privateerproj/privateer має індекс здоров’я 84 зі 100, що відповідає смузі «Відмінний». Найвищий показник — Vitality (90/100), найнижчий — Community & Adoption (56/100). Останнє оновлення було 4 дні тому. Більшість нещодавньої роботи виконують 2 учасники.
84
загалом / 100
Відмінний
Індекс здоров'я програмного забезпечення
Метрики згруповано у зважені категорії на шкалі 1–100. Загальна оцінка починається як їхнє зважене середнє, відкаліброване за розподілом публічного реєстру, тож діапазони мають перцентильний зміст; коли публічні дані активують Політику юрисдикцій високого ризику, рейтинг коригується й отримує верхню межу 34 («У зоні ризику»).
84
Винятковий93-100Верхній щабель реєстру (≈ топ-5%); відповідає практично всім перевіреним критеріям
Відмінний80-92Сильний за всіма напрямами; незначні прогалини
Добрий65-79Здоровий; прогалини обмежені та керовані
Помірний50-64Прийнятний, але з помітними прогалинами; рекомендовано перевірку
Слабкий35-49Суттєві недоліки в кількох сферах
У зоні ризику20-34Суттєві слабкі місця; впровадження потребує обережності
Критичний1-19Серйозні проблеми (покинутий, єдиний мейнтейнер, без базової гігієни)
Профіль оцінок
Кожна вісь — окрема категорія. Форма важить більше, ніж середнє: здоровий об'єкт заповнює всю фігуру, тоді як профіль із піками та провалами означає, що сила в одному вимірі маскує ризик в іншому.
Зважений загальний бал 71 калібровано до 84 за шкалою опублікованого індексу (калібрування реєстру 2026-08-02).
Прямі залежності без відомих сповіщень — жодна пряма залежність не має відомих сповіщень
0/25
Непрямі залежності без відомих сповіщень — транзитивний набір не відокремлюється від залежностей розробки й тестування в цьому обсязі
0/40
Немає задавнених сповіщень — жодне сповіщення не має дати публікації
Використані вхідні дані
source
osv
advisories
1
affected_packages
1
assessed_packages
125
unassessed_packages
0
affected_by_severity
unknown 1
direct_affected_packages
0
Виключено з оцінювання (немає даних або не застосовно): Непрямі залежності без відомих сповіщень, Немає задавнених сповіщень. Залишкові ваги перенормовано. Звірено 125 резолвлених залежностей із OSV. Цей репозиторій не публікує пакета, який резолвить індекс, тож натомість оцінено граф залежностей репозиторію. Цей граф змішує закріплені версії для розробки й тестування зі справді постачаними залежностями, тож оцінюються лише задекларовані runtime-залежності; транзитивні знахідки подаються як контекст і в оцінку не входять. Досяжність не аналізується.
Наскільки репозиторій оснащений для розробки та супроводу за участі ШІ-агентів? Має свідомо малу вагу (4%): агентний інструментарій — реальний сигнал супроводу, але репозиторій без нього все одно може отримати 100/100.
Типізований код — Shell без конфігурації перевірки типів
55/55
Керовані розміри файлів — 0/12 файлів вихідного коду понад 60 КБ
Використані вхідні дані
primary_language
Shell
largest_source_bytes
4 427
source_files_sampled
12
oversized_source_files
0
Ключові факти
23зірок GitHub
13контриб'юторів
151комітів за останні 12 місяців
4днів від останнього пушу
44релізів
2бас-фактор
10відкритих issue
Goпакетних екосистем
Попередження щодо збору даних
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
Докладніше
Історія зірок і форків 0 ★ / 9 ⇿
0Зірки
9Форки
42Релізи
Коли додано кожну зірку й форк — зібрано з GitHub і згруповано за днями. Кумулятивне зростання розміщено просто над денними додаваннями, з яких воно складається, тож їх видно одне проти одного: рівномірне органічне накопичення виглядає зовсім інакше, ніж різкий короткочасний сплеск. Там, де цю різницю можна виміряти, її подано як автентичність росту.
Мажорні 0Мінорні 22Патчі 19
Кожна точка охоплює 3 днів.
OpenSSF Scorecard 7.7 / 10
7.7сукупно
Незалежна, не прив'язана до інструментів оцінка безпеки від відкритого проєкту OpenSSF Scorecard. Кожна перевірка винагороджує практику безпеки, а не інструмент конкретного постачальника. Перевірки, які Scorecard не зміг визначити, позначено н/д і виключено з оцінки безпеки (вони ніколи не зараховуються як нуль).Scorecard v5.5.0 · 2026-08-01 03:04 UTC
Повний розв'язаний набір залежностей із графа залежностей GitHub: 5 прямих і 120 непрямих (транзитивних) пакетів. Транзитивне замикання є повним, коли в репозиторії закомічено lockfile.
Реєстр
Пакет
Версія
Зв'язок
Go
github.com/hashicorp/go-hclog
v1.6.3
пряма
Go
github.com/hashicorp/go-plugin
v1.8.0
пряма
Go
github.com/privateerproj/privateer-sdk
v1.32.0
пряма
Go
github.com/spf13/cobra
v1.10.2
пряма
Go
github.com/spf13/viper
v1.21.0
пряма
Go
dario.cat/mergo
v1.0.1
непряма
Go
github.com/asaskevich/govalidator
v0.0.0-20230301143203-a9d515a09cc2
непряма
Go
github.com/blang/semver
v3.5.1+incompatible
непряма
Go
github.com/cenkalti/backoff/v5
v5.0.3
непряма
Go
github.com/cespare/xxhash/v2
v2.3.0
непряма
Go
github.com/cloudflare/circl
v1.6.3
непряма
Go
github.com/coreos/go-oidc/v3
v3.17.0
непряма
Go
github.com/cyberphone/json-canonicalization
v0.0.0-20241213102144-19d51d7fe467
непряма
Go
github.com/cyphar/filepath-securejoin
v0.6.1
непряма
Go
github.com/defenseunicorns/go-oscal
v0.7.0
непряма
Go
github.com/digitorus/pkcs7
v0.0.0-20230818184609-3a137a874352
непряма
Go
github.com/digitorus/timestamp
v0.0.0-20231217203849-220c5c2851b7
непряма
Go
github.com/emirpasic/gods
v1.18.1
непряма
Go
github.com/fatih/color
v1.18.0
непряма
Go
github.com/fsnotify/fsnotify
v1.9.0
непряма
Go
github.com/gemaraproj/go-gemara
v0.8.0
непряма
Go
github.com/go-git/gcfg
v1.5.1-0.20230307220236-3a3c6141e376
непряма
Go
github.com/go-git/go-billy/v5
v5.9.0
непряма
Go
github.com/go-git/go-git/v5
v5.19.1
непряма
Go
github.com/go-jose/go-jose/v4
v4.1.4
непряма
Go
github.com/go-logr/logr
v1.4.3
непряма
Go
github.com/go-logr/stdr
v1.2.2
непряма
Go
github.com/go-openapi/analysis
v0.25.2
непряма
Go
github.com/go-openapi/errors
v0.22.8
непряма
Go
github.com/go-openapi/jsonpointer
v0.23.1
непряма
Go
github.com/go-openapi/jsonreference
v0.21.6
непряма
Go
github.com/go-openapi/loads
v0.24.0
непряма
Go
github.com/go-openapi/runtime
v0.32.4
непряма
Go
github.com/go-openapi/runtime/server-middleware
v0.30.0
непряма
Go
github.com/go-openapi/spec
v0.22.6
непряма
Go
github.com/go-openapi/strfmt
v0.26.4
непряма
Go
github.com/go-openapi/swag
v0.26.1
непряма
Go
github.com/go-openapi/swag/cmdutils
v0.26.1
непряма
Go
github.com/go-openapi/swag/conv
v0.27.0
непряма
Go
github.com/go-openapi/swag/fileutils
v0.26.1
непряма
Go
github.com/go-openapi/swag/jsonname
v0.26.1
непряма
Go
github.com/go-openapi/swag/jsonutils
v0.26.1
непряма
Go
github.com/go-openapi/swag/loading
v0.26.1
непряма
Go
github.com/go-openapi/swag/mangling
v0.26.1
непряма
Go
github.com/go-openapi/swag/netutils
v0.26.1
непряма
Go
github.com/go-openapi/swag/stringutils
v0.26.1
непряма
Go
github.com/go-openapi/swag/typeutils
v0.27.0
непряма
Go
github.com/go-openapi/swag/yamlutils
v0.26.1
непряма
Go
github.com/go-openapi/validate
v0.26.0
непряма
Go
github.com/go-viper/mapstructure/v2
v2.5.0
непряма
Go
github.com/goccy/go-yaml
v1.19.2
непряма
Go
github.com/golang/groupcache
v0.0.0-20241129210726-2c02b8208cf8
непряма
Go
github.com/golang/protobuf
v1.5.4
непряма
Go
github.com/google/certificate-transparency-go
v1.3.3
непряма
Go
github.com/google/go-containerregistry
v0.21.7
непряма
Go
github.com/google/uuid
v1.6.0
непряма
Go
github.com/grpc-ecosystem/grpc-gateway/v2
v2.29.0
непряма
Go
github.com/hashicorp/go-cleanhttp
v0.5.2
непряма
Go
github.com/hashicorp/go-retryablehttp
v0.7.8
непряма
Go
github.com/hashicorp/yamux
v0.1.2
непряма
Go
github.com/in-toto/attestation
v1.2.0
непряма
Go
github.com/in-toto/in-toto-golang
v0.11.0
непряма
Go
github.com/inconshreveable/mousetrap
v1.1.0
непряма
Go
github.com/jbenet/go-context
v0.0.0-20150711004518-d14ea06fba99
непряма
Go
github.com/jedisct1/go-minisign
v0.0.0-20211028175153-1c139d1cc84b
непряма
Go
github.com/kevinburke/ssh_config
v1.2.0
непряма
Go
github.com/klauspost/cpuid/v2
v2.3.0
непряма
Go
github.com/mattn/go-colorable
v0.1.14
непряма
Go
github.com/mattn/go-isatty
v0.0.20
непряма
Go
github.com/microsoft/go-winio
v0.6.2
непряма
Go
github.com/oklog/run
v1.1.0
непряма
Go
github.com/oklog/ulid/v2
v2.1.1
непряма
Go
github.com/opencontainers/go-digest
v1.0.0
непряма
Go
github.com/opencontainers/image-spec
v1.1.1
непряма
Go
github.com/pelletier/go-toml/v2
v2.2.4
непряма
Go
github.com/pjbgf/sha1cd
v0.6.0
непряма
Go
github.com/pkg/browser
v0.0.0-20240102092130-5ac0b6a4141c
непряма
Go
github.com/pkg/errors
v0.9.1
непряма
Go
github.com/protonmail/go-crypto
v1.1.6
непряма
Go
github.com/revanite-io/grc-store-protocol
v0.5.0
непряма
Go
github.com/sagikazarmark/locafero
v0.11.0
непряма
Go
github.com/santhosh-tekuri/jsonschema/v6
v6.0.2
непряма
Go
github.com/sassoftware/relic
v7.2.1+incompatible
непряма
Go
github.com/secure-systems-lab/go-securesystemslib
v0.11.0
непряма
Go
github.com/sergi/go-diff
v1.4.0
непряма
Go
github.com/shibumi/go-pathspec
v1.3.0
непряма
Go
github.com/sigstore/protobuf-specs
v0.5.1
непряма
Go
github.com/sigstore/rekor
v1.5.3
непряма
Go
github.com/sigstore/rekor-tiles/v2
v2.3.0
непряма
Go
github.com/sigstore/sigstore
v1.10.8
непряма
Go
github.com/sigstore/sigstore-go
v1.2.2
непряма
Go
github.com/sigstore/timestamp-authority/v2
v2.1.2
непряма
Go
github.com/skeema/knownhosts
v1.3.1
непряма
Go
github.com/sourcegraph/conc
v0.3.1-0.20240121214520-5f936abd7ae8
непряма
Go
github.com/spf13/afero
v1.15.0
непряма
Go
github.com/spf13/cast
v1.10.0
непряма
Go
github.com/spf13/pflag
v1.0.10
непряма
Go
github.com/subosito/gotenv
v1.6.0
непряма
Go
github.com/theupdateframework/go-tuf
v0.7.0
непряма
Go
github.com/theupdateframework/go-tuf/v2
v2.4.2
непряма
Go
github.com/transparency-dev/formats
v0.1.1
непряма
Go
github.com/transparency-dev/merkle
v0.0.2
непряма
Go
github.com/xanzy/ssh-agent
v0.3.3
непряма
Go
github.com/youmark/pkcs8
v0.0.0-20240726163527-a2c0da244d78
непряма
Go
go.opentelemetry.io/auto/sdk
v1.2.1
непряма
Go
go.opentelemetry.io/otel
v1.44.0
непряма
Go
go.opentelemetry.io/otel/metric
v1.44.0
непряма
Go
go.opentelemetry.io/otel/trace
v1.44.0
непряма
Go
go.yaml.in/yaml/v3
v3.0.4
непряма
Go
golang.org/x/crypto
v0.54.0
непряма
Go
golang.org/x/mod
v0.38.0
непряма
Go
golang.org/x/net
v0.56.0
непряма
Go
golang.org/x/oauth2
v0.36.0
непряма
Go
golang.org/x/sync
v0.22.0
непряма
Go
golang.org/x/sys
v0.47.0
непряма
Go
golang.org/x/term
v0.45.0
непряма
Go
golang.org/x/text
v0.40.0
непряма
Go
google.golang.org/genproto/googleapis/api
v0.0.0-20260526163538-3dc84a4a5aaa
непряма
Go
google.golang.org/genproto/googleapis/rpc
v0.0.0-20260523011958-0a33c5d7ca68
непряма
Go
google.golang.org/grpc
v1.82.1
непряма
Go
google.golang.org/protobuf
v1.36.11
непряма
Go
gopkg.in/warnings.v0
v0.1.2
непряма
Go
gopkg.in/yaml.v3
v3.0.1
непряма
Go
k8s.io/klog/v2
v2.140.0
непряма
Go
oras.land/oras-go/v2
v2.6.2
непряма
Сповіщення про залежності 1
Цей репозиторій не публікує пакета, який розпізнає індекс, тож оцінено його власний граф залежностей — 125 пакетів, серед яких є й піниї розробки та тестування, що ніколи не постачаються: 1 мають відомі сповіщення, з них 0 прямі.
Пакет
Версія
Зв'язок
Критичність
Сповіщень
Виправлено в
golang.org/x/crypto
v0.54.0
непряма
невідома
1
—
Сповіщення означає, що версія, записана в графі залежностей, потрапляє в уражений діапазон. Досяжність не аналізується, а граф містить піниї розробки й тестування — знахідка може стосуватися інструментів, а не поставленого коду.
Звіт у форматі JSON машиночитний
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 13358,
"has_wiki": false,
"homepage": null,
"languages": {
"Go": 18668,
"Shell": 18975,
"Makefile": 2552,
"Dockerfile": 377
},
"pushed_at": "2026-07-27T17:13:46Z",
"created_at": "2022-10-26T12:14:52Z",
"owner_type": "Organization",
"updated_at": "2026-07-27T17:14:33Z",
"description": "Privateer is a plugin-based framework for security & compliance evaluations.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "main",
"license_spdx_raw": "Apache-2.0",
"primary_language": "Shell",
"significant_languages": [
"Shell",
"Go"
]
},
"owner": {
"blog": null,
"name": "Privateer Project",
"type": "Organization",
"login": "privateerproj",
"company": null,
"location": null,
"followers": 9,
"avatar_url": "https://avatars.githubusercontent.com/u/116728460?v=4",
"created_at": "2022-10-26T12:10:18Z",
"is_verified": null,
"public_repos": 7,
"account_age_days": 1374
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.22.0",
"kind": "minor",
"published_at": "2026-07-20T14:10:11Z"
},
{
"tag": "v0.21.2",
"kind": "patch",
"published_at": "2026-05-18T22:57:37Z"
},
{
"tag": "v0.21.1",
"kind": "patch",
"published_at": "2026-05-12T13:41:40Z"
},
{
"tag": "v0.21.0",
"kind": "minor",
"published_at": "2026-05-01T04:53:14Z"
},
{
"tag": "v0.20.3",
"kind": "patch",
"published_at": "2026-04-26T21:26:14Z"
},
{
"tag": "v0.20.2",
"kind": "patch",
"published_at": "2026-04-12T23:15:45Z"
},
{
"tag": "v0.20.1",
"kind": "patch",
"published_at": "2026-04-12T21:39:55Z"
},
{
"tag": "v0.20.0",
"kind": "minor",
"published_at": "2026-04-12T03:33:41Z"
},
{
"tag": "v0.19.0",
"kind": "minor",
"published_at": "2026-04-07T20:04:56Z"
},
{
"tag": "v0.18.1",
"kind": "patch",
"published_at": "2026-03-31T13:35:41Z"
},
{
"tag": "v0.18.0",
"kind": "minor",
"published_at": "2026-03-16T06:54:32Z"
},
{
"tag": "v0.17.0",
"kind": "minor",
"published_at": "2026-03-16T01:38:04Z"
},
{
"tag": "v0.16.1",
"kind": "patch",
"published_at": "2026-03-14T21:44:41Z"
},
{
"tag": "v0.16.0",
"kind": "minor",
"published_at": "2026-03-14T15:44:55Z"
},
{
"tag": "v0.15.1",
"kind": "patch",
"published_at": "2026-03-13T06:54:32Z"
},
{
"tag": "v0.15.0",
"kind": "minor",
"published_at": "2026-02-15T17:14:18Z"
},
{
"tag": "v0.14.3",
"kind": "patch",
"published_at": "2026-02-15T15:15:30Z"
},
{
"tag": "v0.14.2",
"kind": "patch",
"published_at": "2026-02-15T07:26:29Z"
},
{
"tag": "v0.14.1",
"kind": "patch",
"published_at": "2026-02-15T07:12:17Z"
},
{
"tag": "v0.14.0",
"kind": "minor",
"published_at": "2026-02-15T06:46:51Z"
},
{
"tag": "v0.13.2",
"kind": "patch",
"published_at": "2026-02-15T00:12:08Z"
},
{
"tag": "v0.13.1",
"kind": "patch",
"published_at": "2026-02-14T16:40:40Z"
},
{
"tag": "v0.13.0",
"kind": "minor",
"published_at": "2025-11-06T23:37:47Z"
},
{
"tag": "v0.12.0",
"kind": "minor",
"published_at": "2025-11-04T19:45:06Z"
},
{
"tag": "v0.11.0",
"kind": "minor",
"published_at": "2025-11-03T02:57:40Z"
},
{
"tag": "v0.10.0",
"kind": "minor",
"published_at": "2025-10-10T15:05:42Z"
},
{
"tag": "v0.9.1",
"kind": "patch",
"published_at": "2025-09-27T16:03:22Z"
},
{
"tag": "v0.9.0",
"kind": "minor",
"published_at": "2025-09-25T18:50:37Z"
},
{
"tag": "v0.8.0",
"kind": "minor",
"published_at": "2025-03-30T12:03:15Z"
},
{
"tag": "v0.7.0",
"kind": "minor",
"published_at": "2025-03-06T00:57:49Z"
},
{
"tag": "v0.6.0",
"kind": "minor",
"published_at": "2025-02-23T23:49:52Z"
},
{
"tag": "v0.5.0",
"kind": "minor",
"published_at": "2025-01-28T20:05:52Z"
},
{
"tag": "v0.4.1",
"kind": "patch",
"published_at": "2025-01-27T22:02:35Z"
},
{
"tag": "v0.4.0",
"kind": "minor",
"published_at": "2025-01-20T22:00:39Z"
},
{
"tag": "v0.3.1",
"kind": "patch",
"published_at": "2025-01-19T15:52:00Z"
},
{
"tag": "v0.3.0",
"kind": "minor",
"published_at": "2025-01-15T23:37:34Z"
},
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2025-01-14T11:58:22Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2025-01-07T08:02:43Z"
},
{
"tag": "v0.0.4",
"kind": "patch",
"published_at": "2025-01-03T20:09:00Z"
},
{
"tag": "v0.0.3",
"kind": "patch",
"published_at": "2024-12-23T01:55:34Z"
},
{
"tag": "v0.0.3-rc",
"kind": "prerelease",
"published_at": "2024-12-02T11:03:14Z"
},
{
"tag": "v0.0.2",
"kind": "patch",
"published_at": "2024-09-27T20:00:42Z"
},
{
"tag": "v0.0.1",
"kind": "patch",
"published_at": "2023-09-01T16:14:29Z"
},
{
"tag": "v0.0.0",
"kind": "major",
"published_at": "2023-02-27T16:28:34Z"
}
],
"recent_commits": [
{
"oid": "76500f5556acfac22f0009e8ca3bab1bae324ce4",
"body": "## What/Why\nBump the transitive google.golang.org/grpc dependency to v1.82.1 to\nresolve high-severity advisory GHSA-hrxh-6v49-42gf (xDS RBAC auth\nbypass, HTTP/2 Rapid Reset DoS, and RBAC engine panic).\n\n## Proof it works\n`make test` passes (go vet + go test ok), `golangci-lint run` reports\n0 issues,\n[…]\ned by Claude Opus 4.8.\n\n## Review focus\nConfirm no other module needs a matching bump and that the indirect\nconstraint holds after downstream go mod tidy.\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 (#292)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-07-27T17:13:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "73d087e5a2fda2ea18b9396dbd65de73890c9de7",
"body": "GoReleaser derives ProjectName from the repo/module name when it is not set,\nso every release archive shipped as privateer_* even though the binary, the\nCLI and the formula are all named pvtr. Set project_name explicitly.\n\nThe homebrew job is updated in step: it fetches the renamed archives, and the\n[…]\ns that\nno longer resolve.\n\nVerified with a snapshot build: archives are pvtr_Darwin_all.tar.gz,\npvtr_Linux_{x86_64,arm64,i386}.tar.gz and pvtr_Windows_*.zip, each still\ncontaining a binary named pvtr.",
"is_bot": false,
"headline": "chore: name release archives pvtr_* instead of privateer_* (#290)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-07-23T21:19:06Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3d841a925c2af4ea518aa42c450f479138d69a7f",
"body": "Bumps the dependencies group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action).\n\n\nUpdates `actions/checkout` from 7.0.0 to 7.0.1\n- [Release notes](https://github.com/actions/checko\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump the dependencies group with 2 updates (#291)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-23T21:06:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "babef723cb379d0eefeb397966ec66d5336ced21",
"body": "Signed-off-by: Eddie Knight <knight@linux.com>",
"is_bot": false,
"headline": "feat: added benchmark command (#289)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-07-20T13:35:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3a9214b9e0757780272f9164bed9de8c0c68aab6",
"body": null,
"is_bot": true,
"headline": "chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 (#288)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-16T21:05:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1450a1a1ac449b4abb23d9956c543fa40b030490",
"body": "Signed-off-by: Eddie Knight <knight@linux.com>",
"is_bot": false,
"headline": "chore: upgrade privateer-sdk to v1.31.3 (#287)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-07-16T04:17:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "161c680cf2b25e83291bf70f9bfc627d76aff522",
"body": "…285)",
"is_bot": false,
"headline": "chore(deps): bump privateer-sdk to v1.31.2 and go-gemara to v0.8.0 (#…",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-07-12T04:29:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "255a3988e772a47bd3897a23aa88b797059770e0",
"body": "…(#284)",
"is_bot": false,
"headline": "ci: harden GitHub Actions workflows and resolve code-scanning alerts …",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-07-12T04:28:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "52ac984ef2e6d7b3294bfdc5f0437dab23a97fb3",
"body": "Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.52.0 to 0.54.0.\n- [Commits](https://github.com/golang/crypto/compare/v0.52.0...v0.54.0)\n\n---\nupdated-dependencies:\n- dependency-name: golang.org/x/crypto\n dependency-version: 0.54.0\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.54.0 (#283)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-11T02:16:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e27f3182cf3ab5c71ec7f9a6aa9cf9e7d3302d8d",
"body": "Bumps the dependencies group with 4 updates: [github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml](https://github.com/github-community-projects/ospo-reusable-workflows), [github-community-projects/ospo-reusable-workflows/.github/workflows/pr-title.yaml](https://gith\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump the dependencies group with 4 updates (#280)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-10T18:59:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6e55ec0d12dccc5828ba315cfcf9f68bff32d8f9",
"body": "Bumps [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action) from 23.2.0 to 24.0.0.\n- [Release notes](https://github.com/davidanson/markdownlint-cli2-action/releases)\n- [Commits](https://github.com/davidanson/markdownlint-cli2-action/compare/ded1f9488f68a970bc6\n[…]\nirect:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump DavidAnson/markdownlint-cli2-action (#281)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-10T18:59:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c9736a91054a16f27c8437c29047b22f2bb43030",
"body": "Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.51.0 to 0.52.0.\n- [Commits](https://github.com/golang/crypto/compare/v0.51.0...v0.52.0)\n\n---\nupdated-dependencies:\n- dependency-name: golang.org/x/crypto\n dependency-version: 0.52.0\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#282)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-10T18:59:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c79ccb2ea8c3f19cca03a10675f103d8e3927f5f",
"body": "Bumps [golang.org/x/net](https://github.com/golang/net) from 0.53.0 to 0.55.0.\n- [Commits](https://github.com/golang/net/compare/v0.53.0...v0.55.0)\n\n---\nupdated-dependencies:\n- dependency-name: golang.org/x/net\n dependency-version: 0.55.0\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump golang.org/x/net from 0.53.0 to 0.55.0 (#279)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-04T00:20:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "34430423ac68b9074f1867e6b146ac81b3ac9718",
"body": "Bumps the dependencies group with 1 update: [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action).\n\n\nUpdates `golangci/golangci-lint-action` from 9.2.1 to 9.3.0\n- [Release notes](https://github.com/golangci/golangci-lint-action/releases)\n- [Commits](https://github.com/gol\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump golangci/golangci-lint-action (#278)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-03T17:21:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e5439ed75fb21d59cdc81767b936055c824be098",
"body": "- Only run homebrew update when a release occurred\n- Only release when release label is used",
"is_bot": false,
"headline": "fix: Update release.yml (#277)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-06-26T14:35:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4c4fe36d6c9dea0e07deaf2518b8cb1cdbfdeb0b",
"body": "Bumps the dependencies group with 4 updates: [github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml](https://github.com/github-community-projects/ospo-reusable-workflows), [actions/setup-go](https://github.com/actions/setup-go), [github-community-projects/ospo-reusabl\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump the dependencies group with 4 updates (#276)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-26T03:18:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9d0fd9cf89c1cd1a37db5f942bd2c8c05853b711",
"body": "Bumps alpine from `a2d49ea` to `28bd5fe`.\n\n---\nupdated-dependencies:\n- dependency-name: alpine\n dependency-version: '3.24'\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump alpine from `a2d49ea` to `28bd5fe` (#275)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-20T08:22:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2ff9715533923a371de69d87eabfbda3f9dce810",
"body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b43\n[…]\nirect:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#274)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-20T08:21:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "776bb3f1c5357512eaf639c88bc4684e16c64731",
"body": "Bumps alpine from 3.23 to 3.24.\n\n---\nupdated-dependencies:\n- dependency-name: alpine\n dependency-version: '3.24'\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump alpine from 3.23 to 3.24 (#273)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-12T05:03:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2a94c7febfd3e722250bd3a1aae25523ecc85f01",
"body": "…(#270)\n\n* chore(deps): bump golang from 1.26.3-alpine3.22 to 1.26.4-alpine3.22\n\nBumps golang from 1.26.3-alpine3.22 to 1.26.4-alpine3.22.\n\n---\nupdated-dependencies:\n- dependency-name: golang\n dependency-version: 1.26.4-alpine3.22\n dependency-type: direct:production\n update-type: version-update:s\n[…]\n[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: Jason Meridth <jmeridth@gmail.com>",
"is_bot": true,
"headline": "chore(deps): bump golang from 1.26.3-alpine3.22 to 1.26.4-alpine3.22 …",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-05T18:48:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "bfa3a7d3f1e7a63252f65a0a87733779d57a4b00",
"body": "Bumps the dependencies group with 1 update: [actions/checkout](https://github.com/actions/checkout).\n\n\nUpdates `actions/checkout` from 6.0.2 to 6.0.3\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](\n[…]\nersion-update:semver-patch\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump actions/checkout in the dependencies group (#269)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-04T21:16:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e739edca322cd49ec9fbcf7ec3fa32e142f79778",
"body": "Bumps the dependencies group with 1 update: [github.com/privateerproj/privateer-sdk](https://github.com/privateerproj/privateer-sdk).\n\n\nUpdates `github.com/privateerproj/privateer-sdk` from 1.24.1 to 1.25.0\n- [Release notes](https://github.com/privateerproj/privateer-sdk/releases)\n- [Commits](https:\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/privateerproj/privateer-sdk (#268)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-04T21:16:10Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "782385d60c935d842c7a773faeb6ce78b51696ca",
"body": "Bumps the dependencies group with 6 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml](https://github.com/github-community-projects/ospo-reusable-workflows) | `1.0.1` | `1.1.0` |\n| [golangci/golangci-lint-ac\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump the dependencies group with 6 updates (#266)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-28T23:26:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "982c3b2fa6b5d1b85d89ca7950cb7c482b696977",
"body": "* fix: enforce LF on shell scripts to fix make build on Windows\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* add new line\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* add new line\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* add newline\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n---------\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>",
"is_bot": false,
"headline": "fix: enforce LF on shell scripts to fix make build on Windows (#265)",
"author_name": "Satarupa Deb",
"author_login": "Satarupa22-SD",
"committed_at": "2026-05-28T23:26:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ded766dc2804172485af8dd3e2d41c29e1fb8538",
"body": "Signed-off-by: Satarupa22-SD <satarupa2212@gmail.com>",
"is_bot": false,
"headline": "drop viper dependency (#264)",
"author_name": "Satarupa Deb",
"author_login": "Satarupa22-SD",
"committed_at": "2026-05-27T04:09:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fd98bf16ead2f150439fd4cd18e0708c09ba6247",
"body": "…up (#263)",
"is_bot": true,
"headline": "chore(deps): bump step-security/harden-runner in the dependencies gro…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-23T20:58:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7d5e157fc3a9c93bf15f56410aa53e005f656bb4",
"body": "…(#254)",
"is_bot": true,
"headline": "chore(deps): bump golang from 1.26.2-alpine3.22 to 1.26.3-alpine3.22 …",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-23T12:52:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5097a97949d50a35134ed7675bd329d0d4863eee",
"body": "…#262)\n\nBumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.19.0 to 5.19.1.\n- [Release notes](https://github.com/go-git/go-git/releases)\n- [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md)\n- [Commits](https://github.com/go-git/go-git/compare/v5.19.0...v5.19.\n[…]\nv5\n dependency-version: 5.19.1\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-19T18:39:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9589b4500a119312b7eff8d51649723e8db281f7",
"body": "contents:write, which is the minimum needed for the RubbaBoy/BYOB\naction to push badge data to the shields branch.\n\nSigned-off-by: Vinaya Damle <vinayada@mac.lan>\nCo-authored-by: Vinaya Damle <vinayada@mac.lan>",
"is_bot": false,
"headline": "Add a top-level permissions block restricting the GITHUB_TOKEN to (#245)",
"author_name": "vinayada1",
"author_login": "vinayada1",
"committed_at": "2026-05-18T23:20:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7b623b9a509b26a7a3a66114715f64262712664c",
"body": "Bumps the dependencies group with 1 update: [github.com/privateerproj/privateer-sdk](https://github.com/privateerproj/privateer-sdk).\n\n\nUpdates `github.com/privateerproj/privateer-sdk` from 1.24.0 to 1.24.1\n- [Release notes](https://github.com/privateerproj/privateer-sdk/releases)\n- [Commits](https:\n[…]\nersion-update:semver-patch\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/privateerproj/privateer-sdk (#258)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-18T22:54:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7f76ab950168f9f9af5bf7b01f8f7bd784258ed8",
"body": "…github/workflows/pr-title.yaml (#260)\n\nBumps [github-community-projects/ospo-reusable-workflows/.github/workflows/pr-title.yaml](https://github.com/github-community-projects/ospo-reusable-workflows) from 0.6.0 to 1.0.1.\n- [Release notes](https://github.com/github-community-projects/ospo-reusable-wo\n[…]\nirect:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github-community-projects/ospo-reusable-workflows/.…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-18T22:53:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "81719b61060006ed8812b7334d219e04ddf26429",
"body": "…github/workflows/auto-labeler.yaml (#261)\n\nBumps [github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml](https://github.com/github-community-projects/ospo-reusable-workflows) from 0.6.0 to 1.0.1.\n- [Release notes](https://github.com/github-community-projects/ospo-reu\n[…]\nirect:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github-community-projects/ospo-reusable-workflows/.…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-18T22:53:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7d460680e3b1af269a2ca81bccd5da092fb50748",
"body": "…239)\n\n* update logger\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* fix: initialize writer and logger in NewCLI\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* update cli tests\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* guard writer init in persistentPreRun(fixe\n[…]\nby: Satarupa22-SD <satarupa2212@gmail.com>\n\n* test: regression test for run cmd\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n---------\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>",
"is_bot": false,
"headline": "fix: initialize logger to null logger to prevent nil pointer panic (#…",
"author_name": "Satarupa Deb",
"author_login": "Satarupa22-SD",
"committed_at": "2026-05-18T22:53:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "be3ed48dd725b6aa557e5ddc9e67c79b18c42786",
"body": "…up (#259)\n\nBumps the dependencies group with 1 update: [step-security/harden-runner](https://github.com/step-security/harden-runner).\n\n\nUpdates `step-security/harden-runner` from 2.16.1 to 2.19.2\n- [Release notes](https://github.com/step-security/harden-runner/releases)\n- [Commits](https://github.c\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump step-security/harden-runner in the dependencies gro…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-18T16:18:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3d2130a9b553c79334c969fe9a38dfeb4d0f253a",
"body": null,
"is_bot": false,
"headline": "ci: Update catalog version in security assessment workflow (#257)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-05-12T14:55:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d63cd550cbddb7c0ead7708692535c6fc5557697",
"body": null,
"is_bot": false,
"headline": "ci: adopt consolidated ospo-reusable-workflows release.yaml (#255)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-05-12T13:36:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cecdb19db58c0498d46640b01ef5a5120aff46c9",
"body": "…#256)",
"is_bot": true,
"headline": "chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 (…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-12T13:28:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c024ee800a072dd8fe94c89b4b70027d83d15e05",
"body": "Bumps the dependencies group with 1 update: [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action).\n\n\nUpdates `DavidAnson/markdownlint-cli2-action` from 23.1.0 to 23.2.0\n- [Release notes](https://github.com/davidanson/markdownlint-cli2-action/releases)\n- [Commi\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump DavidAnson/markdownlint-cli2-action (#253)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-08T18:39:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2f742993544870b95ccefdd8c9f9f59a2e5caadb",
"body": "…dates (#251)\n\nBumps the dependencies group with 2 updates in the / directory: [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action) and [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action).\n\n\nUpdates `DavidAnson/markdownlint-cli2-ac\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump the dependencies group across 1 directory with 2 up…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-01T20:44:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fb9aada448bcd2ad2d34371025689b58eb5e107a",
"body": "Bumps the dependencies group with 1 update in the / directory: [github.com/hashicorp/go-plugin](https://github.com/hashicorp/go-plugin).\n\n\nUpdates `github.com/hashicorp/go-plugin` from 1.7.0 to 1.8.0\n- [Release notes](https://github.com/hashicorp/go-plugin/releases)\n- [Changelog](https://github.com/\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/hashicorp/go-plugin (#252)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-01T20:43:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "15222a0b252a7cd3a19d3e334e674df09c31c98f",
"body": "* chore: upgrade sdk to v1.24.0; accept 0 or 1 as successful exit codes\n\nSigned-off-by: Eddie Knight <knight@linux.com>",
"is_bot": false,
"headline": "chore: upgrade sdk (#249)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-05-01T04:52:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e4cb71d947ce01ec5bc1e43eb02d519e16bd8ad2",
"body": "* fix: update to use the latest patch from privateer-sdk for exit code handling\n\nSigned-off-by: Eddie Knight <knight@linux.com>",
"is_bot": false,
"headline": "chore: Update generator to use SDK fix for exit codes (#248)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-04-26T21:03:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2657f8fe2a825ca335d18ce7a3977aa32727b905",
"body": null,
"is_bot": true,
"headline": "chore(deps): bump golang from `c259ff7` to `7ef9411` (#247)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-23T23:11:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7f50ea0cfb0cbd817c1c67a91e70f5387a58ad45",
"body": "…oup (#246)",
"is_bot": true,
"headline": "chore(deps): bump goreleaser/goreleaser-action in the dependencies gr…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-23T23:11:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b8495b940293070f2b461c3622229895d10028d3",
"body": "…#242)",
"is_bot": true,
"headline": "chore(deps): bump github.com/go-git/go-git/v5 from 5.17.2 to 5.18.0 (…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-18T11:22:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b3fcab9833ccc6c8a293fac41e175ee151c6b239",
"body": "Bumps alpine from `2510918` to `5b10f43`.\n\n---\nupdated-dependencies:\n- dependency-name: alpine\n dependency-version: '3.23'\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump alpine from `2510918` to `5b10f43` (#241)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-16T22:25:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "10cd3acbababcb419196736c9280025b3e72c985",
"body": "…#240)\n\nBumps the dependencies group with 1 update: [actions/upload-artifact](https://github.com/actions/upload-artifact).\n\n\nUpdates `actions/upload-artifact` from 7.0.0 to 7.0.1\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-arti\n[…]\nersion-update:semver-patch\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump actions/upload-artifact in the dependencies group (…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-16T22:24:54Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4dedfc05e93e049df14ef2388745155df71ebd4c",
"body": "* update version test\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* update go.mod\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n---------\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>",
"is_bot": false,
"headline": "fix: test --verbose flag via SetArgs instead of viper.Set (#238)",
"author_name": "Satarupa Deb",
"author_login": "Satarupa22-SD",
"committed_at": "2026-04-16T22:24:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "09a57e5b7cea5ac2cfde4c10cec46983c0ed51b4",
"body": "Signed-off-by: Eddie Knight <knight@linux.com>",
"is_bot": false,
"headline": "chore: update SDK dependency (#237)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-04-15T16:59:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d24b6b2d2e0d3c04be1e5b6ad5b9b749f91b2a68",
"body": "* chore: upgrade sdk\n\n- silence downloads in install test\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n* fix: capture install output in success tests for debuggability\n\n## What\n\nReplace `> /dev/null` with output capture in the two success test cases\n(`test_installs_when_checksum_matches` and `test\n[…]\nhe failure test cases in the\nsame file.\n\n## Notes\n\n- Addresses Copilot review comments on PR #236\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "chore: upgrade sdk (#236)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-04-12T23:15:26Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7b74f17612a506857f47df97e06297d411732de6",
"body": "Bumps the dependencies group with 1 update: [github.com/privateerproj/privateer-sdk](https://github.com/privateerproj/privateer-sdk).\n\n\nUpdates `github.com/privateerproj/privateer-sdk` from 1.23.0 to 1.23.1\n- [Release notes](https://github.com/privateerproj/privateer-sdk/releases)\n- [Commits](https:\n[…]\nersion-update:semver-patch\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/privateerproj/privateer-sdk (#235)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-12T21:39:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "afb24075cf8a8bc4a59fce55214562cc33301657",
"body": null,
"is_bot": false,
"headline": "feat: Add install command (#204)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-04-12T03:33:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "20306d0cf8f62a5d61ca5ddbac381ba3b498a801",
"body": "* fix: add mandatory checksum verification to install.sh\n\nThe installer previously piped the downloaded archive directly into tar\nwithout any integrity check, allowing a compromised release asset or\nMITM to silently deliver a tampered binary.\n\nChanges:\n- Download the release archive to a temp file b\n[…]\nigned-off-by: Vinaya Damle <vinayada@mac.lan>\n\n---------\n\nSigned-off-by: Vinaya Damle <vinayada@mac.lan>\nCo-authored-by: Vinaya Damle <vinayada@mac.lan>\nCo-authored-by: Eddie Knight <knight@linux.com>",
"is_bot": false,
"headline": "fix: add mandatory SHA-256 checksum verification to install.sh (#226)",
"author_name": "vinayada1",
"author_login": "vinayada1",
"committed_at": "2026-04-11T15:02:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1709ffeb6dd6b6b4fc80c37c0644739861f72694",
"body": "Signed-off-by: Satarupa22-SD <satarupa2212@gmail.com>",
"is_bot": false,
"headline": "fix: filter .exe binaries from plugin list (#234)",
"author_name": "Satarupa Deb",
"author_login": "Satarupa22-SD",
"committed_at": "2026-04-10T19:33:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7b249ae1d59b159354982a3a92e03a36ca9de77d",
"body": "* chore: upgrade go to 1.26.2\n\n## What\n\nUpgrade Go from 1.26.1 to 1.26.2 in go.mod and the Dockerfile base image.\n\n## Why\n\ngo1.26.2 fixes 4 vulnerabilities in the standard library:\n\n- GO-2026-4947: unexpected work during chain building (crypto/x509)\n- GO-2026-4946: inefficient policy validation (cry\n[…]\n>\n\n* Revert \"fix(ci): add dependency-graph read permission to integration tests\"\n\nThis reverts commit c89483144ababdde6fda911ec873b74006e50a09.\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "chore: upgrade go to 1.26.2 (#233)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-04-09T15:49:57Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "838059da7ba95da56f1aa15519835b71b3894da9",
"body": "The integration test script enables shell tracing globally and writes\nGITHUB_TOKEN into a temporary config file via heredoc. With tracing\nleft on, the expanded token value can appear in CI logs.\n\nDisable tracing only around the config-generation block so secret\nvalues are not echoed while preserving the rest of the script's\ntrace output.\n\nCo-authored-by: Vinaya Damle <vinayada@mac.lan>\nCo-authored-by: Jason Meridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "fix: disable shell tracing around token config generation (#227)",
"author_name": "vinayada1",
"author_login": "vinayada1",
"committed_at": "2026-04-08T23:13:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e48c4d2d2b02cd7c8d9608fc742bb30519d79182",
"body": "## What\n\nExtracted the integration test job from ci.yml into a dedicated\nintegration.yml workflow and replaced octo-sts OIDC token exchange with\nthe default GITHUB_TOKEN in both integration.yml and\nosps-security-assessment.yml. Deleted the STS policy file.\n\n## Why\n\nBoth workflows only perform read-o\n[…]\n\n- Removed id-token:write from both workflows, reducing privilege scope\n- Added explicit permissions: contents: read to the changes job in integration.yml\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "ci: remove octo-sts from repo, use default GITHUB_TOKEN (#232)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-04-08T23:10:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "38b125a0045ef7be590e6466eca276db751a3549",
"body": "…(#229)\n\n* chore(deps): bump golang from 1.25.1-alpine3.22 to 1.26.1-alpine3.22\n\nBumps golang from 1.25.1-alpine3.22 to 1.26.1-alpine3.22.\n\n---\nupdated-dependencies:\n- dependency-name: golang\n dependency-version: 1.26.1-alpine3.22\n dependency-type: direct:production\n update-type: version-update:s\n[…]\nbot] <support@github.com>\nSigned-off-by: jmeridth <jmeridth@gmail.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: jmeridth <jmeridth@gmail.com>",
"is_bot": true,
"headline": "chore(deps): bump golang from 1.25.1-alpine3.22 to 1.26.1-alpine3.22 …",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-07T20:04:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1a090f35c591287ec2f5a66ad0591a2996929537",
"body": "Bumps the dependencies group with 1 update: [github.com/privateerproj/privateer-sdk](https://github.com/privateerproj/privateer-sdk).\n\n\nUpdates `github.com/privateerproj/privateer-sdk` from 1.22.0 to 1.22.1\n- [Release notes](https://github.com/privateerproj/privateer-sdk/releases)\n- [Commits](https:\n[…]\nersion-update:semver-patch\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/privateerproj/privateer-sdk (#230)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-07T19:10:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c7d33693c705679a21a5b81c862ab488673bdc90",
"body": "Bumps alpine from 3.22 to 3.23.\n\n---\nupdated-dependencies:\n- dependency-name: alpine\n dependency-version: '3.23'\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump alpine from 3.22 to 3.23 (#231)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-07T19:00:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cbdaff6b7cc299528806c386969de045842461d0",
"body": "Co-authored-by: Vinaya Damle <vinayada@mac.lan>",
"is_bot": false,
"headline": "chore(deps): pin docker images for privateer (#228)",
"author_name": "vinayada1",
"author_login": "vinayada1",
"committed_at": "2026-04-07T18:51:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fb6262ed9427c2a290e0444f9257a6882fd393de",
"body": "…jection (#219)\n\n* refactor: replace package-level globals with CLI struct dependency injection\n\n## What\n\nIntroduce a CLI struct that holds logger, writer, build info, and\nrootCmd. Convert all command files from init() with package-level vars\nto methods on CLI. Delete execute.go and replace with cli\n[…]\ne buffer and that verbose-only fields (Commit:) are absent, rather than asserting an empty buffer\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "refactor: replace package-level globals with CLI struct dependency in…",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-03-31T13:35:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "01a2188061860fca260c3add552ba9d0bb30b01c",
"body": "## What\n\nAdd `fetch-depth: 0` to the integration test job's checkout step so\nthat git tags are available during the build.\n\n## Why\n\nThe Makefile uses `git describe --tags` to inject the version at build\ntime via ldflags. Without full git history in a shallow clone, this\nfails with:\n\n fatal: No na\n[…]\nd — the CI job doesn't need tags since it doesn't build the binary via ldflags\n- The \"Detect Changes\" job already uses `fetch-depth: 0` for its diff logic\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "fix(ci): add fetch-depth 0 to integration test checkout (#218)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-03-31T01:31:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "88191d60b51d777df7894a827c35596edab1a28f",
"body": "…a flag types (#217)\n\n* refactor: clean up dead tests, fix verbose flag, and use correct Cobra flag types\n\n## What\n\nRemove dead commented-out test in main_test.go, register the missing\n--verbose/-v flag on the version command, switch generate-plugin from\nPersistentFlags to Flags since it has no subc\n[…]\ns to stdout via fmt.Println rather than the tabwriter, so the test asserts the buffer stays empty\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "refactor: clean up dead tests, fix verbose flag, and use correct Cobr…",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-03-31T01:11:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6cf09e5fd82e2e3e8f4b3c98ebcd389d980b2e4b",
"body": "* refactor: improve Go idioms in run, env, and execute commands\n\n## What\n\nUse cobra.NoArgs for declarative argument validation in the run command,\nhandle previously swallowed errors from hcplugin.Discover and\nos.UserHomeDir, and switch from path.Join to filepath.Join for OS-aware\nfilesystem paths.\n\n\n[…]\n behavior added in the previous commit.\n\n## Notes\n\n- Addresses Copilot review feedback on PR #216\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "refactor: improve Go idioms in run, env, and execute commands (#216)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-03-31T00:36:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "883a247ee9f0c34816a6565f551ceaf2abfaea5d",
"body": "Bumps the dependencies group with 1 update: [github.com/privateerproj/privateer-sdk](https://github.com/privateerproj/privateer-sdk).\n\n\nUpdates `github.com/privateerproj/privateer-sdk` from 1.21.0 to 1.22.0\n- [Release notes](https://github.com/privateerproj/privateer-sdk/releases)\n- [Commits](https:\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/privateerproj/privateer-sdk (#215)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-30T21:56:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "aaf1907f7a26503f5fe868736d2cb94383cf82f6",
"body": "…#213)\n\nBumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.17.0 to 5.17.1.\n- [Release notes](https://github.com/go-git/go-git/releases)\n- [Commits](https://github.com/go-git/go-git/compare/v5.17.0...v5.17.1)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/go-git/go\n[…]\nv5\n dependency-version: 5.17.1\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/go-git/go-git/v5 from 5.17.0 to 5.17.1 (…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-30T21:27:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fb8c919c0474490e5fa57d2238f60e9d02b0191c",
"body": "* chore(deps): pin GitHub Actions to latest release SHAs\n\n## What\n\nPin all GitHub Actions references to full commit SHAs of their latest\nreleases, replacing bare version tags (v6, v7) and updating stale SHAs.\n\n## Why\n\nBare version tags are mutable and can be force-pushed, which is a supply\nchain ris\n[…]\nfuture catalog version bumps\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\nCo-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "chore(deps): pin GitHub Actions to latest release SHAs (#214)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-03-30T21:20:51Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1993290288c08404a121ea5c60610afe3aa19259",
"body": "* docs: add contributing.md\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* update links\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* docs: add contributing.md\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* docs: add contributing.md\n\nSigned-off-by: Satarupa22-SD <sa\n[…]\n linting errors\n\nUpdated formatting for tables and notes in the contributing guide.\n\n---------\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\nCo-authored-by: Jason Meridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "docs: add contributing.md file to pvtr (#211)",
"author_name": "Satarupa Deb",
"author_login": "Satarupa22-SD",
"committed_at": "2026-03-21T04:01:10Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5fc9f80de6312ffb7ab033357f02298028c05ba6",
"body": "Bumps the dependencies group with 3 updates: [github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml](https://github.com/github-community-projects/ospo-reusable-workflows), [github-community-projects/ospo-reusable-workflows/.github/workflows/pr-title.yaml](https://gith\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump the dependencies group with 3 updates (#212)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-20T20:24:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a1f2fbaec520f1704e763431fa8afed891d77792",
"body": "Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.71.0 to 1.79.3.\n- [Release notes](https://github.com/grpc/grpc-go/releases)\n- [Commits](https://github.com/grpc/grpc-go/compare/v1.71.0...v1.79.3)\n\n---\nupdated-dependencies:\n- dependency-name: google.golang.org/grpc\n dependency-version: 1.79.3\n dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump google.golang.org/grpc from 1.71.0 to 1.79.3 (#209)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-19T02:26:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3abeb94c9824591e8b9789c17bd41546ce3af389",
"body": "Bumps the dependencies group with 3 updates: [github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml](https://github.com/github-community-projects/ospo-reusable-workflows), [github-community-projects/ospo-reusable-workflows/.github/workflows/pr-title.yaml](https://gith\n[…]\nersion-update:semver-patch\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump the dependencies group with 3 updates (#208)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-17T03:49:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9dd1e795b5500646bdd2fb011661ea91d3185b55",
"body": null,
"is_bot": true,
"headline": "chore(deps): bump the dependencies group with 3 updates (#207)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-16T21:22:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "df3bda3224b29d73a915205df90de566e7332cdc",
"body": "* feat: add --organization flag and adapt to SDK PluginConfig\n\n## What\n\nAdded the --organization / -g flag to the generate-plugin command and updated\nthe generatePlugin function to use the SDK's new PluginConfig struct return\nfrom SetupTemplatingEnvironment.\n\n## Why\n\nThe SDK now returns a PluginConf\n[…]\n changes. Also updated the generatePlugin function\ncomment to reflect the current implementation.\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "feat: add --organization flag and adapt to SDK PluginConfig (#206)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-03-16T06:54:22Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "afa4f98ad505ecd7113d5906cab8b5a5f39aa091",
"body": "…#205)\n\n* feat: replace goreleaser brews with custom homebrew update workflow\n\n## What\n\nRemove the brews section from .goreleaser.yaml and add a new update-homebrew job to the release workflow that updates the homebrew-tap formula by patching URLs and SHA256 checksums directly.\n\n## Why\n\nGoReleaser's\n[…]\n3.0 (4b73464bb391d4059bd26b0524d20df3927bd417)\n- Version comments retained inline for readability\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "feat: replace goreleaser brews with custom homebrew update workflow (…",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-03-16T01:37:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "013a03b098ac11dd19ea55fb4f85295e83d38054",
"body": "…(#203)\n\n## What\n\nSet the name_template field on universal_binaries in .goreleaser.yaml to \"pvtr\" so the macOS universal binary matches the configured build binary name.\n\n## Why\n\nThe universal_binaries name_template defaults to {{ .ProjectName }}, which resolves to the repo name \"privateer\". With re\n[…]\n- The archive filenames will still use \"privateer\" (e.g., privateer_Darwin_all.tar.gz) since ProjectName is unchanged — only the binary inside is affected\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "fix: set universal_binaries name_template to match build binary name …",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-03-14T21:44:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d6147b78d90d5a8458a7113ba5708bad44a39c1b",
"body": "* feat: rename binary from privateer to pvtr\n\n## What\n\nRenamed the CLI binary and all build artifacts from privateer to pvtr.\nThe cobra root command, GoReleaser config, Makefile, Dockerfile, install\nscript, and integration tests all reference the new binary name. A\nbackward-compatible symlink (priva\n[…]\nr\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n* fix: rename build output executables to 'privateer' to match articts generated by goreleaser\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "feat: rename binary from privateer to pvtr (#202)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-03-14T15:44:42Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b5f4bb600d39047c19d6175ff8bd854d433d0f5f",
"body": "* chore: upgrade dependencies\n\nSigned-off-by: Eddie Knight <knight@linux.com>\n\n* replace\n\nSigned-off-by: Eddie Knight <knight@linux.com>\n\n* sdk v1.20.0\n\nSigned-off-by: Eddie Knight <knight@linux.com>\n\n---------\n\nSigned-off-by: Eddie Knight <knight@linux.com>",
"is_bot": false,
"headline": "chore: upgrade dependencies (#201)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-03-13T06:54:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "84ebc5c5a3c1f8aca773167d2a612470885c19f7",
"body": "Signed-off-by: Eddie Knight <knight@linux.com>",
"is_bot": false,
"headline": "docs: initial threats for Privateer CLI (#200)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-03-11T13:33:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "40f0a6f10898433e520ca01ff56f17e81dffd9a3",
"body": "…(#199)\n\n## What\n\nUpdated the organization path for ospo-reusable-workflows from `github` to\n`github-community-projects` across auto-labeler, pr-title, and release workflows.\n\n## Why\n\nThe ospo-reusable-workflows repository has been transferred to the\ngithub-community-projects organization, making th\n[…]\nsolves correctly under the new org\n- All three workflows (auto-labeler, pr-title, release) are affected; if any were missed, CI will break on next trigger\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "fix: update ospo-reusable-workflows org to github-community-projects …",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-03-10T06:47:57Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e1de9b5958543cff04b96ed9a67def3bacd18ddb",
"body": null,
"is_bot": true,
"headline": "chore(deps): bump actions/upload-artifact from 6 to 7 (#198)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-02T23:32:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2844396e5c373f5dc22de9a2806df4041832d5c8",
"body": null,
"is_bot": true,
"headline": "chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 (#197)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-02-25T19:38:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0bc10a33e70fc70c57324b2ab55a5d94d12f7d14",
"body": "Signed-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "chore: upgrade osps github action to latest release SHA (#196)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-24T20:27:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "388838e78de435ff7861d30f5303e6f1b2d21eeb",
"body": null,
"is_bot": false,
"headline": "chore: Update OSPS baseline action version in workflow (#195)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-24T17:30:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "15918ae2bf27666c1730cd8352530738c0922ba9",
"body": null,
"is_bot": false,
"headline": "chore: Add workflow_dispatch trigger to security insights (#194)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-24T16:09:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "755b4a333d18fec9418b6e76f1ce2f13bb3495f2",
"body": "Bumps the dependencies group with 1 update: [github.com/privateerproj/privateer-sdk](https://github.com/privateerproj/privateer-sdk).\n\n\nUpdates `github.com/privateerproj/privateer-sdk` from 1.18.0 to 1.19.0\n- [Release notes](https://github.com/privateerproj/privateer-sdk/releases)\n- [Commits](https:\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/privateerproj/privateer-sdk (#192)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-02-24T02:15:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b47a0dca2ea92c95225e427f5ee92d4007c99afb",
"body": "…193)",
"is_bot": true,
"headline": "chore(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 (#…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-02-23T23:05:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "15643b4ea7b9d34ea27259d02cd689b03178de8c",
"body": "… v1.2.0 (#191)\n\n## What\n\nAdded a new workflow to validate the security-insights.yml file on pushes and PRs\nto main, and bumped the osps-baseline-action from v1.0.0 to v1.2.0.\n\n## Why\n\nThe security insights validation ensures the security-insights.yml file stays\nwell-formed as it's updated. The acti\n[…]\nd to a full commit SHA rather than a\nsemver tag — this is intentional for supply chain safety but means future\nupdates require manually updating the hash.\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "ci: add security insights validation and bump osps-baseline-action to…",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-21T17:54:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3013672eff6b12bd06e41e9d1f4c22f25544e285",
"body": "… (#190)\n\n* ci: replace stored secret with octo-sts for security assessment token\n\n## What\n\nSwitch the OSPS security assessment workflow from using a stored\n`PRIVATEER_GITHUB_TOKEN` secret to dynamically generated tokens via\nocto-sts/action, and add `.claude/` to `.gitignore`.\n\n## Why\n\nOcto-sts prov\n[…]\ned-off-by: jmeridth <jmeridth@gmail.com>\n\n* fix: don't persist credentials when checking out code\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "ci: replace stored secret with octo-sts for security assessment token…",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-21T05:42:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e3c8c521673dd5d9295b06533b141438eeebca0e",
"body": "* ci: skip CI on markdown-only PRs and add markdown linting\n\n## What\n\nReplaced `paths-ignore` with a change-detection job that gates CI and\nintegration jobs so they skip but still satisfy required checks on\nmarkdown-only PRs. Added a markdown lint job using markdownlint-cli2 to\nthe lint workflow, wi\n[…]\n.yml\n\nCo-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\nCo-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "ci: skip CI on markdown-only PRs and add markdown linting (#189)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-19T19:02:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "98090aeabc2c1726295890747aaa01a00c62bebe",
"body": "## What:\n\nAdded Homebrew as the first installation option via the\nprivateerproj/tap tap, and promoted installation options from bold text\nto h4 headings for consistency (markdown linting)\n\n## Why:\n\nHomebrew is the most ergonomic installation method for macOS and Linux\nusers, and should be discoverable as the primary option.\n\n## Notes:\n\nNone\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "docs: add Homebrew tap installation method to README (#188)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-19T18:31:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "70f7268fb372e04cd08e8b2df60a6b79d253d359",
"body": "* fix: update acceptance test to use correct test data filename\n\n## What\n\nUpdate the generate-plugin source path in the acceptance test from\nCCC.VPC_2025.01.yaml to OSPS_Baseline_AC_2025_02.yaml.\n\n## Why\n\nThe test data file was renamed but the acceptance test was not updated,\ncausing the generate-pl\n[…]\nolder and is a reference template, not used directly by CI.\n- This will be handled in a future PR\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "fix: propagate generate-plugin errors to exit code (#187)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-17T02:30:26Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ccadcab717965212b00e7f15ffab62c4c7791340",
"body": "- update to run on push to main, just to double check everything after it\n integrates with default/main branch\n- update octo-sts permissions to include read permissions to run plugin\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "fix: ci (#186)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-16T03:27:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "48f67b66a0432b575c697a6fc273c422e43c3b56",
"body": "## What\n\nAdd an integration test that downloads the latest pvtr-github-repo plugin\nrelease and runs it against the privateer repository using the OSPS\nbaseline catalog at Maturity Level 1.\n\n## Why\n\nValidates that privateer can discover, load, and execute a real plugin\nend-to-end in CI, catching inte\n[…]\n verification step greps for the summary line pattern rather than\n asserting specific pass/fail counts, so it won't break as the plugin\n or repo evolves\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "feat: add pvtr-github-repo plugin integration test (#185)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-16T03:11:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8781dad6bd9439da02facb869356b49d700a3a9a",
"body": "Closes https://github.com/privateerproj/privateer/issues/181\n\n## What\n\nAdd a new `env` command (aliased as `info`) that displays the binary\npath, config location, plugins directory, discovered plugins, version,\ncommit, build time, Go version, and OS/arch.\n\n## Why\n\nThere was no way to quickly see whi\n[…]\nbinaries, matching\n existing behavior in the SDK\n- Config path comes from viper's \"config\" key which defaults to\n {cwd}/config.yml via the SDK's SetBase\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "feat: add env command to display runtime environment info (#182)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-15T17:14:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e5692bd2fa64670b3adf9b9bd3a1c07eb0b52356",
"body": "Bumps the dependencies group with 1 update: [github.com/privateerproj/privateer-sdk](https://github.com/privateerproj/privateer-sdk).\n\n\nUpdates `github.com/privateerproj/privateer-sdk` from 1.17.2 to 1.18.0\n- [Release notes](https://github.com/privateerproj/privateer-sdk/releases)\n- [Commits](https:\n[…]\nersion-update:semver-minor\n dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/privateerproj/privateer-sdk (#184)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-02-15T17:12:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4ae5557c6f18739380757d1bcea21610582f295f",
"body": "* chore: refactored entrypoint logic\n\nSigned-off-by: Eddie Knight <knight@linux.com>\n\n* linting\n\nSigned-off-by: Eddie Knight <knight@linux.com>\n\n---------\n\nSigned-off-by: Eddie Knight <knight@linux.com>",
"is_bot": false,
"headline": "chore: refactored entrypoint logic (#183)",
"author_name": "Eddie Knight",
"author_login": "eddie-knight",
"committed_at": "2026-02-15T17:07:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "53226ed7521a60edf71d55a80923bea00b1443b2",
"body": "## What\n\nAdd ldflags to the goreleaser build config to set Version,\nVersionPostfix, GitCommitHash, and BuiltAt at build time.\n\n## Why\n\nReleased binaries report \"0.0.0-dev\" because the default values in\nmain.go are never overridden during the goreleaser build. Without\nldflags, the Go linker has no in\n[…]\nreducing binary size\n but making stack traces less detailed if users report panics\n- Existing releases are unaffected; only future tags will pick this up\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "fix: inject version info into binaries via goreleaser ldflags (#180)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-15T15:15:20Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b64b4d5fbc86d13bb26d2a3d6b43a365faba58f0",
"body": "## What\n\nReplace verbose if/then blocks with idiomatic shell || operator for\ntracking command failures in the acceptance test script.\n\n## Why\n\nThe repeated $? check pattern is unnecessarily verbose. The || idiom\nis the standard shell approach for \"run but record failure\" and\nreduces the script from \n[…]\ndentical behavior.\n\n## Notes\n\n- No behavioral change — all commands still run regardless of\n earlier failures, and the aggregate exit status is preserved\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "refactor: simplify acceptance test error handling (#178)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-15T07:26:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c1925cd3ec03f47db2d138b38d73c65185f0ef46",
"body": "## What\n\nUpdate the security-insights.yml file to conform to the OSSF Security\nInsights 2.2.0 schema specification, correct stale metadata, and\nupdate the core team roster.\n\n## Why\n\nThe file was using schema version 2.0.0 with outdated dates, a\nplaceholder release license block, and a stale contribu\n[…]\n\n when release license differs from repo license)\n- Rudra Gupta was removed from core-team; Jason Meridth affiliation\n updated from GitHub to Chainguard\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
"is_bot": false,
"headline": "chore: update security-insights.yml to 2.2.0 schema (#177)",
"author_name": "Jason Meridth",
"author_login": "jmeridth",
"committed_at": "2026-02-15T07:12:07Z",
"body_truncated": true,
"is_coding_agent": false
}
],
"releases_count": 44,
"commits_last_year": 151,
"latest_release_at": "2026-07-20T14:10:11Z",
"latest_release_tag": "v0.22.0",
"releases_from_tags": false,
"days_since_last_push": 4,
"active_weeks_last_year": 37,
"days_since_latest_release": 11,
"mean_days_between_releases": 12.3
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 75,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "github.com/privateerproj/privateer",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/privateerproj/privateer",
"is_deprecated": false,
"latest_version": "v0.22.0",
"repository_url": "https://github.com/privateerproj/privateer",
"versions_count": 46,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-20T13:35:45Z",
"latest_version_yanked": null,
"days_since_latest_publish": 11
}
]
},
"popularity": {
"forks": 9,
"stars": 23,
"watchers": 3,
"fork_history": {
"days": [
{
"date": "2023-10-08",
"count": 1
},
{
"date": "2024-09-10",
"count": 1
},
{
"date": "2025-03-16",
"count": 1
},
{
"date": "2025-04-09",
"count": 1
},
{
"date": "2025-09-25",
"count": 1
},
{
"date": "2025-11-26",
"count": 1
},
{
"date": "2026-03-11",
"count": 1
},
{
"date": "2026-04-03",
"count": 1
},
{
"date": "2026-07-21",
"count": 1
}
],
"complete": true,
"collected": 9,
"total_forks": 9
},
"star_history": null,
"open_issues_and_prs": 11
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"go.mod"
],
"largest_source_bytes": 4427,
"source_files_sampled": 12,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"go.mod"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.54.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5932"
],
"fixed_version": null,
"advisory_count": 1,
"oldest_advisory_days": 24
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"unknown": 1
},
"advisory_count": 1,
"affected_count": 1,
"assessed_count": 125,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "github.com/hashicorp/go-hclog",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.6.3"
},
{
"name": "github.com/hashicorp/go-plugin",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.8.0"
},
{
"name": "github.com/privateerproj/privateer-sdk",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.32.0"
},
{
"name": "github.com/spf13/cobra",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.2"
},
{
"name": "github.com/spf13/viper",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.21.0"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "github.com/hashicorp/go-hclog",
"direct": true,
"version": "v1.6.3",
"ecosystem": "go"
},
{
"name": "github.com/hashicorp/go-plugin",
"direct": true,
"version": "v1.8.0",
"ecosystem": "go"
},
{
"name": "github.com/privateerproj/privateer-sdk",
"direct": true,
"version": "v1.32.0",
"ecosystem": "go"
},
{
"name": "github.com/spf13/cobra",
"direct": true,
"version": "v1.10.2",
"ecosystem": "go"
},
{
"name": "github.com/spf13/viper",
"direct": true,
"version": "v1.21.0",
"ecosystem": "go"
},
{
"name": "dario.cat/mergo",
"direct": false,
"version": "v1.0.1",
"ecosystem": "go"
},
{
"name": "github.com/asaskevich/govalidator",
"direct": false,
"version": "v0.0.0-20230301143203-a9d515a09cc2",
"ecosystem": "go"
},
{
"name": "github.com/blang/semver",
"direct": false,
"version": "v3.5.1+incompatible",
"ecosystem": "go"
},
{
"name": "github.com/cenkalti/backoff/v5",
"direct": false,
"version": "v5.0.3",
"ecosystem": "go"
},
{
"name": "github.com/cespare/xxhash/v2",
"direct": false,
"version": "v2.3.0",
"ecosystem": "go"
},
{
"name": "github.com/cloudflare/circl",
"direct": false,
"version": "v1.6.3",
"ecosystem": "go"
},
{
"name": "github.com/coreos/go-oidc/v3",
"direct": false,
"version": "v3.17.0",
"ecosystem": "go"
},
{
"name": "github.com/cyberphone/json-canonicalization",
"direct": false,
"version": "v0.0.0-20241213102144-19d51d7fe467",
"ecosystem": "go"
},
{
"name": "github.com/cyphar/filepath-securejoin",
"direct": false,
"version": "v0.6.1",
"ecosystem": "go"
},
{
"name": "github.com/defenseunicorns/go-oscal",
"direct": false,
"version": "v0.7.0",
"ecosystem": "go"
},
{
"name": "github.com/digitorus/pkcs7",
"direct": false,
"version": "v0.0.0-20230818184609-3a137a874352",
"ecosystem": "go"
},
{
"name": "github.com/digitorus/timestamp",
"direct": false,
"version": "v0.0.0-20231217203849-220c5c2851b7",
"ecosystem": "go"
},
{
"name": "github.com/emirpasic/gods",
"direct": false,
"version": "v1.18.1",
"ecosystem": "go"
},
{
"name": "github.com/fatih/color",
"direct": false,
"version": "v1.18.0",
"ecosystem": "go"
},
{
"name": "github.com/fsnotify/fsnotify",
"direct": false,
"version": "v1.9.0",
"ecosystem": "go"
},
{
"name": "github.com/gemaraproj/go-gemara",
"direct": false,
"version": "v0.8.0",
"ecosystem": "go"
},
{
"name": "github.com/go-git/gcfg",
"direct": false,
"version": "v1.5.1-0.20230307220236-3a3c6141e376",
"ecosystem": "go"
},
{
"name": "github.com/go-git/go-billy/v5",
"direct": false,
"version": "v5.9.0",
"ecosystem": "go"
},
{
"name": "github.com/go-git/go-git/v5",
"direct": false,
"version": "v5.19.1",
"ecosystem": "go"
},
{
"name": "github.com/go-jose/go-jose/v4",
"direct": false,
"version": "v4.1.4",
"ecosystem": "go"
},
{
"name": "github.com/go-logr/logr",
"direct": false,
"version": "v1.4.3",
"ecosystem": "go"
},
{
"name": "github.com/go-logr/stdr",
"direct": false,
"version": "v1.2.2",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/analysis",
"direct": false,
"version": "v0.25.2",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/errors",
"direct": false,
"version": "v0.22.8",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/jsonpointer",
"direct": false,
"version": "v0.23.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/jsonreference",
"direct": false,
"version": "v0.21.6",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/loads",
"direct": false,
"version": "v0.24.0",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/runtime",
"direct": false,
"version": "v0.32.4",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/runtime/server-middleware",
"direct": false,
"version": "v0.30.0",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/spec",
"direct": false,
"version": "v0.22.6",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/strfmt",
"direct": false,
"version": "v0.26.4",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag",
"direct": false,
"version": "v0.26.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/cmdutils",
"direct": false,
"version": "v0.26.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/conv",
"direct": false,
"version": "v0.27.0",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/fileutils",
"direct": false,
"version": "v0.26.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/jsonname",
"direct": false,
"version": "v0.26.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/jsonutils",
"direct": false,
"version": "v0.26.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/loading",
"direct": false,
"version": "v0.26.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/mangling",
"direct": false,
"version": "v0.26.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/netutils",
"direct": false,
"version": "v0.26.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/stringutils",
"direct": false,
"version": "v0.26.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/typeutils",
"direct": false,
"version": "v0.27.0",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/yamlutils",
"direct": false,
"version": "v0.26.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/validate",
"direct": false,
"version": "v0.26.0",
"ecosystem": "go"
},
{
"name": "github.com/go-viper/mapstructure/v2",
"direct": false,
"version": "v2.5.0",
"ecosystem": "go"
},
{
"name": "github.com/goccy/go-yaml",
"direct": false,
"version": "v1.19.2",
"ecosystem": "go"
},
{
"name": "github.com/golang/groupcache",
"direct": false,
"version": "v0.0.0-20241129210726-2c02b8208cf8",
"ecosystem": "go"
},
{
"name": "github.com/golang/protobuf",
"direct": false,
"version": "v1.5.4",
"ecosystem": "go"
},
{
"name": "github.com/google/certificate-transparency-go",
"direct": false,
"version": "v1.3.3",
"ecosystem": "go"
},
{
"name": "github.com/google/go-containerregistry",
"direct": false,
"version": "v0.21.7",
"ecosystem": "go"
},
{
"name": "github.com/google/uuid",
"direct": false,
"version": "v1.6.0",
"ecosystem": "go"
},
{
"name": "github.com/grpc-ecosystem/grpc-gateway/v2",
"direct": false,
"version": "v2.29.0",
"ecosystem": "go"
},
{
"name": "github.com/hashicorp/go-cleanhttp",
"direct": false,
"version": "v0.5.2",
"ecosystem": "go"
},
{
"name": "github.com/hashicorp/go-retryablehttp",
"direct": false,
"version": "v0.7.8",
"ecosystem": "go"
},
{
"name": "github.com/hashicorp/yamux",
"direct": false,
"version": "v0.1.2",
"ecosystem": "go"
},
{
"name": "github.com/in-toto/attestation",
"direct": false,
"version": "v1.2.0",
"ecosystem": "go"
},
{
"name": "github.com/in-toto/in-toto-golang",
"direct": false,
"version": "v0.11.0",
"ecosystem": "go"
},
{
"name": "github.com/inconshreveable/mousetrap",
"direct": false,
"version": "v1.1.0",
"ecosystem": "go"
},
{
"name": "github.com/jbenet/go-context",
"direct": false,
"version": "v0.0.0-20150711004518-d14ea06fba99",
"ecosystem": "go"
},
{
"name": "github.com/jedisct1/go-minisign",
"direct": false,
"version": "v0.0.0-20211028175153-1c139d1cc84b",
"ecosystem": "go"
},
{
"name": "github.com/kevinburke/ssh_config",
"direct": false,
"version": "v1.2.0",
"ecosystem": "go"
},
{
"name": "github.com/klauspost/cpuid/v2",
"direct": false,
"version": "v2.3.0",
"ecosystem": "go"
},
{
"name": "github.com/mattn/go-colorable",
"direct": false,
"version": "v0.1.14",
"ecosystem": "go"
},
{
"name": "github.com/mattn/go-isatty",
"direct": false,
"version": "v0.0.20",
"ecosystem": "go"
},
{
"name": "github.com/microsoft/go-winio",
"direct": false,
"version": "v0.6.2",
"ecosystem": "go"
},
{
"name": "github.com/oklog/run",
"direct": false,
"version": "v1.1.0",
"ecosystem": "go"
},
{
"name": "github.com/oklog/ulid/v2",
"direct": false,
"version": "v2.1.1",
"ecosystem": "go"
},
{
"name": "github.com/opencontainers/go-digest",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/opencontainers/image-spec",
"direct": false,
"version": "v1.1.1",
"ecosystem": "go"
},
{
"name": "github.com/pelletier/go-toml/v2",
"direct": false,
"version": "v2.2.4",
"ecosystem": "go"
},
{
"name": "github.com/pjbgf/sha1cd",
"direct": false,
"version": "v0.6.0",
"ecosystem": "go"
},
{
"name": "github.com/pkg/browser",
"direct": false,
"version": "v0.0.0-20240102092130-5ac0b6a4141c",
"ecosystem": "go"
},
{
"name": "github.com/pkg/errors",
"direct": false,
"version": "v0.9.1",
"ecosystem": "go"
},
{
"name": "github.com/protonmail/go-crypto",
"direct": false,
"version": "v1.1.6",
"ecosystem": "go"
},
{
"name": "github.com/revanite-io/grc-store-protocol",
"direct": false,
"version": "v0.5.0",
"ecosystem": "go"
},
{
"name": "github.com/sagikazarmark/locafero",
"direct": false,
"version": "v0.11.0",
"ecosystem": "go"
},
{
"name": "github.com/santhosh-tekuri/jsonschema/v6",
"direct": false,
"version": "v6.0.2",
"ecosystem": "go"
},
{
"name": "github.com/sassoftware/relic",
"direct": false,
"version": "v7.2.1+incompatible",
"ecosystem": "go"
},
{
"name": "github.com/secure-systems-lab/go-securesystemslib",
"direct": false,
"version": "v0.11.0",
"ecosystem": "go"
},
{
"name": "github.com/sergi/go-diff",
"direct": false,
"version": "v1.4.0",
"ecosystem": "go"
},
{
"name": "github.com/shibumi/go-pathspec",
"direct": false,
"version": "v1.3.0",
"ecosystem": "go"
},
{
"name": "github.com/sigstore/protobuf-specs",
"direct": false,
"version": "v0.5.1",
"ecosystem": "go"
},
{
"name": "github.com/sigstore/rekor",
"direct": false,
"version": "v1.5.3",
"ecosystem": "go"
},
{
"name": "github.com/sigstore/rekor-tiles/v2",
"direct": false,
"version": "v2.3.0",
"ecosystem": "go"
},
{
"name": "github.com/sigstore/sigstore",
"direct": false,
"version": "v1.10.8",
"ecosystem": "go"
},
{
"name": "github.com/sigstore/sigstore-go",
"direct": false,
"version": "v1.2.2",
"ecosystem": "go"
},
{
"name": "github.com/sigstore/timestamp-authority/v2",
"direct": false,
"version": "v2.1.2",
"ecosystem": "go"
},
{
"name": "github.com/skeema/knownhosts",
"direct": false,
"version": "v1.3.1",
"ecosystem": "go"
},
{
"name": "github.com/sourcegraph/conc",
"direct": false,
"version": "v0.3.1-0.20240121214520-5f936abd7ae8",
"ecosystem": "go"
},
{
"name": "github.com/spf13/afero",
"direct": false,
"version": "v1.15.0",
"ecosystem": "go"
},
{
"name": "github.com/spf13/cast",
"direct": false,
"version": "v1.10.0",
"ecosystem": "go"
},
{
"name": "github.com/spf13/pflag",
"direct": false,
"version": "v1.0.10",
"ecosystem": "go"
},
{
"name": "github.com/subosito/gotenv",
"direct": false,
"version": "v1.6.0",
"ecosystem": "go"
},
{
"name": "github.com/theupdateframework/go-tuf",
"direct": false,
"version": "v0.7.0",
"ecosystem": "go"
},
{
"name": "github.com/theupdateframework/go-tuf/v2",
"direct": false,
"version": "v2.4.2",
"ecosystem": "go"
},
{
"name": "github.com/transparency-dev/formats",
"direct": false,
"version": "v0.1.1",
"ecosystem": "go"
},
{
"name": "github.com/transparency-dev/merkle",
"direct": false,
"version": "v0.0.2",
"ecosystem": "go"
},
{
"name": "github.com/xanzy/ssh-agent",
"direct": false,
"version": "v0.3.3",
"ecosystem": "go"
},
{
"name": "github.com/youmark/pkcs8",
"direct": false,
"version": "v0.0.0-20240726163527-a2c0da244d78",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/auto/sdk",
"direct": false,
"version": "v1.2.1",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/metric",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/trace",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.yaml.in/yaml/v3",
"direct": false,
"version": "v3.0.4",
"ecosystem": "go"
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.54.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/mod",
"direct": false,
"version": "v0.38.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/net",
"direct": false,
"version": "v0.56.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/oauth2",
"direct": false,
"version": "v0.36.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sync",
"direct": false,
"version": "v0.22.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sys",
"direct": false,
"version": "v0.47.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/term",
"direct": false,
"version": "v0.45.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/text",
"direct": false,
"version": "v0.40.0",
"ecosystem": "go"
},
{
"name": "google.golang.org/genproto/googleapis/api",
"direct": false,
"version": "v0.0.0-20260526163538-3dc84a4a5aaa",
"ecosystem": "go"
},
{
"name": "google.golang.org/genproto/googleapis/rpc",
"direct": false,
"version": "v0.0.0-20260523011958-0a33c5d7ca68",
"ecosystem": "go"
},
{
"name": "google.golang.org/grpc",
"direct": false,
"version": "v1.82.1",
"ecosystem": "go"
},
{
"name": "google.golang.org/protobuf",
"direct": false,
"version": "v1.36.11",
"ecosystem": "go"
},
{
"name": "gopkg.in/warnings.v0",
"direct": false,
"version": "v0.1.2",
"ecosystem": "go"
},
{
"name": "gopkg.in/yaml.v3",
"direct": false,
"version": "v3.0.1",
"ecosystem": "go"
},
{
"name": "k8s.io/klog/v2",
"direct": false,
"version": "v2.140.0",
"ecosystem": "go"
},
{
"name": "oras.land/oras-go/v2",
"direct": false,
"version": "v2.6.2",
"ecosystem": "go"
}
],
"collected": true,
"truncated": false,
"total_count": 125,
"direct_count": 5,
"indirect_count": 120
}
},
"maintainership": {
"issues": {
"open_prs": 1,
"merged_prs": 238,
"open_issues": 10,
"closed_ratio": 0.677,
"closed_issues": 21,
"closed_unmerged_prs": 23
},
"bus_factor": 2,
"bot_contributors": 1,
"top_contributors": [
{
"type": "User",
"login": "eddie-knight",
"commits": 95,
"avatar_url": "https://avatars.githubusercontent.com/u/21176439?v=4"
},
{
"type": "User",
"login": "jmeridth",
"commits": 68,
"avatar_url": "https://avatars.githubusercontent.com/u/35014?v=4"
},
{
"type": "User",
"login": "lluuiissoo",
"commits": 16,
"avatar_url": "https://avatars.githubusercontent.com/u/13456333?v=4"
},
{
"type": "User",
"login": "zohayb23",
"commits": 11,
"avatar_url": "https://avatars.githubusercontent.com/u/97380019?v=4"
},
{
"type": "User",
"login": "grudra7714",
"commits": 6,
"avatar_url": "https://avatars.githubusercontent.com/u/12394597?v=4"
},
{
"type": "User",
"login": "Satarupa22-SD",
"commits": 6,
"avatar_url": "https://avatars.githubusercontent.com/u/84276219?v=4"
},
{
"type": "User",
"login": "pascalstockert",
"commits": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/29748149?v=4"
},
{
"type": "User",
"login": "vinayada1",
"commits": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/28875764?v=4"
},
{
"type": "User",
"login": "trumant",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/599706?v=4"
},
{
"type": "User",
"login": "speas038",
"commits": 2,
"avatar_url": "https://avatars.githubusercontent.com/u/3419863?v=4"
}
],
"contributors_sampled": 13,
"top_contributor_share": 0.434
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"auto-labeler.yaml",
"ci.yaml",
"integration.yaml",
"lint.yaml",
"osps-security-assessment.yaml",
"post-merge.yaml",
"pr-title.yaml",
"release.yaml",
"security-insights.yaml",
"sync-go-version.yaml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 4,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 2,
"reason": "badge detected: InProgress",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 8,
"reason": "Found 8/10 approved changesets -- score normalized to 8",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 20 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 9,
"reason": "dependency not pinned by hash detected -- score normalized to 9",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 8,
"reason": "SAST tool is not run on all commits -- score normalized to 8",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 10,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 0,
"reason": "Project has not signed or included provenance with any releases.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 10,
"reason": "GitHub workflow tokens follow principle of least privilege",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 9,
"reason": "1 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "76500f5556acfac22f0009e8ca3bab1bae324ce4",
"ran_at": "2026-08-01T03:04:52Z",
"aggregate_score": 7.7,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": true
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-30T21:04:23Z",
"oldest_open_prs": [
{
"number": 293,
"created_at": "2026-07-28T05:33:15Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": "2026-07-27T17:13:07Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 2,
"created_at": "2023-02-27T17:31:10Z",
"last_comment_at": "2026-02-25T20:15:02Z",
"last_comment_author": "jmeridth"
},
{
"number": 67,
"created_at": "2025-01-09T04:42:45Z",
"last_comment_at": "2025-01-20T03:39:10Z",
"last_comment_author": "jmeridth"
},
{
"number": 103,
"created_at": "2025-03-17T13:39:41Z",
"last_comment_at": "2026-06-01T19:42:44Z",
"last_comment_author": "Satarupa22-SD"
},
{
"number": 118,
"created_at": "2025-08-30T11:32:25Z",
"last_comment_at": "2026-02-06T12:13:19Z",
"last_comment_author": "eddie-knight"
},
{
"number": 179,
"created_at": "2026-02-15T07:29:11Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 243,
"created_at": "2026-04-20T15:19:26Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 244,
"created_at": "2026-04-20T15:21:33Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 267,
"created_at": "2026-06-01T20:05:28Z",
"last_comment_at": "2026-06-07T15:34:40Z",
"last_comment_author": "jmeridth"
},
{
"number": 271,
"created_at": "2026-06-08T19:36:20Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 286,
"created_at": "2026-07-12T00:58:05Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/privateerproj/privateer",
"host": "github.com",
"name": "privateer",
"owner": "privateerproj"
},
"metrics": {
"overall": {
"key": "overall",
"band": "excellent",
"name": "Overall health",
"note": "The weighted overall 71 is calibrated to 84 on the published index scale (record calibration 2026-08-02).",
"notes": [
{
"code": "overall_calibration",
"params": {
"raw": 71,
"calibrated": 84,
"calibration": "2026-08-02"
}
}
],
"value": 84,
"inputs": {
"security": 82,
"vitality": 90,
"community": 56,
"governance": 71,
"calibration": "2026-08-02",
"engineering": 57,
"ai_readiness": 57,
"weighted_overall_raw": 71
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "excellent",
"name": "Vitality",
"value": 90,
"weight": 0.21,
"metrics": [
{
"key": "development_activity",
"band": "excellent",
"name": "Development activity",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"commits_last_year": 151,
"human_commit_share": 0.53,
"days_since_last_push": 4,
"active_weeks_last_year": 37
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 4 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 4
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "37/52 weeks with commits",
"points": 25.6,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 37
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "151 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 151
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"releases_count": 44,
"latest_release_tag": "v0.22.0",
"releases_from_tags": false,
"days_since_latest_release": 11,
"mean_days_between_releases": 12.3
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "44 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 44
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 11 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 11
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~12.3 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 12.3
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "exceptional",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 6,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 6 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 6
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "moderate",
"name": "Community & Adoption",
"value": 56,
"weight": 0.17,
"metrics": [
{
"key": "popularity",
"band": "at_risk",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 31,
"inputs": {
"forks": 9,
"stars": 23,
"watchers": 3,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "23 stars",
"points": 21.8,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 23
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "9 forks",
"points": 7.5,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 9
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "3 watchers",
"points": 1.7,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 3
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "excellent",
"name": "Community health",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_readme": true,
"has_license": true,
"readme_badges": null,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": true,
"readme_badge_services": [],
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 13.5,
"status": "met",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "good",
"name": "Sustainability & Governance",
"value": 71,
"weight": 0.23,
"metrics": [
{
"key": "maintainer_resilience",
"band": "moderate",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 61,
"inputs": {
"bus_factor": 2,
"contributors_sampled": 13,
"top_contributor_share": 0.434
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "2 contributor(s) cover half of all commits",
"points": 25.2,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 2
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 43% of commits",
"points": 12.7,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 43
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "13 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 13
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 20 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Newcomer PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"newcomer_pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 78,
"inputs": {
"merged_prs": 238,
"open_issues": 10,
"closed_issues": 21,
"prs_merged_7d": null,
"prs_decided_7d": null,
"prs_merged_30d": null,
"prs_decided_30d": null,
"issue_closed_ratio": 0.677,
"closed_unmerged_prs": 23,
"first_time_authors_30d": null,
"first_time_prs_merged_30d": null,
"first_time_prs_decided_30d": null
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "68% of issues closed",
"points": 28.4,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 68
}
}
],
"max_points": 42
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "238/261 decided PRs merged",
"points": 27.4,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 238,
"decided": 261
}
}
],
"max_points": 30
},
{
"key": "newcomer_pr_acceptance",
"name": "Newcomer PR acceptance",
"detail": "no first-time contributor's PR decided in 30d",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_newcomer_prs",
"params": {
"days": 30
}
}
],
"max_points": 13
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 8/10 approved changesets -- score normalized to 8",
"points": 12,
"status": "partial",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 51,
"inputs": {
"followers": 9,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "privateerproj",
"public_repos": 7,
"account_age_days": 1374
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "9 followers of privateerproj",
"points": 7.2,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 9,
"login": "privateerproj"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "7 public repos, account ~3 yr old",
"points": 14.1,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 7
}
},
{
"code": "account_age_years",
"params": {
"years": 3
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "exceptional",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"github.com/privateerproj/privateer"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 11
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 11 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 11
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "46 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 46
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 57,
"weight": 0.19,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 68,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "10 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 10
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "weak",
"name": "Documentation",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"topics": [],
"has_wiki": false,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "excellent",
"name": "Security",
"value": 82,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "good",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Packaging. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"packaging"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 77,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 17,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 1,
"scorecard_aggregate": 7.7
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 3,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "badge detected: InProgress",
"points": 0.5,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 8/10 approved changesets -- score normalized to 8",
"points": 6,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 20 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 9",
"points": 4.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 8",
"points": 4,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "GitHub workflow tokens follow principle of least privilege",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "1 existing vulnerabilities detected",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "exceptional",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 125 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories",
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 125
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 1,
"affected_packages": 1,
"assessed_packages": 125,
"unassessed_packages": 0,
"affected_by_severity": "unknown 1",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "exceptional",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 125,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "exceptional",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"commit_weight_rule": {
"min_commits": 50,
"min_commit_share": 0.1
},
"review_only_matches": 0,
"below_threshold_exposures": [],
"assessed_self_published_locations": 17
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 57,
"weight": 0.04,
"metrics": [
{
"key": "ai_agent_context",
"band": "weak",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 1,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "53 of 53 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 53,
"sampled": 53
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "good",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 71,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": true,
"typed_language": false,
"bootstrap_files": [
"Makefile"
],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0.02,
"toolchain_manifests": [
"go.mod"
],
"dependency_bot_commit_share": 0.47
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "2 of the last 100 commits agent-authored or agent-credited",
"points": 4,
"status": "partial",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 2,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "47 of the last 100 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 47,
"sampled": 100
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 9",
"points": 9,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "moderate",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"primary_language": "Shell",
"largest_source_bytes": 4427,
"source_files_sampled": 12,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Shell without a type-check config",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_typecheck_config_language",
"params": {
"language": "Shell"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/12 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 12,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight: agent tooling is a real maintenance signal, but its absence must never gate the top of the scale (calibration saturates at raw 91, so 100/100 remains reachable with AI Readiness at zero)."
}
],
"classification": {
"labels": [
"library",
"cli"
],
"scores": {
"cli": 4,
"plugin": 2,
"library": 6,
"framework": 2
},
"primary": "library",
"evidence": [
{
"tier": "distribution",
"label": "library",
"source": "registry:go",
"weight": 6
},
{
"tier": "dependencies",
"label": "cli",
"source": "dep:github.com/spf13/cobra",
"weight": 4
},
{
"tier": "description",
"label": "framework",
"source": "description:framework",
"weight": 2
},
{
"tier": "description",
"label": "plugin",
"source": "description:plugin",
"weight": 2
}
],
"artifacts": [],
"confidence": "medium",
"host_extension": false,
"runs_as_process": true,
"consumed_by_code": true
},
"metrics_version": "2.3.1"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-08-01T03:05:21.696716Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/p/privateerproj/privateer.svg",
"full_name": "privateerproj/privateer",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}
Пов’язані записи
Перевірені репозиторії, що мають спільні каталожні теги або екосистеми з privateerproj/privateer. Читати поруч →
Оцінки — це сигнали, а не гарантії. Вони відображають публічно видимі практики на GitHub — це не аудит коду й не гарантія безпеки.
Відсутні дані виключаються, а ваги перенормовуються — нуль за відсутність ніколи не ставиться. Методологія версіонована й відкрита: метрики v2.3.1, схема v0.27.0 — повна методологія · вікі метрик.
