).\n- Docs references updated\n\n---------\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "ci: remove share/spack/qa/run-unit-tests wrapper (#52747)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-17T13:17:46Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "2553607cba2b99276ff38f36865fa5ad7697f558", "body": "`all` is a catch-all key, not a spec: `satisfies(\"all\")` triggered a\npackage lookup on every `path_for_spec` call to check whether `all` is a\nvirtual provided by the spec.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "projections: check the \"all\" before satisfies (#52743)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-17T09:50:32Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "7ae0f5f28121c1f3a92f9bffcf0f1192872a69ed", "body": "Some tests resolved packages without a repo fixture and imported\n`spack_repo.builtin` instead\n\n`mirror.py` and `url_fetch.py` tests mutated the class-level `versions`\ndict of\ncached package classes in place. Use `monkeypatch.setitem` so the mock\narchive\nURL does not leak into later tests.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "tests: fix stateful tests (#52744)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-17T09:46:27Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "b9c2a77e26f764fe6dcefd139b45e0f87185d53d", "body": "If env activate is the first to touch the lazy `spack.repo.PATH`\nsingleton, the\nsaved `repo_token` materializes only after the env scope is pushed, so\ndeactivate restores the env's own repositories. Same bug as\n8bdac91611a6.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "env activate: ensure_unwrapped before swap (#52745)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-17T09:45:24Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "21577db5686ff231631b304b69c232ade43d99eb", "body": "Extract the reference to the globally active environment into a new\nlow-level module `spack.active_environment`, and make it the only way to\nobtain the active environment:\n\n from spack.active_environment import active_environment\n\n env = active_environment()\n\nThis makes the dependency on globa\n[…]\nokup`\nand `spack.environment`.\n\nBy also making `Environment.activate` a method, we also eliminate the cyclic\nimport with `subprocess_context.py`.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "active_environment.py: extract from environment (#52731)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-17T09:27:22Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "ec7a9bac94e97c4519414c4836fdd745d2e04737", "body": "The leftover `%` after the f-string caused a type error instead of the\nintended\nexception when a namespace is invalid.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "repo.py: fix TypeError when raising InvalidNamespaceError (#52689)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-17T08:54:32Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "526fd687c72c326c5f6b3f3ac87a6c0476c5a1aa", "body": "…for spliced specs (#52665)\n\n`spec_dict_to_json` avoids making yet another node identifier for specs\nby using DAG hashes, but it neglected to cache them bottom-up. If there\nare many abstract specs in a DAG/env/etc., this means we get exponential\nrecomputation of hashes. This could cause extremely lo\n[…]\na traversal bug where\nreused spliced specs can have dangling hashes. Avoid spliced specs for\nnow and just disable caching for them since they are rare.\n\nSigned-off-by: Todd Gamblin \u003ctgamblin@llnl.gov>", "is_bot": false, "headline": "concretization cache: fix exponential time complexity issue; disable …", "author_name": "Todd Gamblin", "author_login": "tgamblin", "committed_at": "2026-07-17T08:46:40Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "0fe003d068e00450c4862e40ba317e8335deb6fc", "body": null, "is_bot": false, "headline": "Fix spack isolate --self (#52725)", "author_name": "John Gouwar", "author_login": "JohnGouwar", "committed_at": "2026-07-15T19:53:46Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "b542f6acd0d72428bfe82ed25f2314e31b8e188a", "body": "Merge-queue style error (one PR removed a fixture, another added some\ntests that used it): this updates the added tests.\n\nSpecifically: replace default_mock_concretize in new tests from 9e527f7b\nfollowing 5c13da4c54\n\nSigned-off-by: Peter Scheibel \u003cscheibel1@llnl.gov>", "is_bot": false, "headline": "Fix tests on develop (#52742)", "author_name": "Peter Scheibel", "author_login": "scheibelp", "committed_at": "2026-07-15T18:25:47Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "94231de440f4261c21f59ad18e702974172fa755", "body": "Fixes a couple issues from 18f807e, which introduced ACL-based\npermission handling to Spack on Windows.\n\nCurrent ACL operations assumed that files were available with\nWRITE_OWNER permissions, as that is the default state of files when\ncreated by the OS. However if Spack or another program has alread\n[…]\npermissions\nto newly-installed files in package builds) is updated to add\nnecessary permissions for files that were previously omitted.\n\n---------\n\nSigned-off-by: John Parent \u003cjohn.parent@kitware.com>", "is_bot": false, "headline": "Windows: fixes to ACL-based permissions handling (#52726)", "author_name": "John W. Parent", "author_login": "johnwparent", "committed_at": "2026-07-15T16:56:44Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "9e527f7b49679648fa8d1be816a1ab7d89ba896d", "body": "Replace the `highlight_version_fn` and `highlight_variant_fn` parameters\nof `Spec.format()` returning a Boolean with three style callbacks that\nreturn the `PartStyle` enum.\n\nThis enum can currently take four values:\n1. NORMAL\n2. HIGHLIGHT\n3. DIM\n4. HIDDEN\n\nHIGHLIGHT currently renders that spec part in red. DIM renders the part\nin grey-out color. HIDDEN suppresses it entirely from the output.\n\nSigned-off-by: Massimiliano Culpo \u003cmassimiliano.culpo@gmail.com>", "is_bot": false, "headline": "spec: replace highlight callbacks with style-based callbacks (#52211)", "author_name": "Massimiliano Culpo", "author_login": "alalazo", "committed_at": "2026-07-15T16:02:16Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "9ac52784576023d50cb05e25096cec72296e9ae6", "body": "`spack list --format ...` ran `git config --get remote.origin.url` and\n`git rev-parse` for every package to build the source link in the html\nand json output.\n\nInstead of querying git, derive the url from the `repos:` configuration.\nA RemoteRepoDescriptor already knows the authoritative git url it c\n[…]\nke the tests work, `use_repositories` needs to preserve the Repo\ninstance instead of \"serializing\" to config and then reconstructing from\nconfig.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "cmd/list: resolve git info once per repo (#52713)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-15T14:04:06Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "c6603435671004d9eabd4a9b1f1d665f194dcdc6", "body": "* when caching is disabled, do not compute a multi-megabyte cache key\n string redundantly\n* do not attempt to remove comments, as they account for only ~2% of the\n size, and are unlikely to change without other changes in ASP\n rules/facts that invalidate the cache.\n* restore use of in-place `rand\n[…]\nthe `ordering` timer phase\nof `spack solve --timers` drops from ~158ms to ~36ms.\n\nIt's minor, but it's both shorter in implementation and faster.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "asp.py: speed up cache key (#51861)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-15T13:57:47Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "5d520228c138a87b3b6a43fa78767ce4a3a3f9fd", "body": "Discovered from spurious failures of:\n- test_module_function_change_env_with_module_src_cmd\n\nWhen `MODULESHOME` is set, module() prepends `source\n$MODULESHOME/init/bash` to the command whose merged stdout/stderr is\nparsed as awk's NUL-separated `NAME=VALUE` dump.\n\nThat sourcing was not output-suppre\n[…]\nissing its output can land ahead of the dump in the captured stream,\nwith no NUL separator, corrupting the first parsed variable name.\n\nSigned-off-by: Massimiliano Culpo \u003cmassimiliano.culpo@gmail.com>", "is_bot": false, "headline": "module: suppress output from sourcing init file (#52740)", "author_name": "Massimiliano Culpo", "author_login": "alalazo", "committed_at": "2026-07-15T12:37:09Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "ceb0009ce40146f9ab9bc478978c0ca5517b462e", "body": "This adds 3 independent fixes to reduce syscall overhead during pytest,\nwhich is presumably what makes tests run slow in CI, since concretizer\ncache was not very significant.\n\nThis is some of the low-hanging fruit based on profiling data.\n\n- **tests: drop per-test purge of spack_repo modules**\n- **tests: build git fixture repos once per session**\n- **tests: restore mutable_database in-memory tarball**\n\n---------\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "tests: reduce syscalls (#52736)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-15T12:05:38Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "e8d3d363a61495870dca747d2840a7e39bf1308a", "body": "Currently, on systems where the host target is not supported by the\ndefault compiler, Spack tries to swap compilers in order to optimize for\nthe target.\n\nThis situation is unfrequent, but the behavior is surprising - if GCC is\nthe preferred compiler users would prefer to see a lower target than\nhave\n[…]\nizations below compiler selection\n\nAs a bonus, we also improved the output for the optimization criteria,\nwhich are now shown grouped:\n\nSigned-off-by: Massimiliano Culpo \u003cmassimiliano.culpo@gmail.com>", "is_bot": false, "headline": "solver: deprioritize target selection (#52654)", "author_name": "Massimiliano Culpo", "author_login": "alalazo", "committed_at": "2026-07-15T08:57:23Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "ac21ee03b84d6b2a6afee1ef1fe63ac982c2c49a", "body": "Several unit tests performed DNS lookups and connections:\n\n- `test_ci_dynamic_mapping_*`: the buildcache-destination mirror\n `https://my.fake.mirror` was probed with an HTTPS HEAD request during\n ci generate (`url_exists` on the index). Use a local `file://` mirror.\n- `test_ci_rebuild_mock_success\n[…]\nk_fetch`, so every build child\n process fetched `http://www.example.com/...tar.gz` for each package in\n the DAG (27 fetches). Add `mock_fetch`.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "tests: no networking in unit tests (#52737)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-15T08:56:54Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "de4dd3a4226615f89c666b25d8b6023c568d863e", "body": "Previously only the database lock respected --disable-locks.\n\nSigned-off-by: Massimiliano Culpo \u003cmassimiliano.culpo@gmail.com>", "is_bot": false, "headline": "Make all locks respect `--disable-locks` (#52270)", "author_name": "Massimiliano Culpo", "author_login": "alalazo", "committed_at": "2026-07-15T08:10:19Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "abbcc3efa716b6e567fa81462e17a4bdadbfbb53", "body": "Signed-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "tests: installer_variant on windows (#52738)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-15T06:18:36Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "bc83af5a54cee6cd9f85256862a895cf560e8ab0", "body": "Remove return that is never used, no need to allocate memory for\nnothing.\n\nSigned-off-by: Ryan Krattiger \u003cryan.krattiger@kitware.com>", "is_bot": false, "headline": "Remove return of fingerprints that is never used (#52699)", "author_name": "Ryan Krattiger", "author_login": "kwryankrattiger", "committed_at": "2026-07-14T18:26:40Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "40700770e94a5912122242c2d5eb698eb6820a6b", "body": "These mock packages compiled elaborate C++ sources at install time. The\nonly thing the tests care about is that the resulting binaries embed\ntheir install paths as constants and rpaths.\n\nUsing C makes the tests run faster and drops a dependency.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "builtin_mock: use C sources in garply/quux/corge (#52719)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-14T13:55:48Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "76ba0bff9bf74076e35f46aa5e72c4d83ffea873", "body": "Use the fullname when computing patches to apply to a spec to ensure\ncorrect patching list is selected.\nIf users are specifying a lower precedent repo with a different patch\nlist then missing patch errors are triggered.\n\nSigned-off-by: Phil Sakievich \u003cpsakievich@gmail.com>", "is_bot": false, "headline": "spec: use fullname when computing patches (#52675)", "author_name": "Phil Sakievich", "author_login": "psakievich", "committed_at": "2026-07-14T13:50:45Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "5c13da4c5432b78becf1718fa89ac853e450e3bd", "body": "`default_mock_concretization` caches input spec -> concrete spec without\ntaking into account changes in config and is thus limited to the default \ntest configuration without mutation. \n\nHere we use the proper concretization cache instead, which doesn't suffer\nfrom these limitations and also works across xdist processes.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "tests: retire default_mock_concretization (#52723)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-14T13:46:17Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "4e02454296ee66c75ae852c1acbb5cf9c00a9a67", "body": "This adds `pytest --spack-concretization-cache=DIR` which can be used in\ndevelopment as well as CI to speed up unit tests.\n\nThe solver dominates unit-test CPU time, and roughly half of the ~3000\nASP problems solved in a full suite run are repeats of an earlier one.\n\nAdd a pytest plugin that enables \n[…]\nning misses are problems that embed per-invocation\ntemporary paths. Default behavior without the option is unchanged\n(cache disabled).\n\n---------\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "tests: add concretization cache plugin (#52717)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-14T13:00:58Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "b86f1b889fefd3dbd9ac359e86555e43461d78e1", "body": "This should give better load balancing under xdist\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "tests: use --dist worksteal (#52711)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-14T12:13:54Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "f914f5fc9aae5e6e8b0b62858e77efb026250c0a", "body": "Workaround for \"Conditional specs do not round trip as dict #52720\".\n\nThat issue should be fixed independently, but I don't see why\nthe concretization cache swaps the user input for the abstract spec\nfrom a file. It feels like it could result in more subtle issues, so\nthis commit avoids possible future issues.\n\n---------\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "concretization cache: use user input spec (#52716)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-14T12:03:22Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "79b4e71c341750a0f67ab6ce94b6f2e9b00360ef", "body": "Restructure the installer tests to follow the recent source restructure.\n\nThe old_ prefix refers to old implementation specific unit tests,\n`install.py` is for integration tests that can in principle parametrize\nthe installer, and `installer/` is about the new installer's\n`spack.installer` package.\n\nWith this, `pytest lib/spack/spack/test/installer/` runs 224 unit tests\nin 7.5ms per test on my desktop.\n\n---------\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "test/installer: new layout, split unit/integration (#52692)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-14T11:47:00Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "084e490a1999468fa0cf8a1858326c2bb62e9d33", "body": "`use_platform` called `spack.config.CONFIG.clear_caches()` through an\ninline\nimport, resulting in a circular dependency.\n\nInvert the dependency: `spack.platforms` exposes a list of\non-host-changed\ncallbacks, and `spack.config` registers its cache clearing there.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "platforms: break cycle with spack.config (#52730)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-14T10:32:11Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "6990b3c0e10273488331a489eea62e5f31891caa", "body": "The filter_padding context manager was the only thing in spack.util.path\nthat needed spack.config: it reads config:install_tree:padded_length.\nPadding is an install-tree concept, so move it to spack.store, which\nalready imports config and util.path. The pure padding_filter callables\nstay in util/pat\n[…]\ndy does this better, the old installer should\nreally ask\nthe store for its current config, but I don't want to make changes to\nthe old\ninstaller.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "util/path.py: break cycle with spack.config (#52733)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-14T10:08:41Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "00b7c12038de59d84524e90bbb93ced1dc0a9fa5", "body": "…52658)\n\n`Spec.installed`, `Spec.installed_upstream`, `Spec.install_status` read\nthe global store from inside the `property` or method. This is bad\ndesign for two reasons:\n1. A dependency on `STORE` is hidden behind a property, and more\nimportantly\n2. It should not be a concern of the `Spec` to know\n[…]\nec as\nargument.\n\nThe `Spec.installed` and `Spec.installed_upstream` properties will be\nremoved in a dedicated follow-up PR.\n\n---------\n\nSigned-off-by: Massimiliano Culpo \u003cmassimiliano.culpo@gmail.com>", "is_bot": false, "headline": "Spec: remove the `.installed` and `.installed upstream` properties (#…", "author_name": "Massimiliano Culpo", "author_login": "alalazo", "committed_at": "2026-07-14T08:56:34Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "2aa12f2ac0c65c9c3184bce3cd2d20dac21825d4", "body": "This commit removes `Spec.spack_install` and `Spec.spack_root` and\nreduces the places where `Spec` needs `STORE`.\n\nRemoval seems safe for the following reasons:\n- Neither token is used by any config, module template, package recipe,\nview/install-tree projection, or .rst doc anywhere in the tree. The\n[…]\nview/module/stage), so it is redundant or breaks the join.\n\nIt was added in #120 as SPACK_INSTALL without any discussion of use cases.\n\nSigned-off-by: Massimiliano Culpo \u003cmassimiliano.culpo@gmail.com>", "is_bot": false, "headline": "Spec: remove `spack_root` and `spack_install` properties (#52722)", "author_name": "Massimiliano Culpo", "author_login": "alalazo", "committed_at": "2026-07-14T08:46:22Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "e5fdefe5a0e3f1e0b1622010efe5b937fa3f3d17", "body": "External compilers failed to concretize when they had dependencies.\n\nThe problem originated from how compilers were parsed from config. \nCompilers were previously filtered _before_ processing externals, leading\nto cases where non-compiler externals were not parsed and thus not \nconsidered as valid d\n[…]\narsing all externals.\n\nSigned-off-by: John Gouwar \u003cjgouwar@gmail.com>\nCo-authored-by: JohnGouwar \u003cJohnGouwar@users.noreply.github.com>\nCo-authored-by: Massimiliano Culpo \u003cmassimiliano.culpo@gmail.com>", "is_bot": false, "headline": "Fix external compilers with dependencies. (#52644)", "author_name": "John Gouwar", "author_login": "JohnGouwar", "committed_at": "2026-07-13T18:42:43Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "19c68e2eb55b2dad2de06d5ac7f6878ce28be5f1", "body": "* Use scandir to make `is_file()` free\n* Use tell-dont-ask to avoid both redundant stat calls and TOCTOU issues\n* Remove a test that tests an implementation detail about skipping a store\n if the entry exists, which only happens during a race of two processes,\n which is already a lock free atomic operation.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "concretization cache: avoid redundant syscalls (#52721)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-13T18:26:40Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "8f27c70881f8618a7f1c1bf138b3825ba7c0f513", "body": "Concretization cleanup was called after every solve, listing and\nstat'ing every cache entry each time even though it early-returns under\nthe entry limit.\n\nAs part of enabling cache under unit tests, I found that it runs ~5\nmillion stat calls resulting in 52 seconds of CPU time.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "concretization cache: prune only after write (#52715)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-13T18:24:17Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "74bf8031f4e21526489016471f1cea022c5a0596", "body": "This + a refactor of module writers is enough to run tests in a randomized order per test (not\njust per module).\n\nTested by running tests 6 times in random order.\n\n---------\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "tests: allow randomized order (#52710)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-13T13:32:01Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "10371204e9f758797c419ff87c0566523c5d5b40", "body": "This PR replaces a class level cache with a DI cache. In this way a\ncache cannot outlive a single \"logical operation\" and no manual clearing\nis ever needed in tests.\n\nSigned-off-by: Massimiliano Culpo \u003cmassimiliano.culpo@gmail.com>", "is_bot": false, "headline": "modules: replace class level cache with DI cache (#52718)", "author_name": "Massimiliano Culpo", "author_login": "alalazo", "committed_at": "2026-07-13T13:22:07Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "07ab9c4706fcfc2aae87d9e5b32c0e2d95b31311", "body": "Serializing an abstract spec with a partial architecture like\n`os=redhat6` or `platform=test` crashes with an error like\n\n```\nAttributeError: 'NoneType' object has no attribute 'vendor'\n```\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "ArchSpec: fix to_dict/from_dict for abstract specs (#52714)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-13T10:57:45Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "c6ac90d5b4c3dd2523e6259a2f1637e61da6629c", "body": "The parallel-package-a/b/c mock packages slept 2, 6 and 2 seconds in\ntheir install method to simulate build duration.\n\nThis property is not used in tests :).\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "builtin_mock: remove sleep from parallel-package (#52712)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-13T09:06:31Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "9c810ad62e45d2dee3f073ed6495270313d9f03a", "body": "`CONFIG.set(path_or_scope, value, scope=scope_name)` can raise an\nexception, and then the temporary scope isn't removed.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "config.py: don't leak scope when override fails (#52709)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-13T07:58:03Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "8bdac91611a6bfcb2dd173274e575f8433786835", "body": "When `use_repositories` was the first thing in the process to touch the\nlazy spack.repo.PATH singleton, PATH was materialized from\nspack.config.CONFIG *after* the new repos scope was already pushed.\n\nThe \"saved\" old repo was then the new repo itself, and on exit it would\nrestore the repositories it was supposed to remove.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "use_repositories: ensure_unwrapped before swap (#52696)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-11T07:48:35Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "1145dfd34c74c2a8f9ca5800ae7ea937a6447447", "body": "Extracted from #52117 \n\nAdd method to extract the spec hash from a manifest name.\n\n---------\n\nSigned-off-by: Ryan Krattiger \u003cryan.krattiger@kitware.com>", "is_bot": false, "headline": "Build cache: Add decompose manifest name function (#52683)", "author_name": "Ryan Krattiger", "author_login": "kwryankrattiger", "committed_at": "2026-07-10T19:05:00Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "194757edf2c4db36d368e8b8372e2113a2620953", "body": "Pass `extra_args` as named parameters\nHandle if_match using put_object\n\n---------\n\nSigned-off-by: Ryan Krattiger \u003cryan.krattiger@kitware.com>", "is_bot": false, "headline": "Fixes for web_util.push_to_url (#52682)", "author_name": "Ryan Krattiger", "author_login": "kwryankrattiger", "committed_at": "2026-07-10T16:47:48Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "b53d5ec3ae3de53d8b772ec027f8cdf5301e7501", "body": "Small readability cleanups in the terminal UI of the new installer. No\nchange in behavior intended.\n\n---------\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "new installer: UI cleanups (#52690)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-10T14:21:07Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "acb0321a44f7a8051b7222b6b5be4cb3e520d3bf", "body": "fixes #14011\n\n---------\n\nSigned-off-by: Massimiliano Culpo \u003cmassimiliano.culpo@gmail.com>", "is_bot": false, "headline": "documentation: add hints hon how to get a Fortran compiler (#52680)", "author_name": "Massimiliano Culpo", "author_login": "alalazo", "committed_at": "2026-07-10T14:16:26Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "120ac6f605868036b43c9a4f8182ed57758eabb2", "body": "Flags were previously injected when `%[deptypes-build]\u003ccompiler>` but in\na few cases a possible compiler is used only as a library. This rule now\nis gated on the virtual being provided, which solves the original issue.\n\nThere are still issues when two compilers bearing flags are used for\ndifferent l\n[…]\nxisting and\ndifficult to solve cleanly since there are flags which are language\nagnostic (`cppflags`, `ldflags`, `ldlibs`).\n\n---------\n\nSigned-off-by: Massimiliano Culpo \u003cmassimiliano.culpo@gmail.com>", "is_bot": false, "headline": "solver: only inject compiler flags when used as a compiler (#52672)", "author_name": "Massimiliano Culpo", "author_login": "alalazo", "committed_at": "2026-07-10T12:42:17Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "fbff43beb248e643716f0ce0f072f9415eda61ac", "body": "…gle virtual spot (#52641)\n\n**Before**\n```console\n$ spack spec caliper +papi %c,cxx,fortran=llvm ^papi %c,cxx,fortran=gcc\n==> Error: Spack concretizer internal error. Please submit a bug report at https://github.com/spack/spack and include the command and environment if applicable.\n caliper+papi \n[…]\n concrete, compilers are allowed for the cxx language\n 6. Only external, or concrete, compilers are allowed for the c language\n```\n\nSigned-off-by: Massimiliano Culpo \u003cmassimiliano.culpo@gmail.com>", "is_bot": false, "headline": "solver: better error message when multiple provider compete for a sin…", "author_name": "Massimiliano Culpo", "author_login": "alalazo", "committed_at": "2026-07-10T12:39:17Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "9713b53dc3360376fe32955239dedf62af83a513", "body": null, "is_bot": false, "headline": "docs: update code formatter (#52671)", "author_name": "Richarda Butler", "author_login": "RikkiButler20", "committed_at": "2026-07-10T11:00:54Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "668d4b2b26ea88f4f9b5876c427b1c75a7dc3c4f", "body": "* Move `new_installer*.py` to `installer/*.py`\n* Split up `new_installer.py` into ui, schedule, ...\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "spack.installer: sub-package for new installer (#52677)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-10T09:36:28Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "d51ea840ea10c6b18e57be6276a9176dab5677e4", "body": "Prep work to move the new installer to `spack.installer`\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "spack.installer -> spack.old_installer (#52673)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-10T08:43:36Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "13eaa1428115e594bcf62afac6701b2e2efb7109", "body": "Tests enabled by the preceding refactors: the event loop is tested\nwith an injected UI instance and build launcher.\n\nAlso cover the schedule_builds prefix invariant errors, PosixJobServer\nattaching to an existing jobserver from MAKEFLAGS, and a few small\nTerminalUI rendering branches.\n\nIt enables al\n[…]\nime per test is\n40ms.\n\nThe remainder is `start_build` etc, which isn't well suited for unit\ntesting, and is already covered by integration tests.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "new_installer.py: enable/add unit tests (#52642)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-09T16:30:40Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "24ecb489befa7d8ddf4ac6163c3d30819ad85915", "body": "This makes it possible to test the event loop without launching actual\nsub-processes.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "new_installer.py: use DI for build launcher (#52674)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-09T13:15:48Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "edff30d7763507f430f987f4c717a0c499497577", "body": "Replace BuildStatus, which mixed terminal rendering with event loop\nbookkeeping, with an explicit UI class:\n\n- InstallerUI defines the interface between the event loop and a\nfrontend. Event loop -> UI notifications are methods that receive plain\n data; they are no-ops in the base class, which there\n[…]\nerminal frontends.\n\nThis commit is pure refactor, unit tests for the event loop are added\nwhen the\nbuild \"launcher\" is also decoupled.\n\n---------\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "new_installer.py: decouple ui from event loop (#52661)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-09T11:06:39Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "97362fd96df5fb619a99b04882e8ed717242c945", "body": "fixes #7487\n\nBefore we were incorrectly using `constraint in spec` instead of\n`spec.satisfies(constraint)`, which would cause double matches when full\nnames are used. Fix that and add a regression test.\n\n---------\n\nSigned-off-by: Massimiliano Culpo \u003cmassimiliano.culpo@gmail.com>", "is_bot": false, "headline": "modules: fix spec matching with suffixes (#52669)", "author_name": "Massimiliano Culpo", "author_login": "alalazo", "committed_at": "2026-07-09T07:25:14Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "18f807ec69a7b70169ff0bedd8717701de4933f2", "body": "File permissions are handled differently on Windows vs. Linux. This\nPR adds an interface to the Windows model of file permissions. A few\nhigh-level methods in Spack that modify file permissions (e.g.\nsetting 755 permissions on the install prefix) have been updated to\nuse this interface.\n\nWindows als\n[…]\ne, so without the changes in this PR,\nthere are some cases where we would be unable to set read/write with\nsomething like chmod at all.\n\n---------\n\nSigned-off-by: John Parent \u003cjohn.parent@kitware.com>", "is_bot": false, "headline": "Windows: Model Access Control Lists (ACLs) (#51903)", "author_name": "John W. Parent", "author_login": "johnwparent", "committed_at": "2026-07-09T01:40:42Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "6f2e9a5f08a0006b89e383ae917e40a44a458777", "body": "Apply ruff PLR0402 across non-vendored files: rewrite `import a.b as b`\nas `from a import b`.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "style: explicit from-import instead of import-as (#52592)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-07T13:28:40Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "ccebd9c6ccc2a586251f67a0dee0921d45722e36", "body": "In recent python `[x for x in xs]` is lowered to an append-loop, which\nis faster than the generator (two frames, fewer allocs).\n\nApply ruff C400/C401/C402 across non-vendored files: turn list/set/dict\naround a generator expression into the corresponding comprehension.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "style: drop unnecessary generators (#52591)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-07T13:28:19Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "351c8bff8c6a0617ee7f5d02d236f05483b07a08", "body": "Signed-off-by: Gregory Becker \u003cbecker33@llnl.gov>\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>\nCo-authored-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "Move spack.llnl.util.tty to spack.util.tty (#52513)", "author_name": "Greg Becker", "author_login": "becker33", "committed_at": "2026-07-07T11:44:42Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "2b1bf3d33eb2f226610dac7a261721f2f06c1d4f", "body": "The check was initially added in #5580 for the old concretizer, and was purely about not changing properties of already installed specs for the old-concretizer. It was modified to be used only when deconcretizing shortly after in #5634. Since the old concretizer was deleted in #45215, nothing deconcretizes a spec as a side effect of concretizing something else.\n\nSigned-off-by: Massimiliano Culpo \u003cmassimiliano.culpo@gmail.com>", "is_bot": false, "headline": "spec.py: make `_mark_concrete` independent of install status (#52663)", "author_name": "Massimiliano Culpo", "author_login": "alalazo", "committed_at": "2026-07-07T10:26:00Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "1fe0675236d33f4a21649fac43d5c1c59073c3b5", "body": "In #52627 we forgot to update the `_main` function, which duplicates\npart of env.activation.\n\nHere we:\n- Fix the issue introduced in #52627\n- Add a unit test to avoid regression\n- Deduplicate the code to keep CONFIG.env_path in sync with `_activate`\n\n---------\n\nSigned-off-by: Massimiliano Culpo \u003cmassimiliano.culpo@gmail.com>", "is_bot": false, "headline": "Fix bug with `$env` substitution (#52666)", "author_name": "Massimiliano Culpo", "author_login": "alalazo", "committed_at": "2026-07-07T09:55:37Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "437e8c87bcc099bcc63b463e28c6b8ff68fe4366", "body": null, "is_bot": false, "headline": "Remove CUDA-related variables from build environment (#52589)", "author_name": "Seth R. Johnson", "author_login": "sethrj", "committed_at": "2026-07-06T20:35:55Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "a31c502509bbe53e1dfe04a775784cb9996b5726", "body": "The `mkstemp` + `rename` pattern is used in various places in Spack,\nwhich is a reasonable way to get a new file in a given directory to \natomically replace a target file. \n\nThe downside is that it doesn't respect umask, cause it's supposed \nto be \"safe\" too (mode 0600).\n\nThat was realized in #52369\n[…]\nnd\nthe temporary file is removed on failure.\n\nCall sites can still do an `fchmod` on the yielded file.\n\n(Not part of `spack.package` fortunately)\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "filesystem.py: improve `write_tmp_and_move` and use throughout (#52653)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-06T12:03:18Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "ef42679b6f123a2836404fc25b9d3b8b45f7210e", "body": "Extracted from #52642 \n\nConsistently use a single Store instance, instead of a mix of DI\ninstance vs global.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "new_installer.py: dependency injection of Store (#52657)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-06T07:18:19Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "dc0627b24b1b941895af2f3af4b0371b35a1c86e", "body": "Modifications:\n\n1. Move state buffers to their natural home\n2. Get rid of the odd `ChildInfo(DatabaseAction)`\n\n---------\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "new_installer.py: refactor child info / state buffer (#52656)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-06T07:13:40Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "67e1c9a9442be778268cbb324451dfea0a8bf857", "body": "The new installer builds the temp log-file path with\n`tempfile.mkstemp(prefix=f\"spack-stage-{spec.name}-{spec.version}-...\")`.\nFor git-ref versions containing a slash (e.g.\n`git.release/shs-13.1.0=13.1.0`, used by `cassini-headers`,\n`cxi-driver`, `libcxi`), the `/` is treated as a directory separato\n[…]\nlease/shs-13.1.0=13.1.0\nError: [Errno 2] No such file or directory: '.../spack-stage-cassini-headers-git.release/shs-13.1.0=...-....log'\n```\n\nSigned-off-by: Till Ehrengruber \u003ctill.ehrengruber@cscs.ch>", "is_bot": false, "headline": "new_installer: sanitize version string in log file path (#52660)", "author_name": "Till Ehrengruber", "author_login": "tehrengruber", "committed_at": "2026-07-06T06:47:04Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "e2e5041cc1813b8a57a0acedd580f3bb6d80ba25", "body": "…and (#52655)\n\n`spack solve` is deprecated in favor of options on `spack spec`.\nClean up all references and uses in CI.\n\nSigned-off-by: Gregory Becker \u003cbecker33@llnl.gov>", "is_bot": false, "headline": "Remove all usage and docs references to deprecated `spack solve` comm…", "author_name": "Greg Becker", "author_login": "becker33", "committed_at": "2026-07-03T18:37:45Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "c1fdef46c84f062882e042a689c2fed48e59d0b6", "body": "Check when validating input if any virtual assignment corresponds to\nvirtuals the package cannot depend on.\n\nSigned-off-by: Massimiliano Culpo \u003cmassimiliano.culpo@gmail.com>", "is_bot": false, "headline": "solver: improve input checking for virtuals (#52645)", "author_name": "Massimiliano Culpo", "author_login": "alalazo", "committed_at": "2026-07-03T12:57:09Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "913c85673a3ce076ef905489826d3f9d8adb7e54", "body": "The new installer has a strict check that ensures uninstalled specs\nupstream cannot be built locally.\n\nIn practice, also thanks to the new installer, build dependencies can be\nmissing in the upstream. Some people use `spack gc`, others prepare the\nupstream using `spack install` from a buildcache, wh\n[…]\n\n\nSo: the installer simply installs the missing specs locally, and when users\nmanage their upstream correctly this is unlikely to be problematic.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "new_installer.py: allow local install if missing upstream (#52630)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-03T12:46:16Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "b94f544a06c808220b6d8ab352ce106b66e187e0", "body": "When installing a spec explicitly that was already installed implicitly,\nthe action is just to mark it explicit in the database.\n\nThat works fine, but the order of operations is suboptimal. Currently\nyou get stuck in `select` on nothing, which means a second of delay, or\nfive seconds in non-interactive mode.\n\nThis commit improves ordering so it's instant when no other process\nholds a database lock.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "new_installer.py: flush DB before select (#52646)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-03T09:46:54Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "b5b06bc036896af346e9ca16ac1183af4333eed7", "body": "The input file\n[py-hatchet.lp.zip](https://github.com/user-attachments/files/29584567/py-hatchet.lp.zip)\nis solving very slow ly on 741ddafc339a0b2fde871d29be07d884a4d779a3, and\n`clingo` stalls trying to prove optimality of the \"build unification sets\" criterion.\n\nIn this PR we:\n- Adapt heuristics so that we decide on `build_set_id` early\n- Trim the search space by imposing a no-gap rule on build set ids\n\n---------\n\nSigned-off-by: Massimiliano Culpo \u003cmassimiliano.culpo@gmail.com>", "is_bot": false, "headline": "solver: improve decisions on `build_set_id` (#52634)", "author_name": "Massimiliano Culpo", "author_login": "alalazo", "committed_at": "2026-07-03T06:34:49Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "107e64610708824fa34afdacf17c89bc18f80692", "body": null, "is_bot": false, "headline": "new_installer.py: import error on wrong platform (#52647)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-02T22:34:08Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "2ec794aa32d627423ae829405e008b18ae75ba7c", "body": "The install tests used nixlog, which is heavy machinery to do something\nlike `... | tee test.log`: it spawns a daemon process (even two under\nforkserver), inside a build process that is already redirected. The\njobserver daemon it created also kept the write end of the new\ninstaller's output pipe ope\n[…]\ndio` fd juggling, used by nixlog,\n threadlog and the new installer's Tee\n\nThe log_output unit tests now run against both nixlog and threadlog.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "install_test.py: do not use multiprocessing for IO (#52618)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-02T21:42:44Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "5e11d599159afe2b22fb4971e07f9ed5b9ee25ee", "body": null, "is_bot": false, "headline": "Fix warning message construction (#52638)", "author_name": "Massimiliano Culpo", "author_login": "alalazo", "committed_at": "2026-07-02T19:28:07Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "24892c072f374f97f495de1d75a945aeaca2762c", "body": "#52411 introduced a regression in the error message reporting mechanism,\nbecause it's not passing `has_provider/1` to `error_message.lp`\n\nSigned-off-by: Massimiliano Culpo \u003cmassimiliano.culpo@gmail.com>", "is_bot": false, "headline": "solver: add missing fact in display.lp (#52640)", "author_name": "Massimiliano Culpo", "author_login": "alalazo", "committed_at": "2026-07-02T15:18:24Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "5ad542d8283cb3e63d2722bdaa4c8f0502d2e8a4", "body": "refers #52620\n\nIn 2023 we had `concretization:unify:true`. Now this option is under the\n`concretizer` section, so fix the stale message.\n\nSigned-off-by: Massimiliano Culpo \u003cmassimiliano.culpo@gmail.com>", "is_bot": false, "headline": "environment: fix a stale error message (#52639)", "author_name": "Massimiliano Culpo", "author_login": "alalazo", "committed_at": "2026-07-02T14:37:51Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "741ddafc339a0b2fde871d29be07d884a4d779a3", "body": "Rarely used, but used.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "libc.py: fix typo (#52626)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-07-01T14:39:06Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "bd85d21e3b11c41d842c9a6744beddf342e3514c", "body": "Currently, config.py depends on the `active_environment()` for path\nsubstitutions, creating a circular dependency between `spack.config` and\n`spack.environment`.\n\nHere we add an attribute to record the active environment's path on the\nConfiguration object during activation in order to remove the circular\ndependency.\n\n---------\n\nSigned-off-by: Massimiliano Culpo \u003cmassimiliano.culpo@gmail.com>", "is_bot": false, "headline": "config: remove circular dependency with env (#52627)", "author_name": "Massimiliano Culpo", "author_login": "alalazo", "committed_at": "2026-07-01T14:07:15Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "5817ab9613f211442a2747b304960c556797c40f", "body": "Closes #52573.\n\nFixes a hang of the new installer under forkserver (Python 3.14+ on\nLinux and\nmacOS in general)\n\nThe Tee thread exits when log pipe's read end hits EOF, which happens\nwhen all fds referring to the write end have been closed. When using\nforkserver based multiprocessing, the forkserver\n[…]\nol pipe to\nsignal it's time to exit.\n\nIndependently of this I'd like to get rid of multiprocessing in\ninstall_test.py,\nwhich triggered the issue.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "new_installer.py: exit tee thread w/ control byte (#52621)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-06-29T12:32:24Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "8c1fb030538af4121c7889db51adb52c9899be8c", "body": "On overlayfs (like docker build) `os.rename(...)` does not work for\ndirectories if the dir is part of a lower layer. If that errors, just\nremove the dir recursively.\n\nSee\nhttps://docs.docker.com/engine/storage/drivers/overlayfs-driver/#renaming-directories.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "view: fix rename on overlayfs issue (#52594)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-06-29T08:52:17Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "9dc979613c79c9e8233f48dbe0fd71797d6b9b7d", "body": "Signed-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "concretize.lp: speed-up solve with grounding improvements (#52605)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-06-29T08:42:09Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "32b08c1a451a1fca640e8552a32f93153b4cb310", "body": "Modifications:\n\n* Eliminated subclasses for `FileLayout` and `ModuleContext`\n* Reduced the number of time we re-read configuration (less\n`spack.config.get` calls in favor of `get_config` and reading from the\nstored dict)\n* Configuration caches are per-class, not per module\n* `*ModuleFileWriter` take\n[…]\nt during construction\n(a `from_spec()` classmethod replaces the old constructor)\n* Errors have been extracted to `spack.modules.error`\n\nSigned-off-by: Massimiliano Culpo \u003cmassimiliano.culpo@gmail.com>", "is_bot": false, "headline": "modules: refactor classes and clean-up code (#52522)", "author_name": "Massimiliano Culpo", "author_login": "alalazo", "committed_at": "2026-06-29T07:25:05Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "c7cea1aa274e796ebb083eaf067cf09ce30d6f2c", "body": "Modifications:\n* Introduce the concepts of hierarchical vs. flat layout early\n* Clearly divide layout from content\n* Reorder \"Module content\" subsections to match logical flow:\n - global modifications first (prefix inspections)\n - then config rules\n - then package.py callbacks\n* Flatten \"Maintaining Module Files\" subheadings into prose \n* Tighten prose throughout.\n\n---------\n\nSigned-off-by: Massimiliano Culpo \u003cmassimiliano.culpo@gmail.com>", "is_bot": false, "headline": "modules: overhaul module file documentation (#52536)", "author_name": "Massimiliano Culpo", "author_login": "alalazo", "committed_at": "2026-06-27T09:42:12Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "4f0b78faf245b31fd424a77eb000f8f4cf1868dd", "body": "This reduces the verbosity of the nodes produced by `spack graph --dot`.\n\n* `{%compiler}` is redundant because the compiler has its own node\n* add `-l/--long`, `-L/--very-long` flags for hash, default to no hash\n\nThat way `spack graph --dot pkg | tred` looks readable (even better with\n`rankdir = \"LR\"`)\n\n---------\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "graph.py: drop compiler, use flags for hashes (#52614)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-06-26T19:07:31Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "5f7d63e806c554b57e8fcece8dc6647d248cf40f", "body": "The `spack develop` and `spack undevelop` short descriptions were vague and\ninconsistent about what they operate on. This updates them to refer to the\nenvironment's `develop:` section:\n\n* `develop`: \"add a spec to an environment's develop: section\"\n* `undevelop`: \"remove specs from an environment's develop: section\"\n\nNo functional change.\n\nSigned-off-by: Todd Gamblin \u003ctgamblin@llnl.gov>", "is_bot": false, "headline": "Clarify develop and undevelop command descriptions (#52612)", "author_name": "Todd Gamblin", "author_login": "tgamblin", "committed_at": "2026-06-26T17:11:21Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "fa79456782a514ea0713eea9c4aeacdb264d55aa", "body": "See https://github.com/spack/spack/issues/52599\nThe unit tests might be a bit overkill but they do test all of the\npossible code paths and are as large as they are mainly because of the\nmocks.\n\n---------\n\nSigned-off-by: dsjense \u003cdsjense@sandia.gov>\nSigned-off-by: John Parent \u003cjohn.parent@kitware.com>\nCo-authored-by: John Parent \u003cjohn.parent@kitware.com>", "is_bot": false, "headline": "Fix temp_cwd logic on non-Windows platforms (#52600)", "author_name": "danielsjensen1", "author_login": "danielsjensen1", "committed_at": "2026-06-26T15:24:09Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "e28340e849f06dfb54b1a972e68b02a4f2563a66", "body": "Add a `--no-deprecated` flag to limit outputting deprecated specs in\n`spack repo show-version-updates`.\n\nIf you're creating a mirror with the output of `spack repo\nshow-version-updates` you likely do not want to mirror new deprecated\nversions into your source mirror. (And if you do you'll need to\nsp\n[…]\nrom `spack.repo.PATH.get_pkg_class()` to\n`repo.get_pkg_class()` since we are specifically looking at one\nrepository at a time during this command.\n\n---------\n\nSigned-off-by: Alec Scott \u003calec@llnl.gov>", "is_bot": false, "headline": "repo cmd: add --no-deprecated flag to show-version-updates (#52391)", "author_name": "Alec Scott", "author_login": "alecbcs", "committed_at": "2026-06-26T14:58:57Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "a534e6456a11aae3f3306a964eb60a9fb2c4ee91", "body": "I think this is not worth pointing out anymore. The user will see\nprogress of the initial git clone anyways.\n\nSigned-off-by: Harmen Stoppels \u003cme@harmenstoppels.nl>", "is_bot": false, "headline": "getting_started.rst: remove warning about slow start (#52186)", "author_name": "Harmen Stoppels", "author_login": "haampie", "committed_at": "2026-06-26T08:16:44Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "d975891ecbbc170178e1313accc668f9fae6a31b", "body": "Bumps [actions/setup-python](https://github.com/actions/setup-python)\nfrom 6.2.0 to 6.3.0.\n\u003cdetails>\n\u003csummary>Release notes\u003c/summary>\n\u003cp>\u003cem>Sourced from \u003ca\nhref=\"https://github.com/actions/setup-python/releases\">actions/setup-python's\nreleases\u003c/a>.\u003c/em>\u003c/p>\n\u003cblockquote>\n\u003ch2>v6.3.0\u003c/h2>\n\u003ch2>What's C\n[…]\nnless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details>\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com>\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com>", "is_bot": true, "headline": "build(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#52608)", "author_name": "dependabot[bot]", "author_login": "dependabot[bot]", "committed_at": "2026-06-26T07:56:31Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "11227cfc0fdbbcab7acdd1848a3394806b183126", "body": "…ib/spack/docs (#52609)\n\nBumps\n[sphinxcontrib-programoutput](https://github.com/OpenNTI/sphinxcontrib-programoutput)\nfrom 0.19 to 0.20.\n\u003cdetails>\n\u003csummary>Changelog\u003c/summary>\n\u003cp>\u003cem>Sourced from \u003ca\nhref=\"https://github.com/OpenNTI/sphinxcontrib-programoutput/blob/master/CHANGES.rst\">sphinxcontrib-pr\n[…]\nnless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details>\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com>\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com>", "is_bot": true, "headline": "build(deps): bump sphinxcontrib-programoutput from 0.19 to 0.20 in /l…", "author_name": "dependabot[bot]", "author_login": "dependabot[bot]", "committed_at": "2026-06-26T07:55:53Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "9627aa7fc4990a175d5e81b992a0b898e2bd7258", "body": "I am working on combining the spack.llnl and spack.util.llnl modules\ninto the spack.util module. The abstraction is leaky, the distinction\nbetween the two is weak, and I don't think it's serving us anymore.\n\nI'm going to try to keep these PRs small and separate. They'll probably\nconflict with each other, but I expect the rebasing to be trivial.\n\n---------\n\nSigned-off-by: Gregory Becker \u003cbecker33@llnl.gov>", "is_bot": false, "headline": "Move spack.llnl.util.lock into spack.util.lock (#52511)", "author_name": "Greg Becker", "author_login": "becker33", "committed_at": "2026-06-25T09:58:40Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "e91c987c3e96c7b1d755c4deb53d254cb8f21a04", "body": "Fixes #52602 \n\nMacos needs to know about older operating systems, to reconstruct specs\nfrom them, but it doesn't need to expose them to the solver unless they\nare coming in from a reused spec.\n\nGeneralized to a `buildable_oses` method on the `Platform` class.\n\n---------\n\nSigned-off-by: Gregory Becker \u003cbecker33@llnl.gov>\nCo-authored-by: becker33 \u003cbecker33@users.noreply.github.com>", "is_bot": false, "headline": "performance bugfix: only expose buildable oses to solver (#52604)", "author_name": "Greg Becker", "author_login": "becker33", "committed_at": "2026-06-25T07:30:25Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "4dfd0a28f90ec890b9f361d8feac0cdb614af677", "body": "I am working on combining the spack.llnl and spack.util.llnl modules\ninto the spack.util module. The abstraction is leaky, the distinction\nbetween the two is weak, and I don't think it's serving us anymore.\n\nI'm going to try to keep these PRs small and separate. They'll probably\nconflict with each other, but I expect the rebasing to be trivial.\n\n---------\n\nSigned-off-by: Gregory Becker \u003cbecker33@llnl.gov>", "is_bot": false, "headline": "Move spack.llnl.util.lang to spack.util.lang (#52507)", "author_name": "Greg Becker", "author_login": "becker33", "committed_at": "2026-06-24T17:35:08Z", "body_truncated": false, "is_coding_agent": false } ], "releases_count": 29, "commits_last_year": 1011, "latest_release_at": "2021-05-22T21:57:30Z", "latest_release_tag": "v0.16.2", "releases_from_tags": true, "days_since_last_push": 2, "active_weeks_last_year": 52, "days_since_latest_release": 1890, "mean_days_between_releases": 47.6 }, "community": { "has_readme": false, "has_license": false, "has_description": false, "has_contributing": false, "health_percentage": null, "has_issue_template": false, "has_code_of_conduct": false, "has_pull_request_template": false }, "ecosystem": { "packages": [] }, "popularity": { "forks": 0, "stars": 3, "watchers": 0, "fork_history": { "days": [], "complete": true, "collected": 0, "total_forks": 0 }, "star_history": null, "open_issues_and_prs": 6 }, "ai_readiness": { "has_nix": false, "example_dirs": [], "has_llms_txt": false, "has_dockerfile": true, "has_mcp_signal": false, "bootstrap_files": [ "lib/spack/docs/Makefile", "lib/spack/spack/test/data/make/affirmative/capital_makefile/Makefile", "lib/spack/spack/test/data/make/affirmative/check_test/Makefile", "lib/spack/spack/test/data/make/affirmative/expansion/Makefile", "lib/spack/spack/test/data/make/affirmative/gnu_makefile/GNUmakefile", "lib/spack/spack/test/data/make/affirmative/include/Makefile", "lib/spack/spack/test/data/make/affirmative/lowercase_makefile/makefile", "lib/spack/spack/test/data/make/affirmative/prerequisites/Makefile", "lib/spack/spack/test/data/make/affirmative/spaces/Makefile", "lib/spack/spack/test/data/make/affirmative/test_check/Makefile", "lib/spack/spack/test/data/make/affirmative/three_targets/Makefile", "lib/spack/spack/test/data/make/negative/partial_match/Makefile", "lib/spack/spack/test/data/make/negative/variable/Makefile", "share/spack/templates/depfile/Makefile" ], "api_schema_files": [], "has_devcontainer": true, "typecheck_configs": [ "lib/spack/spack/vendor/attr/py.typed", "lib/spack/spack/vendor/attrs/py.typed", "lib/spack/spack/vendor/distro/py.typed", "lib/spack/spack/vendor/jinja2/py.typed", "lib/spack/spack/vendor/markupsafe/py.typed", "lib/spack/spack/vendor/pyrsistent/py.typed", "lib/spack/spack/vendor/ruamel/yaml/py.typed" ], "toolchain_manifests": [], "largest_source_bytes": 231403, "source_files_sampled": 1029, "oversized_source_files": 21, "agent_instruction_files": [], "agent_instruction_max_bytes": null }, "dependencies": { "manifests": [ "pyproject.toml" ], "advisories": { "error": null, "scope": "repository_graph", "source": "osv", "findings": [ { "name": "black", "direct": false, "version": "25.12.0", "severity": "critical", "ecosystem": "pypi", "cvss_score": 9.8, "advisory_ids": [ "GHSA-3936-cmfr-pm3m", "PYSEC-2026-2120", "PYSEC-2026-2121" ], "fixed_version": "26.3.1", "advisory_count": 3, "oldest_advisory_days": 136 } ], "collected": true, "malicious": [], "truncated": false, "by_severity": { "critical": 1 }, "advisory_count": 3, "affected_count": 1, "assessed_count": 24, "malicious_count": 0, "assessed_package": null, "unassessed_count": 2, "direct_affected_count": 0 }, "ecosystems": [ "pypi" ], "dependencies": [ { "name": "clingo", "manifest": "pyproject.toml", "ecosystem": "pypi", "version_constraint": null } ], "all_dependencies": { "error": null, "source": "github-sbom", "packages": [ { "name": "clingo", "direct": true, "version": "5.8.0", "ecosystem": "pypi" }, { "name": "black", "direct": false, "version": "25.12.0", "ecosystem": "pypi" }, { "name": "coverage", "direct": false, "version": null, "ecosystem": "pypi" }, { "name": "coverage", "direct": false, "version": "7.14.0", "ecosystem": "pypi" }, { "name": "docutils", "direct": false, "version": "0.22.4", "ecosystem": "pypi" }, { "name": "flake8", "direct": false, "version": "7.3.0", "ecosystem": "pypi" }, { "name": "furo", "direct": false, "version": "2025.12.19", "ecosystem": "pypi" }, { "name": "isort", "direct": false, "version": "7.0.0", "ecosystem": "pypi" }, { "name": "mypy", "direct": false, "version": "1.20.1", "ecosystem": "pypi" }, { "name": "pip", "direct": false, "version": null, "ecosystem": "pypi" }, { "name": "pygments", "direct": false, "version": "2.20.0", "ecosystem": "pypi" }, { "name": "pylint", "direct": false, "version": "4.0.5", "ecosystem": "pypi" }, { "name": "pytest", "direct": false, "version": "9.0.3", "ecosystem": "pypi" }, { "name": "pytest", "direct": false, "version": "9.1.1", "ecosystem": "pypi" }, { "name": "pytest-cov", "direct": false, "version": "7.1.0", "ecosystem": "pypi" }, { "name": "pytest-xdist", "direct": false, "version": "3.8.0", "ecosystem": "pypi" }, { "name": "ruamel-yaml", "direct": false, "version": "0.19.1", "ecosystem": "pypi" }, { "name": "ruff", "direct": false, "version": "0.15.14", "ecosystem": "pypi" }, { "name": "slotscheck", "direct": false, "version": "0.19.1", "ecosystem": "pypi" }, { "name": "sphinx", "direct": false, "version": "9.1.0", "ecosystem": "pypi" }, { "name": "sphinx-copybutton", "direct": false, "version": "0.5.2", "ecosystem": "pypi" }, { "name": "sphinx-last-updated-by-git", "direct": false, "version": "0.3.8", "ecosystem": "pypi" }, { "name": "sphinx-sitemap", "direct": false, "version": "2.9.0", "ecosystem": "pypi" }, { "name": "sphinxcontrib-programoutput", "direct": false, "version": "0.20", "ecosystem": "pypi" }, { "name": "sphinxcontrib-svg2pdfconverter", "direct": false, "version": "2.1.0", "ecosystem": "pypi" }, { "name": "vermin", "direct": false, "version": "1.8.0", "ecosystem": "pypi" } ], "collected": true, "truncated": false, "total_count": 26, "direct_count": 1, "indirect_count": 25 } }, "maintainership": { "issues": { "open_prs": 6, "merged_prs": 2, "open_issues": 0, "closed_ratio": null, "closed_issues": 0, "closed_unmerged_prs": 5 }, "bus_factor": 10, "bot_contributors": 1, "top_contributors": [ { "type": "User", "login": "adamjstewart", "commits": 3238, "avatar_url": "https://avatars.githubusercontent.com/u/12021217?v=4" }, { "type": "User", "login": "tgamblin", "commits": 2956, "avatar_url": "https://avatars.githubusercontent.com/u/299842?v=4" }, { "type": "User", "login": "alalazo", "commits": 2284, "avatar_url": "https://avatars.githubusercontent.com/u/4199709?v=4" }, { "type": "User", "login": "haampie", "commits": 2253, "avatar_url": "https://avatars.githubusercontent.com/u/194764?v=4" }, { "type": "User", "login": "alecbcs", "commits": 966, "avatar_url": "https://avatars.githubusercontent.com/u/19558067?v=4" }, { "type": "User", "login": "wdconinc", "commits": 895, "avatar_url": "https://avatars.githubusercontent.com/u/4656391?v=4" }, { "type": "User", "login": "glennpj", "commits": 811, "avatar_url": "https://avatars.githubusercontent.com/u/16138574?v=4" }, { "type": "User", "login": "becker33", "commits": 746, "avatar_url": "https://avatars.githubusercontent.com/u/13971568?v=4" }, { "type": "User", "login": "manuelakuhn", "commits": 707, "avatar_url": "https://avatars.githubusercontent.com/u/36827019?v=4" }, { "type": "User", "login": "michaelkuhn", "commits": 692, "avatar_url": "https://avatars.githubusercontent.com/u/4062614?v=4" } ], "contributors_sampled": 99, "top_contributor_share": 0.106 }, "quality_signals": { "has_ci": true, "has_tests": true, "ci_workflows": [ "bootstrap.yml", "build-containers.yml", "ci.yaml", "coverage.yml", "import-check.yaml", "prechecks.yml", "stale.yaml", "triage.yml", "unit_tests.yaml" ], "has_docs_dir": false, "linter_configs": [ ".flake8" ], "has_editorconfig": false, "has_linter_config": true, "has_precommit_config": false }, "security_signals": { "lockfiles": [], "scorecard": { "checks": [ { "name": "Binary-Artifacts", "score": 10, "reason": "no binaries found in the repo", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts" }, { "name": "Branch-Protection", "score": 0, "reason": "branch protection not enabled on development/release branches", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection" }, { "name": "CI-Tests", "score": null, "reason": "no pull request found", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests" }, { "name": "CII-Best-Practices", "score": 0, "reason": "no effort to earn an OpenSSF best practices badge detected", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices" }, { "name": "Code-Review", "score": 0, "reason": "Found 0/30 approved changesets -- score normalized to 0", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review" }, { "name": "Contributors", "score": 10, "reason": "project has 91 contributing companies or organizations", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors" }, { "name": "Dangerous-Workflow", "score": 10, "reason": "no dangerous workflow patterns detected", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow" }, { "name": "Dependency-Update-Tool", "score": 10, "reason": "update tool detected", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool" }, { "name": "Fuzzing", "score": 0, "reason": "project is not fuzzed", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing" }, { "name": "License", "score": 10, "reason": "license file detected", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license" }, { "name": "Maintained", "score": 10, "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained" }, { "name": "Packaging", "score": null, "reason": "packaging workflow not detected", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging" }, { "name": "Pinned-Dependencies", "score": null, "reason": "internal error: internal error: invalid Dockerfile", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies" }, { "name": "SAST", "score": 0, "reason": "no SAST tool detected", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast" }, { "name": "Security-Policy", "score": 10, "reason": "security policy file detected", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy" }, { "name": "Signed-Releases", "score": null, "reason": "no releases found", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases" }, { "name": "Token-Permissions", "score": 0, "reason": "detected GitHub workflow tokens with excessive permissions", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions" }, { "name": "Vulnerabilities", "score": 8, "reason": "2 existing vulnerabilities detected", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities" } ], "commit": "20a23061245eff65fd609957e15e3ad06fd53eb7", "ran_at": "2026-07-26T18:35:41Z", "aggregate_score": 5.7, "scorecard_version": "v5.5.0" }, "has_codeql_workflow": false, "has_security_policy": true, "has_dependabot_config": true }, "contribution_flow": { "collected": true, "ci_last_run_at": "2026-07-26T05:43:05Z", "oldest_open_prs": [ { "number": 6, "created_at": "2022-01-25T22:37:57Z", "last_comment_at": null, "last_comment_author": null }, { "number": 7, "created_at": "2022-03-17T16:51:25Z", "last_comment_at": null, "last_comment_author": null }, { "number": 8, "created_at": "2022-09-06T18:35:57Z", "last_comment_at": null, "last_comment_author": null }, { "number": 9, "created_at": "2023-04-18T16:27:02Z", "last_comment_at": null, "last_comment_author": null }, { "number": 12, "created_at": "2025-06-26T19:16:55Z", "last_comment_at": null, "last_comment_author": null }, { "number": 13, "created_at": "2025-06-26T22:07:14Z", "last_comment_at": null, "last_comment_author": null } ], "last_merged_pr_at": "2022-03-15T20:34:23Z", "ci_last_conclusion": "SUCCESS", "oldest_open_issues": [] } }, "config": { "disabled_metrics": [], "disabled_categories": [], "disabled_components": {} }, "source": { "url": "https://github.com/johnwparent/spack", "host": "github.com", "name": "spack", "owner": "johnwparent" }, "metrics": { "overall": { "key": "overall", "band": "moderate", "name": "Overall health", "note": null, "notes": [], "value": 56, "inputs": { "security": 66, "vitality": 76, "community": 14, "governance": 60, "engineering": 58 }, "components": [] }, "categories": [ { "key": "vitality", "band": "good", "name": "Vitality", "value": 76, "weight": 0.22, "metrics": [ { "key": "development_activity", "band": "excellent", "name": "Development activity", "note": null, "notes": [], "value": 100, "inputs": { "commits_last_year": 1011, "human_commit_share": 0.98, "days_since_last_push": 2, "active_weeks_last_year": 52 }, "components": [ { "key": "push_recency", "name": "Push recency", "detail": "last push 2 days ago", "points": 36, "status": "met", "details": [ { "code": "push_recency", "params": { "days": 2 } } ], "max_points": 36 }, { "key": "commit_cadence", "name": "Commit cadence", "detail": "52/52 weeks with commits", "points": 36, "status": "met", "details": [ { "code": "commit_cadence_weeks", "params": { "weeks": 52 } } ], "max_points": 36 }, { "key": "commit_volume", "name": "Commit volume", "detail": "1011 commits in the last year", "points": 18, "status": "met", "details": [ { "code": "commits_last_year", "params": { "count": 1011 } } ], "max_points": 18 }, { "key": "openssf_scorecard_maintained", "name": "OpenSSF Scorecard: Maintained", "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10", "points": 10, "status": "met", "details": [], "max_points": 10 } ] }, { "key": "release_discipline", "band": "at_risk", "name": "Release discipline", "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.", "notes": [ { "code": "excluded_no_data", "params": { "components": [ "openssf_scorecard_signed_releases" ] } }, { "code": "weights_renormalized", "params": {} } ], "value": 40, "inputs": { "releases_count": 29, "latest_release_tag": "v0.16.2", "releases_from_tags": true, "days_since_latest_release": 1890, "mean_days_between_releases": 47.6 }, "components": [ { "key": "ships_releases", "name": "Ships releases", "detail": "29 version tags (no GitHub releases)", "points": 16.2, "status": "partial", "details": [ { "code": "version_tags_no_releases", "params": { "count": 29 } } ], "max_points": 27 }, { "key": "release_recency", "name": "Release recency", "detail": "latest release 1890 days ago", "points": 0, "status": "missed", "details": [ { "code": "release_recency", "params": { "days": 1890 } } ], "max_points": 36 }, { "key": "release_cadence", "name": "Release cadence", "detail": "a release every ~47.6 days", "points": 19.8, "status": "partial", "details": [ { "code": "release_cadence", "params": { "gap": 47.6 } } ], "max_points": 27 }, { "key": "openssf_scorecard_signed_releases", "name": "OpenSSF Scorecard: Signed-Releases", "detail": "no releases found", "points": 0, "status": "excluded", "details": [ { "code": "no_data", "params": {} } ], "max_points": 10 } ] }, { "key": "abandonment", "band": "excellent", "name": "Abandonment", "note": null, "notes": [], "value": 100, "inputs": { "cap": null, "state": "maintained", "guards": [], "signals": [], "red_flag": false, "multiplier_pct": 100, "declared_reason": null, "unverified_reason": null, "unanswered_open_prs": null, "unanswered_open_issues": null, "days_since_last_merged_pr": null, "days_since_last_human_commit": 3, "days_since_last_human_commit_is_floor": false }, "components": [ { "key": "project_is_still_maintained", "name": "Project is still maintained", "detail": "last human commit 3 days ago", "points": 100, "status": "met", "details": [ { "code": "abandonment_maintained", "params": { "days": 3 } } ], "max_points": 100 } ] } ], "description": "Is the project alive — is code being written and are releases shipping?" }, { "key": "community", "band": "critical", "name": "Community & Adoption", "value": 14, "weight": 0.18, "metrics": [ { "key": "popularity", "band": "critical", "name": "Popularity & adoption", "note": null, "notes": [], "value": 5, "inputs": { "forks": 0, "stars": 3, "watchers": 0, "growth_state": "unverified", "growth_factor_pct": 100, "growth_unverified_reason": "no_history" }, "components": [ { "key": "stars", "name": "Stars", "detail": "3 stars", "points": 4.9, "status": "partial", "details": [ { "code": "stars", "params": { "count": 3 } } ], "max_points": 60 }, { "key": "forks", "name": "Forks", "detail": "0 forks", "points": 0, "status": "missed", "details": [ { "code": "forks", "params": { "count": 0 } } ], "max_points": 25 }, { "key": "watchers", "name": "Watchers", "detail": "0 watchers", "points": 0, "status": "missed", "details": [ { "code": "watchers", "params": { "count": 0 } } ], "max_points": 15 } ] }, { "key": "community_health", "band": "critical", "name": "Community health", "note": null, "notes": [], "value": 25, "inputs": { "has_readme": false, "has_license": false, "has_contributing": false, "has_issue_template": false, "has_code_of_conduct": false, "has_pull_request_template": false }, "components": [ { "key": "readme", "name": "README", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 22.5 }, { "key": "license", "name": "License", "detail": "recognized license (Apache-2.0)", "points": 22.5, "status": "met", "details": [ { "code": "license_standard", "params": {} }, { "code": "license_spdx", "params": { "spdx": "Apache-2.0" } } ], "max_points": 22.5 }, { "key": "contributing_guide", "name": "CONTRIBUTING guide", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 18 }, { "key": "code_of_conduct", "name": "Code of conduct", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 13.5 }, { "key": "issue_template", "name": "Issue template", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 7.2 }, { "key": "pr_template", "name": "PR template", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 6.3 } ] } ], "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?" }, { "key": "governance", "band": "moderate", "name": "Sustainability & Governance", "value": 60, "weight": 0.24, "metrics": [ { "key": "maintainer_resilience", "band": "excellent", "name": "Maintainer resilience (bus factor)", "note": null, "notes": [], "value": 98, "inputs": { "bus_factor": 10, "contributors_sampled": 99, "top_contributor_share": 0.106 }, "components": [ { "key": "bus_factor", "name": "Bus factor", "detail": "10 contributor(s) cover half of all commits", "points": 54, "status": "met", "details": [ { "code": "bus_factor", "params": { "count": 10 } } ], "max_points": 54 }, { "key": "commit_distribution", "name": "Commit distribution", "detail": "top contributor authored 11% of commits", "points": 20.1, "status": "partial", "details": [ { "code": "top_contributor_share", "params": { "share": 11 } } ], "max_points": 22.5 }, { "key": "contributor_breadth", "name": "Contributor breadth", "detail": "99 contributors", "points": 13.5, "status": "met", "details": [ { "code": "contributors_sampled", "params": { "count": 99 } } ], "max_points": 13.5 }, { "key": "openssf_scorecard_contributors", "name": "OpenSSF Scorecard: Contributors", "detail": "project has 91 contributing companies or organizations", "points": 10, "status": "met", "details": [], "max_points": 10 } ] }, { "key": "responsiveness", "band": "critical", "name": "Issue & PR responsiveness", "note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.", "notes": [ { "code": "excluded_no_data", "params": { "components": [ "issue_resolution" ] } }, { "code": "weights_renormalized", "params": {} } ], "value": 20, "inputs": { "merged_prs": 2, "open_issues": 0, "closed_issues": 0, "issue_closed_ratio": null, "closed_unmerged_prs": 5 }, "components": [ { "key": "issue_resolution", "name": "Issue resolution", "detail": "no issues or no data", "points": 0, "status": "excluded", "details": [ { "code": "no_issues_or_data", "params": {} } ], "max_points": 46.75 }, { "key": "pr_acceptance", "name": "PR acceptance", "detail": "2/7 decided PRs merged", "points": 10.9, "status": "partial", "details": [ { "code": "decided_prs_merged", "params": { "merged": 2, "decided": 7 } } ], "max_points": 38.25 }, { "key": "openssf_scorecard_code_review", "name": "OpenSSF Scorecard: Code-Review", "detail": "Found 0/30 approved changesets -- score normalized to 0", "points": 0, "status": "missed", "details": [], "max_points": 15 } ] }, { "key": "stewardship", "band": "moderate", "name": "Ownership & stewardship", "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.", "notes": [ { "code": "excluded_no_data", "params": { "components": [ "verified_domain" ] } }, { "code": "weights_renormalized", "params": {} } ], "value": 55, "inputs": { "followers": 15, "owner_type": "User", "is_verified": null, "owner_login": "johnwparent", "public_repos": 71, "account_age_days": 2795 }, "components": [ { "key": "ownership_backing", "name": "Ownership backing", "detail": "personal (user) account", "points": 10, "status": "partial", "details": [ { "code": "owner_personal", "params": {} } ], "max_points": 30 }, { "key": "verified_domain", "name": "Verified domain", "detail": "not applicable to user accounts", "points": 0, "status": "excluded", "details": [ { "code": "not_applicable_to_user_accounts", "params": {} } ], "max_points": 20 }, { "key": "owner_reach", "name": "Owner reach", "detail": "15 followers of johnwparent", "points": 8.7, "status": "partial", "details": [ { "code": "owner_followers", "params": { "count": 15, "login": "johnwparent" } } ], "max_points": 25 }, { "key": "track_record", "name": "Track record", "detail": "71 public repos, account ~7 yr old", "points": 25, "status": "met", "details": [ { "code": "public_repos", "params": { "count": 71 } }, { "code": "account_age_years", "params": { "years": 7 } } ], "max_points": 25 } ] } ], "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?" }, { "key": "engineering", "band": "moderate", "name": "Engineering Quality", "value": 58, "weight": 0.2, "metrics": [ { "key": "engineering_practices", "band": "good", "name": "Engineering practices", "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.", "notes": [ { "code": "excluded_no_data", "params": { "components": [ "openssf_scorecard_ci_tests" ] } }, { "code": "weights_renormalized", "params": {} } ], "value": 80, "inputs": { "has_ci": true, "has_tests": true, "has_editorconfig": false, "has_linter_config": true, "has_precommit_config": false }, "components": [ { "key": "ci_workflows", "name": "CI workflows", "detail": "9 workflow(s)", "points": 24, "status": "met", "details": [ { "code": "ci_workflows", "params": { "count": 9 } } ], "max_points": 24 }, { "key": "tests_present", "name": "Tests present", "detail": null, "points": 24, "status": "met", "details": [], "max_points": 24 }, { "key": "linter_config", "name": "Linter config", "detail": ".flake8", "points": 16, "status": "met", "details": [ { "code": "file_list", "params": { "files": ".flake8" } } ], "max_points": 16 }, { "key": "pre_commit_hooks", "name": "Pre-commit hooks", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 9.6 }, { "key": "editorconfig", "name": ".editorconfig", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 6.4 }, { "key": "openssf_scorecard_ci_tests", "name": "OpenSSF Scorecard: CI-Tests", "detail": "no pull request found", "points": 0, "status": "excluded", "details": [ { "code": "no_data", "params": {} } ], "max_points": 20 } ] }, { "key": "documentation", "band": "critical", "name": "Documentation", "note": null, "notes": [], "value": 25, "inputs": { "topics": [], "has_wiki": true, "homepage": "https://spack.io", "has_readme": false, "has_docs_dir": false, "has_description": false }, "components": [ { "key": "readme", "name": "README", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 30 }, { "key": "documentation_directory", "name": "Documentation directory", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 25 }, { "key": "documentation_homepage_site", "name": "Documentation / homepage site", "detail": "https://spack.io", "points": 15, "status": "met", "details": [], "max_points": 15 }, { "key": "repository_description", "name": "Repository description", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 10 }, { "key": "topics", "name": "Topics", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 10 }, { "key": "wiki", "name": "Wiki", "detail": null, "points": 10, "status": "met", "details": [], "max_points": 10 } ] } ], "description": "Are baseline engineering and documentation practices in place?" }, { "key": "security", "band": "moderate", "name": "Security", "value": 66, "weight": 0.16, "metrics": [ { "key": "security_posture", "band": "moderate", "name": "Security posture", "note": "Excluded from scoring (no data or not applicable): CI-Tests, Packaging, Pinned-Dependencies, Signed-Releases. Remaining weights renormalized.", "notes": [ { "code": "excluded_no_data", "params": { "components": [ "ci_tests", "packaging", "pinned_dependencies", "signed_releases" ] } }, { "code": "weights_renormalized", "params": {} } ], "value": 57, "inputs": { "source": "openssf_scorecard", "checks_evaluated": 14, "scorecard_version": "v5.5.0", "checks_inconclusive": 4, "scorecard_aggregate": 5.7 }, "components": [ { "key": "binary_artifacts", "name": "Binary-Artifacts", "detail": "no binaries found in the repo", "points": 7.5, "status": "met", "details": [], "max_points": 7.5 }, { "key": "branch_protection", "name": "Branch-Protection", "detail": "branch protection not enabled on development/release branches", "points": 0, "status": "missed", "details": [], "max_points": 7.5 }, { "key": "ci_tests", "name": "CI-Tests", "detail": "no pull request found", "points": 0, "status": "excluded", "details": [ { "code": "no_data", "params": {} } ], "max_points": 2.5 }, { "key": "cii_best_practices", "name": "CII-Best-Practices", "detail": "no effort to earn an OpenSSF best practices badge detected", "points": 0, "status": "missed", "details": [], "max_points": 2.5 }, { "key": "code_review", "name": "Code-Review", "detail": "Found 0/30 approved changesets -- score normalized to 0", "points": 0, "status": "missed", "details": [], "max_points": 7.5 }, { "key": "contributors", "name": "Contributors", "detail": "project has 91 contributing companies or organizations", "points": 2.5, "status": "met", "details": [], "max_points": 2.5 }, { "key": "dangerous_workflow", "name": "Dangerous-Workflow", "detail": "no dangerous workflow patterns detected", "points": 10, "status": "met", "details": [], "max_points": 10 }, { "key": "dependency_update_tool", "name": "Dependency-Update-Tool", "detail": "update tool detected", "points": 7.5, "status": "met", "details": [], "max_points": 7.5 }, { "key": "fuzzing", "name": "Fuzzing", "detail": "project is not fuzzed", "points": 0, "status": "missed", "details": [], "max_points": 5 }, { "key": "license", "name": "License", "detail": "license file detected", "points": 2.5, "status": "met", "details": [], "max_points": 2.5 }, { "key": "maintained", "name": "Maintained", "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10", "points": 7.5, "status": "met", "details": [], "max_points": 7.5 }, { "key": "packaging", "name": "Packaging", "detail": "packaging workflow not detected", "points": 0, "status": "excluded", "details": [ { "code": "no_data", "params": {} } ], "max_points": 5 }, { "key": "pinned_dependencies", "name": "Pinned-Dependencies", "detail": "internal error: internal error: invalid Dockerfile", "points": 0, "status": "excluded", "details": [ { "code": "no_data", "params": {} } ], "max_points": 5 }, { "key": "sast", "name": "SAST", "detail": "no SAST tool detected", "points": 0, "status": "missed", "details": [], "max_points": 5 }, { "key": "security_policy", "name": "Security-Policy", "detail": "security policy file detected", "points": 5, "status": "met", "details": [], "max_points": 5 }, { "key": "signed_releases", "name": "Signed-Releases", "detail": "no releases found", "points": 0, "status": "excluded", "details": [ { "code": "no_data", "params": {} } ], "max_points": 7.5 }, { "key": "token_permissions", "name": "Token-Permissions", "detail": "detected GitHub workflow tokens with excessive permissions", "points": 0, "status": "missed", "details": [], "max_points": 7.5 }, { "key": "vulnerabilities", "name": "Vulnerabilities", "detail": "2 existing vulnerabilities detected", "points": 6, "status": "partial", "details": [], "max_points": 7.5 } ] }, { "key": "dependency_advisories", "band": "excellent", "name": "Dependency advisories", "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 24 resolved dependencies against OSV; 2 could not be assessed (no resolved version, an unsupported ecosystem, or beyond the reported package list). This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.", "notes": [ { "code": "excluded_no_data", "params": { "components": [ "indirect_dependencies_free_of_known_advisories", "no_advisories_left_outstanding" ] } }, { "code": "weights_renormalized", "params": {} }, { "code": "advisories_scope_repository", "params": { "assessed": 24 } }, { "code": "advisories_unassessed", "params": { "count": 2 } }, { "code": "advisories_repo_graph_caveat", "params": {} }, { "code": "advisories_reachability", "params": {} } ], "value": 100, "inputs": { "source": "osv", "advisories": 3, "affected_packages": 1, "assessed_packages": 24, "unassessed_packages": 2, "affected_by_severity": "critical 1", "direct_affected_packages": 0 }, "components": [ { "key": "direct_dependencies_free_of_known_advisories", "name": "Direct dependencies free of known advisories", "detail": "no direct dependency carries a known advisory", "points": 35, "status": "met", "details": [ { "code": "no_direct_advisories", "params": {} } ], "max_points": 35 }, { "key": "indirect_dependencies_free_of_known_advisories", "name": "Indirect dependencies free of known advisories", "detail": "transitive set not separable from development and test dependencies in this scope", "points": 0, "status": "excluded", "details": [ { "code": "advisories_scope_not_separable", "params": {} } ], "max_points": 25 }, { "key": "no_advisories_left_outstanding", "name": "No advisories left outstanding", "detail": "no advisory carries a publication date", "points": 0, "status": "excluded", "details": [ { "code": "advisories_no_publication_date", "params": {} } ], "max_points": 40 } ] }, { "key": "malicious_dependencies", "band": "excellent", "name": "Malicious dependencies", "note": null, "notes": [], "value": 100, "inputs": { "source": "osv", "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored", "packages": [], "red_flag": false, "assessed_packages": 24, "malicious_packages": 0, "direct_malicious_packages": 0, "withdrawn_malicious_packages": 0, "installable_malicious_packages": 0 }, "components": [ { "key": "no_dependency_reported_as_a_malicious_package", "name": "No dependency reported as a malicious package", "detail": "no dependency is reported as a malicious package", "points": 100, "status": "met", "details": [ { "code": "no_malicious_dependencies", "params": {} } ], "max_points": 100 } ] }, { "key": "high_risk_jurisdiction_exposure", "band": "excellent", "name": "High-Risk Jurisdiction Exposure", "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.", "notes": [ { "code": "jurisdiction_evidence_limits", "params": {} } ], "value": 100, "inputs": { "meaning": "self-published location evidence; not nationality or citizenship", "red_flag": false, "exposures": [], "policy_countries": [ "Russia", "Iran", "North Korea" ], "review_only_matches": 0, "assessed_self_published_locations": 14 }, "components": [ { "key": "policy_exposure_multiplier", "name": "Policy exposure multiplier", "detail": "no confirmed policy-scope location match", "points": 100, "status": "met", "details": [ { "code": "jurisdiction_no_match", "params": {} } ], "max_points": 100 } ] } ], "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?" }, { "key": "ai_readiness", "band": "good", "name": "AI Readiness", "value": 70, "weight": 0, "metrics": [ { "key": "ai_agent_context", "band": "at_risk", "name": "Agent context & guidance", "note": null, "notes": [], "value": 40, "inputs": { "has_llms_txt": false, "legible_history_share": 1, "agent_instruction_files": [], "agent_instruction_max_bytes": null }, "components": [ { "key": "agent_instructions", "name": "Agent instructions", "detail": "no CLAUDE.md / AGENTS.md / editor rules", "points": 0, "status": "missed", "details": [ { "code": "no_agent_instructions", "params": {} } ], "max_points": 45 }, { "key": "machine_readable_docs_llms_txt", "name": "Machine-readable docs (llms.txt)", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 15 }, { "key": "legible_commit_history", "name": "Legible commit history", "detail": "98 of 98 human commits state their intent (structured subject or explanatory body)", "points": 40, "status": "met", "details": [ { "code": "legible_history", "params": { "legible": 98, "sampled": 98 } } ], "max_points": 40 } ] }, { "key": "ai_verify_loop", "band": "excellent", "name": "Verify loop (build / test / typecheck)", "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Pinned-Dependencies. Remaining weights renormalized.", "notes": [ { "code": "excluded_no_data", "params": { "components": [ "openssf_scorecard_pinned_dependencies" ] } }, { "code": "weights_renormalized", "params": {} } ], "value": 89, "inputs": { "has_nix": false, "has_tests": true, "lockfiles": [], "has_dockerfile": true, "typed_language": false, "bootstrap_files": [ "lib/spack/docs/Makefile", "lib/spack/spack/test/data/make/affirmative/capital_makefile/Makefile", "lib/spack/spack/test/data/make/affirmative/check_test/Makefile", "lib/spack/spack/test/data/make/affirmative/expansion/Makefile", "lib/spack/spack/test/data/make/affirmative/gnu_makefile/GNUmakefile", "lib/spack/spack/test/data/make/affirmative/include/Makefile", "lib/spack/spack/test/data/make/affirmative/lowercase_makefile/makefile", "lib/spack/spack/test/data/make/affirmative/prerequisites/Makefile", "lib/spack/spack/test/data/make/affirmative/spaces/Makefile", "lib/spack/spack/test/data/make/affirmative/test_check/Makefile", "lib/spack/spack/test/data/make/affirmative/three_targets/Makefile", "lib/spack/spack/test/data/make/negative/partial_match/Makefile", "lib/spack/spack/test/data/make/negative/variable/Makefile", "share/spack/templates/depfile/Makefile" ], "has_devcontainer": true, "has_linter_config": true, "typecheck_configs": [ "lib/spack/spack/vendor/attr/py.typed", "lib/spack/spack/vendor/attrs/py.typed", "lib/spack/spack/vendor/distro/py.typed", "lib/spack/spack/vendor/jinja2/py.typed", "lib/spack/spack/vendor/markupsafe/py.typed", "lib/spack/spack/vendor/pyrsistent/py.typed", "lib/spack/spack/vendor/ruamel/yaml/py.typed" ], "agent_commit_share": 0, "toolchain_manifests": [], "dependency_bot_commit_share": 0.02 }, "components": [ { "key": "one_command_bootstrap", "name": "One-command bootstrap", "detail": "lib/spack/docs/Makefile, lib/spack/spack/test/data/make/affirmative/capital_makefile/Makefile, lib/spack/spack/test/data/make/affirmative/check_test/Makefile, lib/spack/spack/test/data/make/affirmative/expansion/Makefile, lib/spack/spack/test/data/make/affirmative/gnu_makefile/GNUmakefile, lib/spack/spack/test/data/make/affirmative/include/Makefile, lib/spack/spack/test/data/make/affirmative/lowercase_makefile/makefile, lib/spack/spack/test/data/make/affirmative/prerequisites/Makefile, lib/spack/spack/test/data/make/affirmative/spaces/Makefile, lib/spack/spack/test/data/make/affirmative/test_check/Makefile, lib/spack/spack/test/data/make/affirmative/three_targets/Makefile, lib/spack/spack/test/data/make/negative/partial_match/Makefile, lib/spack/spack/test/data/make/negative/variable/Makefile, share/spack/templates/depfile/Makefile", "points": 18, "status": "met", "details": [ { "code": "file_list", "params": { "files": "lib/spack/docs/Makefile, lib/spack/spack/test/data/make/affirmative/capital_makefile/Makefile, lib/spack/spack/test/data/make/affirmative/check_test/Makefile, lib/spack/spack/test/data/make/affirmative/expansion/Makefile, lib/spack/spack/test/data/make/affirmative/gnu_makefile/GNUmakefile, lib/spack/spack/test/data/make/affirmative/include/Makefile, lib/spack/spack/test/data/make/affirmative/lowercase_makefile/makefile, lib/spack/spack/test/data/make/affirmative/prerequisites/Makefile, lib/spack/spack/test/data/make/affirmative/spaces/Makefile, lib/spack/spack/test/data/make/affirmative/test_check/Makefile, lib/spack/spack/test/data/make/affirmative/three_targets/Makefile, lib/spack/spack/test/data/make/negative/partial_match/Makefile, lib/spack/spack/test/data/make/negative/variable/Makefile, share/spack/templates/depfile/Makefile" } } ], "max_points": 18 }, { "key": "automated_tests", "name": "Automated tests", "detail": null, "points": 22, "status": "met", "details": [], "max_points": 22 }, { "key": "lint_format_config", "name": "Lint / format config", "detail": ".flake8", "points": 11, "status": "met", "details": [ { "code": "file_list", "params": { "files": ".flake8" } } ], "max_points": 11 }, { "key": "static_type_checking", "name": "Static type checking", "detail": "lib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed", "points": 11, "status": "met", "details": [ { "code": "file_list", "params": { "files": "lib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed" } } ], "max_points": 11 }, { "key": "reproducible_environment", "name": "Reproducible environment", "detail": "devcontainer, Dockerfile", "points": 10, "status": "met", "details": [ { "code": "file_list", "params": { "files": "devcontainer, Dockerfile" } } ], "max_points": 10 }, { "key": "demonstrated_agent_practice", "name": "Demonstrated agent practice", "detail": "no agent-authored commits among the last 100", "points": 0, "status": "missed", "details": [ { "code": "no_agent_authored_commits", "params": { "sampled": 100 } } ], "max_points": 10 }, { "key": "automated_maintenance", "name": "Automated maintenance", "detail": "2 of the last 100 commits are automated dependency updates", "points": 8, "status": "met", "details": [ { "code": "dependency_bot_commits", "params": { "count": 2, "sampled": 100 } } ], "max_points": 8 }, { "key": "openssf_scorecard_pinned_dependencies", "name": "OpenSSF Scorecard: Pinned-Dependencies", "detail": "internal error: internal error: invalid Dockerfile", "points": 0, "status": "excluded", "details": [ { "code": "no_data", "params": {} } ], "max_points": 10 } ] }, { "key": "ai_code_legibility", "band": "good", "name": "Code legibility for models", "note": null, "notes": [], "value": 81, "inputs": { "primary_language": "Python", "largest_source_bytes": 231403, "source_files_sampled": 1029, "oversized_source_files": 21 }, "components": [ { "key": "type_checkable_code", "name": "Type-checkable code", "detail": "Python with type-check config (lib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed)", "points": 27, "status": "partial", "details": [ { "code": "typecheck_config_language", "params": { "files": "lib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed", "language": "Python" } } ], "max_points": 45 }, { "key": "manageable_file_sizes", "name": "Manageable file sizes", "detail": "21/1029 source files over 60KB", "points": 53.9, "status": "partial", "details": [ { "code": "oversized_source_files", "params": { "kb": 60, "sampled": 1029, "oversized": 21 } } ], "max_points": 55 } ] } ], "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score." } ], "metrics_version": "1.13.0" }, "warnings": [ "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token", "Community profile unavailable", "Could not fetch pypi package 'spack' from its registry" ], "report_type": "repository", "generated_at": "2026-07-26T18:36:00.025924Z", "schema_version": "0.27.0", "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/j/johnwparent/spack.svg", "full_name": "johnwparent/spack", "license_state": "standard", "license_spdx": "Apache-2.0" }, "repoMeta": null, "notFound": false, "related": [ { "id": 139, "full_name": "apache/superset", "url": "https://github.com/apache/superset", "description": "Apache Superset is a Data Visualization and Data Exploration Platform", "ecosystem": "npm", "ecosystems": [ "npm", "pypi" ], "primary_language": "TypeScript", "languages": [ "TypeScript", "Python", "Jupyter Notebook" ], "topics": [ "superset", "apache", "apache-superset", "data-visualization", "data-viz", "analytics", "business-intelligence", "data-science", "data-engineering", "asf", "bi", "business-analytics", "data-analytics", "data-analysis", "python", "react", "sql-editor", "flask", "extensions", "visualization", "embed", "embedded", "sdk", "iframe", "dashboard", "chart", "cli", "development-tools" ], "license_spdx": "Apache-2.0", "license_state": "standard", "stars": 73846, "forks": 17889, "watchers": 1535, "monthly_downloads": 1098754, "latest_score": 97, "latest_band": "excellent", "latest_scanned_at": "2026-07-15T20:41:37.957488Z", "has_high_risk_jurisdiction_exposure": false, "has_malicious_dependency": false, "growth_authenticity": "unverified", "abandonment_state": "unverified", "red_flags": [], "badge_url": "" }, { "id": 10747, "full_name": "scikit-learn/scikit-learn", "url": "https://github.com/scikit-learn/scikit-learn", "description": "scikit-learn: machine learning in Python", "ecosystem": "pypi", "ecosystems": [ "pypi" ], "primary_language": "Python", "languages": [ "Python" ], "topics": [ "machine-learning", "python", "statistics", "data-science", "data-analysis" ], "license_spdx": "BSD-3-Clause", "license_state": "standard", "stars": 66748, "forks": 27200, "watchers": 2124, "monthly_downloads": 216399843, "latest_score": 95, "latest_band": "excellent", "latest_scanned_at": "2026-07-22T01:48:23.800991Z", "has_high_risk_jurisdiction_exposure": false, "has_malicious_dependency": false, "growth_authenticity": "organic", "abandonment_state": "maintained", "red_flags": [], "badge_url": "" }, { "id": 11038, "full_name": "onnx/onnx", "url": "https://github.com/onnx/onnx", "description": "Open standard for machine learning interoperability", "ecosystem": "pypi", "ecosystems": [ "pypi" ], "primary_language": "Python", "languages": [ "Python", "C++" ], "topics": [ "deep-learning", "deep-neural-networks", "neural-network", "onnx", "pytorch", "tensorflow", "keras", "scikit-learn", "ml", "machine-learning", "dnn", "ai", "artificial-intelligence" ], "license_spdx": "Apache-2.0", "license_state": "standard", "stars": 21160, "forks": 3973, "watchers": 422, "monthly_downloads": null, "latest_score": 95, "latest_band": "excellent", "latest_scanned_at": "2026-07-17T00:44:18.902853Z", "has_high_risk_jurisdiction_exposure": false, "has_malicious_dependency": false, "growth_authenticity": "unverified", "abandonment_state": "unverified", "red_flags": [], "badge_url": "" }, { "id": 21535, "full_name": "run-llama/llama_index", "url": "https://github.com/run-llama/llama_index", "description": "LlamaIndex is the leading document agent and OCR platform", "ecosystem": "pypi", "ecosystems": [ "pypi" ], "primary_language": "Python", "languages": [ "Python", "Jupyter Notebook" ], "topics": [ "agents", "application", "data", "fine-tuning", "framework", "llamaindex", "llm", "rag", "vector-database", "multi-agents", "nlp", "devtools", "index", "retrieval" ], "license_spdx": "MIT", "license_state": "standard", "stars": 50927, "forks": 7772, "watchers": 281, "monthly_downloads": 22943707, "latest_score": 94, "latest_band": "excellent", "latest_scanned_at": "2026-07-18T14:07:28.301018Z", "has_high_risk_jurisdiction_exposure": false, "has_malicious_dependency": false, "growth_authenticity": "unverified", "abandonment_state": "unverified", "red_flags": [], "badge_url": "" }, { "id": 10517, "full_name": "wandb/wandb", "url": "https://github.com/wandb/wandb", "description": "The AI developer platform. Use Weights & Biases to train and fine-tune models, and manage models from experimentation to production.", "ecosystem": "pypi", "ecosystems": [ "pypi", "go", "crates" ], "primary_language": "Python", "languages": [ "Python", "Go" ], "topics": [ "machine-learning", "experiment-track", "deep-learning", "keras", "tensorflow", "pytorch", "hyperparameter-search", "reinforcement-learning", "mlops", "data-science", "collaboration", "hyperparameter-optimization", "reproducibility", "hyperparameter-tuning", "data-versioning", "model-versioning", "ml-platform", "jax", "ai" ], "license_spdx": "MIT", "license_state": "standard", "stars": 11195, "forks": 885, "watchers": 62, "monthly_downloads": 23033482, "latest_score": 94, "latest_band": "excellent", "latest_scanned_at": "2026-07-20T23:02:12.679869Z", "has_high_risk_jurisdiction_exposure": false, "has_malicious_dependency": false, "growth_authenticity": "unverified", "abandonment_state": "unverified", "red_flags": [], "badge_url": "" }, { "id": 30871, "full_name": "apache/airflow", "url": "https://github.com/apache/airflow", "description": "Apache Airflow - A platform to programmatically author, schedule, and monitor workflows", "ecosystem": "pypi", "ecosystems": [ "pypi", "npm", "go", "maven" ], "primary_language": "Python", "languages": [ "Python" ], "topics": [ "airflow", "apache", "apache-airflow", "python", "scheduler", "workflow", "automation", "dag", "data-engineering", "data-integration", "data-orchestrator", "data-pipelines", "data-science", "elt", "etl", "machine-learning", "mlops", "orchestration", "workflow-engine", "workflow-orchestration", "data", "pipelines" ], "license_spdx": "Apache-2.0", "license_state": "standard", "stars": 46191, "forks": 17407, "watchers": 781, "monthly_downloads": 28891797, "latest_score": 93, "latest_band": "excellent", "latest_scanned_at": "2026-07-21T02:34:57.958196Z", "has_high_risk_jurisdiction_exposure": false, "has_malicious_dependency": false, "growth_authenticity": "unverified", "abandonment_state": "unverified", "red_flags": [], "badge_url": "" } ] } }
Публічний реєстр
Звіт про здоров'я програмного забезпеченнясхема 0.27.0 · метрики 1.13.0 · 2026-07-26 18:36 UTC

johnwparent / spack

A flexible package manager that supports multiple versions, configurations, platforms, and compilers.

PythonApache-2.0★ 3 зірки⑂ 0 форківз черв. 2021 р.форкПереглянути на GitHub ↗

johnwparent/spack має індекс здоров’я 56 зі 100, що відповідає смузі «Помірний». Найвищий показник — Vitality (76/100), найнижчий — Community & Adoption (14/100). Останнє оновлення було 2 дні тому. Більшість нещодавньої роботи виконують 10 учасників.

56
загалом / 100
Помірний

Індекс здоров'я програмного забезпечення

Метрики згруповано у зважені категорії на шкалі 1–100. Загальна оцінка починається як їхнє середнє; коли публічні дані активують Політику юрисдикцій високого ризику, рейтинг коригується й отримує верхню межу 49 («Під ризиком»). Готовність до ШІ не входить до індексу.

56
Відмінний85-100Зразковий; відповідає практично всім перевіреним критеріям
Добрий70-84Здоровий; незначні прогалини
Помірний50-69Прийнятний, але з помітними прогалинами; рекомендовано перевірку
У зоні ризику30-49Суттєві слабкі місця; впровадження потребує обережності
Критичний1-29Серйозні проблеми (покинутий, єдиний мейнтейнер, без базової гігієни)
ЖиттєздатністьСпільнота тавпровадженняСталість таврядуванняІнженернаякістьБезпекаГотовність доШІ

Профіль оцінок

Кожна вісь — окрема категорія. Форма важить більше, ніж середнє: здоровий об'єкт заповнює всю фігуру, тоді як профіль із піками та провалами означає, що сила в одному вимірі маскує ризик в іншому.

Власність

John W. ParentОсобистий обліковий запис
15 підписників71 публічний репозиторійз лист. 2018 р.@Kitware

Цей репозиторій належить особистому обліковому запису. Проєкт з єдиним власником несе більший ризик безперервності, ніж підтримуваний організацією.

Метрики за категоріями

Життєздатність

Чи живий проєкт — чи пишеться код і чи виходять релізи?

76Добрий · 22% загального індексу

Активність розробки

100Відмінний
Як обчислюється оцінка
36/36Свіжість push — останній push 2 дн. тому
36/36Ритм комітів — 52/52 тижнів із комітами
18/18Обсяг комітів — 1 011 комітів за останній рік
10/10OpenSSF Scorecard: Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Використані вхідні дані
commits_last_year1 011
human_commit_share0,98
days_since_last_push2
active_weeks_last_year52

Дисципліна релізів

40У зоні ризику
Як обчислюється оцінка
16.2/27Випускає релізи — 29 тегів версій (без релізів GitHub)
0/36Свіжість релізів — останній реліз 1 890 дн. тому
19.8/27Ритм релізів — реліз кожні ~47,6 дн.
0/10OpenSSF Scorecard: Signed-Releases — немає даних
Використані вхідні дані
releases_count29
latest_release_tagv0.16.2
releases_from_tagsтак
days_since_latest_release1 890
mean_days_between_releases47,6
Виключено з оцінювання (немає даних або не застосовно): OpenSSF Scorecard: Signed-Releases. Залишкові ваги перенормовано.

Спільнота та впровадження

Чи має проєкт користувачів, завантаження, увагу та влаштовані умови для контриб’юторів?

14Критичний · 18% загального індексу

Популярність і впровадження

5Критичний
Як обчислюється оцінка
4.9/60Зірки — 3 зірок
0/25Форки — 0 форків
0/15Спостерігачі — 0 спостерігачів
Використані вхідні дані
forks0
stars3
watchers0
growth_stateunverified
growth_factor_pct100
growth_unverified_reasonno_history

Здоров'я спільноти

25Критичний
Як обчислюється оцінка
0/22.5README
22.5/22.5Ліцензія — визнана ліцензія (Apache-2.0)
0/18Настанови CONTRIBUTING
0/13.5Кодекс поведінки
0/7.2Шаблон issue
0/6.3Шаблон PR
Використані вхідні дані
has_readmeні
has_licenseні
has_contributingні
has_issue_templateні
has_code_of_conductні
has_pull_request_templateні

Сталість та врядування

Чи переживе проєкт своїх людей — бас-фактор, реактивність, хто за ним стоїть і як супроводжуються пакети?

60Помірний · 24% загального індексу

Стійкість мейнтейнерів (бас-фактор)

98Відмінний
Як обчислюється оцінка
54/54Бас-фактор — на 10 контриб’ютор(ів) припадає половина всіх комітів
20.1/22.5Розподіл комітів — головний контриб’ютор — автор 11% комітів
13.5/13.5Широта контриб’юторів — 99 контриб’юторів
10/10OpenSSF Scorecard: Contributors — project has 91 contributing companies or organizations
Використані вхідні дані
bus_factor10
contributors_sampled99
top_contributor_share0,106

Реактивність на issue та PR

20Критичний
Як обчислюється оцінка
0/46.8Вирішення issue — немає issue або даних
10.9/38.3Прийняття PR — злито 2/7 вирішених PR
0/15OpenSSF Scorecard: Code-Review — Found 0/30 approved changesets -- score normalized to 0
Використані вхідні дані
merged_prs2
open_issues0
closed_issues0
issue_closed_ratio—
closed_unmerged_prs5
Виключено з оцінювання (немає даних або не застосовно): Вирішення issue. Залишкові ваги перенормовано.

Власність та опіка

55Помірний
Як обчислюється оцінка
10/30Підтримка власника — особистий (користувацький) обліковий запис
0/20Верифікований домен — не застосовно до користувацьких облікових записів
8.7/25Охоплення власника — 15 підписників у johnwparent
25/25Послужний список — 71 публічних репозиторіїв, вік облікового запису ~7 р.
Використані вхідні дані
followers15
owner_typeUser
is_verified—
owner_loginjohnwparent
public_repos71
account_age_days2 795
Виключено з оцінювання (немає даних або не застосовно): Верифікований домен. Залишкові ваги перенормовано.

Інженерна якість

Чи наявні базові інженерні практики та документація?

58Помірний · 20% загального індексу

Інженерні практики

80Добрий
Як обчислюється оцінка
24/24Процеси CI — 9 процес(ів) CI
24/24Наявні тести
16/16Конфігурація лінтера — .flake8
0/9.6Pre-commit-хуки
0/6.4.editorconfig
0/20OpenSSF Scorecard: CI-Tests — немає даних
Використані вхідні дані
has_ciтак
has_testsтак
has_editorconfigні
has_linter_configтак
has_precommit_configні
Виключено з оцінювання (немає даних або не застосовно): OpenSSF Scorecard: CI-Tests. Залишкові ваги перенормовано.

Документація

25Критичний
Як обчислюється оцінка
0/30README
0/25Каталог документації
15/15Сайт документації / домашня сторінка — https://spack.io
0/10Опис репозиторію
0/10Теми
10/10Wiki
Використані вхідні дані
topics—
has_wikiтак
homepagehttps://spack.io
has_readmeні
has_docs_dirні
has_descriptionні

Безпека

Чи міцні видимі практики безпеки й ланцюга постачання, без непослабленої пов’язаності з юрисдикціями високого ризику?

66Помірний · 16% загального індексу

Стан безпеки

57Помірний
Як обчислюється оцінка
7.5/7.5Binary-Artifacts — no binaries found in the repo
0/7.5Branch-Protection — branch protection not enabled on development/release branches
0/2.5CI-Tests — немає даних
0/2.5CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected
0/7.5Code-Review — Found 0/30 approved changesets -- score normalized to 0
2.5/2.5Contributors — project has 91 contributing companies or organizations
10/10Dangerous-Workflow — no dangerous workflow patterns detected
7.5/7.5Dependency-Update-Tool — update tool detected
0/5Fuzzing — project is not fuzzed
2.5/2.5Ліцензія — license file detected
7.5/7.5Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
0/5Packaging — немає даних
0/5Pinned-Dependencies — немає даних
0/5SAST — no SAST tool detected
5/5Security-Policy — security policy file detected
0/7.5Signed-Releases — немає даних
0/7.5Token-Permissions — detected GitHub workflow tokens with excessive permissions
6/7.5Vulnerabilities — 2 existing vulnerabilities detected
Використані вхідні дані
sourceopenssf_scorecard
checks_evaluated14
scorecard_versionv5.5.0
checks_inconclusive4
scorecard_aggregate5,7
Виключено з оцінювання (немає даних або не застосовно): ci_tests, packaging, pinned_dependencies, signed_releases. Залишкові ваги перенормовано.

Сповіщення про залежності

100Відмінний
Як обчислюється оцінка
35/35Прямі залежності без відомих сповіщень — жодна пряма залежність не має відомих сповіщень
0/25Непрямі залежності без відомих сповіщень — транзитивний набір не відокремлюється від залежностей розробки й тестування в цьому обсязі
0/40Немає задавнених сповіщень — жодне сповіщення не має дати публікації
Використані вхідні дані
sourceosv
advisories3
affected_packages1
assessed_packages24
unassessed_packages2
affected_by_severitycritical 1
direct_affected_packages0
Виключено з оцінювання (немає даних або не застосовно): Непрямі залежності без відомих сповіщень, Немає задавнених сповіщень. Залишкові ваги перенормовано. Звірено 24 резолвлених залежностей із OSV. 2 не вдалося оцінити — немає резолвленої версії, непідтримувана екосистема або поза межами звітованого переліку пакетів. Цей репозиторій не публікує пакета, який резолвить індекс, тож натомість оцінено граф залежностей репозиторію. Цей граф змішує закріплені версії для розробки й тестування зі справді постачаними залежностями, тож оцінюються лише задекларовані runtime-залежності; транзитивні знахідки подаються як контекст і в оцінку не входять. Досяжність не аналізується.

Готовність до ШІ

Наскільки репозиторій оснащений для розробки та супроводу за участі ШІ-агентів? Незалежний, експериментальний бейдж — вага 0.0, тож він подається окремо і не впливає на загальний індекс здоров'я.

70Добрий · 0% загального індексу

Контекст і настанови для агентів

40У зоні ризику
Як обчислюється оцінка
0/45Інструкції для агентів — немає CLAUDE.md / AGENTS.md / правил редактора
0/15Машиночитана документація (llms.txt)
40/40Читабельна історія комітів — намір зазначено у 98 з 98 людських комітів (структурований заголовок або пояснювальний текст)
Використані вхідні дані
has_llms_txtні
legible_history_share1
agent_instruction_files—
agent_instruction_max_bytes—

Цикл верифікації (збірка / тести / перевірка типів)

89Відмінний
Як обчислюється оцінка
18/18Розгортання однією командою — lib/spack/docs/Makefile, lib/spack/spack/test/data/make/affirmative/capital_makefile/Makefile, lib/spack/spack/test/data/make/affirmative/check_test/Makefile, lib/spack/spack/test/data/make/affirmative/expansion/Makefile, lib/spack/spack/test/data/make/affirmative/gnu_makefile/GNUmakefile, lib/spack/spack/test/data/make/affirmative/include/Makefile, lib/spack/spack/test/data/make/affirmative/lowercase_makefile/makefile, lib/spack/spack/test/data/make/affirmative/prerequisites/Makefile, lib/spack/spack/test/data/make/affirmative/spaces/Makefile, lib/spack/spack/test/data/make/affirmative/test_check/Makefile, lib/spack/spack/test/data/make/affirmative/three_targets/Makefile, lib/spack/spack/test/data/make/negative/partial_match/Makefile, lib/spack/spack/test/data/make/negative/variable/Makefile, share/spack/templates/depfile/Makefile
22/22Автоматизовані тести
11/11Конфігурація лінтера / форматера — .flake8
11/11Статична перевірка типів — lib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed
10/10Відтворюване середовище — devcontainer, Dockerfile
0/10Підтверджена практика роботи з агентами — серед останніх 100 комітів немає створених агентом
8/8Автоматизоване супроводження — 2 з останніх 100 комітів — автоматичні оновлення залежностей
0/10OpenSSF Scorecard: Pinned-Dependencies — немає даних
Використані вхідні дані
has_nixні
has_testsтак
lockfiles—
has_dockerfileтак
typed_languageні
bootstrap_fileslib/spack/docs/Makefile, lib/spack/spack/test/data/make/affirmative/capital_makefile/Makefile, lib/spack/spack/test/data/make/affirmative/check_test/Makefile, lib/spack/spack/test/data/make/affirmative/expansion/Makefile, lib/spack/spack/test/data/make/affirmative/gnu_makefile/GNUmakefile, lib/spack/spack/test/data/make/affirmative/include/Makefile, lib/spack/spack/test/data/make/affirmative/lowercase_makefile/makefile, lib/spack/spack/test/data/make/affirmative/prerequisites/Makefile, lib/spack/spack/test/data/make/affirmative/spaces/Makefile, lib/spack/spack/test/data/make/affirmative/test_check/Makefile, lib/spack/spack/test/data/make/affirmative/three_targets/Makefile, lib/spack/spack/test/data/make/negative/partial_match/Makefile, lib/spack/spack/test/data/make/negative/variable/Makefile, share/spack/templates/depfile/Makefile
has_devcontainerтак
has_linter_configтак
typecheck_configslib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed
agent_commit_share0
toolchain_manifests—
dependency_bot_commit_share0,02
Виключено з оцінювання (немає даних або не застосовно): OpenSSF Scorecard: Pinned-Dependencies. Залишкові ваги перенормовано.

Читабельність коду для моделей

81Добрий
Як обчислюється оцінка
27/45Типізований код — Python з конфігурацією перевірки типів (lib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed)
53.9/55Керовані розміри файлів — 21/1 029 файлів вихідного коду понад 60 КБ
Використані вхідні дані
primary_languagePython
largest_source_bytes231 403
source_files_sampled1 029
oversized_source_files21

Ключові факти

3зірок GitHub
99контриб'юторів
1 011комітів за останні 12 місяців
2днів від останнього пушу
29релізів
10бас-фактор
0відкритих issue
PyPIпакетних екосистем

Попередження щодо збору даних

  • Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
  • Community profile unavailable
  • Could not fetch pypi package 'spack' from its registry

Докладніше

OpenSSF Scorecard 5.7 / 10
5.7сукупно

Незалежна, не прив'язана до інструментів оцінка безпеки від відкритого проєкту OpenSSF Scorecard. Кожна перевірка винагороджує практику безпеки, а не інструмент конкретного постачальника. Перевірки, які Scorecard не зміг визначити, позначено н/д і виключено з оцінки безпеки (вони ніколи не зараховуються як нуль).Scorecard v5.5.0 · 2026-07-26 18:35 UTC

10Binary-Artifactsno binaries found in the repo
0Branch-Protectionbranch protection not enabled on development/release branches
н/дCI-Testsno pull request found
0CII-Best-Practicesno effort to earn an OpenSSF best practices badge detected
0Code-ReviewFound 0/30 approved changesets -- score normalized to 0
10Contributorsproject has 91 contributing companies or organizations
10Dangerous-Workflowno dangerous workflow patterns detected
10Dependency-Update-Toolupdate tool detected
0Fuzzingproject is not fuzzed
10Licenselicense file detected
10Maintained30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
н/дPackagingpackaging workflow not detected
н/дPinned-Dependenciesinternal error: internal error: invalid Dockerfile
0SASTno SAST tool detected
10Security-Policysecurity policy file detected
н/дSigned-Releasesno releases found
0Token-Permissionsdetected GitHub workflow tokens with excessive permissions
8Vulnerabilities2 existing vulnerabilities detected
Прямі залежності 1
РеєстрПакетОбмеження версіїМаніфест
PyPIclingo—pyproject.toml
Усі залежності 26

Повний розв'язаний набір залежностей із графа залежностей GitHub: 1 прямих і 25 непрямих (транзитивних) пакетів. Транзитивне замикання є повним, коли в репозиторії закомічено lockfile.

РеєстрПакетВерсіяЗв'язок
PyPIclingo5.8.0пряма
PyPIblack25.12.0непряма
PyPIcoverage—непряма
PyPIcoverage7.14.0непряма
PyPIdocutils0.22.4непряма
PyPIflake87.3.0непряма
PyPIfuro2025.12.19непряма
PyPIisort7.0.0непряма
PyPImypy1.20.1непряма
PyPIpip—непряма
PyPIpygments2.20.0непряма
PyPIpylint4.0.5непряма
PyPIpytest9.0.3непряма
PyPIpytest9.1.1непряма
PyPIpytest-cov7.1.0непряма
PyPIpytest-xdist3.8.0непряма
PyPIruamel-yaml0.19.1непряма
PyPIruff0.15.14непряма
PyPIslotscheck0.19.1непряма
PyPIsphinx9.1.0непряма
PyPIsphinx-copybutton0.5.2непряма
PyPIsphinx-last-updated-by-git0.3.8непряма
PyPIsphinx-sitemap2.9.0непряма
PyPIsphinxcontrib-programoutput0.20непряма
PyPIsphinxcontrib-svg2pdfconverter2.1.0непряма
PyPIvermin1.8.0непряма
Сповіщення про залежності 1

Цей репозиторій не публікує пакета, який розпізнає індекс, тож оцінено його власний граф залежностей — 24 пакетів, серед яких є й піниї розробки та тестування, що ніколи не постачаються: 1 мають відомі сповіщення, з них 0 прямі. 2 не вдалося оцінити — немає резолвленої версії, непідтримувана екосистема або поза наведеним переліком пакетів.

ПакетВерсіяЗв'язокКритичністьСповіщеньВиправлено в
black25.12.0непрямакритична326.3.1

Сповіщення означає, що версія, записана в графі залежностей, потрапляє в уражений діапазон. Досяжність не аналізується, а граф містить піниї розробки й тестування — знахідка може стосуватися інструментів, а не поставленого коду.

Звіт у форматі JSON машиночитний
{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": true,
      "size_kb": 240109,
      "has_wiki": true,
      "homepage": "https://spack.io",
      "languages": {
        "C": 38431,
        "Lua": 3080,
        "Tcl": 3709,
        "HTML": 2418,
        "CMake": 4652,
        "Shell": 526271,
        "Python": 8394389,
        "Lambdapi": 128065,
        "Makefile": 9844,
        "Batchfile": 12132,
        "Dockerfile": 11727,
        "PowerShell": 8058,
        "Standard ML": 22142,
        "Answer Set Programming": 14743
      },
      "pushed_at": "2026-07-23T22:04:14Z",
      "created_at": "2021-06-15T21:21:57Z",
      "owner_type": "User",
      "updated_at": "2026-07-23T19:01:22Z",
      "description": "A flexible package manager that supports multiple versions, configurations, platforms, and compilers.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "develop",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Python",
      "significant_languages": [
        "Python"
      ]
    },
    "owner": {
      "blog": null,
      "name": "John W. Parent",
      "type": "User",
      "login": "johnwparent",
      "company": "@Kitware",
      "location": null,
      "followers": 15,
      "avatar_url": "https://avatars.githubusercontent.com/u/45471568?v=4",
      "created_at": "2018-11-29T22:46:10Z",
      "is_verified": null,
      "public_repos": 71,
      "account_age_days": 2795
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": false
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.16.2",
          "kind": "patch",
          "published_at": "2021-05-22T21:57:30Z"
        },
        {
          "tag": "v0.16.1",
          "kind": "patch",
          "published_at": "2021-02-19T19:06:33Z"
        },
        {
          "tag": "v0.16.0",
          "kind": "minor",
          "published_at": "2020-11-18T12:22:09Z"
        },
        {
          "tag": "v0.15.4",
          "kind": "patch",
          "published_at": "2020-08-13T07:41:59Z"
        },
        {
          "tag": "v0.15.3",
          "kind": "patch",
          "published_at": "2020-07-28T09:11:06Z"
        },
        {
          "tag": "v0.15.2",
          "kind": "patch",
          "published_at": "2020-07-23T23:04:26Z"
        },
        {
          "tag": "v0.15.1",
          "kind": "patch",
          "published_at": "2020-07-10T23:54:49Z"
        },
        {
          "tag": "v0.15.0",
          "kind": "minor",
          "published_at": "2020-06-30T23:21:32Z"
        },
        {
          "tag": "v0.14.2",
          "kind": "patch",
          "published_at": "2020-04-15T21:32:01Z"
        },
        {
          "tag": "v0.14.1",
          "kind": "patch",
          "published_at": "2020-03-20T19:29:44Z"
        },
        {
          "tag": "v0.14.0",
          "kind": "minor",
          "published_at": "2020-02-24T01:08:15Z"
        },
        {
          "tag": "v0.13.4",
          "kind": "patch",
          "published_at": "2020-02-07T22:52:07Z"
        },
        {
          "tag": "v0.13.3",
          "kind": "patch",
          "published_at": "2019-12-24T07:48:11Z"
        },
        {
          "tag": "v0.13.2",
          "kind": "patch",
          "published_at": "2019-12-05T06:02:41Z"
        },
        {
          "tag": "v0.13.1",
          "kind": "patch",
          "published_at": "2019-11-05T09:49:17Z"
        },
        {
          "tag": "v0.13.0",
          "kind": "minor",
          "published_at": "2019-10-26T06:19:36Z"
        },
        {
          "tag": "v0.12.1",
          "kind": "patch",
          "published_at": "2019-01-13T22:29:07Z"
        },
        {
          "tag": "v0.12.0",
          "kind": "minor",
          "published_at": "2018-11-13T17:05:17Z"
        },
        {
          "tag": "v0.11.2",
          "kind": "patch",
          "published_at": "2018-02-07T16:45:29Z"
        },
        {
          "tag": "v0.11.1",
          "kind": "patch",
          "published_at": "2018-01-19T21:28:26Z"
        },
        {
          "tag": "v0.11.0",
          "kind": "minor",
          "published_at": "2018-01-17T22:14:45Z"
        },
        {
          "tag": "v0.10.0",
          "kind": "minor",
          "published_at": "2017-01-17T09:36:03Z"
        },
        {
          "tag": "v0.9.1",
          "kind": "patch",
          "published_at": "2016-05-18T15:30:13Z"
        },
        {
          "tag": "v0.8.17",
          "kind": "patch",
          "published_at": "2015-03-24T17:17:18Z"
        },
        {
          "tag": "v0.8.16",
          "kind": "patch",
          "published_at": "2015-03-14T03:41:59Z"
        },
        {
          "tag": "v0.8.15",
          "kind": "patch",
          "published_at": "2015-02-24T18:42:58Z"
        },
        {
          "tag": "v0.8.11",
          "kind": "patch",
          "published_at": "2014-11-06T21:22:15Z"
        },
        {
          "tag": "v0.8.10",
          "kind": "patch",
          "published_at": "2014-10-28T06:04:47Z"
        },
        {
          "tag": "v0.8.5",
          "kind": "patch",
          "published_at": "2014-09-19T16:56:00Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "20a23061245eff65fd609957e15e3ad06fd53eb7",
          "body": "The package hash of a spec is supposed to describe the package.py it is\nconcretized\nwith, but both lookups that produce it went by name instead of fullname.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "package hash: resolve package by namespace (#52777)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-23T14:23:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6c801651161ba0764eccb4efe9672f887526dc3c",
          "body": "nothing functional, just that the job is rendered `ubuntu (3.7,\nubuntu-22.04)` instead of `(ubuntu-22.04, 3.7)` like the others.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "gha: swap os<->python-version in unit-tests (#52763)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-22T22:41:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e4d5e4020cba852790afa3f46977caff05eff81c",
          "body": "`spack uninstall` currently allows `-R/--dependents` to uninstall all\ndependents, this PR adds an option to uninstall only implicitly\ninstalled dependents. Used `-r/--implicit-dependents` as the signature\nto match the (IMO poorly) named existing option.\n\nIncludes tests.\n\nAs part of this refactor, re\n[…]\n`-R/--dependents` from the common\narguments module, since it's only used for uninstall and I don't want to\npollute other commands with it.\n\n---------\n\nSigned-off-by: Gregory Becker <becker33@llnl.gov>",
          "is_bot": false,
          "headline": "cmd/uninstall: option to uninstall implicit dependents (#52652)",
          "author_name": "Greg Becker",
          "author_login": "becker33",
          "committed_at": "2026-07-22T16:50:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d511ff7f11dfc5d37a5927da2100e38482b0216f",
          "body": "…(#52759)\n\nReduce and make explicit the use of the `spack.config.CONFIG`,\n`spack.store.STORE` and `spack.repo.PATH` globals.\n\nThere are two related things in this PR:\n\n- In tests, use the `config` / `mutable_config`, `temporary_store` and\n`mock_packages` fixtures instead of reaching for the globals \n[…]\nbeing set. The same reasoning applies to\n`spack.store.STORE` and `spack.repo.PATH`. Tests can then be refactored\nto pass the instance.\n\n---------\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "config, store, repo: make global use explicit and reduce it in tests …",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-22T15:26:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c28b22c92656df5625738688665ac5c739b36411",
          "body": "## Summary\n\nMake `spack.util.module_cmd.load_module()` return successfully when its\nrequested module is already listed in `LOADEDMODULES`.\n\nAdd a regression test covering this idempotent module-load behavior.\n\n## Problem\n\n`load_module()` uses a change in `LOADEDMODULES` as evidence that a\nmodule loa\n[…]\nDEDMODULES` unchanged.\n\n## Disclosure\n\nThis change was developed with assistance from OpenAI GPT-5.6 Terra and\nreviewed by the contributor.\n\nSigned-off-by: Matthew Thompson <matthew.thompson@nasa.gov>",
          "is_bot": false,
          "headline": "module_cmd: allow loading already-loaded modules (#52752)",
          "author_name": "Matt Thompson",
          "author_login": "mathomp4",
          "committed_at": "2026-07-22T01:50:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2d1cea34f43d4d681c2ac4e310d97c4255b36cab",
          "body": "On Python 3.14 and macOS we use forkserver with a couple modules\npreloaded to improve startup time. This adds `spack.test.conftest` which\nshould improve test runtime significantly as it pulls in more of spack\ncore with it. In tests it's relevant cause we pass monkeypatches down to\nthe install subproces, so more modules are needed than at runtime.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "tests: preload spack.test.conftest in the forkserver (#52764)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-21T18:46:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "71c6db9eee0a4aa7884b5753685d615de695842e",
          "body": "Ctypes invocations need typing for both their args and their return\ntypes, otherwise the typing is left ambiguous, and spurious errors can\noccur due to the underlying types `ctypes` will pass to the win32 api.\nExplicitly typing `restype` and `argtypes` prevents this and ensures the\ncorrect types are forwarded back and forth from ctypes to the win32 api.\n\n---------\n\nSigned-off-by: John Parent <john.parent@kitware.com>",
          "is_bot": false,
          "headline": "Spack on Windows: windows_sfn type handling (#52681)",
          "author_name": "John W. Parent",
          "author_login": "johnwparent",
          "committed_at": "2026-07-21T18:29:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c2e5f49c353f79e007386d5bf734980d6a02b105",
          "body": "* use forkserver on macos\n* use our clingo binaries on macos\n* uniformly split smoke tests from unit tests\n* drop 3.7 from prs (matrix bug?)\n* combine clingo ffi and clingo v6 jobs\n* drop `SPACK_PYTHON` var\n* drop xml coverage report (coverage dir is uploaded, not xml)\n* remove unused `pip install click`\n* drop `spack spec` smoke test\n* extract composite local setup-spack action\n\n---------\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "gha: cleanup (#52755)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-20T18:37:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ba367637785a944641f8f5dd93274fba527cb5a4",
          "body": "Add a short guide for all Spack jargon.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "docs: add index and glossary (#51102)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-17T13:50:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "14efdb671343065516a54d6b56a7761f0ab2f678",
          "body": "The `run-unit-tests` wrapper made it opaque what CI actually runs: of\nthe seven unit-test jobs, only the `ubuntu` job used it, every other job\nalready invokes `pytest` directly in the workflow. This PR deletes the\nscript and inlines its useful parts as explicit workflow steps.\n\n- Smoke tests: (`spac\n[…]\nger sources\n`qa/setup.sh`. This also fixes `[ ! -z \"env_cfg\" ]` which tested a\nliteral string (missing `$`).\n- Docs references updated\n\n---------\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "ci: remove share/spack/qa/run-unit-tests wrapper (#52747)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-17T13:17:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2553607cba2b99276ff38f36865fa5ad7697f558",
          "body": "`all` is a catch-all key, not a spec: `satisfies(\"all\")` triggered a\npackage lookup on every `path_for_spec` call to check whether `all` is a\nvirtual provided by the spec.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "projections: check the \"all\" before satisfies (#52743)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-17T09:50:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7ae0f5f28121c1f3a92f9bffcf0f1192872a69ed",
          "body": "Some tests resolved packages without a repo fixture and imported\n`spack_repo.builtin` instead\n\n`mirror.py` and `url_fetch.py` tests mutated the class-level `versions`\ndict of\ncached package classes in place. Use `monkeypatch.setitem` so the mock\narchive\nURL does not leak into later tests.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "tests: fix stateful tests (#52744)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-17T09:46:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b9c2a77e26f764fe6dcefd139b45e0f87185d53d",
          "body": "If env activate is the first to touch the lazy `spack.repo.PATH`\nsingleton, the\nsaved `repo_token` materializes only after the env scope is pushed, so\ndeactivate restores the env's own repositories. Same bug as\n8bdac91611a6.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "env activate: ensure_unwrapped before swap (#52745)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-17T09:45:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "21577db5686ff231631b304b69c232ade43d99eb",
          "body": "Extract the reference to the globally active environment into a new\nlow-level module `spack.active_environment`, and make it the only way to\nobtain the active environment:\n\n    from spack.active_environment import active_environment\n\n    env = active_environment()\n\nThis makes the dependency on globa\n[…]\nokup`\nand `spack.environment`.\n\nBy also making `Environment.activate` a method, we also eliminate the cyclic\nimport with `subprocess_context.py`.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "active_environment.py: extract from environment (#52731)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-17T09:27:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ec7a9bac94e97c4519414c4836fdd745d2e04737",
          "body": "The leftover `%` after the f-string caused a type error instead of the\nintended\nexception when a namespace is invalid.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "repo.py: fix TypeError when raising InvalidNamespaceError (#52689)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-17T08:54:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "526fd687c72c326c5f6b3f3ac87a6c0476c5a1aa",
          "body": "…for spliced specs (#52665)\n\n`spec_dict_to_json` avoids making yet another node identifier for specs\nby using DAG hashes, but it neglected to cache them bottom-up. If there\nare many abstract specs in a DAG/env/etc., this means we get exponential\nrecomputation of hashes. This could cause extremely lo\n[…]\na traversal bug where\nreused spliced specs can have dangling hashes. Avoid spliced specs for\nnow and just disable caching for them since they are rare.\n\nSigned-off-by: Todd Gamblin <tgamblin@llnl.gov>",
          "is_bot": false,
          "headline": "concretization cache: fix exponential time complexity issue; disable …",
          "author_name": "Todd Gamblin",
          "author_login": "tgamblin",
          "committed_at": "2026-07-17T08:46:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0fe003d068e00450c4862e40ba317e8335deb6fc",
          "body": null,
          "is_bot": false,
          "headline": "Fix spack isolate --self (#52725)",
          "author_name": "John Gouwar",
          "author_login": "JohnGouwar",
          "committed_at": "2026-07-15T19:53:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b542f6acd0d72428bfe82ed25f2314e31b8e188a",
          "body": "Merge-queue style error (one PR removed a fixture, another added some\ntests that used it): this updates the added tests.\n\nSpecifically: replace default_mock_concretize in new tests from 9e527f7b\nfollowing 5c13da4c54\n\nSigned-off-by: Peter Scheibel <scheibel1@llnl.gov>",
          "is_bot": false,
          "headline": "Fix tests on develop (#52742)",
          "author_name": "Peter Scheibel",
          "author_login": "scheibelp",
          "committed_at": "2026-07-15T18:25:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "94231de440f4261c21f59ad18e702974172fa755",
          "body": "Fixes a couple issues from 18f807e, which introduced ACL-based\npermission handling to Spack on Windows.\n\nCurrent ACL operations assumed that files were available with\nWRITE_OWNER permissions, as that is the default state of files when\ncreated by the OS. However if Spack or another program has alread\n[…]\npermissions\nto newly-installed files in package builds) is updated to add\nnecessary permissions for files that were previously omitted.\n\n---------\n\nSigned-off-by: John Parent <john.parent@kitware.com>",
          "is_bot": false,
          "headline": "Windows: fixes to ACL-based permissions handling (#52726)",
          "author_name": "John W. Parent",
          "author_login": "johnwparent",
          "committed_at": "2026-07-15T16:56:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9e527f7b49679648fa8d1be816a1ab7d89ba896d",
          "body": "Replace the `highlight_version_fn` and `highlight_variant_fn` parameters\nof `Spec.format()` returning a Boolean with three style callbacks that\nreturn the `PartStyle` enum.\n\nThis enum can currently take four values:\n1. NORMAL\n2. HIGHLIGHT\n3. DIM\n4. HIDDEN\n\nHIGHLIGHT currently renders that spec part in red. DIM renders the part\nin grey-out color. HIDDEN suppresses it entirely from the output.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "spec: replace highlight callbacks with style-based callbacks (#52211)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-15T16:02:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9ac52784576023d50cb05e25096cec72296e9ae6",
          "body": "`spack list --format ...` ran `git config --get remote.origin.url` and\n`git rev-parse` for every package to build the source link in the html\nand json output.\n\nInstead of querying git, derive the url from the `repos:` configuration.\nA RemoteRepoDescriptor already knows the authoritative git url it c\n[…]\nke the tests work, `use_repositories` needs to preserve the Repo\ninstance instead of \"serializing\" to config and then reconstructing from\nconfig.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "cmd/list: resolve git info once per repo (#52713)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-15T14:04:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c6603435671004d9eabd4a9b1f1d665f194dcdc6",
          "body": "* when caching is disabled, do not compute a multi-megabyte cache key\n  string redundantly\n* do not attempt to remove comments, as they account for only ~2% of the\n  size, and are unlikely to change without other changes in ASP\n  rules/facts that invalidate the cache.\n* restore use of in-place `rand\n[…]\nthe `ordering` timer phase\nof `spack solve --timers` drops from ~158ms to ~36ms.\n\nIt's minor, but it's both shorter in implementation and faster.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "asp.py: speed up cache key (#51861)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-15T13:57:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5d520228c138a87b3b6a43fa78767ce4a3a3f9fd",
          "body": "Discovered from spurious failures of:\n- test_module_function_change_env_with_module_src_cmd\n\nWhen `MODULESHOME` is set, module() prepends `source\n$MODULESHOME/init/bash` to the command whose merged stdout/stderr is\nparsed as awk's NUL-separated `NAME=VALUE` dump.\n\nThat sourcing was not output-suppre\n[…]\nissing its output can land ahead of the dump in the captured stream,\nwith no NUL separator, corrupting the first parsed variable name.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "module: suppress output from sourcing init file (#52740)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-15T12:37:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ceb0009ce40146f9ab9bc478978c0ca5517b462e",
          "body": "This adds 3 independent fixes to reduce syscall overhead during pytest,\nwhich is presumably what makes tests run slow in CI, since concretizer\ncache was not very significant.\n\nThis is some of the low-hanging fruit based on profiling data.\n\n- **tests: drop per-test purge of spack_repo modules**\n- **tests: build git fixture repos once per session**\n- **tests: restore mutable_database in-memory tarball**\n\n---------\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "tests: reduce syscalls (#52736)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-15T12:05:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e8d3d363a61495870dca747d2840a7e39bf1308a",
          "body": "Currently, on systems where the host target is not supported by the\ndefault compiler, Spack tries to swap compilers in order to optimize for\nthe target.\n\nThis situation is unfrequent, but the behavior is surprising - if GCC is\nthe preferred compiler users would prefer to see a lower target than\nhave\n[…]\nizations below compiler selection\n\nAs a bonus, we also improved the output for the optimization criteria,\nwhich are now shown grouped:\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "solver: deprioritize target selection (#52654)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-15T08:57:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ac21ee03b84d6b2a6afee1ef1fe63ac982c2c49a",
          "body": "Several unit tests performed DNS lookups and connections:\n\n- `test_ci_dynamic_mapping_*`: the buildcache-destination mirror\n  `https://my.fake.mirror` was probed with an HTTPS HEAD request during\n  ci generate (`url_exists` on the index). Use a local `file://` mirror.\n- `test_ci_rebuild_mock_success\n[…]\nk_fetch`, so every build child\n  process fetched `http://www.example.com/...tar.gz` for each package in\n  the DAG (27 fetches). Add `mock_fetch`.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "tests: no networking in unit tests (#52737)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-15T08:56:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "de4dd3a4226615f89c666b25d8b6023c568d863e",
          "body": "Previously only the database lock respected --disable-locks.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "Make all locks respect `--disable-locks`  (#52270)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-15T08:10:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "abbcc3efa716b6e567fa81462e17a4bdadbfbb53",
          "body": "Signed-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "tests: installer_variant on windows (#52738)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-15T06:18:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bc83af5a54cee6cd9f85256862a895cf560e8ab0",
          "body": "Remove return that is never used, no need to allocate memory for\nnothing.\n\nSigned-off-by: Ryan Krattiger <ryan.krattiger@kitware.com>",
          "is_bot": false,
          "headline": "Remove return of fingerprints that is never used (#52699)",
          "author_name": "Ryan Krattiger",
          "author_login": "kwryankrattiger",
          "committed_at": "2026-07-14T18:26:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "40700770e94a5912122242c2d5eb698eb6820a6b",
          "body": "These mock packages compiled elaborate C++ sources at install time. The\nonly thing the tests care about is that the resulting binaries embed\ntheir install paths as constants and rpaths.\n\nUsing C makes the tests run faster and drops a dependency.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "builtin_mock: use C sources in garply/quux/corge (#52719)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-14T13:55:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "76ba0bff9bf74076e35f46aa5e72c4d83ffea873",
          "body": "Use the fullname when computing patches to apply to a spec to ensure\ncorrect patching list is selected.\nIf users are specifying a lower precedent repo with a different patch\nlist then missing patch errors are triggered.\n\nSigned-off-by: Phil Sakievich <psakievich@gmail.com>",
          "is_bot": false,
          "headline": "spec: use fullname when computing patches (#52675)",
          "author_name": "Phil Sakievich",
          "author_login": "psakievich",
          "committed_at": "2026-07-14T13:50:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5c13da4c5432b78becf1718fa89ac853e450e3bd",
          "body": "`default_mock_concretization` caches input spec -> concrete spec without\ntaking into account changes in config and is thus limited to the default \ntest configuration without mutation. \n\nHere we use the proper concretization cache instead, which doesn't suffer\nfrom these limitations and also works across xdist processes.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "tests: retire default_mock_concretization (#52723)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-14T13:46:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4e02454296ee66c75ae852c1acbb5cf9c00a9a67",
          "body": "This adds `pytest --spack-concretization-cache=DIR` which can be used in\ndevelopment as well as CI to speed up unit tests.\n\nThe solver dominates unit-test CPU time, and roughly half of the ~3000\nASP problems solved in a full suite run are repeats of an earlier one.\n\nAdd a pytest plugin that enables \n[…]\nning misses are problems that embed per-invocation\ntemporary paths. Default behavior without the option is unchanged\n(cache disabled).\n\n---------\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "tests: add concretization cache plugin (#52717)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-14T13:00:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b86f1b889fefd3dbd9ac359e86555e43461d78e1",
          "body": "This should give better load balancing under xdist\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "tests: use --dist worksteal (#52711)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-14T12:13:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f914f5fc9aae5e6e8b0b62858e77efb026250c0a",
          "body": "Workaround for \"Conditional specs do not round trip as dict #52720\".\n\nThat issue should be fixed independently, but I don't see why\nthe concretization cache swaps the user input for the abstract spec\nfrom a file. It feels like it could result in more subtle issues, so\nthis commit avoids possible future issues.\n\n---------\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "concretization cache: use user input spec (#52716)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-14T12:03:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "79b4e71c341750a0f67ab6ce94b6f2e9b00360ef",
          "body": "Restructure the installer tests to follow the recent source restructure.\n\nThe old_ prefix refers to old implementation specific unit tests,\n`install.py` is for integration tests that can in principle parametrize\nthe installer, and `installer/` is about the new installer's\n`spack.installer` package.\n\nWith this, `pytest lib/spack/spack/test/installer/` runs 224 unit tests\nin 7.5ms per test on my desktop.\n\n---------\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "test/installer: new layout, split unit/integration (#52692)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-14T11:47:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "084e490a1999468fa0cf8a1858326c2bb62e9d33",
          "body": "`use_platform` called `spack.config.CONFIG.clear_caches()` through an\ninline\nimport, resulting in a circular dependency.\n\nInvert the dependency: `spack.platforms` exposes a list of\non-host-changed\ncallbacks, and `spack.config` registers its cache clearing there.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "platforms: break cycle with spack.config (#52730)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-14T10:32:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6990b3c0e10273488331a489eea62e5f31891caa",
          "body": "The filter_padding context manager was the only thing in spack.util.path\nthat needed spack.config: it reads config:install_tree:padded_length.\nPadding is an install-tree concept, so move it to spack.store, which\nalready imports config and util.path. The pure padding_filter callables\nstay in util/pat\n[…]\ndy does this better, the old installer should\nreally ask\nthe store for its current config, but I don't want to make changes to\nthe old\ninstaller.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "util/path.py: break cycle with spack.config (#52733)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-14T10:08:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "00b7c12038de59d84524e90bbb93ced1dc0a9fa5",
          "body": "…52658)\n\n`Spec.installed`, `Spec.installed_upstream`, `Spec.install_status` read\nthe global store from inside the `property` or method. This is bad\ndesign for two reasons:\n1. A dependency on `STORE` is hidden behind a property, and more\nimportantly\n2. It should not be a concern of the `Spec` to know\n[…]\nec as\nargument.\n\nThe `Spec.installed` and `Spec.installed_upstream` properties will be\nremoved in a dedicated follow-up PR.\n\n---------\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "Spec: remove the `.installed` and `.installed upstream` properties (#…",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-14T08:56:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2aa12f2ac0c65c9c3184bce3cd2d20dac21825d4",
          "body": "This commit removes `Spec.spack_install` and `Spec.spack_root` and\nreduces the places where `Spec` needs `STORE`.\n\nRemoval seems safe for the following reasons:\n- Neither token is used by any config, module template, package recipe,\nview/install-tree projection, or .rst doc anywhere in the tree. The\n[…]\nview/module/stage), so it is redundant or breaks the join.\n\nIt was added in #120 as SPACK_INSTALL without any discussion of use cases.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "Spec: remove `spack_root` and `spack_install` properties (#52722)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-14T08:46:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e5fdefe5a0e3f1e0b1622010efe5b937fa3f3d17",
          "body": "External compilers failed to concretize when they had dependencies.\n\nThe problem originated from how compilers were parsed from config. \nCompilers were previously filtered _before_ processing externals, leading\nto cases where non-compiler externals were not parsed and thus not \nconsidered as valid d\n[…]\narsing all externals.\n\nSigned-off-by: John Gouwar <jgouwar@gmail.com>\nCo-authored-by: JohnGouwar <JohnGouwar@users.noreply.github.com>\nCo-authored-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "Fix external compilers with dependencies. (#52644)",
          "author_name": "John Gouwar",
          "author_login": "JohnGouwar",
          "committed_at": "2026-07-13T18:42:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "19c68e2eb55b2dad2de06d5ac7f6878ce28be5f1",
          "body": "* Use scandir to make `is_file()` free\n* Use tell-dont-ask to avoid both redundant stat calls and TOCTOU issues\n* Remove a test that tests an implementation detail about skipping a store\n   if the entry exists, which only happens during a race of two processes,\n   which is already a lock free atomic operation.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "concretization cache: avoid redundant syscalls (#52721)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-13T18:26:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8f27c70881f8618a7f1c1bf138b3825ba7c0f513",
          "body": "Concretization cleanup was called after every solve, listing and\nstat'ing every cache entry each time even though it early-returns under\nthe entry limit.\n\nAs part of enabling cache under unit tests, I found that it runs ~5\nmillion stat calls resulting in 52 seconds of CPU time.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "concretization cache: prune only after write (#52715)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-13T18:24:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "74bf8031f4e21526489016471f1cea022c5a0596",
          "body": "This + a refactor of module writers is enough to run tests in a randomized order per test (not\njust per module).\n\nTested by running tests 6 times in random order.\n\n---------\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "tests: allow randomized order (#52710)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-13T13:32:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "10371204e9f758797c419ff87c0566523c5d5b40",
          "body": "This PR replaces a class level cache with a DI cache. In this way a\ncache cannot outlive a single \"logical operation\" and no manual clearing\nis ever needed in tests.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "modules: replace class level cache with DI cache (#52718)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-13T13:22:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "07ab9c4706fcfc2aae87d9e5b32c0e2d95b31311",
          "body": "Serializing an abstract spec with a partial architecture like\n`os=redhat6` or `platform=test` crashes with an error like\n\n```\nAttributeError: 'NoneType' object has no attribute 'vendor'\n```\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "ArchSpec: fix to_dict/from_dict for abstract specs (#52714)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-13T10:57:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c6ac90d5b4c3dd2523e6259a2f1637e61da6629c",
          "body": "The parallel-package-a/b/c mock packages slept 2, 6 and 2 seconds in\ntheir install method to simulate build duration.\n\nThis property is not used in tests :).\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "builtin_mock: remove sleep from parallel-package (#52712)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-13T09:06:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9c810ad62e45d2dee3f073ed6495270313d9f03a",
          "body": "`CONFIG.set(path_or_scope, value, scope=scope_name)` can raise an\nexception, and then the temporary scope isn't removed.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "config.py: don't leak scope when override fails (#52709)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-13T07:58:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8bdac91611a6bfcb2dd173274e575f8433786835",
          "body": "When `use_repositories` was the first thing in the process to touch the\nlazy spack.repo.PATH singleton, PATH was materialized from\nspack.config.CONFIG *after* the new repos scope was already pushed.\n\nThe \"saved\" old repo was then the new repo itself, and on exit it would\nrestore the repositories it was supposed to remove.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "use_repositories: ensure_unwrapped before swap (#52696)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-11T07:48:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1145dfd34c74c2a8f9ca5800ae7ea937a6447447",
          "body": "Extracted from #52117 \n\nAdd method to extract the spec hash from a manifest name.\n\n---------\n\nSigned-off-by: Ryan Krattiger <ryan.krattiger@kitware.com>",
          "is_bot": false,
          "headline": "Build cache: Add decompose manifest name function (#52683)",
          "author_name": "Ryan Krattiger",
          "author_login": "kwryankrattiger",
          "committed_at": "2026-07-10T19:05:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "194757edf2c4db36d368e8b8372e2113a2620953",
          "body": "Pass `extra_args` as named parameters\nHandle if_match using put_object\n\n---------\n\nSigned-off-by: Ryan Krattiger <ryan.krattiger@kitware.com>",
          "is_bot": false,
          "headline": "Fixes for web_util.push_to_url (#52682)",
          "author_name": "Ryan Krattiger",
          "author_login": "kwryankrattiger",
          "committed_at": "2026-07-10T16:47:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b53d5ec3ae3de53d8b772ec027f8cdf5301e7501",
          "body": "Small readability cleanups in the terminal UI of the new installer. No\nchange in behavior intended.\n\n---------\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new installer: UI cleanups (#52690)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-10T14:21:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "acb0321a44f7a8051b7222b6b5be4cb3e520d3bf",
          "body": "fixes #14011\n\n---------\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "documentation: add hints hon how to get a Fortran compiler (#52680)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-10T14:16:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "120ac6f605868036b43c9a4f8182ed57758eabb2",
          "body": "Flags were previously injected when `%[deptypes-build]<compiler>` but in\na few cases a possible compiler is used only as a library. This rule now\nis gated on the virtual being provided, which solves the original issue.\n\nThere are still issues when two compilers bearing flags are used for\ndifferent l\n[…]\nxisting and\ndifficult to solve cleanly since there are flags which are language\nagnostic (`cppflags`, `ldflags`, `ldlibs`).\n\n---------\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "solver: only inject compiler flags when used as a compiler (#52672)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-10T12:42:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fbff43beb248e643716f0ce0f072f9415eda61ac",
          "body": "…gle virtual spot (#52641)\n\n**Before**\n```console\n$ spack spec caliper +papi %c,cxx,fortran=llvm ^papi %c,cxx,fortran=gcc\n==> Error: Spack concretizer internal error. Please submit a bug report at https://github.com/spack/spack and include the command and environment if applicable.\n    caliper+papi \n[…]\n concrete, compilers are allowed for the cxx language\n     6. Only external, or concrete, compilers are allowed for the c language\n```\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "solver: better error message when multiple provider compete for a sin…",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-10T12:39:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9713b53dc3360376fe32955239dedf62af83a513",
          "body": null,
          "is_bot": false,
          "headline": "docs: update code formatter (#52671)",
          "author_name": "Richarda Butler",
          "author_login": "RikkiButler20",
          "committed_at": "2026-07-10T11:00:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "668d4b2b26ea88f4f9b5876c427b1c75a7dc3c4f",
          "body": "* Move `new_installer*.py` to `installer/*.py`\n* Split up `new_installer.py` into ui, schedule, ...\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "spack.installer: sub-package for new installer (#52677)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-10T09:36:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d51ea840ea10c6b18e57be6276a9176dab5677e4",
          "body": "Prep work to move the new installer to `spack.installer`\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "spack.installer -> spack.old_installer (#52673)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-10T08:43:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "13eaa1428115e594bcf62afac6701b2e2efb7109",
          "body": "Tests enabled by the preceding refactors: the event loop is tested\nwith an injected UI instance and build launcher.\n\nAlso cover the schedule_builds prefix invariant errors, PosixJobServer\nattaching to an existing jobserver from MAKEFLAGS, and a few small\nTerminalUI rendering branches.\n\nIt enables al\n[…]\nime per test is\n40ms.\n\nThe remainder is `start_build` etc, which isn't well suited for unit\ntesting, and is already covered by integration tests.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer.py: enable/add unit tests (#52642)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-09T16:30:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "24ecb489befa7d8ddf4ac6163c3d30819ad85915",
          "body": "This makes it possible to test the event loop without launching actual\nsub-processes.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer.py: use DI for build launcher (#52674)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-09T13:15:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "edff30d7763507f430f987f4c717a0c499497577",
          "body": "Replace BuildStatus, which mixed terminal rendering with event loop\nbookkeeping, with an explicit UI class:\n\n- InstallerUI defines the interface between the event loop and a\nfrontend. Event loop -> UI notifications are methods that receive plain\n  data; they are no-ops in the base class, which there\n[…]\nerminal frontends.\n\nThis commit is pure refactor, unit tests for the event loop are added\nwhen the\nbuild \"launcher\" is also decoupled.\n\n---------\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer.py: decouple ui from event loop (#52661)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-09T11:06:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "97362fd96df5fb619a99b04882e8ed717242c945",
          "body": "fixes #7487\n\nBefore we were incorrectly using `constraint in spec` instead of\n`spec.satisfies(constraint)`, which would cause double matches when full\nnames are used. Fix that and add a regression test.\n\n---------\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "modules: fix spec matching with suffixes (#52669)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-09T07:25:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "18f807ec69a7b70169ff0bedd8717701de4933f2",
          "body": "File permissions are handled differently on Windows vs. Linux. This\nPR adds an interface to the Windows model of file permissions. A few\nhigh-level methods in Spack that modify file permissions (e.g.\nsetting 755 permissions on the install prefix) have been updated to\nuse this interface.\n\nWindows als\n[…]\ne, so without the changes in this PR,\nthere are some cases where we would be unable to set read/write with\nsomething like chmod at all.\n\n---------\n\nSigned-off-by: John Parent <john.parent@kitware.com>",
          "is_bot": false,
          "headline": "Windows: Model Access Control Lists (ACLs) (#51903)",
          "author_name": "John W. Parent",
          "author_login": "johnwparent",
          "committed_at": "2026-07-09T01:40:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6f2e9a5f08a0006b89e383ae917e40a44a458777",
          "body": "Apply ruff PLR0402 across non-vendored files: rewrite `import a.b as b`\nas `from a import b`.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "style: explicit from-import instead of import-as (#52592)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-07T13:28:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ccebd9c6ccc2a586251f67a0dee0921d45722e36",
          "body": "In recent python `[x for x in xs]` is lowered to an append-loop, which\nis faster than the generator (two frames, fewer allocs).\n\nApply ruff C400/C401/C402 across non-vendored files: turn list/set/dict\naround a generator expression into the corresponding comprehension.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "style: drop unnecessary generators (#52591)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-07T13:28:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "351c8bff8c6a0617ee7f5d02d236f05483b07a08",
          "body": "Signed-off-by: Gregory Becker <becker33@llnl.gov>\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>\nCo-authored-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "Move spack.llnl.util.tty to spack.util.tty (#52513)",
          "author_name": "Greg Becker",
          "author_login": "becker33",
          "committed_at": "2026-07-07T11:44:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2b1bf3d33eb2f226610dac7a261721f2f06c1d4f",
          "body": "The check was initially added in #5580 for the old concretizer, and was purely about not changing properties of already installed specs for the old-concretizer. It was modified to be used only when deconcretizing shortly after in #5634. Since the old concretizer was deleted in #45215, nothing deconcretizes a spec as a side effect of concretizing something else.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "spec.py: make `_mark_concrete` independent of install status (#52663)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-07T10:26:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1fe0675236d33f4a21649fac43d5c1c59073c3b5",
          "body": "In #52627 we forgot to update the `_main` function, which duplicates\npart of env.activation.\n\nHere we:\n- Fix the issue introduced in #52627\n- Add a unit test to avoid regression\n- Deduplicate the code to keep CONFIG.env_path in sync with `_activate`\n\n---------\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "Fix bug with `$env` substitution (#52666)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-07T09:55:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "437e8c87bcc099bcc63b463e28c6b8ff68fe4366",
          "body": null,
          "is_bot": false,
          "headline": "Remove CUDA-related variables from build environment (#52589)",
          "author_name": "Seth R. Johnson",
          "author_login": "sethrj",
          "committed_at": "2026-07-06T20:35:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a31c502509bbe53e1dfe04a775784cb9996b5726",
          "body": "The `mkstemp` + `rename` pattern is used in various places in Spack,\nwhich is a reasonable way to get a new file in a given directory to \natomically replace a target file. \n\nThe downside is that it doesn't respect umask, cause it's supposed \nto be \"safe\" too (mode 0600).\n\nThat was realized in #52369\n[…]\nnd\nthe temporary file is removed on failure.\n\nCall sites can still do an `fchmod` on the yielded file.\n\n(Not part of `spack.package` fortunately)\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "filesystem.py: improve `write_tmp_and_move` and use throughout (#52653)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-06T12:03:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ef42679b6f123a2836404fc25b9d3b8b45f7210e",
          "body": "Extracted from #52642 \n\nConsistently use a single Store instance, instead of a mix of DI\ninstance vs global.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer.py: dependency injection of Store (#52657)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-06T07:18:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "dc0627b24b1b941895af2f3af4b0371b35a1c86e",
          "body": "Modifications:\n\n1. Move state buffers to their natural home\n2. Get rid of the odd `ChildInfo(DatabaseAction)`\n\n---------\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer.py: refactor child info / state buffer (#52656)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-06T07:13:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "67e1c9a9442be778268cbb324451dfea0a8bf857",
          "body": "The new installer builds the temp log-file path with\n`tempfile.mkstemp(prefix=f\"spack-stage-{spec.name}-{spec.version}-...\")`.\nFor git-ref versions containing a slash (e.g.\n`git.release/shs-13.1.0=13.1.0`, used by `cassini-headers`,\n`cxi-driver`, `libcxi`), the `/` is treated as a directory separato\n[…]\nlease/shs-13.1.0=13.1.0\nError: [Errno 2] No such file or directory: '.../spack-stage-cassini-headers-git.release/shs-13.1.0=...-....log'\n```\n\nSigned-off-by: Till Ehrengruber <till.ehrengruber@cscs.ch>",
          "is_bot": false,
          "headline": "new_installer: sanitize version string in log file path (#52660)",
          "author_name": "Till Ehrengruber",
          "author_login": "tehrengruber",
          "committed_at": "2026-07-06T06:47:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e2e5041cc1813b8a57a0acedd580f3bb6d80ba25",
          "body": "…and (#52655)\n\n`spack solve` is deprecated in favor of options on `spack spec`.\nClean up all references and uses in CI.\n\nSigned-off-by: Gregory Becker <becker33@llnl.gov>",
          "is_bot": false,
          "headline": "Remove all usage and docs references to deprecated `spack solve` comm…",
          "author_name": "Greg Becker",
          "author_login": "becker33",
          "committed_at": "2026-07-03T18:37:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c1fdef46c84f062882e042a689c2fed48e59d0b6",
          "body": "Check when validating input if any virtual assignment corresponds to\nvirtuals the package cannot depend on.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "solver: improve input checking for virtuals (#52645)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-03T12:57:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "913c85673a3ce076ef905489826d3f9d8adb7e54",
          "body": "The new installer has a strict check that ensures uninstalled specs\nupstream cannot be built locally.\n\nIn practice, also thanks to the new installer, build dependencies can be\nmissing in the upstream. Some people use `spack gc`, others prepare the\nupstream using `spack install` from a buildcache, wh\n[…]\n\n\nSo: the installer simply installs the missing specs locally, and when users\nmanage their upstream correctly this is unlikely to be problematic.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer.py: allow local install if missing upstream (#52630)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-03T12:46:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b94f544a06c808220b6d8ab352ce106b66e187e0",
          "body": "When installing a spec explicitly that was already installed implicitly,\nthe action is just to mark it explicit in the database.\n\nThat works fine, but the order of operations is suboptimal. Currently\nyou get stuck in `select` on nothing, which means a second of delay, or\nfive seconds in non-interactive mode.\n\nThis commit improves ordering so it's instant when no other process\nholds a database lock.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer.py: flush DB before select (#52646)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-03T09:46:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b5b06bc036896af346e9ca16ac1183af4333eed7",
          "body": "The input file\n[py-hatchet.lp.zip](https://github.com/user-attachments/files/29584567/py-hatchet.lp.zip)\nis solving very slow ly on 741ddafc339a0b2fde871d29be07d884a4d779a3, and\n`clingo` stalls trying to prove optimality of the \"build unification sets\" criterion.\n\nIn this PR we:\n- Adapt heuristics so that we decide on `build_set_id` early\n- Trim the search space by imposing a no-gap rule on build set ids\n\n---------\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "solver: improve decisions on `build_set_id` (#52634)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-03T06:34:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "107e64610708824fa34afdacf17c89bc18f80692",
          "body": null,
          "is_bot": false,
          "headline": "new_installer.py: import error on wrong platform (#52647)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-02T22:34:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2ec794aa32d627423ae829405e008b18ae75ba7c",
          "body": "The install tests used nixlog, which is heavy machinery to do something\nlike `... | tee test.log`: it spawns a daemon process (even two under\nforkserver), inside a build process that is already redirected. The\njobserver daemon it created also kept the write end of the new\ninstaller's output pipe ope\n[…]\ndio` fd juggling, used by nixlog,\n    threadlog and the new installer's Tee\n\nThe log_output unit tests now run against both nixlog and threadlog.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "install_test.py: do not use multiprocessing for IO (#52618)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-02T21:42:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5e11d599159afe2b22fb4971e07f9ed5b9ee25ee",
          "body": null,
          "is_bot": false,
          "headline": "Fix warning message construction (#52638)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-02T19:28:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "24892c072f374f97f495de1d75a945aeaca2762c",
          "body": "#52411 introduced a regression in the error message reporting mechanism,\nbecause it's not passing `has_provider/1` to `error_message.lp`\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "solver: add missing fact in display.lp (#52640)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-02T15:18:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5ad542d8283cb3e63d2722bdaa4c8f0502d2e8a4",
          "body": "refers #52620\n\nIn 2023 we had `concretization:unify:true`. Now this option is under the\n`concretizer` section, so fix the stale message.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "environment: fix a stale error message (#52639)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-02T14:37:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "741ddafc339a0b2fde871d29be07d884a4d779a3",
          "body": "Rarely used, but used.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "libc.py: fix typo (#52626)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-01T14:39:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bd85d21e3b11c41d842c9a6744beddf342e3514c",
          "body": "Currently, config.py depends on the `active_environment()` for path\nsubstitutions, creating a circular dependency between `spack.config` and\n`spack.environment`.\n\nHere we add an attribute to record the active environment's path on the\nConfiguration object during activation in order to remove the circular\ndependency.\n\n---------\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "config: remove circular dependency with env (#52627)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-01T14:07:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5817ab9613f211442a2747b304960c556797c40f",
          "body": "Closes #52573.\n\nFixes a hang of the new installer under forkserver (Python 3.14+ on\nLinux and\nmacOS in general)\n\nThe Tee thread exits when log pipe's read end hits EOF, which happens\nwhen all fds referring to the write end have been closed. When using\nforkserver based multiprocessing, the forkserver\n[…]\nol pipe to\nsignal it's time to exit.\n\nIndependently of this I'd like to get rid of multiprocessing in\ninstall_test.py,\nwhich triggered the issue.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer.py: exit tee thread w/ control byte (#52621)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-29T12:32:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8c1fb030538af4121c7889db51adb52c9899be8c",
          "body": "On overlayfs (like docker build) `os.rename(...)` does not work for\ndirectories if the dir is part of a lower layer. If that errors, just\nremove the dir recursively.\n\nSee\nhttps://docs.docker.com/engine/storage/drivers/overlayfs-driver/#renaming-directories.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "view: fix rename on overlayfs issue (#52594)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-29T08:52:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9dc979613c79c9e8233f48dbe0fd71797d6b9b7d",
          "body": "Signed-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "concretize.lp: speed-up solve with grounding improvements (#52605)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-29T08:42:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "32b08c1a451a1fca640e8552a32f93153b4cb310",
          "body": "Modifications:\n\n* Eliminated subclasses for `FileLayout` and `ModuleContext`\n* Reduced the number of time we re-read configuration (less\n`spack.config.get` calls in favor of `get_config` and reading from the\nstored dict)\n* Configuration caches are per-class, not per module\n* `*ModuleFileWriter` take\n[…]\nt during construction\n(a `from_spec()` classmethod replaces the old constructor)\n* Errors have been extracted to `spack.modules.error`\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "modules: refactor classes and clean-up code (#52522)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-06-29T07:25:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c7cea1aa274e796ebb083eaf067cf09ce30d6f2c",
          "body": "Modifications:\n* Introduce the concepts of hierarchical vs. flat layout early\n* Clearly divide layout from content\n* Reorder \"Module content\" subsections to match logical flow:\n  - global modifications first (prefix inspections)\n  - then config rules\n  - then package.py callbacks\n* Flatten \"Maintaining Module Files\" subheadings into prose \n* Tighten prose throughout.\n\n---------\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "modules: overhaul module file documentation (#52536)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-06-27T09:42:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4f0b78faf245b31fd424a77eb000f8f4cf1868dd",
          "body": "This reduces the verbosity of the nodes produced by `spack graph --dot`.\n\n* `{%compiler}` is redundant because the compiler has its own node\n* add `-l/--long`, `-L/--very-long` flags for hash, default to no hash\n\nThat way `spack graph --dot pkg | tred` looks readable (even better with\n`rankdir = \"LR\"`)\n\n---------\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "graph.py: drop compiler, use flags for hashes (#52614)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-26T19:07:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5f7d63e806c554b57e8fcece8dc6647d248cf40f",
          "body": "The `spack develop` and `spack undevelop` short descriptions were vague and\ninconsistent about what they operate on. This updates them to refer to the\nenvironment's `develop:` section:\n\n* `develop`: \"add a spec to an environment's develop: section\"\n* `undevelop`: \"remove specs from an environment's develop: section\"\n\nNo functional change.\n\nSigned-off-by: Todd Gamblin <tgamblin@llnl.gov>",
          "is_bot": false,
          "headline": "Clarify develop and undevelop command descriptions (#52612)",
          "author_name": "Todd Gamblin",
          "author_login": "tgamblin",
          "committed_at": "2026-06-26T17:11:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fa79456782a514ea0713eea9c4aeacdb264d55aa",
          "body": "See https://github.com/spack/spack/issues/52599\nThe unit tests might be a bit overkill but they do test all of the\npossible code paths and are as large as they are mainly because of the\nmocks.\n\n---------\n\nSigned-off-by: dsjense <dsjense@sandia.gov>\nSigned-off-by: John Parent <john.parent@kitware.com>\nCo-authored-by: John Parent <john.parent@kitware.com>",
          "is_bot": false,
          "headline": "Fix temp_cwd logic on non-Windows platforms (#52600)",
          "author_name": "danielsjensen1",
          "author_login": "danielsjensen1",
          "committed_at": "2026-06-26T15:24:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e28340e849f06dfb54b1a972e68b02a4f2563a66",
          "body": "Add a `--no-deprecated` flag to limit outputting deprecated specs in\n`spack repo show-version-updates`.\n\nIf you're creating a mirror with the output of `spack repo\nshow-version-updates` you likely do not want to mirror new deprecated\nversions into your source mirror. (And if you do you'll need to\nsp\n[…]\nrom `spack.repo.PATH.get_pkg_class()` to\n`repo.get_pkg_class()` since we are specifically looking at one\nrepository at a time during this command.\n\n---------\n\nSigned-off-by: Alec Scott <alec@llnl.gov>",
          "is_bot": false,
          "headline": "repo cmd: add --no-deprecated flag to show-version-updates (#52391)",
          "author_name": "Alec Scott",
          "author_login": "alecbcs",
          "committed_at": "2026-06-26T14:58:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a534e6456a11aae3f3306a964eb60a9fb2c4ee91",
          "body": "I think this is not worth pointing out anymore. The user will see\nprogress of the initial git clone anyways.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "getting_started.rst: remove warning about slow start (#52186)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-26T08:16:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d975891ecbbc170178e1313accc668f9fae6a31b",
          "body": "Bumps [actions/setup-python](https://github.com/actions/setup-python)\nfrom 6.2.0 to 6.3.0.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/actions/setup-python/releases\">actions/setup-python's\nreleases</a>.</em></p>\n<blockquote>\n<h2>v6.3.0</h2>\n<h2>What's C\n[…]\nnless you reopen the\nPR or upgrade to it yourself)\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#52608)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-26T07:56:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "11227cfc0fdbbcab7acdd1848a3394806b183126",
          "body": "…ib/spack/docs (#52609)\n\nBumps\n[sphinxcontrib-programoutput](https://github.com/OpenNTI/sphinxcontrib-programoutput)\nfrom 0.19 to 0.20.\n<details>\n<summary>Changelog</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/OpenNTI/sphinxcontrib-programoutput/blob/master/CHANGES.rst\">sphinxcontrib-pr\n[…]\nnless you reopen the\nPR or upgrade to it yourself)\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump sphinxcontrib-programoutput from 0.19 to 0.20 in /l…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-26T07:55:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9627aa7fc4990a175d5e81b992a0b898e2bd7258",
          "body": "I am working on combining the spack.llnl and spack.util.llnl modules\ninto the spack.util module. The abstraction is leaky, the distinction\nbetween the two is weak, and I don't think it's serving us anymore.\n\nI'm going to try to keep these PRs small and separate. They'll probably\nconflict with each other, but I expect the rebasing to be trivial.\n\n---------\n\nSigned-off-by: Gregory Becker <becker33@llnl.gov>",
          "is_bot": false,
          "headline": "Move spack.llnl.util.lock into spack.util.lock (#52511)",
          "author_name": "Greg Becker",
          "author_login": "becker33",
          "committed_at": "2026-06-25T09:58:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e91c987c3e96c7b1d755c4deb53d254cb8f21a04",
          "body": "Fixes #52602 \n\nMacos needs to know about older operating systems, to reconstruct specs\nfrom them, but it doesn't need to expose them to the solver unless they\nare coming in from a reused spec.\n\nGeneralized to a `buildable_oses` method on the `Platform` class.\n\n---------\n\nSigned-off-by: Gregory Becker <becker33@llnl.gov>\nCo-authored-by: becker33 <becker33@users.noreply.github.com>",
          "is_bot": false,
          "headline": "performance bugfix: only expose buildable oses to solver (#52604)",
          "author_name": "Greg Becker",
          "author_login": "becker33",
          "committed_at": "2026-06-25T07:30:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4dfd0a28f90ec890b9f361d8feac0cdb614af677",
          "body": "I am working on combining the spack.llnl and spack.util.llnl modules\ninto the spack.util module. The abstraction is leaky, the distinction\nbetween the two is weak, and I don't think it's serving us anymore.\n\nI'm going to try to keep these PRs small and separate. They'll probably\nconflict with each other, but I expect the rebasing to be trivial.\n\n---------\n\nSigned-off-by: Gregory Becker <becker33@llnl.gov>",
          "is_bot": false,
          "headline": "Move spack.llnl.util.lang to spack.util.lang (#52507)",
          "author_name": "Greg Becker",
          "author_login": "becker33",
          "committed_at": "2026-06-24T17:35:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 29,
      "commits_last_year": 1011,
      "latest_release_at": "2021-05-22T21:57:30Z",
      "latest_release_tag": "v0.16.2",
      "releases_from_tags": true,
      "days_since_last_push": 2,
      "active_weeks_last_year": 52,
      "days_since_latest_release": 1890,
      "mean_days_between_releases": 47.6
    },
    "community": {
      "has_readme": false,
      "has_license": false,
      "has_description": false,
      "has_contributing": false,
      "health_percentage": null,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": []
    },
    "popularity": {
      "forks": 0,
      "stars": 3,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": null,
      "open_issues_and_prs": 6
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "lib/spack/docs/Makefile",
        "lib/spack/spack/test/data/make/affirmative/capital_makefile/Makefile",
        "lib/spack/spack/test/data/make/affirmative/check_test/Makefile",
        "lib/spack/spack/test/data/make/affirmative/expansion/Makefile",
        "lib/spack/spack/test/data/make/affirmative/gnu_makefile/GNUmakefile",
        "lib/spack/spack/test/data/make/affirmative/include/Makefile",
        "lib/spack/spack/test/data/make/affirmative/lowercase_makefile/makefile",
        "lib/spack/spack/test/data/make/affirmative/prerequisites/Makefile",
        "lib/spack/spack/test/data/make/affirmative/spaces/Makefile",
        "lib/spack/spack/test/data/make/affirmative/test_check/Makefile",
        "lib/spack/spack/test/data/make/affirmative/three_targets/Makefile",
        "lib/spack/spack/test/data/make/negative/partial_match/Makefile",
        "lib/spack/spack/test/data/make/negative/variable/Makefile",
        "share/spack/templates/depfile/Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": true,
      "typecheck_configs": [
        "lib/spack/spack/vendor/attr/py.typed",
        "lib/spack/spack/vendor/attrs/py.typed",
        "lib/spack/spack/vendor/distro/py.typed",
        "lib/spack/spack/vendor/jinja2/py.typed",
        "lib/spack/spack/vendor/markupsafe/py.typed",
        "lib/spack/spack/vendor/pyrsistent/py.typed",
        "lib/spack/spack/vendor/ruamel/yaml/py.typed"
      ],
      "toolchain_manifests": [],
      "largest_source_bytes": 231403,
      "source_files_sampled": 1029,
      "oversized_source_files": 21,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "pyproject.toml"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "black",
            "direct": false,
            "version": "25.12.0",
            "severity": "critical",
            "ecosystem": "pypi",
            "cvss_score": 9.8,
            "advisory_ids": [
              "GHSA-3936-cmfr-pm3m",
              "PYSEC-2026-2120",
              "PYSEC-2026-2121"
            ],
            "fixed_version": "26.3.1",
            "advisory_count": 3,
            "oldest_advisory_days": 136
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "critical": 1
        },
        "advisory_count": 3,
        "affected_count": 1,
        "assessed_count": 24,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 2,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "pypi"
      ],
      "dependencies": [
        {
          "name": "clingo",
          "manifest": "pyproject.toml",
          "ecosystem": "pypi",
          "version_constraint": null
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "clingo",
            "direct": true,
            "version": "5.8.0",
            "ecosystem": "pypi"
          },
          {
            "name": "black",
            "direct": false,
            "version": "25.12.0",
            "ecosystem": "pypi"
          },
          {
            "name": "coverage",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "coverage",
            "direct": false,
            "version": "7.14.0",
            "ecosystem": "pypi"
          },
          {
            "name": "docutils",
            "direct": false,
            "version": "0.22.4",
            "ecosystem": "pypi"
          },
          {
            "name": "flake8",
            "direct": false,
            "version": "7.3.0",
            "ecosystem": "pypi"
          },
          {
            "name": "furo",
            "direct": false,
            "version": "2025.12.19",
            "ecosystem": "pypi"
          },
          {
            "name": "isort",
            "direct": false,
            "version": "7.0.0",
            "ecosystem": "pypi"
          },
          {
            "name": "mypy",
            "direct": false,
            "version": "1.20.1",
            "ecosystem": "pypi"
          },
          {
            "name": "pip",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "pygments",
            "direct": false,
            "version": "2.20.0",
            "ecosystem": "pypi"
          },
          {
            "name": "pylint",
            "direct": false,
            "version": "4.0.5",
            "ecosystem": "pypi"
          },
          {
            "name": "pytest",
            "direct": false,
            "version": "9.0.3",
            "ecosystem": "pypi"
          },
          {
            "name": "pytest",
            "direct": false,
            "version": "9.1.1",
            "ecosystem": "pypi"
          },
          {
            "name": "pytest-cov",
            "direct": false,
            "version": "7.1.0",
            "ecosystem": "pypi"
          },
          {
            "name": "pytest-xdist",
            "direct": false,
            "version": "3.8.0",
            "ecosystem": "pypi"
          },
          {
            "name": "ruamel-yaml",
            "direct": false,
            "version": "0.19.1",
            "ecosystem": "pypi"
          },
          {
            "name": "ruff",
            "direct": false,
            "version": "0.15.14",
            "ecosystem": "pypi"
          },
          {
            "name": "slotscheck",
            "direct": false,
            "version": "0.19.1",
            "ecosystem": "pypi"
          },
          {
            "name": "sphinx",
            "direct": false,
            "version": "9.1.0",
            "ecosystem": "pypi"
          },
          {
            "name": "sphinx-copybutton",
            "direct": false,
            "version": "0.5.2",
            "ecosystem": "pypi"
          },
          {
            "name": "sphinx-last-updated-by-git",
            "direct": false,
            "version": "0.3.8",
            "ecosystem": "pypi"
          },
          {
            "name": "sphinx-sitemap",
            "direct": false,
            "version": "2.9.0",
            "ecosystem": "pypi"
          },
          {
            "name": "sphinxcontrib-programoutput",
            "direct": false,
            "version": "0.20",
            "ecosystem": "pypi"
          },
          {
            "name": "sphinxcontrib-svg2pdfconverter",
            "direct": false,
            "version": "2.1.0",
            "ecosystem": "pypi"
          },
          {
            "name": "vermin",
            "direct": false,
            "version": "1.8.0",
            "ecosystem": "pypi"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 26,
        "direct_count": 1,
        "indirect_count": 25
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 6,
        "merged_prs": 2,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 5
      },
      "bus_factor": 10,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "adamjstewart",
          "commits": 3238,
          "avatar_url": "https://avatars.githubusercontent.com/u/12021217?v=4"
        },
        {
          "type": "User",
          "login": "tgamblin",
          "commits": 2956,
          "avatar_url": "https://avatars.githubusercontent.com/u/299842?v=4"
        },
        {
          "type": "User",
          "login": "alalazo",
          "commits": 2284,
          "avatar_url": "https://avatars.githubusercontent.com/u/4199709?v=4"
        },
        {
          "type": "User",
          "login": "haampie",
          "commits": 2253,
          "avatar_url": "https://avatars.githubusercontent.com/u/194764?v=4"
        },
        {
          "type": "User",
          "login": "alecbcs",
          "commits": 966,
          "avatar_url": "https://avatars.githubusercontent.com/u/19558067?v=4"
        },
        {
          "type": "User",
          "login": "wdconinc",
          "commits": 895,
          "avatar_url": "https://avatars.githubusercontent.com/u/4656391?v=4"
        },
        {
          "type": "User",
          "login": "glennpj",
          "commits": 811,
          "avatar_url": "https://avatars.githubusercontent.com/u/16138574?v=4"
        },
        {
          "type": "User",
          "login": "becker33",
          "commits": 746,
          "avatar_url": "https://avatars.githubusercontent.com/u/13971568?v=4"
        },
        {
          "type": "User",
          "login": "manuelakuhn",
          "commits": 707,
          "avatar_url": "https://avatars.githubusercontent.com/u/36827019?v=4"
        },
        {
          "type": "User",
          "login": "michaelkuhn",
          "commits": 692,
          "avatar_url": "https://avatars.githubusercontent.com/u/4062614?v=4"
        }
      ],
      "contributors_sampled": 99,
      "top_contributor_share": 0.106
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "bootstrap.yml",
        "build-containers.yml",
        "ci.yaml",
        "coverage.yml",
        "import-check.yaml",
        "prechecks.yml",
        "stale.yaml",
        "triage.yml",
        "unit_tests.yaml"
      ],
      "has_docs_dir": false,
      "linter_configs": [
        ".flake8"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 91 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": null,
            "reason": "internal error: internal error: invalid Dockerfile",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "no SAST tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 8,
            "reason": "2 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "20a23061245eff65fd609957e15e3ad06fd53eb7",
        "ran_at": "2026-07-26T18:35:41Z",
        "aggregate_score": 5.7,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-26T05:43:05Z",
      "oldest_open_prs": [
        {
          "number": 6,
          "created_at": "2022-01-25T22:37:57Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 7,
          "created_at": "2022-03-17T16:51:25Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 8,
          "created_at": "2022-09-06T18:35:57Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 9,
          "created_at": "2023-04-18T16:27:02Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 12,
          "created_at": "2025-06-26T19:16:55Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 13,
          "created_at": "2025-06-26T22:07:14Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ],
      "last_merged_pr_at": "2022-03-15T20:34:23Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/johnwparent/spack",
    "host": "github.com",
    "name": "spack",
    "owner": "johnwparent"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 56,
      "inputs": {
        "security": 66,
        "vitality": 76,
        "community": 14,
        "governance": 60,
        "engineering": 58
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 76,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "excellent",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "commits_last_year": 1011,
              "human_commit_share": 0.98,
              "days_since_last_push": 2,
              "active_weeks_last_year": 52
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 2 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 2
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "52/52 weeks with commits",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 52
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "1011 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 1011
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "at_risk",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 40,
            "inputs": {
              "releases_count": 29,
              "latest_release_tag": "v0.16.2",
              "releases_from_tags": true,
              "days_since_latest_release": 1890,
              "mean_days_between_releases": 47.6
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "29 version tags (no GitHub releases)",
                "points": 16.2,
                "status": "partial",
                "details": [
                  {
                    "code": "version_tags_no_releases",
                    "params": {
                      "count": 29
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 1890 days ago",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 1890
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~47.6 days",
                "points": 19.8,
                "status": "partial",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 47.6
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "maintained",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 3,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "last human commit 3 days ago",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_maintained",
                    "params": {
                      "days": 3
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 14,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 5,
            "inputs": {
              "forks": 0,
              "stars": 3,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "3 stars",
                "points": 4.9,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "critical",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 25,
            "inputs": {
              "has_readme": false,
              "has_license": false,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 60,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "excellent",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 98,
            "inputs": {
              "bus_factor": 10,
              "contributors_sampled": 99,
              "top_contributor_share": 0.106
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "10 contributor(s) cover half of all commits",
                "points": 54,
                "status": "met",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 10
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 11% of commits",
                "points": 20.1,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 11
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "99 contributors",
                "points": 13.5,
                "status": "met",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 99
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 91 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 20,
            "inputs": {
              "merged_prs": 2,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 5
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "2/7 decided PRs merged",
                "points": 10.9,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 2,
                      "decided": 7
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 55,
            "inputs": {
              "followers": 15,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "johnwparent",
              "public_repos": 71,
              "account_age_days": 2795
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "15 followers of johnwparent",
                "points": 8.7,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 15,
                      "login": "johnwparent"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "71 public repos, account ~7 yr old",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 71
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 7
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 58,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 80,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "9 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 9
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".flake8",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".flake8"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "critical",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 25,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": "https://spack.io",
              "has_readme": false,
              "has_docs_dir": false,
              "has_description": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://spack.io",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 66,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Packaging, Pinned-Dependencies, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "packaging",
                    "pinned_dependencies",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 57,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 14,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 4,
              "scorecard_aggregate": 5.7
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 91 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "internal error: internal error: invalid Dockerfile",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "no SAST tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "2 existing vulnerabilities detected",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 24 resolved dependencies against OSV; 2 could not be assessed (no resolved version, an unsupported ecosystem, or beyond the reported package list). This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories",
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 24
                }
              },
              {
                "code": "advisories_unassessed",
                "params": {
                  "count": 2
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 3,
              "affected_packages": 1,
              "assessed_packages": 24,
              "unassessed_packages": 2,
              "affected_by_severity": "critical 1",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 24,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 14
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 70,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "98 of 98 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 98,
                      "sampled": 98
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "excellent",
            "name": "Verify loop (build / test / typecheck)",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Pinned-Dependencies. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_pinned_dependencies"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 89,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [],
              "has_dockerfile": true,
              "typed_language": false,
              "bootstrap_files": [
                "lib/spack/docs/Makefile",
                "lib/spack/spack/test/data/make/affirmative/capital_makefile/Makefile",
                "lib/spack/spack/test/data/make/affirmative/check_test/Makefile",
                "lib/spack/spack/test/data/make/affirmative/expansion/Makefile",
                "lib/spack/spack/test/data/make/affirmative/gnu_makefile/GNUmakefile",
                "lib/spack/spack/test/data/make/affirmative/include/Makefile",
                "lib/spack/spack/test/data/make/affirmative/lowercase_makefile/makefile",
                "lib/spack/spack/test/data/make/affirmative/prerequisites/Makefile",
                "lib/spack/spack/test/data/make/affirmative/spaces/Makefile",
                "lib/spack/spack/test/data/make/affirmative/test_check/Makefile",
                "lib/spack/spack/test/data/make/affirmative/three_targets/Makefile",
                "lib/spack/spack/test/data/make/negative/partial_match/Makefile",
                "lib/spack/spack/test/data/make/negative/variable/Makefile",
                "share/spack/templates/depfile/Makefile"
              ],
              "has_devcontainer": true,
              "has_linter_config": true,
              "typecheck_configs": [
                "lib/spack/spack/vendor/attr/py.typed",
                "lib/spack/spack/vendor/attrs/py.typed",
                "lib/spack/spack/vendor/distro/py.typed",
                "lib/spack/spack/vendor/jinja2/py.typed",
                "lib/spack/spack/vendor/markupsafe/py.typed",
                "lib/spack/spack/vendor/pyrsistent/py.typed",
                "lib/spack/spack/vendor/ruamel/yaml/py.typed"
              ],
              "agent_commit_share": 0,
              "toolchain_manifests": [],
              "dependency_bot_commit_share": 0.02
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "lib/spack/docs/Makefile, lib/spack/spack/test/data/make/affirmative/capital_makefile/Makefile, lib/spack/spack/test/data/make/affirmative/check_test/Makefile, lib/spack/spack/test/data/make/affirmative/expansion/Makefile, lib/spack/spack/test/data/make/affirmative/gnu_makefile/GNUmakefile, lib/spack/spack/test/data/make/affirmative/include/Makefile, lib/spack/spack/test/data/make/affirmative/lowercase_makefile/makefile, lib/spack/spack/test/data/make/affirmative/prerequisites/Makefile, lib/spack/spack/test/data/make/affirmative/spaces/Makefile, lib/spack/spack/test/data/make/affirmative/test_check/Makefile, lib/spack/spack/test/data/make/affirmative/three_targets/Makefile, lib/spack/spack/test/data/make/negative/partial_match/Makefile, lib/spack/spack/test/data/make/negative/variable/Makefile, share/spack/templates/depfile/Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lib/spack/docs/Makefile, lib/spack/spack/test/data/make/affirmative/capital_makefile/Makefile, lib/spack/spack/test/data/make/affirmative/check_test/Makefile, lib/spack/spack/test/data/make/affirmative/expansion/Makefile, lib/spack/spack/test/data/make/affirmative/gnu_makefile/GNUmakefile, lib/spack/spack/test/data/make/affirmative/include/Makefile, lib/spack/spack/test/data/make/affirmative/lowercase_makefile/makefile, lib/spack/spack/test/data/make/affirmative/prerequisites/Makefile, lib/spack/spack/test/data/make/affirmative/spaces/Makefile, lib/spack/spack/test/data/make/affirmative/test_check/Makefile, lib/spack/spack/test/data/make/affirmative/three_targets/Makefile, lib/spack/spack/test/data/make/negative/partial_match/Makefile, lib/spack/spack/test/data/make/negative/variable/Makefile, share/spack/templates/depfile/Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".flake8",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".flake8"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "lib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "devcontainer, Dockerfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "devcontainer, Dockerfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "2 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 2,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "internal error: internal error: invalid Dockerfile",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "good",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 81,
            "inputs": {
              "primary_language": "Python",
              "largest_source_bytes": 231403,
              "source_files_sampled": 1029,
              "oversized_source_files": 21
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Python with type-check config (lib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed)",
                "points": 27,
                "status": "partial",
                "details": [
                  {
                    "code": "typecheck_config_language",
                    "params": {
                      "files": "lib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed",
                      "language": "Python"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "21/1029 source files over 60KB",
                "points": 53.9,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 1029,
                      "oversized": 21
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "Community profile unavailable",
    "Could not fetch pypi package 'spack' from its registry"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-26T18:36:00.025924Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/j/johnwparent/spack.svg",
  "full_name": "johnwparent/spack",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}

Пов’язані записи

Перевірені репозиторії, що мають спільні каталожні теги або екосистеми з johnwparent/spack. Читати поруч →

97apache/supersetApache Superset is a Data Visualization and Data Exploration PlatformВідмінний95scikit-learn/scikit-learnscikit-learn: machine learning in PythonВідмінний95onnx/onnxOpen standard for machine learning interoperabilityВідмінний94run-llama/llama_indexLlamaIndex is the leading document agent and OCR platformВідмінний94wandb/wandbThe AI developer platform. Use Weights & Biases to train and fine-tune models, and manage models from experimentation to production.Відмінний93apache/airflowApache Airflow - A platform to programmatically author, schedule, and monitor workflowsВідмінний

Оцінки — це сигнали, а не гарантії. Вони відображають публічно видимі практики на GitHub — це не аудит коду й не гарантія безпеки.

Відсутні дані виключаються, а ваги перенормовуються — нуль за відсутність ніколи не ставиться. Методологія версіонована й відкрита: метрики v1.13.0, схема v0.27.0 — повна методологія · вікі метрик.

Як окремий результат виглядає на тлі всього реєстру: сукупна статистика.