: Tom Hennen <tomhennen@Toms-MBP.localdomain>",
          "is_bot": false,
          "headline": "update deps to resolve CVEs",
          "author_name": "Tom Hennen",
          "author_login": "TomHennen",
          "committed_at": "2026-05-31T11:31:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f78d92f0abc8190f1c198c726bf9c53c0b6fd52e",
          "body": "Merged by miniprow",
          "is_bot": true,
          "headline": "Merge pull request #135 from puerco/signer-id",
          "author_name": "miniprow-dev[bot]",
          "author_login": "miniprow-dev[bot]",
          "committed_at": "2026-05-17T22:04:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ede86380f5b53ac69825a8beb265f5f109cf14e6",
          "body": "Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@carabiner.dev>",
          "is_bot": false,
          "headline": "Render signer id, even when unverified",
          "author_name": "Adolfo Garcia Veytia (puerco)",
          "author_login": "puerco",
          "committed_at": "2026-05-17T21:23:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8404da05d28a36673e2cd40c6df651e9d39ed941",
          "body": "…ub.com/go-git/go-git/v5-5.19.0\n\nMerged by miniprow",
          "is_bot": true,
          "headline": "Merge pull request #134 from carabiner-dev/dependabot/go_modules/gith…",
          "author_name": "miniprow-dev[bot]",
          "author_login": "miniprow-dev[bot]",
          "committed_at": "2026-05-13T20:51:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "90e8c587bdd2f96a985027e9a9771df679f94efb",
          "body": "Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.18.0 to 5.19.0.\n- [Release notes](https://github.com/go-git/go-git/releases)\n- [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md)\n- [Commits](https://github.com/go-git/go-git/compare/v5.18.0...v5.19.0)\n\n---\n\n[…]\n-name: github.com/go-git/go-git/v5\n  dependency-version: 5.19.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-07T04:48:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "96914b7b67db1fc006873c409eaffc6eb66c264a",
          "body": "…actions-2a09194511\n\nMerged by miniprow",
          "is_bot": true,
          "headline": "Merge pull request #133 from carabiner-dev/dependabot/github_actions/…",
          "author_name": "miniprow-dev[bot]",
          "author_login": "miniprow-dev[bot]",
          "committed_at": "2026-05-06T06:44:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3d4dd1a6f1bfcb74aa3249b177febdd6dbd752c7",
          "body": "Bumps the actions group with 2 updates in the / directory: [carabiner-dev/actions](https://github.com/carabiner-dev/actions) and [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action).\n\n\nUpdates `carabiner-dev/actions` from 1.1.6 to 1.2.0\n- [Release notes](https://github.com\n[…]\n-action\n  dependency-version: 7.2.1\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n  dependency-group: actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump the actions group across 1 directory with 2 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-06T04:46:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "593e6aee09b149e1807bee1219df25461522c566",
          "body": "Merged by miniprow",
          "is_bot": true,
          "headline": "Merge pull request #132 from puerco/multi-signer",
          "author_name": "miniprow-dev[bot]",
          "author_login": "miniprow-dev[bot]",
          "committed_at": "2026-04-28T03:36:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0c7243e459daa9aaf422451cd606f392780bcf89",
          "body": "Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>",
          "is_bot": false,
          "headline": "Pull TSA patch in signer",
          "author_name": "Adolfo García Veytia (Puerco)",
          "author_login": "puerco",
          "committed_at": "2026-04-28T03:25:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bed7ae3111a631c9ba7dc9e94e069c50e5b2a18a",
          "body": "Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>",
          "is_bot": false,
          "headline": "Wire new unified verifier options",
          "author_name": "Adolfo García Veytia (Puerco)",
          "author_login": "puerco",
          "committed_at": "2026-04-28T00:37:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "85e1695eae20c2f1859e4985b339ad1e210ec8c4",
          "body": "Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>",
          "is_bot": false,
          "headline": "Make bnd use the new signer OptionsSet",
          "author_name": "Adolfo García Veytia (Puerco)",
          "author_login": "puerco",
          "committed_at": "2026-04-28T00:19:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "719e6904df9ea318195e7da0810587c365238b92",
          "body": "Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>",
          "is_bot": false,
          "headline": "Drop deprecated 'Slug' call from identities",
          "author_name": "Adolfo García Veytia (Puerco)",
          "author_login": "puerco",
          "committed_at": "2026-04-24T23:50:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "eb3e7fa283e5a143698c21ce4febcd17d3d2a978",
          "body": "Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>",
          "is_bot": false,
          "headline": "Bump signer to v0.5 prerelease",
          "author_name": "Adolfo García Veytia (Puerco)",
          "author_login": "puerco",
          "committed_at": "2026-04-24T23:50:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "28074189b48db165c8dba872251531b3c9541e2e",
          "body": "…d-4b9d3b21b3\n\nMerged by miniprow",
          "is_bot": true,
          "headline": "Merge pull request #129 from carabiner-dev/dependabot/go_modules/gomo…",
          "author_name": "miniprow-dev[bot]",
          "author_login": "miniprow-dev[bot]",
          "committed_at": "2026-04-22T21:27:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0f34e57ccb5421892998256187aee297caf40f0d",
          "body": "Merged by miniprow",
          "is_bot": true,
          "headline": "Merge pull request #130 from puerco/table",
          "author_name": "miniprow-dev[bot]",
          "author_login": "miniprow-dev[bot]",
          "committed_at": "2026-04-22T21:25:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c55f4485d7b2e159ab564447f3678aafc7b058c7",
          "body": "Bumps the gomod group with 1 update: [github.com/carabiner-dev/collector](https://github.com/carabiner-dev/collector).\n\n\nUpdates `github.com/carabiner-dev/collector` from 0.3.4 to 0.3.5\n- [Release notes](https://github.com/carabiner-dev/collector/releases)\n- [Commits](https://github.com/carabiner-de\n[…]\ncollector\n  dependency-version: 0.3.5\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: gomod\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump github.com/carabiner-dev/collector in the gomod group",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-22T21:18:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a4cb060146132df2a877ae95ad4711d6bcef894d",
          "body": "This renames the read command to \"get\" which makes a little bit more sense.\n\nThe old read is still kept as a hidden command.\n\nSigned-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>",
          "is_bot": false,
          "headline": "Rename read subcommand to 'get'",
          "author_name": "Adolfo García Veytia (Puerco)",
          "author_login": "puerco",
          "committed_at": "2026-04-22T21:17:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9ee2a135604640998f41f5d4fe849b1a63cb40ea",
          "body": "Update CI",
          "is_bot": false,
          "headline": "Merge pull request #128 from puerco/ci",
          "author_name": "Puerco",
          "author_login": "puerco",
          "committed_at": "2026-04-22T21:17:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b78ca46304d67da60bac920f718f18023e561671",
          "body": "Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>",
          "is_bot": false,
          "headline": "only matrix on OS (not go version)",
          "author_name": "Adolfo García Veytia (Puerco)",
          "author_login": "puerco",
          "committed_at": "2026-04-22T21:11:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f8ece85ffa5451533acc756fc793a6eba516c774",
          "body": "Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>",
          "is_bot": false,
          "headline": "Update CI",
          "author_name": "Adolfo García Veytia (Puerco)",
          "author_login": "puerco",
          "committed_at": "2026-04-22T21:08:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c8d74777f5be55bd41b98960e2c3cab07b30699e",
          "body": "Switch ls table to termtable",
          "is_bot": false,
          "headline": "Merge pull request #127 from puerco/table",
          "author_name": "Puerco",
          "author_login": "puerco",
          "committed_at": "2026-04-22T20:54:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "919abd9094f4b6cfc2c52a37ba488e5643998939",
          "body": "Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>",
          "is_bot": false,
          "headline": "Switch ls table to termtable",
          "author_name": "Adolfo García Veytia (Puerco)",
          "author_login": "puerco",
          "committed_at": "2026-04-22T20:49:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4d51368ddde7b84ff696839d3049710e47d9a90a",
          "body": "…d-3ba261eb6b\n\nMerged by miniprow",
          "is_bot": true,
          "headline": "Merge pull request #124 from carabiner-dev/dependabot/go_modules/gomo…",
          "author_name": "miniprow-dev[bot]",
          "author_login": "miniprow-dev[bot]",
          "committed_at": "2026-04-20T20:26:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "93c872bbf43b53459793cc178712d3e72e43f9a3",
          "body": "Bumps the gomod group with 4 updates: [github.com/carabiner-dev/collector](https://github.com/carabiner-dev/collector), [github.com/carabiner-dev/hasher](https://github.com/carabiner-dev/hasher), [github.com/carabiner-dev/signer](https://github.com/carabiner-dev/signer) and [github.com/go-git/go-git\n[…]\no-git/v5\n  dependency-version: 5.18.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n  dependency-group: gomod\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump the gomod group with 4 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-20T20:25:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "90b7f134929dd2c5d3eb3d4852522ed8f88080eb",
          "body": "…actions-5963efd9c8\n\nMerged by miniprow",
          "is_bot": true,
          "headline": "Merge pull request #123 from carabiner-dev/dependabot/github_actions/…",
          "author_name": "miniprow-dev[bot]",
          "author_login": "miniprow-dev[bot]",
          "committed_at": "2026-04-20T20:24:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "045920093b4b3a445fc89555e21ee12a9a637ee3",
          "body": "…ub.com/carabiner-dev/command-0.3.1\n\nMerged by miniprow",
          "is_bot": true,
          "headline": "Merge pull request #125 from carabiner-dev/dependabot/go_modules/gith…",
          "author_name": "miniprow-dev[bot]",
          "author_login": "miniprow-dev[bot]",
          "committed_at": "2026-04-20T20:23:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "091d18cafa8cb376e7bb919d9eb0b2ccbb23a7d6",
          "body": "Merged by miniprow",
          "is_bot": true,
          "headline": "Merge pull request #126 from puerco/hashes",
          "author_name": "miniprow-dev[bot]",
          "author_login": "miniprow-dev[bot]",
          "committed_at": "2026-04-20T20:23:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "56fcf80ab9e926a21738a8a93359a7c6e551796d",
          "body": "Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>",
          "is_bot": false,
          "headline": "prefer sha256 in ls",
          "author_name": "Adolfo García Veytia (Puerco)",
          "author_login": "puerco",
          "committed_at": "2026-04-20T20:20:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b438ae8ce9ee80c85dcc44615832a4b0624ed7c8",
          "body": "Bumps [github.com/carabiner-dev/command](https://github.com/carabiner-dev/command) from 0.3.1-0.20260317212123-38975797a6a0 to 0.3.1.\n- [Release notes](https://github.com/carabiner-dev/command/releases)\n- [Commits](https://github.com/carabiner-dev/command/commits/v0.3.1)\n\n---\nupdated-dependencies:\n-\n[…]\ne: github.com/carabiner-dev/command\n  dependency-version: 0.3.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump github.com/carabiner-dev/command",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-20T05:02:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7960c6818bbc478276310ce90d18b0efd5fa4ba0",
          "body": "Bumps the actions group with 1 update: [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action).\n\n\nUpdates `goreleaser/goreleaser-action` from 7.0.0 to 7.1.0\n- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)\n- [Commits](https://github.com/goreleaser/g\n[…]\n-action\n  dependency-version: 7.1.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n  dependency-group: actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump goreleaser/goreleaser-action in the actions group",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-20T05:02:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "033f7965162b627424eb7b19610863be9ee59ec9",
          "body": "ls: display all subjects from attestations",
          "is_bot": false,
          "headline": "Merge pull request #122 from puerco/multi-sub",
          "author_name": "Puerco",
          "author_login": "puerco",
          "committed_at": "2026-04-15T20:12:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aa234de73322457fa0156b29d7392bea3c472d42",
          "body": "Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>",
          "is_bot": false,
          "headline": "ls: display all subjects from attestations",
          "author_name": "Adolfo García Veytia (Puerco)",
          "author_login": "puerco",
          "committed_at": "2026-04-15T20:09:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d6a58be2f56de72ac15b7d4e996739ffebe14356",
          "body": "…actions-3f73f0f948\n\nBump kubernetes-sigs/release-actions from 0.4.2 to 0.4.3 in the actions group",
          "is_bot": false,
          "headline": "Merge pull request #119 from carabiner-dev/dependabot/github_actions/…",
          "author_name": "Puerco",
          "author_login": "puerco",
          "committed_at": "2026-04-15T19:10:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f808d95db556c6f2a0fa82a9cebd52a1875e8ab1",
          "body": "…d-9bb5981ad9\n\nBump the gomod group with 2 updates",
          "is_bot": false,
          "headline": "Merge pull request #120 from carabiner-dev/dependabot/go_modules/gomo…",
          "author_name": "Puerco",
          "author_login": "puerco",
          "committed_at": "2026-04-15T19:10:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5d45363a9b261050752597b78d62343fe97307cb",
          "body": "…ng.org/x/term-0.42.0\n\nBump golang.org/x/term from 0.41.0 to 0.42.0",
          "is_bot": false,
          "headline": "Merge pull request #121 from carabiner-dev/dependabot/go_modules/gola…",
          "author_name": "Puerco",
          "author_login": "puerco",
          "committed_at": "2026-04-15T19:10:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "daa7649c70db6698a7c6e03fc29cd99d6d51d22f",
          "body": "Bumps [golang.org/x/term](https://github.com/golang/term) from 0.41.0 to 0.42.0.\n- [Commits](https://github.com/golang/term/compare/v0.41.0...v0.42.0)\n\n---\nupdated-dependencies:\n- dependency-name: golang.org/x/term\n  dependency-version: 0.42.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump golang.org/x/term from 0.41.0 to 0.42.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-13T04:59:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c16b93b06825821b0c3ad0620fe02c86cb18e8d2",
          "body": "Bumps the gomod group with 2 updates: [github.com/carabiner-dev/signer](https://github.com/carabiner-dev/signer) and [github.com/sigstore/protobuf-specs](https://github.com/sigstore/protobuf-specs).\n\n\nUpdates `github.com/carabiner-dev/signer` from 0.4.2 to 0.4.3\n- [Release notes](https://github.com/\n[…]\nbuf-specs\n  dependency-version: 0.5.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: gomod\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump the gomod group with 2 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-13T04:59:45Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a2eb62fd70aba7cba9eaa0039172a894237143ec",
          "body": "Bumps the actions group with 1 update: [kubernetes-sigs/release-actions](https://github.com/kubernetes-sigs/release-actions).\n\n\nUpdates `kubernetes-sigs/release-actions` from 0.4.2 to 0.4.3\n- [Release notes](https://github.com/kubernetes-sigs/release-actions/releases)\n- [Changelog](https://github.co\n[…]\nactions\n  dependency-version: 0.4.3\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump kubernetes-sigs/release-actions in the actions group",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-13T04:59:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a90db593701ce3281ca2b1e193a671bddb6c15cd",
          "body": "…d-2acecb6910\n\nBump github.com/carabiner-dev/collector from 0.3.2 to 0.3.3 in the gomod group",
          "is_bot": false,
          "headline": "Merge pull request #118 from carabiner-dev/dependabot/go_modules/gomo…",
          "author_name": "Puerco",
          "author_login": "puerco",
          "committed_at": "2026-04-07T02:02:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "493a791551c8c074b167cea1350f54c12d9e1c14",
          "body": "…actions-ebf7109426\n\nBump kubernetes-sigs/release-actions from 0.4.0 to 0.4.2 in the actions group",
          "is_bot": false,
          "headline": "Merge pull request #117 from carabiner-dev/dependabot/github_actions/…",
          "author_name": "Puerco",
          "author_login": "puerco",
          "committed_at": "2026-04-07T01:50:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a68fb964a854f00ebb4d44107f47181159f2c52d",
          "body": "Bumps the gomod group with 1 update: [github.com/carabiner-dev/collector](https://github.com/carabiner-dev/collector).\n\n\nUpdates `github.com/carabiner-dev/collector` from 0.3.2 to 0.3.3\n- [Release notes](https://github.com/carabiner-dev/collector/releases)\n- [Commits](https://github.com/carabiner-de\n[…]\ncollector\n  dependency-version: 0.3.3\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: gomod\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump github.com/carabiner-dev/collector in the gomod group",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-06T04:56:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8e79d1d8252aa3f4cb6e5b72fba4b56d7fcb386c",
          "body": "Bumps the actions group with 1 update: [kubernetes-sigs/release-actions](https://github.com/kubernetes-sigs/release-actions).\n\n\nUpdates `kubernetes-sigs/release-actions` from 0.4.0 to 0.4.2\n- [Release notes](https://github.com/kubernetes-sigs/release-actions/releases)\n- [Changelog](https://github.co\n[…]\nactions\n  dependency-version: 0.4.2\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump kubernetes-sigs/release-actions in the actions group",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-06T04:56:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f34e27a7ec833cb94d89bfd200253f806e5c9fde",
          "body": "…actions-84ffaffffe\n\nBump actions/setup-go from 6.3.0 to 6.4.0 in the actions group",
          "is_bot": false,
          "headline": "Merge pull request #113 from carabiner-dev/dependabot/github_actions/…",
          "author_name": "Puerco",
          "author_login": "puerco",
          "committed_at": "2026-03-31T20:34:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e3d19d496bb0497ee333e7e763721180bd5daeb9",
          "body": "…d-144f000280\n\nBump the gomod group across 1 directory with 2 updates",
          "is_bot": false,
          "headline": "Merge pull request #116 from carabiner-dev/dependabot/go_modules/gomo…",
          "author_name": "Puerco",
          "author_login": "puerco",
          "committed_at": "2026-03-31T20:33:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a1180e2cab4571a4229a069c4286fbf56e8e82ca",
          "body": "Bumps the gomod group with 2 updates in the / directory: [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) and [sigs.k8s.io/release-utils](https://github.com/kubernetes-sigs/release-utils).\n\n\nUpdates `github.com/go-git/go-git/v5` from 5.17.0 to 5.17.2\n- [Release notes](https://github.c\n[…]\nse-utils\n  dependency-version: 0.12.4\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: gomod\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump the gomod group across 1 directory with 2 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-31T20:31:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "696d20d97e32ec13a50a5d96c57486584e40d9bd",
          "body": "Skip dsc when specifying collectors",
          "is_bot": false,
          "headline": "Merge pull request #115 from puerco/dsc-auto",
          "author_name": "Puerco",
          "author_login": "puerco",
          "committed_at": "2026-03-31T20:29:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4d06a6856a60e9450af713f71102dbae71a45da2",
          "body": "Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>",
          "is_bot": false,
          "headline": "Skip dsc when specifying collectors",
          "author_name": "Adolfo García Veytia (Puerco)",
          "author_login": "puerco",
          "committed_at": "2026-03-31T20:19:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6b5d989c143fc91b096124e1f8783a45a4c23448",
          "body": "Bumps the actions group with 1 update: [actions/setup-go](https://github.com/actions/setup-go).\n\n\nUpdates `actions/setup-go` from 6.3.0 to 6.4.0\n- [Release notes](https://github.com/actions/setup-go/releases)\n- [Commits](https://github.com/actions/setup-go/compare/4b73464bb391d4059bd26b0524d20df3927\n[…]\netup-go\n  dependency-version: 6.4.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n  dependency-group: actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump actions/setup-go from 6.3.0 to 6.4.0 in the actions group",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-30T04:56:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "25bb8fdeb3727073fe4ae8a307f4310292afd676",
          "body": "…d-ae73f331fc\n\nBump sigs.k8s.io/release-sdk from 0.12.5 to 0.12.6 in the gomod group",
          "is_bot": false,
          "headline": "Merge pull request #109 from carabiner-dev/dependabot/go_modules/gomo…",
          "author_name": "Puerco",
          "author_login": "puerco",
          "committed_at": "2026-03-24T11:10:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "21baf7502b4def661decc8ea150439ec714943d5",
          "body": "…ub.com/carabiner-dev/signer-0.4.2\n\nBump github.com/carabiner-dev/signer from 0.4.2-0.20260317092902-42e595fd41c1 to 0.4.2",
          "is_bot": false,
          "headline": "Merge pull request #110 from carabiner-dev/dependabot/go_modules/gith…",
          "author_name": "Puerco",
          "author_login": "puerco",
          "committed_at": "2026-03-24T11:09:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cf8d8ccc4b83f2172f864fd11a7d74890921abf8",
          "body": "…ub.com/in-toto/attestation-1.2.0\n\nBump github.com/in-toto/attestation from 1.1.2 to 1.2.0",
          "is_bot": false,
          "headline": "Merge pull request #111 from carabiner-dev/dependabot/go_modules/gith…",
          "author_name": "Puerco",
          "author_login": "puerco",
          "committed_at": "2026-03-24T11:09:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8a7c2591446eb5270be4431ca37b93d94c7b6151",
          "body": "…ub.com/carabiner-dev/collector-0.3.2\n\nBump github.com/carabiner-dev/collector from 0.3.2-0.20260317100825-e0826693cb15 to 0.3.2",
          "is_bot": false,
          "headline": "Merge pull request #112 from carabiner-dev/dependabot/go_modules/gith…",
          "author_name": "Puerco",
          "author_login": "puerco",
          "committed_at": "2026-03-24T11:08:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2767203f39839be12d84f4ed93765059b81e5ea7",
          "body": "Bumps [github.com/carabiner-dev/collector](https://github.com/carabiner-dev/collector) from 0.3.2-0.20260317100825-e0826693cb15 to 0.3.2.\n- [Release notes](https://github.com/carabiner-dev/collector/releases)\n- [Commits](https://github.com/carabiner-dev/collector/commits/v0.3.2)\n\n---\nupdated-depende\n[…]\n github.com/carabiner-dev/collector\n  dependency-version: 0.3.2\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump github.com/carabiner-dev/collector",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-23T04:45:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "691c5810b609eaf942b4d60b64027b86468af6a5",
          "body": "Bumps [github.com/in-toto/attestation](https://github.com/in-toto/attestation) from 1.1.2 to 1.2.0.\n- [Release notes](https://github.com/in-toto/attestation/releases)\n- [Commits](https://github.com/in-toto/attestation/compare/v1.1.2...v1.2.0)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/in-toto/attestation\n  dependency-version: 1.2.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump github.com/in-toto/attestation from 1.1.2 to 1.2.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-23T04:45:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2bdb09db9c64c0f4f53dc26b4f14871814a5bc36",
          "body": "Bumps [github.com/carabiner-dev/signer](https://github.com/carabiner-dev/signer) from 0.4.2-0.20260317092902-42e595fd41c1 to 0.4.2.\n- [Release notes](https://github.com/carabiner-dev/signer/releases)\n- [Commits](https://github.com/carabiner-dev/signer/commits/v0.4.2)\n\n---\nupdated-dependencies:\n- dep\n[…]\nme: github.com/carabiner-dev/signer\n  dependency-version: 0.4.2\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump github.com/carabiner-dev/signer",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-23T04:45:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7ccb463f6046633235ae746f7752a8217c5a11c0",
          "body": "Bumps the gomod group with 1 update: [sigs.k8s.io/release-sdk](https://github.com/kubernetes-sigs/release-sdk).\n\n\nUpdates `sigs.k8s.io/release-sdk` from 0.12.5 to 0.12.6\n- [Release notes](https://github.com/kubernetes-sigs/release-sdk/releases)\n- [Commits](https://github.com/kubernetes-sigs/release-\n[…]\nease-sdk\n  dependency-version: 0.12.6\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: gomod\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Bump sigs.k8s.io/release-sdk from 0.12.5 to 0.12.6 in the gomod group",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-23T04:44:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "85e2e7f463ea8763dff8f31d440ab786e5acb595",
          "body": "Fix broken sigstore initialization",
          "is_bot": false,
          "headline": "Merge pull request #108 from puerco/fix-sigs",
          "author_name": "Puerco",
          "author_login": "puerco",
          "committed_at": "2026-03-19T08:12:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e3a1b53171aca9803da32132d8a7b343a6d99b62",
          "body": "Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@carabiner.dev>",
          "is_bot": false,
          "headline": "Fix linter nits",
          "author_name": "Adolfo Garcia Veytia (puerco)",
          "author_login": "puerco",
          "committed_at": "2026-03-19T08:11:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "78cf9dddd371d5b918078cd1e7d000856c064037",
          "body": "Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@carabiner.dev>",
          "is_bot": false,
          "headline": "Add tests for sigstore init",
          "author_name": "Adolfo Garcia Veytia (puerco)",
          "author_login": "puerco",
          "committed_at": "2026-03-19T08:05:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aa1eefa574885ed1f27897429d0d0152d930ae4e",
          "body": "Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@carabiner.dev>",
          "is_bot": false,
          "headline": "Fix sigstore options init",
          "author_name": "Adolfo Garcia Veytia (puerco)",
          "author_login": "puerco",
          "committed_at": "2026-03-19T08:04:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1ef5c66cfeca1fc81abbca1c622235998a6468af",
          "body": "Update readme and add .supplychain.yaml",
          "is_bot": false,
          "headline": "Merge pull request #107 from puerco/docs",
          "author_name": "Puerco",
          "author_login": "puerco",
          "committed_at": "2026-03-18T00:49:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 18,
      "commits_last_year": 230,
      "latest_release_at": "2026-07-18T01:41:19Z",
      "latest_release_tag": "v0.4.4",
      "releases_from_tags": false,
      "days_since_last_push": 1,
      "active_weeks_last_year": 35,
      "days_since_latest_release": 4,
      "mean_days_between_releases": 43.1
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 37,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/carabiner-dev/bnd",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/carabiner-dev/bnd",
          "is_deprecated": false,
          "latest_version": "v0.4.4",
          "repository_url": "https://github.com/carabiner-dev/bnd",
          "versions_count": 19,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-18T01:33:33Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 4
        }
      ]
    },
    "popularity": {
      "forks": 3,
      "stars": 10,
      "watchers": 1,
      "fork_history": {
        "days": [
          {
            "date": "2025-02-12",
            "count": 1
          },
          {
            "date": "2025-02-18",
            "count": 1
          },
          {
            "date": "2025-10-03",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 3,
        "total_forks": 3
      },
      "star_history": null,
      "open_issues_and_prs": 1
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [
        "proto/carabiner/supplychain/v1/supplychain.proto"
      ],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 15227,
      "source_files_sampled": 36,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "google.golang.org/grpc",
            "direct": false,
            "version": "v1.82.0",
            "severity": "critical",
            "ecosystem": "go",
            "cvss_score": 9.1,
            "advisory_ids": [
              "GHSA-hrxh-6v49-42gf"
            ],
            "fixed_version": "1.82.1",
            "advisory_count": 1,
            "oldest_advisory_days": 1
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.53.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5932"
            ],
            "fixed_version": null,
            "advisory_count": 1,
            "oldest_advisory_days": 15
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.38.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 8
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "unknown": 2,
          "critical": 1
        },
        "advisory_count": 3,
        "affected_count": 3,
        "assessed_count": 157,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/carabiner-dev/attestation",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.2.1"
        },
        {
          "name": "github.com/carabiner-dev/collector",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.9"
        },
        {
          "name": "github.com/carabiner-dev/command",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.1"
        },
        {
          "name": "github.com/carabiner-dev/hasher",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.2.4"
        },
        {
          "name": "github.com/carabiner-dev/jsonl",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.2.1"
        },
        {
          "name": "github.com/carabiner-dev/signer",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.2"
        },
        {
          "name": "github.com/carabiner-dev/termtable",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.0"
        },
        {
          "name": "github.com/go-git/go-git/v5",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.19.1"
        },
        {
          "name": "github.com/in-toto/attestation",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.0"
        },
        {
          "name": "github.com/sigstore/protobuf-specs",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.1"
        },
        {
          "name": "github.com/sigstore/sigstore-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.2"
        },
        {
          "name": "github.com/sirupsen/logrus",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.9.4"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.2"
        },
        {
          "name": "github.com/stretchr/testify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.11.1"
        },
        {
          "name": "google.golang.org/protobuf",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.36.12-0.20260120151049-f2248ac996af"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        },
        {
          "name": "sigs.k8s.io/release-sdk",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.12.7"
        },
        {
          "name": "sigs.k8s.io/release-utils",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.12.4"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "github.com/carabiner-dev/attestation",
            "direct": true,
            "version": "v0.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/carabiner-dev/collector",
            "direct": true,
            "version": "v0.3.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/carabiner-dev/command",
            "direct": true,
            "version": "v0.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/carabiner-dev/hasher",
            "direct": true,
            "version": "v0.2.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/carabiner-dev/jsonl",
            "direct": true,
            "version": "v0.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/carabiner-dev/signer",
            "direct": true,
            "version": "v0.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/carabiner-dev/termtable",
            "direct": true,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/go-git/v5",
            "direct": true,
            "version": "v5.19.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/in-toto/attestation",
            "direct": true,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/protobuf-specs",
            "direct": true,
            "version": "v0.5.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/sigstore-go",
            "direct": true,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sirupsen/logrus",
            "direct": true,
            "version": "v1.9.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cobra",
            "direct": true,
            "version": "v1.10.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/testify",
            "direct": true,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/protobuf",
            "direct": true,
            "version": "v1.36.12-0.20260120151049-f2248ac996af",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": true,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/release-sdk",
            "direct": true,
            "version": "v0.12.7",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/release-utils",
            "direct": true,
            "version": "v0.12.4",
            "ecosystem": "go"
          },
          {
            "name": "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go",
            "direct": false,
            "version": "v1.36.11-20260415201107-50325440f8f2.1",
            "ecosystem": "go"
          },
          {
            "name": "dario.cat/mergo",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/anchore/go-struct-converter",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/asaskevich/govalidator",
            "direct": false,
            "version": "v0.0.0-20230301143203-a9d515a09cc2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/avast/retry-go/v4",
            "direct": false,
            "version": "v4.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/blang/semver",
            "direct": false,
            "version": "v3.5.1+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/blang/semver/v4",
            "direct": false,
            "version": "v4.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/carabiner-dev/ghrfs",
            "direct": false,
            "version": "v0.3.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/carabiner-dev/github",
            "direct": false,
            "version": "v0.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/carabiner-dev/openeox",
            "direct": false,
            "version": "v1.0.0-pre.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/carabiner-dev/osv",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/carabiner-dev/policy",
            "direct": false,
            "version": "v0.5.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/carabiner-dev/predicates",
            "direct": false,
            "version": "v0.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/carabiner-dev/sbomfs",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/carabiner-dev/vcslocator",
            "direct": false,
            "version": "v0.4.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cenkalti/backoff/v5",
            "direct": false,
            "version": "v5.0.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cespare/xxhash/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/displaywidth",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/uax29/v2",
            "direct": false,
            "version": "v2.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cloudflare/circl",
            "direct": false,
            "version": "v1.6.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/common-nighthawk/go-figure",
            "direct": false,
            "version": "v0.0.0-20210622060536-734e95fb86be",
            "ecosystem": "go"
          },
          {
            "name": "github.com/coreos/go-oidc/v3",
            "direct": false,
            "version": "v3.18.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyberphone/json-canonicalization",
            "direct": false,
            "version": "v0.0.0-20241213102144-19d51d7fe467",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyclonedx/cyclonedx-go",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyphar/filepath-securejoin",
            "direct": false,
            "version": "v0.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": false,
            "version": "v1.1.2-0.20180830191138-d8f796af33cc",
            "ecosystem": "go"
          },
          {
            "name": "github.com/digitorus/pkcs7",
            "direct": false,
            "version": "v0.0.0-20250730155240-ffadbf3f398c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/digitorus/timestamp",
            "direct": false,
            "version": "v0.0.0-20250524132541-c45532741eea",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/cli",
            "direct": false,
            "version": "v29.5.3+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/docker-credential-helpers",
            "direct": false,
            "version": "v0.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/libtrust",
            "direct": false,
            "version": "v0.0.0-20160708172513-aabc10ec26b7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/emirpasic/gods",
            "direct": false,
            "version": "v1.18.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fatih/color",
            "direct": false,
            "version": "v1.19.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/github/smimesign",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/gcfg",
            "direct": false,
            "version": "v1.5.1-0.20230307220236-3a3c6141e376",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/go-billy/v5",
            "direct": false,
            "version": "v5.9.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-jose/go-jose/v4",
            "direct": false,
            "version": "v4.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/logr",
            "direct": false,
            "version": "v1.4.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/stdr",
            "direct": false,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/analysis",
            "direct": false,
            "version": "v0.25.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/errors",
            "direct": false,
            "version": "v0.22.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/jsonpointer",
            "direct": false,
            "version": "v0.23.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/jsonreference",
            "direct": false,
            "version": "v0.21.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/loads",
            "direct": false,
            "version": "v0.24.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/runtime",
            "direct": false,
            "version": "v0.32.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/runtime/server-middleware",
            "direct": false,
            "version": "v0.32.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/spec",
            "direct": false,
            "version": "v0.22.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/strfmt",
            "direct": false,
            "version": "v0.26.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag",
            "direct": false,
            "version": "v0.26.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/cmdutils",
            "direct": false,
            "version": "v0.26.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/conv",
            "direct": false,
            "version": "v0.27.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/fileutils",
            "direct": false,
            "version": "v0.26.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/jsonname",
            "direct": false,
            "version": "v0.26.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/jsonutils",
            "direct": false,
            "version": "v0.26.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/loading",
            "direct": false,
            "version": "v0.26.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/mangling",
            "direct": false,
            "version": "v0.26.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/netutils",
            "direct": false,
            "version": "v0.26.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/stringutils",
            "direct": false,
            "version": "v0.26.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/typeutils",
            "direct": false,
            "version": "v0.27.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/yamlutils",
            "direct": false,
            "version": "v0.26.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/validate",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-viper/mapstructure/v2",
            "direct": false,
            "version": "v2.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/goccy/go-json",
            "direct": false,
            "version": "v0.10.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gogo/protobuf",
            "direct": false,
            "version": "v1.3.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/groupcache",
            "direct": false,
            "version": "v0.0.0-20241129210726-2c02b8208cf8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/certificate-transparency-go",
            "direct": false,
            "version": "v1.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-cmp",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-containerregistry",
            "direct": false,
            "version": "v0.21.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/uuid",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/grpc-ecosystem/grpc-gateway/v2",
            "direct": false,
            "version": "v2.29.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-cleanhttp",
            "direct": false,
            "version": "v0.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-retryablehttp",
            "direct": false,
            "version": "v0.7.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/in-toto/in-toto-golang",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/inconshreveable/mousetrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jbenet/go-context",
            "direct": false,
            "version": "v0.0.0-20150711004518-d14ea06fba99",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jedisct1/go-minisign",
            "direct": false,
            "version": "v0.0.0-20260527172527-a09352b57a22",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kevinburke/ssh_config",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/compress",
            "direct": false,
            "version": "v1.18.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/cpuid/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-colorable",
            "direct": false,
            "version": "v0.1.15",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-isatty",
            "direct": false,
            "version": "v0.0.22",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-runewidth",
            "direct": false,
            "version": "v0.0.24",
            "ecosystem": "go"
          },
          {
            "name": "github.com/microsoft/go-winio",
            "direct": false,
            "version": "v0.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/nozzle/throttler",
            "direct": false,
            "version": "v0.0.0-20180817012639-2ea982251481",
            "ecosystem": "go"
          },
          {
            "name": "github.com/oklog/ulid/v2",
            "direct": false,
            "version": "v2.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/cat",
            "direct": false,
            "version": "v0.0.0-20250911104152-50322a0618f6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/errors",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/ll",
            "direct": false,
            "version": "v0.1.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/tablewriter",
            "direct": false,
            "version": "v1.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/go-digest",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/image-spec",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/openvex/go-vex",
            "direct": false,
            "version": "v0.2.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/package-url/packageurl-go",
            "direct": false,
            "version": "v0.1.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pjbgf/sha1cd",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/browser",
            "direct": false,
            "version": "v0.0.0-20240102092130-5ac0b6a4141c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/errors",
            "direct": false,
            "version": "v0.9.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.1-0.20181226105442-5d4384ee4fb2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/protobom/protobom",
            "direct": false,
            "version": "v0.5.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/protonmail/go-crypto",
            "direct": false,
            "version": "v1.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/regclient/regclient",
            "direct": false,
            "version": "v0.11.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rivo/uniseg",
            "direct": false,
            "version": "v0.4.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sassoftware/relic",
            "direct": false,
            "version": "v7.2.1+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/secure-systems-lab/go-securesystemslib",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sergi/go-diff",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/shibumi/go-pathspec",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/gitsign",
            "direct": false,
            "version": "v0.16.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/rekor",
            "direct": false,
            "version": "v1.5.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/rekor-tiles/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/sigstore",
            "direct": false,
            "version": "v1.10.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/timestamp-authority/v2",
            "direct": false,
            "version": "v2.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/skeema/knownhosts",
            "direct": false,
            "version": "v1.3.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spdx/tools-golang",
            "direct": false,
            "version": "v0.5.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": false,
            "version": "v1.0.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spiffe/go-spiffe/v2",
            "direct": false,
            "version": "v2.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/theupdateframework/go-tuf",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/theupdateframework/go-tuf/v2",
            "direct": false,
            "version": "v2.4.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/transparency-dev/formats",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/transparency-dev/merkle",
            "direct": false,
            "version": "v0.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ulikunitz/xz",
            "direct": false,
            "version": "v0.5.15",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xanzy/ssh-agent",
            "direct": false,
            "version": "v0.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/youmark/pkcs8",
            "direct": false,
            "version": "v0.0.0-20240726163527-a2c0da244d78",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/auto/sdk",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/metric",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/trace",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v3",
            "direct": false,
            "version": "v3.0.4",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.53.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/mod",
            "direct": false,
            "version": "v0.37.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.56.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/oauth2",
            "direct": false,
            "version": "v0.36.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sync",
            "direct": false,
            "version": "v0.21.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.46.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/term",
            "direct": false,
            "version": "v0.44.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.38.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/api",
            "direct": false,
            "version": "v0.0.0-20260608224507-4308a22a1bab",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/rpc",
            "direct": false,
            "version": "v0.0.0-20260608224507-4308a22a1bab",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/grpc",
            "direct": false,
            "version": "v1.82.0",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/warnings.v0",
            "direct": false,
            "version": "v0.1.2",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/klog/v2",
            "direct": false,
            "version": "v2.140.0",
            "ecosystem": "go"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 157,
        "direct_count": 18,
        "indirect_count": 139
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 119,
        "open_issues": 1,
        "closed_ratio": 0.667,
        "closed_issues": 2,
        "closed_unmerged_prs": 36
      },
      "bus_factor": 1,
      "bot_contributors": 3,
      "top_contributors": [
        {
          "type": "User",
          "login": "puerco",
          "commits": 261,
          "avatar_url": "https://avatars.githubusercontent.com/u/3935899?v=4"
        },
        {
          "type": "User",
          "login": "TomHennen",
          "commits": 5,
          "avatar_url": "https://avatars.githubusercontent.com/u/5216560?v=4"
        }
      ],
      "contributors_sampled": 2,
      "top_contributor_share": 0.981
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "go-build-and-test.yaml",
        "golangci-lint.yaml",
        "release.yaml"
      ],
      "has_docs_dir": false,
      "linter_configs": [
        ".golangci.yaml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "15 out of 15 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 10,
            "reason": "all changesets reviewed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 19 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 10,
            "reason": "all dependencies are pinned",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 10,
            "reason": "GitHub workflow tokens follow principle of least privilege",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 7,
            "reason": "3 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "bc7a4fa1405e5cad4bc9e5762a352954e4f1ac4c",
        "ran_at": "2026-07-23T01:16:45Z",
        "aggregate_score": 6.7,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-22T04:43:19Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-07-21T04:45:09Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 1,
          "created_at": "2025-02-11T06:55:56Z",
          "last_comment_at": "2026-06-05T18:47:19Z",
          "last_comment_author": "puerco"
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/carabiner-dev/bnd",
    "host": "github.com",
    "name": "bnd",
    "owner": "carabiner-dev"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 66,
      "inputs": {
        "security": 74,
        "vitality": 89,
        "community": 33,
        "governance": 59,
        "engineering": 70
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "excellent",
        "name": "Vitality",
        "value": 89,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "excellent",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 88,
            "inputs": {
              "commits_last_year": 230,
              "human_commit_share": 0.41,
              "days_since_last_push": 1,
              "active_weeks_last_year": 35
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 1 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "35/52 weeks with commits",
                "points": 24.2,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 35
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "230 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 230
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "releases_count": 18,
              "latest_release_tag": "v0.4.4",
              "releases_from_tags": false,
              "days_since_latest_release": 4,
              "mean_days_between_releases": 43.1
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "18 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 18
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 4 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 4
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~43.1 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 43.1
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "maintained",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 4,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "last human commit 4 days ago",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_maintained",
                    "params": {
                      "days": 4
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 33,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 18,
            "inputs": {
              "forks": 3,
              "stars": 10,
              "watchers": 1,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "10 stars",
                "points": 15.5,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 10
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "3 forks",
                "points": 2.5,
                "status": "partial",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "1 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 59,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 22,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 2,
              "top_contributor_share": 0.981
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 98% of commits",
                "points": 0.4,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 98
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "2 contributors",
                "points": 2.7,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 19 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "good",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 76,
            "inputs": {
              "merged_prs": 119,
              "open_issues": 1,
              "closed_issues": 2,
              "issue_closed_ratio": 0.667,
              "closed_unmerged_prs": 36
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "67% of issues closed",
                "points": 31.2,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 67
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "119/155 decided PRs merged",
                "points": 29.4,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 119,
                      "decided": 155
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "all changesets reviewed",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 55,
            "inputs": {
              "followers": 17,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "carabiner-dev",
              "public_repos": 58,
              "account_age_days": 562
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "17 followers of carabiner-dev",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 17,
                      "login": "carabiner-dev"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "58 public repos, account ~1 yr old",
                "points": 16,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 58
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 1
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/carabiner-dev/bnd"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 4
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 4 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 4
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "19 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 19
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 70,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 84,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "3 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yaml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "15 out of 15 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "moderate",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "topics": [
                "attestation",
                "attestations",
                "intoto",
                "signature-verification",
                "signatures",
                "sigstore",
                "slsa",
                "slsa-provenance"
              ],
              "has_wiki": false,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": false,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "8 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 8
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "good",
        "name": "Security",
        "value": 74,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": null,
            "notes": [],
            "value": 67,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 18,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 0,
              "scorecard_aggregate": 6.7
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "15 out of 15 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "all changesets reviewed",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 19 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "all dependencies are pinned",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "GitHub workflow tokens follow principle of least privilege",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "3 existing vulnerabilities detected",
                "points": 5.2,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 157 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories",
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 157
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 3,
              "affected_packages": 3,
              "assessed_packages": 157,
              "unassessed_packages": 0,
              "affected_by_severity": "critical 1, unknown 2",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 157,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 5
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 63,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "critical",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 26,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.488,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "20 of 41 human commits state their intent (structured subject or explanatory body)",
                "points": 26,
                "status": "partial",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 20,
                      "sampled": 41
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "excellent",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0.31
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "go.mod (toolchain convention, no task runner)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "toolchain_convention",
                    "params": {
                      "files": "go.mod"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yaml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "31 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 31,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "all dependencies are pinned",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 15227,
              "source_files_sampled": 36,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/36 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 36,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [],
              "has_mcp_signal": false,
              "api_schema_files": [
                "proto/carabiner/supplychain/v1/supplychain.proto"
              ]
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": "proto/carabiner/supplychain/v1/supplychain.proto",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "proto/carabiner/supplychain/v1/supplychain.proto"
                    }
                  }
                ],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-23T01:17:04.172492Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/c/carabiner-dev/bnd.svg",
  "full_name": "carabiner-dev/bnd",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}