Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
OpenSSF Scorecard did not return a usable result (2026/07/23 23:40:47 Warning: PATs stored in env variables GITHUB_AUTH_TOKEN and GITHUB_TOKEN differ. Scorecard will use the former.); skipping Scorecard checks
更多细节
Star 与 Fork 历史 0 ★ / 2 ⇿
0Star
2Fork
1发布
每颗 star 和每个 fork 的添加时间，来自 GitHub 并按天汇总。累计增长位于其构成来源——每日新增——的正上方，二者可相互对照：稳定的自然增长与短暂的突增形态截然不同。当这一差别可被衡量时，它会作为增长真实性予以报告。
主版本 0次版本 0修订 1
直接依赖 16
注册表
软件包
版本约束
清单文件
Go
github.com/CycloneDX/cyclonedx-go
v0.11.0
go.mod
Go
github.com/bmatcuk/doublestar/v4
v4.10.0
go.mod
Go
github.com/charlievieth/fastwalk
v1.0.14
go.mod
Go
github.com/cloudflare/ahocorasick
v0.0.0-20240916140611-054963ec9396
go.mod
Go
github.com/go-git/go-git/v5
v5.19.1
go.mod
Go
github.com/knadh/koanf/parsers/yaml
v1.1.0
go.mod
Go
github.com/knadh/koanf/providers/file
v1.2.1
go.mod
Go
github.com/knadh/koanf/providers/posflag
v1.0.1
go.mod
Go
github.com/knadh/koanf/v2
v2.3.5
go.mod
Go
github.com/spf13/cobra
v1.10.2
go.mod
Go
github.com/spf13/pflag
v1.0.10
go.mod
Go
github.com/zeebo/xxh3
v1.1.0
go.mod
Go
golang.org/x/mod
v0.38.0
go.mod
Go
golang.org/x/sync
v0.22.0
go.mod
Go
golang.org/x/tools
v0.48.0
go.mod
Go
gopkg.in/yaml.v3
v3.0.1
go.mod
全部依赖 未采集
本报告未能采集到解析后的依赖集合：GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
原始 JSON 报告 机器可读
{
"data": {
"repo": {
"topics": [
"ai-governance",
"ai-security",
"aibom",
"cyclonedx",
"golang",
"mlops",
"sarif",
"sbom",
"supply-chain-security",
"ai-bill-of-materials",
"compliance",
"devsecops",
"eu-ai-act",
"llm-security",
"ml-security",
"mlsecops",
"model-scanning",
"nist-ai-rmf",
"owasp",
"vulnerability-scanner"
],
"is_fork": false,
"size_kb": 1749,
"has_wiki": true,
"homepage": null,
"languages": {
"Go": 1195218,
"MDX": 183593,
"Python": 65332,
"Makefile": 4401
},
"pushed_at": "2026-07-23T09:06:26Z",
"created_at": "2026-07-17T03:33:22Z",
"owner_type": "Organization",
"updated_at": "2026-07-23T09:33:02Z",
"description": "Open-source AI Bill of Materials (AIBOM) scanner: inventories AI models, datasets, prompts, embeddings, vector DBs & RAG pipelines across code, containers & Kubernetes — with file:line evidence, load-time risk detection (poisoned pickle / Keras Lambda / unsafe torch.load) and NIST AI RMF / OWASP compliance mapping. CycloneDX · SARIF · JSON.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "main",
"license_spdx_raw": "Apache-2.0",
"primary_language": "Go",
"significant_languages": [
"Go",
"MDX"
]
},
"owner": {
"blog": null,
"name": null,
"type": "Organization",
"login": "airomhq",
"company": null,
"location": null,
"followers": 0,
"avatar_url": "https://avatars.githubusercontent.com/u/306122292?v=4",
"created_at": "2026-07-17T07:30:06Z",
"is_verified": null,
"public_repos": 2,
"account_age_days": 6
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": null,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.1.9",
"kind": "patch",
"published_at": "2026-07-23T08:57:30Z"
},
{
"tag": "v0.1.8",
"kind": "patch",
"published_at": "2026-07-23T06:29:57Z"
},
{
"tag": "v0.1.7",
"kind": "patch",
"published_at": "2026-07-22T19:31:07Z"
},
{
"tag": "v0.1.6",
"kind": "patch",
"published_at": "2026-07-22T17:36:29Z"
},
{
"tag": "v0.1.5",
"kind": "patch",
"published_at": "2026-07-22T09:22:12Z"
},
{
"tag": "v0.1.4",
"kind": "patch",
"published_at": "2026-07-22T08:46:05Z"
},
{
"tag": "v0.1.3",
"kind": "patch",
"published_at": "2026-07-21T06:48:02Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2026-07-17T13:11:03Z"
}
],
"recent_commits": [
{
"oid": "74716fb24917bb60c94ae95a2ebccd0df7dd1858",
"body": "airom-rules (the signed rule-channel repo) may live at ./airom-rules for local\nmaintenance. It is its own git repo; ignore it so airom never tracks it as an\nembedded gitlink.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: gitignore a nested airom-rules checkout",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-23T09:06:24Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "6ca39029dce7c889098b5f9c84891f29cfb5fd1d",
"body": "Bump the SDK to 0.1.9 (the version stamped into the bundled binary and the PyPI\npublish trigger) and refresh the version references across the README, docs-site\ninstallation page, and SDK README.\n\nHeadline: `airom rules update` fetches a signed rule bundle from the airom-rules\nchannel into the cache; scans prefer it over the embedded packs while staying\noffline and deterministic, and every AIBOM now records rulesVersion + rulesHash.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "release: v0.1.9 — signed rule-update channel (Model B)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-23T08:51:39Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "6cb97f4bc35d3d180b3bbddde03ef894317aeff0",
"body": "…ance\n\nAdd a \"Rule updates\" docs-site page covering the model (embedded floor + fetched\nbundle), pinning/reproducibility, offline/air-gap, the ed25519 trust chain,\n--no-cached-rules, --insecure-skip-signature, and the rulesVersion/rulesHash\nprovenance now in every AIBOM. Register it in the Rules nav\n[…]\nadd --no-cached-rules to the global-flag tables, and note the\nairom-rules distribution channel in rules/README.md. Mintlify broken-links clean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: rule updates (Model B) — new page, CLI/config reference, proven…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-23T08:38:03Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f3e20d45a76f05936afd5e3bdf219fb6c9aee995",
"body": "Replace the placeholder with the real ed25519 public key whose private half\nlives in the airom-rules CI secret. Signed `airom rules update` now verifies\nend-to-end without --insecure-skip-signature.\n\nRefactor: verifyManifest returns ErrNoSigningKey on a nil key and Update\nresolves the embedded key a\n[…]\neal signed\nbundle (49 packs) produced by airom-rules/tools/bundle: signature + checksum\naccept a good bundle, a corrupted tarball fails closed.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(rulesync): embed the airom-rules signing public key",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-23T08:32:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "53204f04ba35a7cc038ac33fa1fe5e028321416b",
"body": "Wire internal/rulesync into the CLI and the scan loader so a fetched bundle can\noverride the embedded packs.\n\n- `airom rules update [version]`: fetch, verify (ed25519), and cache a signed\n bundle from the airom-rules channel. Flags: --rules-source (mirror/testing\n override), --insecure-skip-signat\n[…]\nline refuses, and clean removes it.\nThe e2e golden harness pins CacheDir to a temp dir so goldens never depend on a\ndeveloper's fetched bundle.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(rules): airom rules update + cache-backed rule loading (Model B)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-23T08:22:31Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b175785a4ca05ca44f4580e0ba61a85753279ba2",
"body": "…g yet)\n\nNew internal/rulesync package — the fetch/verify/extract/cache core for Model B,\nwith no CLI or loader wiring yet (that is the next PR).\n\n- Update() fetches manifest.json + a detached ed25519 signature, verifies the\n signature against the embedded public key BEFORE trusting any manifest fi\n[…]\n\ntarball, no-key fail-closed, insecure-skip-still-checks-integrity, offline,\nversion mismatch, traversal clamp, non-regular skip, empty bundle.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(rulesync): signed rule-bundle fetch, verify, and cache (no wirin…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-23T08:06:44Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d80d2944eb431e104cc32f3535d174a0317adb8f",
"body": "Add RulesVersion and RulesHash to airom.ToolInfo and populate them at the scan\nsite from the effective ruleset (matcher.Hash()), on a per-scan copy of the tool\nidentity — never the package global. RulesVersion is \"builtin\" for now; PR4 will\nset it to a fetched bundle version. Every AIBOM now records\n[…]\ne edits that don't touch a fixture don't\nchurn every golden.\n\nThis is the provenance foundation for cache-backed remote rule updates (Model B).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(provenance): stamp the rule-pack version + hash into every AIBOM",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-23T07:57:03Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "04279344f7881910334c86c6a30b8b199f3605ea",
"body": "Bump the SDK to 0.1.8 and align version references so `pip install\nairom` and the tagged binaries ship the per-package cell merging from\na40188c: a package's CVEs share one LIBRARY / INSTALLED / FIXED cell\nthat spans the group, instead of repeating on every row.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "release: v0.1.8 — Trivy-style cell merging in the vulnerability table",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-23T06:26:55Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "a40188cda882fc1b1b83163d7337534eda094307",
"body": "Consecutive CVEs on the same package now share one LIBRARY / INSTALLED /\nFIXED cell that spans the group (the value shows once, the row rules\ncarry no horizontal segment under merged columns), instead of repeating\nthe package name and versions on every row. VULNERABILITY, SEVERITY,\nSTATUS, and TITLE\n[…]\nions\n(├ ┤ ┼ │) accordingly; width is measured with dispWidth so the box stays\nrectangular. Regression test covers the merge and rectangularity.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(table): merge per-package cells in the vuln table, Trivy-style",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-22T20:15:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "aff2718835f5f252b2ba3880011dfe263776e67d",
"body": "…table\n\nBump the SDK to 0.1.7 and align version references so `pip install\nairom` and the tagged binaries ship the changes from 5db0440: the CVE\noverlay now runs by default (disable with --no-cve/--offline), the\ncomponent table drops the RISK/FLAGS columns, and a per-CVE detail table\nplus a Vulnerabilities summary breakdown replace them.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "release: v0.1.7 — default-on CVE overlay + Trivy-style vulnerability …",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-22T19:28:33Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "5db04406cfb54cf04dc83aa54d1052799fe5e97e",
"body": "…drop RISK/FLAGS columns\n\nThree UX changes to the terminal experience:\n\n- The CVE overlay is now ON BY DEFAULT (was opt-in in v0.1.6). Disable\n with --no-cve, an explicit --cve=false / `cve: false`, or --offline\n (which also asserts no network). The default is applied in the CLI\n layer only — app\n[…]\n — both with regression tests.\nDocs (README, docs/cve.md, docs/cli.md, docs-site) and e2e table goldens\nupdated for the new default and layout.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cve,table): default the CVE overlay on; Trivy-style vuln table, …",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-22T19:06:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "aec2f8b365995f88bcc478d33f3714d4277cff39",
"body": "Bump the SDK to 0.1.6 and align the version references so `pip install\nairom` and the tagged binaries ship the CVE overlay landed in b1e5540:\n--cve matches AI dependencies against OSV.dev with locally-computed CVSS\nv3 scores, surfaced in every format and gateable via --fail-on cve.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "release: v0.1.6 — ship the opt-in --cve overlay (OSV.dev)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-22T17:33:21Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b1e554011c4b3e35cff325be749ecccf907b82d2",
"body": "Add a CVE overlay that matches inventoried AI package dependencies (by\npurl) against the live OSV.dev advisory database and attaches the\nresulting CVEs — with real CVSS v3 base scores computed from each vector\n— to those components. Scoped to AI deps, not a general-purpose SCA.\n\nOpt-in on purpose: i\n[…]\niew: honest CDX scoring method, version-aware\nfirstFixed, HTTP timeout, fail-closed gate, deterministic warnings, and a\ntruncated-vector guard.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cve): opt-in --cve overlay matching AI deps against OSV.dev",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-22T14:01:48Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "232a4944db8438f6339650ed8037b1d57d14593d",
"body": "Patch release so the --wide flag and its documentation line up on the index:\nv0.1.4 documented --wide but never wired it to the CLI. Bump the SDK to 0.1.5\n(the version stamped into the bundled binary and the PyPI publish trigger) and\nupdate the version references across the README, docs-site installation page,\nand SDK README.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "release: v0.1.5 — ship the wired-up --wide table flag",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-22T09:19:21Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "9991f96294bf558a16de0b4736302dbaed014576",
"body": "…table\n\nThe table writer already supported a wide mode — expanding every file:line\noccurrence (with the detector that fired) under each component — but nothing on\nthe CLI ever set writer.Options.TableWide, so it was reachable only from Go\ntests. Add a --wide bool flag, thread it through app.Config i\n[…]\nable shows one primary LOCATION plus a count, --wide shows the full\nlist. Test the flag resolves both ways; document it in both CLI references.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cli): wire up --wide to expand per-component occurrences in the …",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-22T09:15:58Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "522bbeb50f212c31ae2116ae370e78ba86393129",
"body": "Bump the Python SDK to 0.1.4 (the version stamped into the bundled binary and\nthe trigger for the PyPI publish) and update the version references across the\nREADME, docs-site installation page, and SDK README.\n\nHeadline of this release: the terminal output is reworked into a boxed\nscan-summary panel\n[…]\ncomponent table, and the table gains a\nLOCATION column (each component's primary path:line sighting) alongside the\nexisting RISK/FLAGS overlay.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "release: v0.1.4 — boxed scan-summary table + LOCATION column",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-22T08:43:14Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ffcfccbf95621b5a5e8c403b08cc10daba8a9b49",
"body": "Drop the path filter on the PyPI publish workflow so it runs on every push to\nmain, not only source/SDK changes. Publishing stays version-gated (PyPI refuses\nduplicate versions), so the effect is: whenever main moves, PyPI is reconciled\nto the declared __version__ — a bump ships, anything else runs \n[…]\nags drive the binary release workflow).\n\nAlso exclude ci:/release: commits from the goreleaser changelog so release notes\nstay feature-focused.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "ci: publish to PyPI on every push to main; trim the release changelog",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-22T08:43:06Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a10004f0658838b34015874f7376f9c58305c8a3",
"body": "…ting\n\nThe component table now shows where each component was found — the primary\noccurrence rendered as source-relative `path:line` (a whole-file match shows\njust the path), picked deterministically as the lowest (path, line). The\nfamiliar EVIDENCE count stays, so a component with several sightings\n[…]\nrt/evidence/filesystem/\ncli) from real captured output — box widths are computed at render time, so the\nsnippets are verbatim, not hand-edited.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(table): add a LOCATION column with each component's primary sigh…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-22T08:35:36Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "eec7caf4f9b48547f70608b3568316a2b40d250a",
"body": "Update every table-output snippet to the new format (boxed Scan Summary panel +\nbox-drawn component table with RISK/FLAGS): README example output (real 12-\ncomponent RAG scan with a pickle-import risk), and the docs-site pages\noutput/formats, quickstart, concepts/evidence, scanning/filesystem, and\nr\n[…]\n are exactly …\" descriptions gain the summary panel + RISK/FLAGS.\n\nAll snippets are captured from the real binary; Mintlify broken-links clean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: show the new boxed table output across README and docs-site",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-22T08:16:02Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3c3a8a9cf90a15d9744971f03474e5950130444e",
"body": "Rework the default table output into a scannable, boxed report:\n\n- A \"Scan Summary\" panel — target, component count, files scanned, a By Type\n breakdown (component kinds by count), and a By Severity breakdown of the\n artifact risks.\n- A box-drawn component table with columns sized to content (full\n[…]\nything a pure projection.\n\nRegenerated the five e2e table goldens; updated the tablew/app assertions that\npinned the old \"N component(s)\" line.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(table): boxed scan-summary panel + box-drawn component table",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-22T08:16:02Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "9c16927813d4e0b7a07c5a930026da84a3d9faa5",
"body": "…ersion\n\ndocs(sdk): update stale version in Python SDK README example",
"is_bot": false,
"headline": "Merge pull request #5 from bhatt-neel-dev/docs/fix-stale-sdk-readme-v…",
"author_name": "Roro",
"author_login": "Roro1727",
"committed_at": "2026-07-22T06:59:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9ce776e04ed25340155894c50063b02df73d58e5",
"body": "The example output under 'pip install airom' still showed 'airom 0.1.1',\nwhile the current release on PyPI is 0.1.3.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(sdk): update stale version in Python SDK README example",
"author_name": "Neel Bhatt",
"author_login": "bhatt-neel-dev",
"committed_at": "2026-07-22T06:52:37Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "924c650897eb58a6026ffd441e29579cac2fe65b",
"body": "Rework the card so the scan-glyph badge is vertically centered on the AIROM\nwordmark in the left gutter, and every text element (eyebrow, wordmark, tagline,\nvalue line, chips, URL) shares one left margin — no more misaligned edges.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: tidy social-preview layout — glyph centered, single left margin",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-21T07:24:29Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "99434e019dbd5126443aff153014eeaca7c9c7bc",
"body": "Regenerate the 1280×640 social-preview with a small logo mark: an indigo\napp-badge holding a white magnifier scanning an AI node graph — the \"scan AI\nassets\" idea — as a lockup left of the AIROM wordmark.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: add a scan-glyph logo to the social-preview card",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-21T07:18:11Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "d9e0305d98845bfc360ccdbbbb44738e201a0076",
"body": "A 1280×640 branded card for the repository's social preview (the Open Graph\nimage shown when the repo is shared on X/Slack/LinkedIn). GitHub-dark + indigo,\nleading with the AIBOM tagline and the risk-detection / CycloneDX·SARIF /\nNIST AI RMF·OWASP / offline-deterministic differentiators.\n\nThe image \n[…]\n; setting it as the actual social preview\nis a one-time upload in Settings → General → Social preview (UI-only — GitHub\nexposes no API for it).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: add the GitHub social-preview card (.github/social-preview.png)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-21T07:06:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "67c6c51a0f6137aa437b44238738b652f0104ba5",
"body": "Bring the metadata level with the shipped features (risk detection, compliance\nmapping) and cover the high-intent, low-competition search terms:\n\n- PyPI (sdk/python/pyproject.toml): keywords 7 -> 20 (ai-bill-of-materials,\n ml-bom, ai-security, llm-security, ml-security, mlsecops, ai-governance,\n c\n[…]\nset on GitHub directly (repo settings, live now): topics expanded 10 -> 20\nand a sharper repo description covering the risk + compliance angle.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: sharpen SEO metadata (keywords, descriptions) for discoverability",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-21T07:01:13Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b475617b295f131499c67052951d5b868ac21ca6",
"body": "The AI-native risk overlay (artifact + code risks → CycloneDX vulnerabilities[]\n/ SARIF / --fail-on risk) and compliance framework mapping (NIST AI RMF, OWASP\nAgentic → CycloneDX attestations / report / --fail-on compliance) landed after\nv0.1.0, so no released binary and no PyPI wheel carried them —\n[…]\nching `v0.1.3` tag (pushed next) drives goreleaser for the signed\nbinaries + GitHub release; its notes auto-generate from the feat/fix commits.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "release: v0.1.3 — ship the risk overlay and compliance mapping",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-21T06:40:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4395071462845bf10d1bb28682ad3fd8934db19d",
"body": "…isks end-to-end\n\nVerifying the risk overlay surfaced a real gap: keras-lambda, gguf-template, and\nsavedmodel-pyfunc were covered only by inline unit tests — no committed,\nscannable fixture exercised them through the full pipeline into every writer\n(the way python-langchain-rag's poisoned.pt already\n[…]\nties[]`; a real `airom fs` scan of the committed fixture flags every\nrisk and the risk/compliance gates fire. Full suite + golangci-lint clean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test(e2e): commit the risky-models fixture — all five artifact/code r…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T13:45:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2a599e27a57bed72590e9c1cb4877e0d6950bb6c",
"body": "The compliance feature (PR4–PR5) shipped but the user-facing docs didn't mention\nit. Bring both level with docs/compliance.md.\n\nREADME:\n- New \"Compliance mapping\" section: the --compliance flag, the mapping-not-\n certification contract (manual controls carry no score), the two frameworks\n (nist-ai\n[…]\ny; every claim cross-checked against the shipped behavior. Mintlify\n`broken-links` clean and `mint dev` compiles with no errors on Node 24 LTS.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: document compliance mapping in the README and the Mintlify site",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T13:28:03Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1937cce51afd67bbadb73f89cfc5e81746033dfe",
"body": "… Agentic framework\n\nPR5 completes the compliance feature on top of PR4's mapping engine, adding the\ntwo things that make it usable in a real workflow — a human-readable report and\na CI gate — plus a second framework.\n\n1. Compliance report writer (`-o compliance[=report.md]`, internal/writer/\n com\n[…]\nhe\ncompliance-gate grammar/matching/guard suite, and OWASP load/RCE mapping. Docs:\ndocs/compliance.md (report, gate, frameworks) + docs/cli.md.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(compliance): report writer, --fail-on compliance gate, and OWASP…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T13:18:04Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "17971f3b0bcc5734772f670399b9fa7146e6c391",
"body": "…X attestations (NIST AI RMF)\n\nPR4 of the AI-native security work, and the payoff of the risk overlay: a\n`--compliance <framework>` flag that maps the assembled AIBOM onto a governance\nframework's controls and projects the result into CycloneDX's native\nattestation model. First framework: NIST AI RM\n[…]\nonfidence regression, and the projection pinned in the cdx/native/yaml\ngoldens. Docs: docs/compliance.md + the --compliance row in docs/cli.md.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(compliance): map the AIBOM onto governance frameworks — CycloneD…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T12:49:56Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "855f9710a409fd15431e601baa0e81610558bf53",
"body": "…l page\n\nThe installation page still claimed AIROM was pre-release with \"no prebuilt\nbinaries to download\" and documented only `go install` / build-from-source —\nboth false as of v0.1.0. Ground truth (verified): v0.1.0 is tagged and released\nwith cosign-signed binaries, and `airom` is on PyPI (bundl\n[…]\nnt broken-links` clean, `mint dev` compiles\nwith no errors, /installation renders 200. Every claim checked against PyPI and a\nreal pip install.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(docs-site): add pip install and fix the stale pre-release instal…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T12:01:14Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ee463beaac61530e81ddef4b0bbfdae6e28d7f54",
"body": "…site\n\nThe hosted docs predated the artifact-risk overlay (PR1–PR3). Bring them level\nwith the README and docs/risks.md:\n\n- New concepts/risks.mdx: the five-risk catalog with severities, the\n suspicion-not-verdict framing, how risks project (CycloneDX vulnerabilities[],\n SARIF security results, na\n[…]\national.\n\nDocs only; every claim cross-checked against docs/risks.md and the shipped\nprojections. docs.json validated; MDX components balanced.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(docs-site): mirror the risk detection section into the Mintlify …",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T11:52:39Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0e725c03397bebfcf514798d5180a9709c669159",
"body": "The risk overlay (PR1–PR3) is a genuine differentiator and the README didn't\nmention it beyond a now-stale PickleRisk bullet. Add:\n\n- A \"Risk detection\" section: the five-risk catalog (pickle-import,\n keras-lambda, gguf-template, savedmodel-pyfunc, unsafe-load) with severities\n and what each catch\n[…]\n/ 101 rules / 9 categories,\n incl. the security category and risk: field).\n\nDocs only; every claim cross-checked against the shipped behavior.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(readme): document the AI-native risk detection features",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T09:43:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "438b7d0ba9476f15f478b7732ec9646443fa7f80",
"body": "…weights_only=False)\n\nPR3 of the artifact-risk work: teach the rule engine to emit risks, and ship\nthe first code-level risk. Where PR1/PR2 attach risks to model *artifacts*, a\n`torch.load(..., weights_only=False)` is a property of the *code* — so this adds\nthe general mechanism and one exemplar.\n\nM\n[…]\n: risk-emission + unknown-id validation in ruleengine, pos/neg pack\nfixtures. Docs: risks.md catalog entry + the risk: field in rule-schema.md.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(risk): code-level risk mechanism + unsafe-load pack (torch.load …",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T08:54:09Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f5ca05340feb2202fb527559ce4440daf62948e6",
"body": "…template, SavedModel PyFunc)\n\nPR2 of the artifact-risk work: the first detection checks that plug into the\nPR1 spine. Each scans bytes the detector has ALREADY read (a bounded header/\ncontent buffer, never tensor data), so it adds no memory beyond the existing\nread (P2), and each projects into vuln\n[…]\nbenign negatives), a\nreal CLI scan flags all three and gates via --fail-on risk, go test ./...\ngreen, -race green, golangci-lint + gofmt clean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(risk): three AI-native artifact-risk checks (Keras Lambda, GGUF …",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T08:28:31Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "91299bee6f52899ed55a0f528c55d84bca3d7c92",
"body": "CI's `gofmt -l .` scans testdata/ (which golangci-lint and gofumpt skip\nlocally), so the comment alignment in riskyTorchPickle tripped the format gate.\nContent-identical; regenerates no fixtures.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "style: gofmt the e2e gen.go risky-pickle helper",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T07:54:06Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "7481603c931d181452d6d21eed4fa3bbe35ff2bc",
"body": "…-native security finding\n\nPR1 of the artifact-risk work: generalize the pickle-specific signal into a\nfirst-class, evidence-linked risk overlay projected into every format, with a\nCI gate. Zero new detection — the torch pickle walk is unchanged; this is the\nspine the later checks (Keras Lambda, GGU\n[…]\nere with tests. go test ./... green, -race green, golangci-lint\nclean. 25 of the touched files are mechanical golden regens gaining Risks:null.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(risk): artifact-risk overlay spine (ArtifactRisk) — the first AI…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T07:48:59Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0c11347278a1578da6ee382e88fc7b6cd95a0f34",
"body": "Lead with AIROM's own identity rather than \"what Trivy is to SBOMs.\"\nReworded every Trivy reference across the docs and two code comments to\nstand on its own or point at the generic category (SBOM/scanner tooling),\npreserving the technical meaning of each design rationale:\n\n- README, docs-site (inde\n[…]\n\n\nNo behavior change: comment-only in Go, docs otherwise. `go build ./...`\nand the touched packages' tests pass; `grep -ri trivy` is now empty.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: remove the Trivy analogy and comparisons throughout",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T06:49:20Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "7ab4927e09c571800aa27a1f1ddad0a19d35cf1d",
"body": "… MODEL_ID and training hyperparameters\n\nThe Cisco head-to-head left four gaps; the two headline ones landed in\n585352d. These are the remaining two.\n\n1. MODEL_ID env vars in compose/Dockerfile now surface as models. The k8s\n source already treated MODEL_ID as an AI signal; compose and Dockerfile\n\n[…]\nackages,\ngolangci-lint clean. New coverage: envmodel_test.go, TestModelFold*,\nthe training pack pos/neg fixtures, and a rewritten assertNoLeak.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(detectors): close the two lesser Cisco-comparison gaps — compose…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T06:10:13Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "585352d38d8f4959944f050872ed7e438477e559",
"body": "…model IDs and manifest-vs-code double counting\n\nThe head-to-head against Cisco's aibom left AIROM with two verified losses.\nA fine-tuning script's BASE_MODEL = \"gpt-4o-mini-2024-07-18\" produced no\ncomponent at all — the single most important fact in the file, silently\nabsent. And the same real-worl\n[…]\n golden's warning is gone — its uses edge now survives\ninto the CycloneDX output. Full suite green under -race; goldens\nregenerated; lint clean.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(detectors): close the two Cisco-comparison gaps — variable-bound …",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T17:59:22Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6e8bc541c847bfafe71040376f01e890b06dd090",
"body": "P2 (\"peak RSS is a function of configuration, never input size\") was\ndocumented as guarded by a perf-regression test. It was not. Both memory\nassertions open with `if raceEnabled { t.Skip }`, and the only `go test`\ninvocation in CI passes -race — so every P2 assertion skipped on every run.\n\nAdd a de\n[…]\neakMemory remains opt-in via AIROM_PERF_HEAVY and so is still\nnot enforced in CI -- a pre-existing choice to keep the job fast, untouched\nhere.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(perf): arm the P2 memory gate in CI, on a baseline that holds still",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T16:39:41Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "513e251de86ae01f3d12f54b0a378f91462ef5bd",
"body": "Bumps the Python SDK to 0.1.2, which is what publishes today's fixes to PyPI —\nthe nanosecond-timestamp decode that broke every scan on Python 3.10, and the\nmissing build test dependency. 0.1.1 on the index still carries the broken\ndecode.\n\nDry-running goreleaser before tagging (a tag is immutable o\n[…]\ngets clean with zero unmatched\nglobs, CGO_ENABLED=0 holds, and the wheel's bundled binary reports 0.1.2.\nSDK suite 26/26 on real 3.10 and 3.13.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "release: SDK 0.1.2, and prepare the v0.1.0 release",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T13:01:13Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "19e72f83a3bd5a2c6e43dedede45e65aa8f62be7",
"body": "… build dep\n\nCI's Python SDK job has been red since 07:21 today, on two independent faults\nthat both hid behind the same red X.\n\n1. Every scan test failed with `ValueError: Invalid isoformat string:\n '2026-07-17T12:05:20.639213449+00:00'`. Before 3.11, datetime.fromisoformat\n accepts ONLY 3- or \n[…]\n\non both, plus the wheel build and its .data/scripts guard. ruff's 9 findings\nwere all in the code added here — CI had never reached that step.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): decode Go's nanosecond timestamps, and give the tests their…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T12:24:58Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "452068f34a196f430768d065c7075a2b82b28269",
"body": "`go install` fetches a zip from the module proxy, not a checkout, so the binary\ncarries no vcs.* stamps and `airom --version` printed\n\n airom v0.0.0-20260717115955-5ab297f08f99 (commit none, built unknown)\n\n— \"none\" and \"unknown\" sitting directly beside a string that spells out both.\nA pseudo-ver\n[…]\nis [-.], not \"-\": of the three documented\nforms only the base-less one uses a dash, and requiring one silently skipped\nboth post-release forms.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: read the commit and build time back out of a pseudo-version",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T12:04:26Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "5ab297f08f994aa0fdaa0ad50cc72ef768a42fe5",
"body": "`airom --version` printed \"dev (commit none, built unknown)\" on any binary not\nbuilt by make/goreleaser — which includes `go install ...@latest`, the way users\nactually install it. main.go carried only the ldflags sentinels and no fallback.\nThis was not cosmetic: ToolInfo is embedded in every AIBOM,\n[…]\nput\nat --parallel 1 vs 16, and zero diff against the pre-fix binary across 2 GB of\nthird-party code — no new false positives, no lost findings.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: report an honest version, and stop three flags from lying",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T11:59:55Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2f59d1d37c250224dbdfabd937051cdef2408930",
"body": "… noise\n\nA real scan reported 1,330 components, roughly a thousand of them false. Three\ndetectors were claiming findings their evidence could not support. The principle\nin each case: a file's extension, path, or a keyword's presence is not evidence —\nsomething must corroborate the claim.\n\nMeasured o\n[…]\nt Cisco's aibom (verified: their CycloneDX reporter emits only\nbom_ref/licenses/name/properties/type/version), but the absolute was a liability.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(detectors): corroboration-gate the dataset, prompt, and ai-config…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T11:10:35Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "daea88e5efef6627cdb5dbf0856e4e2a9b02507d",
"body": "Two terminal-UX improvements, both of which degrade to exactly the previous\nbehaviour the moment the output is not a terminal.\n\nHelp. Cobra's default was one flat list of twelve commands (with `scan`, the\ncommand most people want, sorted last behind `fs`) and one undifferentiated wall\nof twenty flag\n[…]\nsion (the\nellipsis is one column but three bytes, so it overshot and could split a\nmulti-byte character) and two dead symbols I had left behind.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cli): grouped, styled help and a live scan progress indicator",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T09:34:02Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2255bcca3f2abff00359072b4dbe45ef3f6170f4",
"body": "The 0.1.1 wheel jobs all failed with \"bundles no airom binary\": both workflow\nguards still grepped the wheel for /_bin/airom, the package-data path the binary\nshipped from before it moved to .data/scripts/. The guard was correct to fail —\nit was just asserting the old contract.\n\nThey now assert the \n[…]\nctionlint clean.\n\nThe version gate did its job: with the wheels failing, publish was skipped, so\nnothing was uploaded and 0.1.1 stays available.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(ci): verify the wheel installs the airom SCRIPT, not package data",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T09:06:21Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e432ce26e0947c62b6bd9d7e58168e1d76c2e257",
"body": "…s version\n\nTwo defects in the 0.1.0 wheel, both found by actually installing it:\n\n1. `pip install airom` gave you the library but NOT the command. The binary was\n packaged as package data (airom/_bin/airom), reachable only via `import\n airom` — `airom` was not on PATH at all. It now ships via t\n[…]\ninary must not report \"dev\"). Also documents the PATH caveat for\n`go install`, which writes to $(go env GOPATH)/bin and does not add it to PATH.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): make `airom` a real command after pip install, and stamp it…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T09:03:10Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "13914d3333111efc6f9278dc0f7b7bfd71a89028",
"body": "The repo now lives at github.com/airomhq/airom. The Go module path must follow\nthe canonical location: with the repo transferred but go.mod still declaring\ngithub.com/Roro1727/airom, `go install github.com/airomhq/airom/cmd/airom@latest`\nfails with \"module declares its path as github.com/Roro1727/ai\n[…]\n golangci-lint (0 issues — the depguard\nimport-direction rules key on the module path), the full -race suite, and the\nPython SDK suite all pass.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "refactor: move to the airomhq org and rename the module path",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T07:40:21Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "283c4aae47f814cd79c464a200567cd1f5daf9d0",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "Roro",
"author_login": "Roro1727",
"committed_at": "2026-07-17T07:34:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3feb3a528e6643cc6225269f30ea8295c55f89f9",
"body": "The version-check step redirected the whole Python script's stdout into\n$GITHUB_OUTPUT, so the ::notice:: workflow command landed in the outputs file —\nwhich only accepts key=value — and the step failed with:\n\n ##[error]Invalid format '::notice::airom 0.1.0.dev0 on pypi.org: will publish'\n\nWrite \n[…]\n airom` without --pre, so publishing 0.1.0.dev0 would have produced\na release nobody gets by default. 0.1.0 makes the first publish installable.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(ci): keep ::notice:: out of $GITHUB_OUTPUT; release the SDK as 0.1.0",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T07:20:58Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "056b62a44c4d4d53293818e9b7b2c2d0e4b57a53",
"body": "A push to main that touches the SDK (or the scanner it bundles) builds and\npublishes sdk/python to PyPI.\n\nAuth is PyPI Trusted Publishing (OIDC): GitHub Actions proves its identity to\nPyPI directly, so no API token is stored as a secret — nothing to leak or\nrotate. Setup is a pending publisher on py\n[…]\nlint clean; the version gate dry-run resolves 0.1.0.dev0 against\nthe live index (project absent -> publish=true). The name 'airom' is available.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "ci: publish the Python SDK to PyPI from main via Trusted Publishing",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T07:17:57Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "dbfb298705407fec6bef3db8c33c82cd5ffcacc1",
"body": "Wraps the airom binary and decodes its native JSON — the lossless superset every\nother format projects from — into typed Python objects. Stdlib only: no\nthird-party runtime dependencies, matching the tool's own \"no runtime, no\ndependencies\" posture.\n\n import airom\n inv = airom.fs(\"./my-app\", m\n[…]\nthe test and docs now state the real semantics. 13 tests, ruff and\nmypy --strict clean, and a new CI job covering 3.10/3.13 plus wheel-bundling.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(sdk): add a dependency-free Python SDK (sdk/python)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T07:06:49Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "9af574c573d8e95463b250070b6ad4a52f01c290",
"body": "`mint dev` refuses to run on non-LTS Node (\"not supported on node versions 25+\").\nDocument the symptom and the keg-only `brew install node@24` + PATH-prepend fix,\nwhich leaves an existing non-LTS node untouched.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: note the Mintlify LTS-Node requirement in the docs-site README",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T06:48:55Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "538f4f989ffb451d47bde65e82c2028290895776",
"body": "A 19-page Mintlify site under docs-site/ (docs.json + .mdx), separate from the\nengineering reference in docs/ (ARCHITECTURE/mapping/cli/rule-schema), which\nstays plain Markdown and is linked from source comments.\n\nSections: get started (index/quickstart/installation), concepts (aibom/evidence/\nconfi\n[…]\nts in the binary (checked by\nextracting flags from the .mdx and diffing against `airom --help` output);\nbuild/vet/-race/golangci-lint all clean.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: add a Mintlify documentation site (docs-site/)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T06:35:04Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0fb8a93b2de97f774527f2ebbc1948747da050a3",
"body": "`go install …@latest` resolves against the now-public repo (a pseudo-version\nof the latest commit) even before v0.1.0 is tagged — the old \"unavailable until\npublished\" notes were wrong. Clarify that it builds from source, requires Go,\nand needs $(go env GOPATH)/bin on PATH (the usual \"command not found\" cause).\nAlso rewrite the go.mod header comment that still said \"Trivy for AI\".\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: correct install instructions and drop a go.mod branding straggler",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T05:45:15Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "88756646b3a0cf07de5c19189c407b801327074f",
"body": "A local-path gitsource delegates Walk to dirsource's parallel fastwalk, so the\nWalkFunc is invoked from multiple goroutines (the source.Source contract). The\ntest helper appended to a shared slice without synchronization — a latent race\nthat CI's -race job on Linux surfaced (scheduling-dependent; lo\n[…]\nard the append with a mutex, mirroring dirsource_test.go's helper.\n\nVerified with `go test -race -count=20 -cpu=8 ./internal/source/gitsource/`.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: fix data race in the gitsource walkPaths helper",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T04:08:36Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c528a5f2694667f1a088786871e1ebb330bf8388",
"body": "Conventional NOTICE for an Apache-licensed project; goreleaser now ships it\nalongside LICENSE in every archive.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: add Apache-2.0 NOTICE file and bundle it in release archives",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T04:03:48Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "eba39a20c9ff2c4f093ed0dcd452407fac8afded",
"body": "License: replace MIT with the Apache License 2.0 (explicit patent grant).\nUpdates LICENSE, the README badge/comparison/footer, CONTRIBUTING (inbound =\noutbound, Apache §5), and the ARCHITECTURE header. The \"MIT\" in cdx_test.go is\na scanned-component fixture, not our license, and is left as-is.\n\nBran\n[…]\n. Engineering references to Trivy in ARCHITECTURE.md\n(design rationale) are left intact — they're legitimate technical comparison,\nnot identity.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: relicense to Apache-2.0 and lead with AIBOM-first branding",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T03:50:26Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d097e7e25a1325077dcf254d01a61299ce1548ff",
"body": "A 10-dimension multi-agent adversarial review of the whole tree, with every\nfinding independently verified against a concrete repro. 17 confirmed defects\nfixed, each with a regression test; the full suite stays green under -race,\ngolangci-lint is clean, and generated code is current.\n\nSecurity / cor\n[…]\nencies[] (no substantiated depends-on edges are ever fabricated) and the\ndeferred live registry/daemon/cluster source modes (they fail cleanly).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "review: fix 17 verified defects from the Phase 10 production review",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T02:29:34Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c4e5447ea65ac6edfd22e81a22d9563cabab2a3a",
"body": "Continuous integration (.github/workflows/ci.yml):\n- lint/vet/gofmt gate; golangci-lint via the v7 action (matches the v2\n .golangci.yml, whose depguard rules enforce the §4 import-direction law)\n- race-detector tests on Linux and macOS with a coverage summary\n- CGO_ENABLED=0 cross-compile matrix o\n[…]\nTRIBUTING.md centered\n on the evidence-keyed detector workflow\n- README status ledger updated: Phases 1–8 complete, Phase 9 done, Phase 10 open\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "ci: add release automation, CI, and community health files (Phase 9)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-16T21:43:35Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0cf65c2cd9090a28c2ec953e2ae6f7c53e2ff6f6",
"body": "The integration coverage that ties the whole pipeline together, built by\nthree parallel workstreams over disjoint packages.\n\n- internal/e2e: four realistic fixture repos (python-langchain-rag,\n node-openai, go-openai, mixed-monorepo) scanned via app.Scan through\n the whole pipeline into all five f\n[…]\nDATE_GOLDEN honored\nalongside -update); make bench / test-heavy added. 36 packages green\nunder -race; golangci-lint clean; ~74% total coverage.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "tests: add the cross-cutting end-to-end test suite (Phase 8)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-16T21:32:03Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "82df9789b6e82657da3df556a83e6c97999ee6f6",
"body": "Turn the assembled graph into every output format — each a pure\nprojection of the same Inventory (invariant P5), mapped per\ndocs/mapping.md, deterministic (P7).\n\n- internal/writer: the Writer interface, self-registering registry,\n multi-output Fanout, and the shared §6.2 confidence formatting\n (ro\n[…]\nroot->dependency\ndepends-on edges, so CycloneDX's dependencies[] graph is currently empty\n(the writers correctly project the edges that exist).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "writers: implement the output writers (Phase 7)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-16T20:42:21Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a4fe44217c55b15f6bcc448cbecea457f97b653e",
"body": "…se 6)\n\nBreadth phase — the content that makes AIROM detect AI. Built by eight\nparallel workstreams over disjoint packages, then integrated.\n\nBinary model-file parsers (internal/detectors/modelfile, modelfilex),\nheader-only, fuzzed, never load weights:\n- GGUF (arch/param-count/quantization), safeten\n[…]\nama infra, generation params, synthesized\nRAG pipeline). All 27 packages green under -race; golangci-lint clean;\nmodel-file parsers fuzz-clean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "detectors: implement the detector suite, rule packs, and sources (Pha…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-16T20:18:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c446e6eea5dd220976f51bd6d3ddba7f41f22e6e",
"body": "The public SDK, dispatcher, rule engine, and assembler — the framework\nthat turns detector claims into the canonical component graph:\n\nPublic SDK (semver-guarded, stdlib-only by depguard):\n- pkg/airom: the full §5 domain model; tri-state fields with a lossless\n JSON contract (Absent omitted / Unkno\n[…]\nnt,\nresolves uses-edges via call-site capture, and refuses ambiguity — with\nzero built-in detectors. 15 packages green under -race; lint clean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "framework: implement the plugin framework (Phase 5)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-16T19:19:09Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6e29fbbf7d613e015351601186c4fe2d4e2189e0",
"body": "The phase-1 pipeline per ARCHITECTURE.md §7-§8, wired so `airom fs .`\n(and `airom scan <dir>`) runs a real scan:\n\n- internal/xio: clamped byte-weighted I/O semaphore (the 40GB-vs-budget\n deadlock is a regression test) and size-classed buffer pools\n- internal/classify: language routing, git-style NU\n[…]\n rules and symlink containment. Every fix has\na regression test.\n\nAll packages green under -race; golangci-lint clean; scans this repo\nin ~6ms.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "scanner: implement the filesystem scanner (Phase 4)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-16T16:14:17Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0006bf169540335ed18c26dbf478c0d781a51851",
"body": "Adversarial review (3 lenses, every finding reproduced by running the\nbinary, zero refuted) surfaced real defects; all fixed with regression\ntests:\n\nSafety:\n- clean: the home/root refusal compared unresolved case-exact strings —\n bypassable on case-insensitive APFS (a lowercase typo of $HOME delete\n[…]\nsemantics, clean safety\nnote.\n\nAll tests pass under -race; go vet, gofmt, golangci-lint clean; every\nfix smoke-tested through the built binary.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "cli: fix 30 execution-verified review findings",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-16T14:36:37Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "696f7dc9c9abe0a0ae5f75db5c27fb09fcffdf16",
"body": "…act (Phase 3)\n\nImplements the frozen surface in docs/cli.md:\n- Commands: scan (scheme auto-detect with dir:/repo:/image: forcing),\n fs, repo, image (--input/--platform), k8s (--namespace/-A/--manifests/\n --parallel-images), clean (with home/root safety refusals), version\n- Configuration: flags > \n[…]\n lands (TODO(phase-4) in internal/app/run.go).\n\nDocs: cli.md marked implemented with the final --fail-on grammar;\nREADME status ledger updated.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "cli: implement the command tree, config layering, and exit-code contr…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-16T14:00:56Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2680b7ceb440fd69fa648cf5cf53386acdbd0a80",
"body": "Lay down the full skeleton per docs/ARCHITECTURE.md §4:\n- go.mod (github.com/Roro1727/airom, go 1.25), MIT LICENSE, .gitignore,\n .editorconfig, CODEOWNERS\n- Makefile with ldflags version stamping and self-documenting targets\n- golangci-lint v2 config encoding the import-direction law as depguard\n \n[…]\nound-trip test\n- rules/, schemas/, testdata/fixtures/ layout with policy READMEs\n\ngo build ./..., go vet ./..., gofmt -l all clean on go1.26.5.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "scaffold: create repository structure (Phase 2)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-16T13:00:45Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ba819234a9ba02002f6ff62f4c1dc83196d5d8c1",
"body": "Canonical architecture for AIROM, an evidence-first AIBOM scanner:\n- Eight enforceable invariants (read-once, bounded memory, determinism,\n pure-Go CGO_ENABLED=0, degradable-by-default, claims-not-components)\n- Canonical component graph designed as a superset of CycloneDX 1.6\n ML-BOM, SPDX 3.0.1 A\n[…]\n/semgrep),\nspec verification against published schemas, and a three-design\nadversarial review across contributor/operations/correctness lenses.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: add v1 architecture baseline (Phase 1)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-16T12:58:33Z",
"body_truncated": true,
"is_coding_agent": true
}
],
"releases_count": 8,
"commits_last_year": 64,
"latest_release_at": "2026-07-23T08:57:30Z",
"latest_release_tag": "v0.1.9",
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 1,
"days_since_latest_release": 0,
"mean_days_between_releases": 0.8
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 87,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"ecosystem": {
"packages": [
{
"name": "github.com/airomhq/airom",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/airomhq/airom",
"is_deprecated": false,
"latest_version": "v0.1.9",
"repository_url": "https://github.com/airomhq/airom",
"versions_count": 8,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-23T08:51:39Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
}
]
},
"popularity": {
"forks": 2,
"stars": 8,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2026-07-19",
"count": 1
},
{
"date": "2026-07-22",
"count": 1
}
],
"complete": true,
"collected": 2,
"total_forks": 2
},
"star_history": null,
"open_issues_and_prs": 1
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"sdk/python/src/airom/py.typed"
],
"toolchain_manifests": [
"go.mod",
"internal/detectors/manifest/testdata/cargo/Cargo.toml",
"internal/detectors/manifest/testdata/gomod/go.mod",
"internal/detectors/manifest/testdata/gradle/build.gradle",
"internal/detectors/manifest/testdata/gradle/build.gradle.kts",
"internal/detectors/manifest/testdata/maven/pom.xml",
"internal/detectors/manifest/testdata/nuget/sample.csproj",
"internal/e2e/testdata/fixtures/go-openai/go.mod"
],
"largest_source_bytes": 35839,
"source_files_sampled": 299,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"go.mod"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "github.com/CycloneDX/cyclonedx-go",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.11.0"
},
{
"name": "github.com/bmatcuk/doublestar/v4",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v4.10.0"
},
{
"name": "github.com/charlievieth/fastwalk",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.14"
},
{
"name": "github.com/cloudflare/ahocorasick",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.0.0-20240916140611-054963ec9396"
},
{
"name": "github.com/go-git/go-git/v5",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v5.19.1"
},
{
"name": "github.com/knadh/koanf/parsers/yaml",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.1.0"
},
{
"name": "github.com/knadh/koanf/providers/file",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.2.1"
},
{
"name": "github.com/knadh/koanf/providers/posflag",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.1"
},
{
"name": "github.com/knadh/koanf/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.3.5"
},
{
"name": "github.com/spf13/cobra",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.2"
},
{
"name": "github.com/spf13/pflag",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.10"
},
{
"name": "github.com/zeebo/xxh3",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.1.0"
},
{
"name": "golang.org/x/mod",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.38.0"
},
{
"name": "golang.org/x/sync",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.22.0"
},
{
"name": "golang.org/x/tools",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.48.0"
},
{
"name": "gopkg.in/yaml.v3",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v3.0.1"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 1,
"merged_prs": 1,
"open_issues": 0,
"closed_ratio": null,
"closed_issues": 0,
"closed_unmerged_prs": 3
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "Roro1727",
"commits": 71,
"avatar_url": "https://avatars.githubusercontent.com/u/85880033?v=4"
},
{
"type": "User",
"login": "bhatt-neel-dev",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/220570574?v=4"
}
],
"contributors_sampled": 2,
"top_contributor_share": 0.986
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"codeql.yml",
"release-pypi.yml",
"release.yml"
],
"has_docs_dir": true,
"linter_configs": [
".golangci.yml"
],
"has_editorconfig": true,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": null,
"has_codeql_workflow": true,
"has_security_policy": true,
"has_dependabot_config": true
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-23T09:06:55Z",
"oldest_open_prs": [
{
"number": 3,
"created_at": "2026-07-17T07:33:59Z",
"last_comment_at": "2026-07-17T07:34:00Z",
"last_comment_author": "dependabot"
}
],
"last_merged_pr_at": "2026-07-22T06:59:48Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/airomhq/airom",
"host": "github.com",
"name": "airom",
"owner": "airomhq"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 68,
"inputs": {
"security": 100,
"vitality": 75,
"community": 50,
"governance": 39,
"engineering": 87
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 75,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 59,
"inputs": {
"commits_last_year": 64,
"human_commit_share": 1,
"days_since_last_push": 0,
"active_weeks_last_year": 1
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "1/52 weeks with commits",
"points": 0.7,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 1
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "64 commits in the last year",
"points": 16.3,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 64
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "OpenSSF Scorecard unavailable",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"releases_count": 8,
"latest_release_tag": "v0.1.9",
"releases_from_tags": false,
"days_since_latest_release": 0,
"mean_days_between_releases": 0.8
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "8 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 8
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~0.8 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 0.8
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "OpenSSF Scorecard unavailable",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "moderate",
"name": "Community & Adoption",
"value": 50,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 14,
"inputs": {
"forks": 2,
"stars": 8,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "8 stars",
"points": 13.7,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 8
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "2 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 2
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "excellent",
"name": "Community health",
"note": null,
"notes": [],
"value": 92,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 13.5,
"status": "met",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 6.3,
"status": "met",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "at_risk",
"name": "Sustainability & Governance",
"value": 39,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 13,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 2,
"top_contributor_share": 0.986
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 99% of commits",
"points": 0.3,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 99
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "2 contributors",
"points": 2.7,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 2
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "OpenSSF Scorecard unavailable",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "critical",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"issue_resolution"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 25,
"inputs": {
"merged_prs": 1,
"open_issues": 0,
"closed_issues": 0,
"issue_closed_ratio": null,
"closed_unmerged_prs": 3
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "no issues or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_issues_or_data",
"params": {}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "1/4 decided PRs merged",
"points": 9.6,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 1,
"decided": 4
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "OpenSSF Scorecard unavailable",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 34,
"inputs": {
"followers": 0,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "airomhq",
"public_repos": 2,
"account_age_days": 6
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "0 followers of airomhq",
"points": 0,
"status": "missed",
"details": [
{
"code": "owner_followers",
"params": {
"count": 0,
"login": "airomhq"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "2 public repos, account ~0 yr old",
"points": 3.5,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 2
}
},
{
"code": "account_age_years",
"params": {
"years": 0
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"github.com/airomhq/airom"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 0
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 0 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 0
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "8 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 8
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "excellent",
"name": "Engineering Quality",
"value": 87,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "excellent",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 88,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": true,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "4 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 4
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": ".golangci.yml",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 6.4,
"status": "met",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "OpenSSF Scorecard unavailable",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "excellent",
"name": "Documentation",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"topics": [
"ai-governance",
"ai-security",
"aibom",
"cyclonedx",
"golang",
"mlops",
"sarif",
"sbom",
"supply-chain-security",
"ai-bill-of-materials",
"compliance",
"devsecops",
"eu-ai-act",
"llm-security",
"ml-security",
"mlsecops",
"model-scanning",
"nist-ai-rmf",
"owasp",
"vulnerability-scanner"
],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "20 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 20
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "excellent",
"name": "Security",
"value": 100,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "excellent",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Dependency lockfiles. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"dependency_lockfiles"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "file_signals",
"lockfiles": [
"go.sum"
],
"manifests": [
"go.mod"
],
"has_codeql_workflow": true,
"has_security_policy": true,
"has_dependabot_config": true
},
"components": [
{
"key": "security_policy_security_md",
"name": "Security policy (SECURITY.md)",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "dependabot_config",
"name": "Dependabot config",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "dependency_lockfiles",
"name": "Dependency lockfiles",
"detail": "published library — lockfiles are an application concern, not expected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "lockfiles_not_expected",
"params": {}
}
],
"max_points": 25
},
{
"key": "codeql_workflow",
"name": "CodeQL workflow",
"detail": null,
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 1
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "good",
"name": "AI Readiness",
"value": 77,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.986,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "71 of 72 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 71,
"sampled": 72
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "excellent",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 97,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": true,
"typed_language": true,
"bootstrap_files": [
"Makefile"
],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [
"sdk/python/src/airom/py.typed"
],
"agent_commit_share": 0.972,
"toolchain_manifests": [
"go.mod",
"internal/detectors/manifest/testdata/cargo/Cargo.toml",
"internal/detectors/manifest/testdata/gomod/go.mod",
"internal/detectors/manifest/testdata/gradle/build.gradle",
"internal/detectors/manifest/testdata/gradle/build.gradle.kts",
"internal/detectors/manifest/testdata/maven/pom.xml",
"internal/detectors/manifest/testdata/nuget/sample.csproj",
"internal/e2e/testdata/fixtures/go-openai/go.mod"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": ".golangci.yml",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "sdk/python/src/airom/py.typed",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "sdk/python/src/airom/py.typed"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "70 of the last 72 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 70,
"sampled": 72
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "dependency automation configured, none observed in the sampled commits",
"points": 5,
"status": "partial",
"details": [
{
"code": "dependency_bot_config_only",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "OpenSSF Scorecard unavailable",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 35839,
"source_files_sampled": 299,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/299 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 299,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"OpenSSF Scorecard did not return a usable result (2026/07/23 23:40:47 Warning: PATs stored in env variables GITHUB_AUTH_TOKEN and GITHUB_TOKEN differ. Scorecard will use the former.); skipping Scorecard checks"
],
"report_type": "repository",
"generated_at": "2026-07-23T23:41:57.516031Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/a/airomhq/airom.svg",
"full_name": "airomhq/airom",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}
