, missing URLs with `#fragment`. While\nfixing that, audited every internal link in the generated site and found\n24 more broken — examples-gallery cross-links, agent-usage skill paths,\ncli.md `#akua-r\n[…]\nth filter so dead links fail the deploy.\n- `docs/sdk.md` — transport table rewritten. The SDK is NAPI-only;\n the WASM + shell-out tiers were aspirational. Lists the 14 verbs\n actually exposed today.", "is_bot": false, "headline": "fix(site): kill dead links + add a checker that fails CI on regression", "author_name": "Robin", "author_login": "robinbraemer", "committed_at": "2026-05-07T12:47:48Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "397e9ce182e478ada2cd50ada6854b32606c1280", "body": null, "is_bot": false, "headline": "fix(docs/sdk): npm link missing @akua scope (was /package/-dev/sdk)", "author_name": "Robin", "author_login": "robinbraemer", "committed_at": "2026-05-07T12:36:33Z", "body_truncated": false, "is_coding_agent": false }, { "oid": "09530b3921fa1d04f2c65022b00910dbf544965a", "body": "…links\n\nThree design fixes:\n\n1. Landing is back to a tight, vertical-centered single column. The\n prior \"logo hero + giant tagline\" pushed the install command well\n below the fold; now `akua` headline + tagline sit ~6px apart and\n the install pre block is the second visible element. Footer + D\n[…]\ne click target is consistent and the\n text sits dead-center. Brand img dropped from 28→26 to better match\n the text x-height.\n\nSidebar `top: 76px → 24px` since the topnav no longer reserves space.", "is_bot": false, "headline": "fix(site): tighter centered landing, scroll-fade topnav, aligned nav …", "author_name": "Robin", "author_login": "robinbraemer", "committed_at": "2026-05-07T12:35:09Z", "body_truncated": true, "is_coding_agent": false }, { "oid": "ff5f076874f2fa78dd5b2e275e0af5622aee7aaa", "body": "`npm publish` is the most failure-prone step in the release pipeline\n(OIDC config drift, registry hiccups, version-pin mismatch, …). When\nit fails today, the only recovery path is to push a workflow fix and\nre-tag, which re-runs the full build matrix — hours of CI time for a\n3-line YAML fix.\n\nThis s\n[…]\nublish failure — without a pattern,\ndownload-artifact also pulls the docker job's auto-attached\n`cnap-tech~akua~\u003cid>.dockerbuild` provenance artifact, whose\n`~`-containing name fails path validation).", "is_bot": false, "headline": "refactor(release): split publish into separately-dispatchable workflow", "author_name": "Robin", "author_login": "robinbraemer", "committed_at": "2026-05-07T12:25:57Z", "body_truncated": true, "is_coding_agent": false } ], "releases_count": 26, "commits_last_year": 523, "latest_release_at": "2026-07-11T23:50:28Z", "latest_release_tag": "v0.8.25", "releases_from_tags": false, "days_since_last_push": 4, "active_weeks_last_year": 13, "days_since_latest_release": 17, "mean_days_between_releases": 4.8 }, "community": { "has_readme": true, "has_license": true, "has_description": true, "has_contributing": true, "health_percentage": 87, "has_issue_template": false, "has_code_of_conduct": true, "has_pull_request_template": false }, "ecosystem": { "packages": [ { "name": "@akua-dev/sdk", "exists": true, "license": "Apache-2.0", "keywords": [], "ecosystem": "npm", "matches_repo": true, "registry_url": "https://www.npmjs.com/package/@akua-dev/sdk", "is_deprecated": false, "latest_version": "0.8.25", "repository_url": "https://github.com/akua-dev/akua", "versions_count": 26, "total_downloads": null, "dependents_count": null, "deprecation_note": null, "maintainers_count": 1, "monthly_downloads": 2005, "first_published_at": "2026-04-27T12:42:24.932000Z", "latest_published_at": "2026-07-21T08:15:17.042000Z", "latest_version_yanked": null, "days_since_latest_publish": 7 }, { "name": "@akua-dev/native", "exists": true, "license": "Apache-2.0", "keywords": [ "akua", "napi-rs", "NAPI", "node-addon", "helm", "kustomize", "kcl" ], "ecosystem": "npm", "matches_repo": true, "registry_url": "https://www.npmjs.com/package/@akua-dev/native", "is_deprecated": false, "latest_version": "0.8.25", "repository_url": "https://github.com/akua-dev/akua", "versions_count": 26, "total_downloads": null, "dependents_count": null, "deprecation_note": null, "maintainers_count": 1, "monthly_downloads": 2109, "first_published_at": "2026-04-27T12:42:19.969000Z", "latest_published_at": "2026-07-21T08:15:02.097000Z", "latest_version_yanked": null, "days_since_latest_publish": 7 } ] }, "popularity": { "forks": 0, "stars": 5, "watchers": 0, "fork_history": { "days": [], "complete": true, "collected": 0, "total_forks": 0 }, "star_history": null, "open_issues_and_prs": 25 }, "ai_readiness": { "has_nix": false, "example_dirs": [ "examples" ], "has_llms_txt": false, "has_dockerfile": true, "has_mcp_signal": false, "bootstrap_files": [ ".mise.toml", "Taskfile.yml", "docs/hero-source/Taskfile.yml" ], "api_schema_files": [], "has_devcontainer": false, "typecheck_configs": [ "packages/sdk/tsconfig.json" ], "toolchain_manifests": [ "Cargo.toml", "crates/akua-cli/Cargo.toml", "crates/akua-core/Cargo.toml", "crates/akua-napi/Cargo.toml", "crates/akua-render-worker/Cargo.toml", "crates/engine-host-wasm/Cargo.toml", "crates/helm-engine-wasm/Cargo.toml", "crates/helm-engine-wasm/go-src/go.mod", "crates/kustomize-engine-wasm/Cargo.toml", "crates/kustomize-engine-wasm/go-src/go.mod", "crates/source-hash/Cargo.toml" ], "largest_source_bytes": 84955, "source_files_sampled": 194, "oversized_source_files": 4, "agent_instruction_files": [ "AGENTS.md", "CLAUDE.md" ], "agent_instruction_max_bytes": 18329 }, "dependencies": { "manifests": [ "Cargo.toml", "package.json" ], "advisories": { "error": null, "scope": "published_package", "source": "osv", "findings": [], "collected": true, "malicious": [], "truncated": false, "by_severity": {}, "advisory_count": 0, "affected_count": 0, "assessed_count": 16, "malicious_count": 0, "assessed_package": "npm:@akua-dev/sdk@0.8.25", "unassessed_count": 0, "direct_affected_count": 0 }, "ecosystems": [ "crates", "npm" ], "dependencies": [ { "name": "akua-core", "manifest": "crates/akua-cli/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "clap", "manifest": "crates/akua-cli/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "serde", "manifest": "crates/akua-cli/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "serde_json", "manifest": "crates/akua-cli/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "serde_yaml", "manifest": "crates/akua-cli/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "thiserror", "manifest": "crates/akua-cli/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "toml", "manifest": "crates/akua-cli/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "reqwest", "manifest": "crates/akua-cli/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "ctrlc", "manifest": "crates/akua-cli/Cargo.toml", "ecosystem": "crates", "version_constraint": "3" }, { "name": "ts-rs", "manifest": "crates/akua-cli/Cargo.toml", "ecosystem": "crates", "version_constraint": "12" }, { "name": "schemars", "manifest": "crates/akua-cli/Cargo.toml", "ecosystem": "crates", "version_constraint": "1" }, { "name": "wasmtime", "manifest": "crates/akua-cli/Cargo.toml", "ecosystem": "crates", "version_constraint": "43" }, { "name": "wasmtime-wasi", "manifest": "crates/akua-cli/Cargo.toml", "ecosystem": "crates", "version_constraint": "43" }, { "name": "engine-host-wasm", "manifest": "crates/akua-cli/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "tracing", "manifest": "crates/akua-cli/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "tracing-subscriber", "manifest": "crates/akua-cli/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "tracing-opentelemetry", "manifest": "crates/akua-cli/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "opentelemetry", "manifest": "crates/akua-cli/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "opentelemetry_sdk", "manifest": "crates/akua-cli/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "opentelemetry-otlp", "manifest": "crates/akua-cli/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "tokio", "manifest": "crates/akua-cli/Cargo.toml", "ecosystem": "crates", "version_constraint": "1" }, { "name": "serde", "manifest": "crates/akua-core/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "serde_json", "manifest": "crates/akua-core/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "serde_yaml", "manifest": "crates/akua-core/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "toml", "manifest": "crates/akua-core/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "thiserror", "manifest": "crates/akua-core/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "base64", "manifest": "crates/akua-core/Cargo.toml", "ecosystem": "crates", "version_constraint": "0.22" }, { "name": "kcl-lang", "manifest": "crates/akua-core/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "sha2", "manifest": "crates/akua-core/Cargo.toml", "ecosystem": "crates", "version_constraint": "0.10" }, { "name": "tempfile", "manifest": "crates/akua-core/Cargo.toml", "ecosystem": "crates", "version_constraint": "3" }, { "name": "ts-rs", "manifest": "crates/akua-core/Cargo.toml", "ecosystem": "crates", "version_constraint": "12" }, { "name": "schemars", "manifest": "crates/akua-core/Cargo.toml", "ecosystem": "crates", "version_constraint": "1" }, { "name": "semver", "manifest": "crates/akua-core/Cargo.toml", "ecosystem": "crates", "version_constraint": "1" }, { "name": "akua-cli", "manifest": "crates/akua-napi/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "akua-core", "manifest": "crates/akua-napi/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "napi", "manifest": "crates/akua-napi/Cargo.toml", "ecosystem": "crates", "version_constraint": "3" }, { "name": "napi-derive", "manifest": "crates/akua-napi/Cargo.toml", "ecosystem": "crates", "version_constraint": "3" }, { "name": "serde", "manifest": "crates/akua-napi/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "serde_json", "manifest": "crates/akua-napi/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "serde_yaml", "manifest": "crates/akua-napi/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "@akua-dev/native-engines", "manifest": "crates/akua-napi/package.json", "ecosystem": "npm", "version_constraint": "0.8.8" }, { "name": "akua-core", "manifest": "crates/akua-render-worker/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "serde", "manifest": "crates/akua-render-worker/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "serde_json", "manifest": "crates/akua-render-worker/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "serde_yaml", "manifest": "crates/akua-render-worker/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "tracing", "manifest": "crates/akua-render-worker/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "tracing-subscriber", "manifest": "crates/akua-render-worker/Cargo.toml", "ecosystem": "crates", "version_constraint": "0.3" }, { "name": "wasmtime", "manifest": "crates/engine-host-wasm/Cargo.toml", "ecosystem": "crates", "version_constraint": "43" }, { "name": "wasmtime-wasi", "manifest": "crates/engine-host-wasm/Cargo.toml", "ecosystem": "crates", "version_constraint": "43" }, { "name": "thiserror", "manifest": "crates/engine-host-wasm/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "engine-host-wasm", "manifest": "crates/helm-engine-wasm/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "serde", "manifest": "crates/helm-engine-wasm/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "serde_json", "manifest": "crates/helm-engine-wasm/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "base64", "manifest": "crates/helm-engine-wasm/Cargo.toml", "ecosystem": "crates", "version_constraint": "0.22" }, { "name": "thiserror", "manifest": "crates/helm-engine-wasm/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "flate2", "manifest": "crates/helm-engine-wasm/Cargo.toml", "ecosystem": "crates", "version_constraint": "1" }, { "name": "tar", "manifest": "crates/helm-engine-wasm/Cargo.toml", "ecosystem": "crates", "version_constraint": "0.4" }, { "name": "engine-host-wasm", "manifest": "crates/kustomize-engine-wasm/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "serde", "manifest": "crates/kustomize-engine-wasm/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "serde_json", "manifest": "crates/kustomize-engine-wasm/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "base64", "manifest": "crates/kustomize-engine-wasm/Cargo.toml", "ecosystem": "crates", "version_constraint": "0.22" }, { "name": "thiserror", "manifest": "crates/kustomize-engine-wasm/Cargo.toml", "ecosystem": "crates", "version_constraint": null }, { "name": "flate2", "manifest": "crates/kustomize-engine-wasm/Cargo.toml", "ecosystem": "crates", "version_constraint": "1" }, { "name": "tar", "manifest": "crates/kustomize-engine-wasm/Cargo.toml", "ecosystem": "crates", "version_constraint": "0.4" }, { "name": "sha2", "manifest": "crates/source-hash/Cargo.toml", "ecosystem": "crates", "version_constraint": "0.10" }, { "name": "@akua-dev/native", "manifest": "packages/sdk/package.json", "ecosystem": "npm", "version_constraint": "0.8.8" }, { "name": "@standard-schema/spec", "manifest": "packages/sdk/package.json", "ecosystem": "npm", "version_constraint": "^1.1.0" }, { "name": "ajv", "manifest": "packages/sdk/package.json", "ecosystem": "npm", "version_constraint": "^8.18.0" }, { "name": "yaml", "manifest": "packages/sdk/package.json", "ecosystem": "npm", "version_constraint": "^2.8.3" } ], "all_dependencies": { "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository", "source": null, "packages": [], "collected": false, "truncated": false, "total_count": null, "direct_count": null, "indirect_count": null } }, "maintainership": { "issues": { "open_prs": 14, "merged_prs": 46, "open_issues": 11, "closed_ratio": 0.214, "closed_issues": 3, "closed_unmerged_prs": 15 }, "bus_factor": 1, "bot_contributors": 1, "top_contributors": [ { "type": "User", "login": "robinbraemer", "commits": 517, "avatar_url": "https://avatars.githubusercontent.com/u/22003767?v=4" }, { "type": "User", "login": "marcus-klingler", "commits": 1, "avatar_url": "https://avatars.githubusercontent.com/u/181632184?v=4" } ], "contributors_sampled": 2, "top_contributor_share": 0.998 }, "quality_signals": { "has_ci": true, "has_tests": true, "ci_workflows": [ "ci.yml", "pages.yml", "release-publish.yml", "release.yml" ], "has_docs_dir": true, "linter_configs": [], "has_editorconfig": false, "has_linter_config": false, "has_precommit_config": false }, "security_signals": { "lockfiles": [ "Cargo.lock" ], "scorecard": { "checks": [ { "name": "Binary-Artifacts", "score": 10, "reason": "no binaries found in the repo", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts" }, { "name": "Branch-Protection", "score": 0, "reason": "branch protection not enabled on development/release branches", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection" }, { "name": "CI-Tests", "score": 9, "reason": "9 out of 10 merged PRs checked by a CI test -- score normalized to 9", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests" }, { "name": "CII-Best-Practices", "score": 0, "reason": "no effort to earn an OpenSSF best practices badge detected", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices" }, { "name": "Code-Review", "score": 0, "reason": "Found 1/29 approved changesets -- score normalized to 0", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review" }, { "name": "Contributors", "score": 10, "reason": "project has 4 contributing companies or organizations", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors" }, { "name": "Dangerous-Workflow", "score": 10, "reason": "no dangerous workflow patterns detected", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow" }, { "name": "Dependency-Update-Tool", "score": 10, "reason": "update tool detected", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool" }, { "name": "Fuzzing", "score": 0, "reason": "project is not fuzzed", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing" }, { "name": "License", "score": 10, "reason": "license file detected", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license" }, { "name": "Maintained", "score": 10, "reason": "30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained" }, { "name": "Packaging", "score": 10, "reason": "packaging workflow detected", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging" }, { "name": "Pinned-Dependencies", "score": 0, "reason": "dependency not pinned by hash detected -- score normalized to 0", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies" }, { "name": "SAST", "score": 0, "reason": "SAST tool is not run on all commits -- score normalized to 0", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast" }, { "name": "Security-Policy", "score": 10, "reason": "security policy file detected", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy" }, { "name": "Signed-Releases", "score": 0, "reason": "Project has not signed or included provenance with any releases.", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases" }, { "name": "Token-Permissions", "score": 0, "reason": "detected GitHub workflow tokens with excessive permissions", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions" }, { "name": "Vulnerabilities", "score": 0, "reason": "89 existing vulnerabilities detected", "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities" } ], "commit": "1b87537aaa2f3b1aa8f6bf5d8d41313511aee6ef", "ran_at": "2026-07-29T07:41:12Z", "aggregate_score": 4.7, "scorecard_version": "v5.5.0" }, "has_codeql_workflow": false, "has_security_policy": true, "has_dependabot_config": false }, "contribution_flow": { "collected": true, "ci_last_run_at": "2026-07-21T10:30:47Z", "oldest_open_prs": [ { "number": 5, "created_at": "2026-04-18T05:52:46Z", "last_comment_at": "2026-07-24T05:17:43Z", "last_comment_author": "akua-renovate" }, { "number": 8, "created_at": "2026-04-18T13:26:21Z", "last_comment_at": "2026-07-24T05:17:42Z", "last_comment_author": "akua-renovate" }, { "number": 25, "created_at": "2026-04-26T03:46:15Z", "last_comment_at": "2026-05-07T21:12:53Z", "last_comment_author": "akua-renovate" }, { "number": 28, "created_at": "2026-04-26T06:24:19Z", "last_comment_at": "2026-07-24T05:17:44Z", "last_comment_author": "akua-renovate" }, { "number": 29, "created_at": "2026-04-26T06:24:27Z", "last_comment_at": "2026-07-24T05:17:45Z", "last_comment_author": "akua-renovate" }, { "number": 30, "created_at": "2026-04-27T14:19:36Z", "last_comment_at": "2026-07-24T05:17:41Z", "last_comment_author": "akua-renovate" }, { "number": 31, "created_at": "2026-04-27T14:19:57Z", "last_comment_at": "2026-05-07T21:12:51Z", "last_comment_author": "akua-renovate" }, { "number": 52, "created_at": "2026-05-07T21:14:46Z", "last_comment_at": "2026-05-08T03:40:55Z", "last_comment_author": "akua-renovate" }, { "number": 84, "created_at": "2026-07-24T05:17:34Z", "last_comment_at": null, "last_comment_author": null }, { "number": 85, "created_at": "2026-07-24T05:17:39Z", "last_comment_at": null, "last_comment_author": null }, { "number": 86, "created_at": "2026-07-24T09:08:19Z", "last_comment_at": null, "last_comment_author": null }, { "number": 87, "created_at": "2026-07-24T09:08:25Z", "last_comment_at": null, "last_comment_author": null }, { "number": 88, "created_at": "2026-07-24T12:47:38Z", "last_comment_at": null, "last_comment_author": null }, { "number": 89, "created_at": "2026-07-24T12:49:29Z", "last_comment_at": null, "last_comment_author": null } ], "last_merged_pr_at": "2026-07-21T10:30:05Z", "ci_last_conclusion": "SUCCESS", "oldest_open_issues": [ { "number": 67, "created_at": "2026-07-07T22:28:32Z", "last_comment_at": null, "last_comment_author": null }, { "number": 73, "created_at": "2026-07-13T16:40:34Z", "last_comment_at": "2026-07-14T07:01:46Z", "last_comment_author": "robinbraemer" }, { "number": 74, "created_at": "2026-07-13T16:41:36Z", "last_comment_at": null, "last_comment_author": null }, { "number": 75, "created_at": "2026-07-13T16:44:22Z", "last_comment_at": "2026-07-14T07:01:58Z", "last_comment_author": "robinbraemer" }, { "number": 76, "created_at": "2026-07-13T16:56:08Z", "last_comment_at": null, "last_comment_author": null }, { "number": 77, "created_at": "2026-07-13T16:58:28Z", "last_comment_at": null, "last_comment_author": null }, { "number": 78, "created_at": "2026-07-13T16:58:39Z", "last_comment_at": null, "last_comment_author": null }, { "number": 79, "created_at": "2026-07-13T16:58:51Z", "last_comment_at": null, "last_comment_author": null }, { "number": 80, "created_at": "2026-07-13T17:03:38Z", "last_comment_at": null, "last_comment_author": null }, { "number": 81, "created_at": "2026-07-13T17:03:55Z", "last_comment_at": null, "last_comment_author": null }, { "number": 82, "created_at": "2026-07-13T17:04:24Z", "last_comment_at": null, "last_comment_author": null } ] } }, "config": { "disabled_metrics": [], "disabled_categories": [], "disabled_components": {} }, "source": { "url": "https://github.com/akua-dev/akua", "host": "github.com", "name": "akua", "owner": "akua-dev" }, "metrics": { "overall": { "key": "overall", "band": "moderate", "name": "Overall health", "note": null, "notes": [], "value": 63, "inputs": { "security": 58, "vitality": 80, "community": 49, "governance": 49, "engineering": 80 }, "components": [] }, "categories": [ { "key": "vitality", "band": "good", "name": "Vitality", "value": 80, "weight": 0.22, "metrics": [ { "key": "development_activity", "band": "good", "name": "Development activity", "note": null, "notes": [], "value": 73, "inputs": { "commits_last_year": 523, "human_commit_share": 1, "days_since_last_push": 4, "active_weeks_last_year": 13 }, "components": [ { "key": "push_recency", "name": "Push recency", "detail": "last push 4 days ago", "points": 36, "status": "met", "details": [ { "code": "push_recency", "params": { "days": 4 } } ], "max_points": 36 }, { "key": "commit_cadence", "name": "Commit cadence", "detail": "13/52 weeks with commits", "points": 9, "status": "partial", "details": [ { "code": "commit_cadence_weeks", "params": { "weeks": 13 } } ], "max_points": 36 }, { "key": "commit_volume", "name": "Commit volume", "detail": "523 commits in the last year", "points": 18, "status": "met", "details": [ { "code": "commits_last_year", "params": { "count": 523 } } ], "max_points": 18 }, { "key": "openssf_scorecard_maintained", "name": "OpenSSF Scorecard: Maintained", "detail": "30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10", "points": 10, "status": "met", "details": [], "max_points": 10 } ] }, { "key": "release_discipline", "band": "excellent", "name": "Release discipline", "note": null, "notes": [], "value": 90, "inputs": { "releases_count": 26, "latest_release_tag": "v0.8.25", "releases_from_tags": false, "days_since_latest_release": 17, "mean_days_between_releases": 4.8 }, "components": [ { "key": "ships_releases", "name": "Ships releases", "detail": "26 releases published", "points": 27, "status": "met", "details": [ { "code": "releases_published", "params": { "count": 26 } } ], "max_points": 27 }, { "key": "release_recency", "name": "Release recency", "detail": "latest release 17 days ago", "points": 36, "status": "met", "details": [ { "code": "release_recency", "params": { "days": 17 } } ], "max_points": 36 }, { "key": "release_cadence", "name": "Release cadence", "detail": "a release every ~4.8 days", "points": 27, "status": "met", "details": [ { "code": "release_cadence", "params": { "gap": 4.8 } } ], "max_points": 27 }, { "key": "openssf_scorecard_signed_releases", "name": "OpenSSF Scorecard: Signed-Releases", "detail": "Project has not signed or included provenance with any releases.", "points": 0, "status": "missed", "details": [], "max_points": 10 } ] }, { "key": "abandonment", "band": "excellent", "name": "Abandonment", "note": null, "notes": [], "value": 100, "inputs": { "cap": null, "state": "unverified", "guards": [], "signals": [], "red_flag": false, "multiplier_pct": 100, "declared_reason": null, "unverified_reason": "repository_too_young", "unanswered_open_prs": null, "unanswered_open_issues": null, "days_since_last_merged_pr": null, "days_since_last_human_commit": null, "days_since_last_human_commit_is_floor": false }, "components": [ { "key": "project_is_still_maintained", "name": "Project is still maintained", "detail": "maintenance record not established from the collected data", "points": 100, "status": "met", "details": [ { "code": "abandonment_unverified", "params": {} } ], "max_points": 100 } ] } ], "description": "Is the project alive — is code being written and are releases shipping?" }, { "key": "community", "band": "at_risk", "name": "Community & Adoption", "value": 49, "weight": 0.18, "metrics": [ { "key": "popularity", "band": "critical", "name": "Popularity & adoption", "note": null, "notes": [], "value": 10, "inputs": { "forks": 0, "stars": 5, "watchers": 0, "growth_state": "unverified", "growth_factor_pct": 100, "growth_unverified_reason": "no_history" }, "components": [ { "key": "stars", "name": "Stars", "detail": "5 stars", "points": 9.8, "status": "partial", "details": [ { "code": "stars", "params": { "count": 5 } } ], "max_points": 60 }, { "key": "forks", "name": "Forks", "detail": "0 forks", "points": 0, "status": "missed", "details": [ { "code": "forks", "params": { "count": 0 } } ], "max_points": 25 }, { "key": "watchers", "name": "Watchers", "detail": "0 watchers", "points": 0, "status": "missed", "details": [ { "code": "watchers", "params": { "count": 0 } } ], "max_points": 15 } ] }, { "key": "community_health", "band": "excellent", "name": "Community health", "note": null, "notes": [], "value": 85, "inputs": { "has_readme": true, "has_license": true, "has_contributing": true, "has_issue_template": false, "has_code_of_conduct": true, "has_pull_request_template": false }, "components": [ { "key": "readme", "name": "README", "detail": null, "points": 22.5, "status": "met", "details": [], "max_points": 22.5 }, { "key": "license", "name": "License", "detail": "recognized license (Apache-2.0)", "points": 22.5, "status": "met", "details": [ { "code": "license_standard", "params": {} }, { "code": "license_spdx", "params": { "spdx": "Apache-2.0" } } ], "max_points": 22.5 }, { "key": "contributing_guide", "name": "CONTRIBUTING guide", "detail": null, "points": 18, "status": "met", "details": [], "max_points": 18 }, { "key": "code_of_conduct", "name": "Code of conduct", "detail": null, "points": 13.5, "status": "met", "details": [], "max_points": 13.5 }, { "key": "issue_template", "name": "Issue template", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 7.2 }, { "key": "pr_template", "name": "PR template", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 6.3 } ] }, { "key": "ecosystem_adoption", "band": "moderate", "name": "Ecosystem adoption (downloads)", "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.", "notes": [ { "code": "excluded_no_data", "params": { "components": [ "registry_dependents" ] } }, { "code": "weights_renormalized", "params": {} } ], "value": 60, "inputs": { "packages": [ "@akua-dev/sdk", "@akua-dev/native" ], "dependents": null, "ecosystems": "npm", "total_downloads": null, "monthly_downloads": 4114 }, "components": [ { "key": "monthly_downloads", "name": "Monthly downloads", "detail": "4,114 downloads/month across npm", "points": 48.2, "status": "partial", "details": [ { "code": "downloads_monthly", "params": { "count": 4114, "ecosystems": "npm" } } ], "max_points": 80 }, { "key": "registry_dependents", "name": "Registry dependents", "detail": "not reported by this ecosystem", "points": 0, "status": "excluded", "details": [ { "code": "not_reported_by_this_ecosystem", "params": {} } ], "max_points": 20 } ] } ], "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?" }, { "key": "governance", "band": "at_risk", "name": "Sustainability & Governance", "value": 49, "weight": 0.24, "metrics": [ { "key": "maintainer_resilience", "band": "critical", "name": "Maintainer resilience (bus factor)", "note": null, "notes": [], "value": 22, "inputs": { "bus_factor": 1, "contributors_sampled": 2, "top_contributor_share": 0.998 }, "components": [ { "key": "bus_factor", "name": "Bus factor", "detail": "1 contributor(s) cover half of all commits", "points": 9, "status": "partial", "details": [ { "code": "bus_factor", "params": { "count": 1 } } ], "max_points": 54 }, { "key": "commit_distribution", "name": "Commit distribution", "detail": "top contributor authored 100% of commits", "points": 0, "status": "partial", "details": [ { "code": "top_contributor_share", "params": { "share": 100 } } ], "max_points": 22.5 }, { "key": "contributor_breadth", "name": "Contributor breadth", "detail": "2 contributors", "points": 2.7, "status": "partial", "details": [ { "code": "contributors_sampled", "params": { "count": 2 } } ], "max_points": 13.5 }, { "key": "openssf_scorecard_contributors", "name": "OpenSSF Scorecard: Contributors", "detail": "project has 4 contributing companies or organizations", "points": 10, "status": "met", "details": [], "max_points": 10 } ] }, { "key": "responsiveness", "band": "at_risk", "name": "Issue & PR responsiveness", "note": null, "notes": [], "value": 39, "inputs": { "merged_prs": 46, "open_issues": 11, "closed_issues": 3, "issue_closed_ratio": 0.214, "closed_unmerged_prs": 15 }, "components": [ { "key": "issue_resolution", "name": "Issue resolution", "detail": "21% of issues closed", "points": 10, "status": "partial", "details": [ { "code": "issues_closed_share", "params": { "share": 21 } } ], "max_points": 46.75 }, { "key": "pr_acceptance", "name": "PR acceptance", "detail": "46/61 decided PRs merged", "points": 28.8, "status": "partial", "details": [ { "code": "decided_prs_merged", "params": { "merged": 46, "decided": 61 } } ], "max_points": 38.25 }, { "key": "openssf_scorecard_code_review", "name": "OpenSSF Scorecard: Code-Review", "detail": "Found 1/29 approved changesets -- score normalized to 0", "points": 0, "status": "missed", "details": [], "max_points": 15 } ] }, { "key": "stewardship", "band": "moderate", "name": "Ownership & stewardship", "note": null, "notes": [], "value": 51, "inputs": { "followers": 11, "owner_type": "Organization", "is_verified": null, "owner_login": "akua-dev", "public_repos": 15, "account_age_days": 769 }, "components": [ { "key": "ownership_backing", "name": "Ownership backing", "detail": "organization-owned", "points": 30, "status": "met", "details": [ { "code": "owner_organization", "params": {} } ], "max_points": 30 }, { "key": "verified_domain", "name": "Verified domain", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 20 }, { "key": "owner_reach", "name": "Owner reach", "detail": "11 followers of akua-dev", "points": 7.8, "status": "partial", "details": [ { "code": "owner_followers", "params": { "count": 11, "login": "akua-dev" } } ], "max_points": 25 }, { "key": "track_record", "name": "Track record", "detail": "15 public repos, account ~2 yr old", "points": 13, "status": "partial", "details": [ { "code": "public_repos", "params": { "count": 15 } }, { "code": "account_age_years", "params": { "years": 2 } } ], "max_points": 25 } ] }, { "key": "package_maintenance", "band": "excellent", "name": "Package maintenance", "note": null, "notes": [], "value": 100, "inputs": { "packages": [ "@akua-dev/sdk", "@akua-dev/native" ], "ecosystems": "npm", "any_deprecated": false, "min_days_since_publish": 7 }, "components": [ { "key": "published_resolvable", "name": "Published & resolvable", "detail": "2 package(s) on npm", "points": 25, "status": "met", "details": [ { "code": "packages_published", "params": { "count": 2, "ecosystems": "npm" } } ], "max_points": 25 }, { "key": "publish_recency", "name": "Publish recency", "detail": "latest publish 7 days ago", "points": 35, "status": "met", "details": [ { "code": "publish_recency", "params": { "days": 7 } } ], "max_points": 35 }, { "key": "version_history", "name": "Version history", "detail": "26 published versions", "points": 20, "status": "met", "details": [ { "code": "published_versions", "params": { "count": 26 } } ], "max_points": 20 }, { "key": "not_deprecated", "name": "Not deprecated", "detail": "active, not deprecated or yanked", "points": 20, "status": "met", "details": [ { "code": "package_not_deprecated", "params": {} } ], "max_points": 20 } ] } ], "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?" }, { "key": "engineering", "band": "good", "name": "Engineering Quality", "value": 80, "weight": 0.2, "metrics": [ { "key": "engineering_practices", "band": "moderate", "name": "Engineering practices", "note": null, "notes": [], "value": 66, "inputs": { "has_ci": true, "has_tests": true, "has_editorconfig": false, "has_linter_config": false, "has_precommit_config": false }, "components": [ { "key": "ci_workflows", "name": "CI workflows", "detail": "4 workflow(s)", "points": 24, "status": "met", "details": [ { "code": "ci_workflows", "params": { "count": 4 } } ], "max_points": 24 }, { "key": "tests_present", "name": "Tests present", "detail": null, "points": 24, "status": "met", "details": [], "max_points": 24 }, { "key": "linter_config", "name": "Linter config", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 16 }, { "key": "pre_commit_hooks", "name": "Pre-commit hooks", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 9.6 }, { "key": "editorconfig", "name": ".editorconfig", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 6.4 }, { "key": "openssf_scorecard_ci_tests", "name": "OpenSSF Scorecard: CI-Tests", "detail": "9 out of 10 merged PRs checked by a CI test -- score normalized to 9", "points": 18, "status": "partial", "details": [], "max_points": 20 } ] }, { "key": "documentation", "band": "excellent", "name": "Documentation", "note": null, "notes": [], "value": 100, "inputs": { "topics": [ "devops", "helm", "infrastructure-as-code", "kcl", "kubernetes", "kustomize", "rust", "security", "webassembly", "agentic-infra", "aumakua" ], "has_wiki": true, "homepage": "https://cli.akua.dev", "has_readme": true, "has_docs_dir": true, "has_description": true }, "components": [ { "key": "readme", "name": "README", "detail": null, "points": 30, "status": "met", "details": [], "max_points": 30 }, { "key": "documentation_directory", "name": "Documentation directory", "detail": null, "points": 25, "status": "met", "details": [], "max_points": 25 }, { "key": "documentation_homepage_site", "name": "Documentation / homepage site", "detail": "https://cli.akua.dev", "points": 15, "status": "met", "details": [], "max_points": 15 }, { "key": "repository_description", "name": "Repository description", "detail": null, "points": 10, "status": "met", "details": [], "max_points": 10 }, { "key": "topics", "name": "Topics", "detail": "11 topics", "points": 10, "status": "met", "details": [ { "code": "topics_count", "params": { "count": 11 } } ], "max_points": 10 }, { "key": "wiki", "name": "Wiki", "detail": null, "points": 10, "status": "met", "details": [], "max_points": 10 } ] } ], "description": "Are baseline engineering and documentation practices in place?" }, { "key": "security", "band": "moderate", "name": "Security", "value": 58, "weight": 0.16, "metrics": [ { "key": "security_posture", "band": "at_risk", "name": "Security posture", "note": null, "notes": [], "value": 47, "inputs": { "source": "openssf_scorecard", "checks_evaluated": 18, "scorecard_version": "v5.5.0", "checks_inconclusive": 0, "scorecard_aggregate": 4.7 }, "components": [ { "key": "binary_artifacts", "name": "Binary-Artifacts", "detail": "no binaries found in the repo", "points": 7.5, "status": "met", "details": [], "max_points": 7.5 }, { "key": "branch_protection", "name": "Branch-Protection", "detail": "branch protection not enabled on development/release branches", "points": 0, "status": "missed", "details": [], "max_points": 7.5 }, { "key": "ci_tests", "name": "CI-Tests", "detail": "9 out of 10 merged PRs checked by a CI test -- score normalized to 9", "points": 2.2, "status": "partial", "details": [], "max_points": 2.5 }, { "key": "cii_best_practices", "name": "CII-Best-Practices", "detail": "no effort to earn an OpenSSF best practices badge detected", "points": 0, "status": "missed", "details": [], "max_points": 2.5 }, { "key": "code_review", "name": "Code-Review", "detail": "Found 1/29 approved changesets -- score normalized to 0", "points": 0, "status": "missed", "details": [], "max_points": 7.5 }, { "key": "contributors", "name": "Contributors", "detail": "project has 4 contributing companies or organizations", "points": 2.5, "status": "met", "details": [], "max_points": 2.5 }, { "key": "dangerous_workflow", "name": "Dangerous-Workflow", "detail": "no dangerous workflow patterns detected", "points": 10, "status": "met", "details": [], "max_points": 10 }, { "key": "dependency_update_tool", "name": "Dependency-Update-Tool", "detail": "update tool detected", "points": 7.5, "status": "met", "details": [], "max_points": 7.5 }, { "key": "fuzzing", "name": "Fuzzing", "detail": "project is not fuzzed", "points": 0, "status": "missed", "details": [], "max_points": 5 }, { "key": "license", "name": "License", "detail": "license file detected", "points": 2.5, "status": "met", "details": [], "max_points": 2.5 }, { "key": "maintained", "name": "Maintained", "detail": "30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10", "points": 7.5, "status": "met", "details": [], "max_points": 7.5 }, { "key": "packaging", "name": "Packaging", "detail": "packaging workflow detected", "points": 5, "status": "met", "details": [], "max_points": 5 }, { "key": "pinned_dependencies", "name": "Pinned-Dependencies", "detail": "dependency not pinned by hash detected -- score normalized to 0", "points": 0, "status": "missed", "details": [], "max_points": 5 }, { "key": "sast", "name": "SAST", "detail": "SAST tool is not run on all commits -- score normalized to 0", "points": 0, "status": "missed", "details": [], "max_points": 5 }, { "key": "security_policy", "name": "Security-Policy", "detail": "security policy file detected", "points": 5, "status": "met", "details": [], "max_points": 5 }, { "key": "signed_releases", "name": "Signed-Releases", "detail": "Project has not signed or included provenance with any releases.", "points": 0, "status": "missed", "details": [], "max_points": 7.5 }, { "key": "token_permissions", "name": "Token-Permissions", "detail": "detected GitHub workflow tokens with excessive permissions", "points": 0, "status": "missed", "details": [], "max_points": 7.5 }, { "key": "vulnerabilities", "name": "Vulnerabilities", "detail": "89 existing vulnerabilities detected", "points": 0, "status": "missed", "details": [], "max_points": 7.5 } ] }, { "key": "dependency_advisories", "band": "excellent", "name": "Dependency advisories", "note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:@akua-dev/sdk@0.8.25 runtime dependency closure — what installing the published package pulls in — 16 packages. Reachability is not analyzed.", "notes": [ { "code": "excluded_no_data", "params": { "components": [ "no_advisories_left_outstanding" ] } }, { "code": "weights_renormalized", "params": {} }, { "code": "advisories_scope_published", "params": { "package": "npm:@akua-dev/sdk@0.8.25", "assessed": 16 } }, { "code": "advisories_reachability", "params": {} } ], "value": 100, "inputs": { "source": "osv", "advisories": 0, "affected_packages": 0, "assessed_packages": 16, "unassessed_packages": 0, "affected_by_severity": "none", "direct_affected_packages": 0 }, "components": [ { "key": "direct_dependencies_free_of_known_advisories", "name": "Direct dependencies free of known advisories", "detail": "no direct dependency carries a known advisory", "points": 35, "status": "met", "details": [ { "code": "no_direct_advisories", "params": {} } ], "max_points": 35 }, { "key": "indirect_dependencies_free_of_known_advisories", "name": "Indirect dependencies free of known advisories", "detail": "no indirect dependency carries a known advisory", "points": 25, "status": "met", "details": [ { "code": "no_indirect_advisories", "params": {} } ], "max_points": 25 }, { "key": "no_advisories_left_outstanding", "name": "No advisories left outstanding", "detail": "no advisory carries a publication date", "points": 0, "status": "excluded", "details": [ { "code": "advisories_no_publication_date", "params": {} } ], "max_points": 40 } ] }, { "key": "malicious_dependencies", "band": "excellent", "name": "Malicious dependencies", "note": null, "notes": [], "value": 100, "inputs": { "source": "osv", "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored", "packages": [], "red_flag": false, "assessed_packages": 16, "malicious_packages": 0, "direct_malicious_packages": 0, "withdrawn_malicious_packages": 0, "installable_malicious_packages": 0 }, "components": [ { "key": "no_dependency_reported_as_a_malicious_package", "name": "No dependency reported as a malicious package", "detail": "no dependency is reported as a malicious package", "points": 100, "status": "met", "details": [ { "code": "no_malicious_dependencies", "params": {} } ], "max_points": 100 } ] }, { "key": "high_risk_jurisdiction_exposure", "band": "excellent", "name": "High-Risk Jurisdiction Exposure", "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.", "notes": [ { "code": "jurisdiction_evidence_limits", "params": {} } ], "value": 100, "inputs": { "meaning": "self-published location evidence; not nationality or citizenship", "red_flag": false, "exposures": [], "policy_countries": [ "Russia", "Iran", "North Korea" ], "review_only_matches": 0, "assessed_self_published_locations": 5 }, "components": [ { "key": "policy_exposure_multiplier", "name": "Policy exposure multiplier", "detail": "no confirmed policy-scope location match", "points": 100, "status": "met", "details": [ { "code": "jurisdiction_no_match", "params": {} } ], "max_points": 100 } ] } ], "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?" }, { "key": "ai_readiness", "band": "good", "name": "AI Readiness", "value": 71, "weight": 0, "metrics": [ { "key": "ai_agent_context", "band": "excellent", "name": "Agent context & guidance", "note": null, "notes": [], "value": 85, "inputs": { "has_llms_txt": false, "legible_history_share": 1, "agent_instruction_files": [ "AGENTS.md", "CLAUDE.md" ], "agent_instruction_max_bytes": 18329 }, "components": [ { "key": "agent_instructions", "name": "Agent instructions", "detail": "AGENTS.md, CLAUDE.md", "points": 45, "status": "met", "details": [ { "code": "file_list", "params": { "files": "AGENTS.md, CLAUDE.md" } } ], "max_points": 45 }, { "key": "machine_readable_docs_llms_txt", "name": "Machine-readable docs (llms.txt)", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 15 }, { "key": "legible_commit_history", "name": "Legible commit history", "detail": "100 of 100 human commits state their intent (structured subject or explanatory body)", "points": 40, "status": "met", "details": [ { "code": "legible_history", "params": { "legible": 100, "sampled": 100 } } ], "max_points": 40 } ] }, { "key": "ai_verify_loop", "band": "moderate", "name": "Verify loop (build / test / typecheck)", "note": null, "notes": [], "value": 61, "inputs": { "has_nix": false, "has_tests": true, "lockfiles": [ "Cargo.lock" ], "has_dockerfile": true, "typed_language": true, "bootstrap_files": [ ".mise.toml", "Taskfile.yml", "docs/hero-source/Taskfile.yml" ], "has_devcontainer": false, "has_linter_config": false, "typecheck_configs": [ "packages/sdk/tsconfig.json" ], "agent_commit_share": 0, "toolchain_manifests": [ "Cargo.toml", "crates/akua-cli/Cargo.toml", "crates/akua-core/Cargo.toml", "crates/akua-napi/Cargo.toml", "crates/akua-render-worker/Cargo.toml", "crates/engine-host-wasm/Cargo.toml", "crates/helm-engine-wasm/Cargo.toml", "crates/helm-engine-wasm/go-src/go.mod", "crates/kustomize-engine-wasm/Cargo.toml", "crates/kustomize-engine-wasm/go-src/go.mod", "crates/source-hash/Cargo.toml" ], "dependency_bot_commit_share": 0 }, "components": [ { "key": "one_command_bootstrap", "name": "One-command bootstrap", "detail": ".mise.toml, Taskfile.yml, docs/hero-source/Taskfile.yml", "points": 18, "status": "met", "details": [ { "code": "file_list", "params": { "files": ".mise.toml, Taskfile.yml, docs/hero-source/Taskfile.yml" } } ], "max_points": 18 }, { "key": "automated_tests", "name": "Automated tests", "detail": null, "points": 22, "status": "met", "details": [], "max_points": 22 }, { "key": "lint_format_config", "name": "Lint / format config", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 11 }, { "key": "static_type_checking", "name": "Static type checking", "detail": "packages/sdk/tsconfig.json", "points": 11, "status": "met", "details": [ { "code": "file_list", "params": { "files": "packages/sdk/tsconfig.json" } } ], "max_points": 11 }, { "key": "reproducible_environment", "name": "Reproducible environment", "detail": "Dockerfile, lockfile", "points": 10, "status": "met", "details": [ { "code": "file_list", "params": { "files": "Dockerfile, lockfile" } } ], "max_points": 10 }, { "key": "demonstrated_agent_practice", "name": "Demonstrated agent practice", "detail": "no agent-authored commits among the last 100", "points": 0, "status": "missed", "details": [ { "code": "no_agent_authored_commits", "params": { "sampled": 100 } } ], "max_points": 10 }, { "key": "automated_maintenance", "name": "Automated maintenance", "detail": "no automated dependency updates observed", "points": 0, "status": "missed", "details": [ { "code": "no_dependency_automation", "params": {} } ], "max_points": 8 }, { "key": "openssf_scorecard_pinned_dependencies", "name": "OpenSSF Scorecard: Pinned-Dependencies", "detail": "dependency not pinned by hash detected -- score normalized to 0", "points": 0, "status": "missed", "details": [], "max_points": 10 } ] }, { "key": "ai_code_legibility", "band": "excellent", "name": "Code legibility for models", "note": null, "notes": [], "value": 99, "inputs": { "primary_language": "Rust", "largest_source_bytes": 84955, "source_files_sampled": 194, "oversized_source_files": 4 }, "components": [ { "key": "type_checkable_code", "name": "Type-checkable code", "detail": "Rust (statically typed)", "points": 45, "status": "met", "details": [ { "code": "statically_typed_language", "params": { "language": "Rust" } } ], "max_points": 45 }, { "key": "manageable_file_sizes", "name": "Manageable file sizes", "detail": "4/194 source files over 60KB", "points": 53.9, "status": "partial", "details": [ { "code": "oversized_source_files", "params": { "kb": 60, "sampled": 194, "oversized": 4 } } ], "max_points": 55 } ] }, { "key": "ai_interfaces", "band": "at_risk", "name": "Machine-readable interfaces", "note": null, "notes": [], "value": 40, "inputs": { "example_dirs": [ "examples" ], "has_mcp_signal": false, "api_schema_files": [] }, "components": [ { "key": "api_schema_openapi_graphql_proto", "name": "API schema (OpenAPI/GraphQL/proto)", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 40 }, { "key": "mcp_server", "name": "MCP server", "detail": null, "points": 0, "status": "missed", "details": [], "max_points": 20 }, { "key": "runnable_examples", "name": "Runnable examples", "detail": "examples", "points": 40, "status": "met", "details": [ { "code": "file_list", "params": { "files": "examples" } } ], "max_points": 40 } ] } ], "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score." } ], "metrics_version": "1.13.0" }, "warnings": [ "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token", "Could not fetch crates package 'akua-cli' from its registry", "Could not fetch crates package 'akua-core' from its registry", "Could not fetch crates package 'akua-napi' from its registry", "Could not fetch crates package 'source-hash' from its registry", "Could not fetch crates package 'engine-host-wasm' from its registry", "Could not fetch crates package 'helm-engine-wasm' from its registry", "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository" ], "report_type": "repository", "generated_at": "2026-07-29T07:41:23.917526Z", "schema_version": "0.27.0", "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/a/akua-dev/akua.svg", "full_name": "akua-dev/akua", "license_state": "standard", "license_spdx": "Apache-2.0" }, "repoMeta": null, "notFound": false, "related": [ { "id": 7937, "full_name": "fluxcd/flux2", "url": "https://github.com/fluxcd/flux2", "description": "Open and extensible continuous delivery solution for Kubernetes. Powered by GitOps Toolkit.", "ecosystem": "go", "ecosystems": [ "go" ], "primary_language": "Go", "languages": [ "Go" ], "topics": [ "gitops-toolkit", "gitops", "continuous-delivery", "kubernetes", "kustomize", "helm" ], "license_spdx": "Apache-2.0", "license_state": "standard", "stars": 8274, "forks": 772, "watchers": 68, "monthly_downloads": null, "latest_score": 87, "latest_band": "excellent", "latest_scanned_at": "2026-07-15T16:44:56.285382Z", "has_high_risk_jurisdiction_exposure": false, "has_malicious_dependency": false, "growth_authenticity": "unverified", "abandonment_state": "unverified", "red_flags": [], "badge_url": "" }, { "id": 21013, "full_name": "Gravitational/teleport", "url": "https://github.com/Gravitational/teleport", "description": "The easiest, and most secure way to access and protect all of your infrastructure.", "ecosystem": "go", "ecosystems": [ "go", "crates", "npm" ], "primary_language": "Go", "languages": [ "Go", "TypeScript" ], "topics": [ "ssh", "go", "bastion", "teleport-binaries", "certificate", "golang", "cluster", "teleport", "firewall", "security", "jumpserver", "rbac", "audit", "pam", "kubernetes", "kubernetes-access", "firewalls", "database-access", "postgres", "rdp" ], "license_spdx": "AGPL-3.0", "license_state": "standard", "stars": 20655, "forks": 2117, "watchers": 234, "monthly_downloads": null, "latest_score": 89, "latest_band": "excellent", "latest_scanned_at": "2026-07-18T11:02:06.635913Z", "has_high_risk_jurisdiction_exposure": false, "has_malicious_dependency": false, "growth_authenticity": "unverified", "abandonment_state": "unverified", "red_flags": [], "badge_url": "" }, { "id": 16084, "full_name": "valkey-io/valkey-glide", "url": "https://github.com/valkey-io/valkey-glide", "description": "An open source Valkey client library that supports Valkey, and Redis open source 6.2, 7.0 and 7.2. Valkey GLIDE is designed for reliability, optimized performance, and high-availability, for Valkey and Redis OSS based applications. GLIDE is a multi language client library, written in Rust with programming language bindings, such as Java and Python", "ecosystem": "npm", "ecosystems": [ "npm", "go", "crates", "maven", "pypi" ], "primary_language": "Java", "languages": [ "Java", "Python", "Rust", "Go", "TypeScript" ], "topics": [ "cache", "fault-tolerance", "golang", "java", "javascript", "kotlin", "nodejs", "open-source", "performance", "python", "reliability", "rust", "typescript", "valkey", "valkey-client", "database", "key-value", "csharp", "pubsub", "scala", "redis", "client", "driver", "napi", "cross-platform", "cluster", "standalone", "high-availability", "fault-tolerant", "distributed", "scalable", "resilient", "valkey-glide" ], "license_spdx": "Apache-2.0", "license_state": "standard", "stars": 767, "forks": 168, "watchers": 12, "monthly_downloads": 1695966, "latest_score": 88, "latest_band": "excellent", "latest_scanned_at": "2026-07-24T13:54:33.733944Z", "has_high_risk_jurisdiction_exposure": false, "has_malicious_dependency": false, "growth_authenticity": "unverified", "abandonment_state": "maintained", "red_flags": [], "badge_url": "" }, { "id": 39573, "full_name": "authelia/authelia", "url": "https://github.com/authelia/authelia", "description": "The Single Sign-On Multi-Factor portal for web apps, now OpenID Certified™", "ecosystem": "go", "ecosystems": [ "go", "npm" ], "primary_language": "Go", "languages": [ "Go", "TypeScript" ], "topics": [ "totp", "ldap", "sso-authentication", "yubikey", "two-factor-authentication", "docker", "kubernetes", "sso", "multifactor", "push-notifications", "mfa", "two-factor", "authentication", "security", "golang", "2fa", "oauth2", "openid-connect", "webauthn", "passkeys" ], "license_spdx": "Apache-2.0", "license_state": "standard", "stars": 28362, "forks": 1447, "watchers": 164, "monthly_downloads": null, "latest_score": 91, "latest_band": "excellent", "latest_scanned_at": "2026-07-25T04:42:51.544923Z", "has_high_risk_jurisdiction_exposure": false, "has_malicious_dependency": false, "growth_authenticity": "unverified", "abandonment_state": "maintained", "red_flags": [], "badge_url": "" }, { "id": 23997, "full_name": "dynemo-ai/dynemo", "url": "https://github.com/dynemo-ai/dynemo", "description": "A Datacenter Scale Distributed Inference Serving Framework", "ecosystem": "crates", "ecosystems": [ "crates", "pypi" ], "primary_language": "Rust", "languages": [ "Rust", "Python", "Go" ], "topics": [ "diffusion", "disaggregated-serving", "kubernetes", "llm-inference", "omni", "routing-engine", "rust", "sglang", "tensorrt-llm", "vllm" ], "license_spdx": null, "license_state": "custom", "stars": 7526, "forks": 1348, "watchers": 72, "monthly_downloads": null, "latest_score": 89, "latest_band": "excellent", "latest_scanned_at": "2026-07-19T01:17:30.058798Z", "has_high_risk_jurisdiction_exposure": false, "has_malicious_dependency": false, "growth_authenticity": "unverified", "abandonment_state": "unverified", "red_flags": [], "badge_url": "" }, { "id": 8508, "full_name": "marapongo/mu", "url": "https://github.com/marapongo/mu", "description": "Pulumi - Infrastructure as Code in any programming language 🚀", "ecosystem": "go", "ecosystems": [ "go", "npm", "pypi" ], "primary_language": "Go", "languages": [ "Go" ], "topics": [ "infrastructure-as-code", "serverless", "containers", "aws", "azure", "gcp", "kubernetes", "cloud", "cloud-computing", "iac", "csharp", "typescript", "javascript", "golang", "go", "dotnet", "fsharp", "python" ], "license_spdx": "Apache-2.0", "license_state": "standard", "stars": 25446, "forks": 1400, "watchers": 190, "monthly_downloads": null, "latest_score": 88, "latest_band": "excellent", "latest_scanned_at": "2026-07-16T00:03:47.348908Z", "has_high_risk_jurisdiction_exposure": false, "has_malicious_dependency": false, "growth_authenticity": "unverified", "abandonment_state": "unverified", "red_flags": [], "badge_url": "" } ] } }
公开记录
软件健康报告模式 0.27.0 · 指标 1.13.0 · 2026-07-29 07:41 UTC

akua-dev / akua

Replace bureaucratic YAML mass with high-energy, deterministic contracts. The Deno of Infra

Rust · HTMLApache-2.0★ 5 星标⑂ 0 复刻始于 2026年4月在 GitHub 上查看 ↗
#devops#helm#infrastructure-as-code#kcl#kubernetes#kustomize#rust#security#webassembly#agentic-infra#aumakua

akua-dev/akua 的健康指数为 100 分中的 63 分，处于「中等」区间。 其得分最高的类别是Vitality（80/100），最低的是Sustainability & Governance（49/100）。 最近一次更新在 4 天前。 近期的大部分工作由 1 位贡献者完成。

63
总分 / 100
中等

软件健康指数

指标归入加权类别，统一采用 1–100 量表。总体分先取类别加权平均；当公开证据触发高风险司法辖区政策时，评级会按政策调整，并设置 49（有风险）的上限。AI 就绪度不计入总体分。

63
优秀85-100堪称典范；基本满足所有检验标准
良好70-84健康；仅有轻微不足
中等50-69可接受，但存在明显不足；建议进行审查
存在风险30-49存在重大薄弱环节；采用时应保持审慎
危急1-29问题严重（项目被弃置、仅有单一维护者、缺乏基本工程规范）
活力社区与采用可持续性与治理工程质量安全AI 就绪度

评分画像

每条轴代表一个类别。形状比平均值更重要——健康的对象会填满整个图形，而“一峰一谷”式画像意味着某一维度的优势正掩盖另一维度的风险。

所有权

Akua - Build autonomous companies 组织
11 关注者15 个公开仓库始于 2024年6月

该仓库由组织支持——共同承担、可问责的托管责任，可延续于任何单一维护者之后。

软件包生态系统

注册表软件包版本月下载量版本数最近发布标签
npm@akua-dev/sdk0.8.252,005267 天前—
npm@akua-dev/native0.8.252,109267 天前akuanapi-rsnapinode-addonhelmkustomizekcl

按类别列示的指标

活力

项目是否仍有生命——是否仍在编写代码，是否仍在发布版本？

80良好 · 占总体的 22%

开发活跃度

73良好
评分方式
36/36推送新近度 — 最近一次推送于 4 天前
9/36提交节奏 — 52 周中有 13 周有提交
18/18提交量 — 最近一年 523 次提交
10/10OpenSSF Scorecard：Maintained — 30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
所用输入
commits_last_year523
human_commit_share1
days_since_last_push4
active_weeks_last_year13

发布纪律

90优秀
评分方式
27/27有发布版本 — 已发布 26 个发布版本
36/36发布时效 — 最近一次发布版本于 17 天前
27/27发布节奏 — 约每 4.8 天发布一次
0/10OpenSSF Scorecard：Signed-Releases — Project has not signed or included provenance with any releases.
所用输入
releases_count26
latest_release_tagv0.8.25
releases_from_tags否
days_since_latest_release17
mean_days_between_releases4.8

社区与采用

项目是否拥有用户、下载量与关注度，并具备欢迎贡献者参与的配置？

49存在风险 · 占总体的 18%

流行度与采用

10危急
评分方式
9.8/60星标 — 5 个星标
0/25复刻 — 0 个复刻
0/15关注者 — 0 位关注者
所用输入
forks0
stars5
watchers0
growth_stateunverified
growth_factor_pct100
growth_unverified_reasonno_history

社区健康

85优秀
评分方式
22.5/22.5README
22.5/22.5许可证 — 可识别的许可证（Apache-2.0）
18/18CONTRIBUTING 指南
13.5/13.5行为准则
0/7.2议题模板
0/6.3PR 模板
所用输入
has_readme是
has_license是
has_contributing是
has_issue_template否
has_code_of_conduct是
has_pull_request_template否

生态采用（下载量）

60中等
评分方式
48.2/80月度下载量 — npm 合计每月 4,114 次下载
0/20注册表被依赖数 — 该生态系统不报告此项
所用输入
packages@akua-dev/sdk, @akua-dev/native
dependents—
ecosystemsnpm
total_downloads—
monthly_downloads4,114
已排除计分（无数据或不适用）：注册表被依赖数。 其余权重已重新归一化。

可持续性与治理

项目能否在其成员之外延续——巴士系数、响应能力、由谁支持，以及软件包的维护状况？

49存在风险 · 占总体的 24%

维护者韧性（巴士系数）

22危急
评分方式
9/54巴士系数 — 1 位贡献者贡献了半数提交
0/22.5提交分布 — 头号贡献者编写了 100% 的提交
2.7/13.5贡献者广度 — 2 位贡献者
10/10OpenSSF Scorecard：Contributors — project has 4 contributing companies or organizations
所用输入
bus_factor1
contributors_sampled2
top_contributor_share0.998

议题与 PR 响应能力

39存在风险
评分方式
10/46.8议题解决 — 21% 的议题已关闭
28.8/38.3PR 接受 — 已裁定的 PR 中 46/61 已合并
0/15OpenSSF Scorecard：Code-Review — Found 1/29 approved changesets -- score normalized to 0
所用输入
merged_prs46
open_issues11
closed_issues3
issue_closed_ratio0.214
closed_unmerged_prs15

所有权与托管责任

51中等
评分方式
30/30所有权背书 — 组织持有
0/20已验证域名
7.8/25所有者影响力 — akua-dev 有 11 位关注者
13/25既往记录 — 15 个公开仓库，账户约 2 年
所用输入
followers11
owner_typeOrganization
is_verified—
owner_loginakua-dev
public_repos15
account_age_days769

软件包维护

100优秀
评分方式
25/25已发布且可解析 — npm 上有 2 个软件包
35/35发布时效 — 最近一次发布于 7 天前
20/20版本历史 — 26 个已发布版本
20/20未被弃用 — 活跃，未被弃用或撤回
所用输入
packages@akua-dev/sdk, @akua-dev/native
ecosystemsnpm
any_deprecated否
min_days_since_publish7

工程质量

基础的工程与文档实践是否到位？

80良好 · 占总体的 20%

工程实践

66中等
评分方式
24/24CI 工作流 — 4 个工作流
24/24存在测试
0/16Linter 配置
0/9.6Pre-commit 钩子
0/6.4.editorconfig
18/20OpenSSF Scorecard：CI-Tests — 9 out of 10 merged PRs checked by a CI test -- score normalized to 9
所用输入
has_ci是
has_tests是
has_editorconfig否
has_linter_config否
has_precommit_config否

文档

100优秀
评分方式
30/30README
25/25文档目录
15/15文档 / 主页站点 — https://cli.akua.dev
10/10仓库描述
10/10主题标签 — 11 个主题标签
10/10Wiki
所用输入
topicsdevops, helm, infrastructure-as-code, kcl, kubernetes, kustomize, rust, security, webassembly, agentic-infra, aumakua
has_wiki是
homepagehttps://cli.akua.dev
has_readme是
has_docs_dir是
has_description是

安全

可见的安全与供应链实践是否稳固，且不存在未解决的高风险司法辖区暴露？

58中等 · 占总体的 16%

安全态势

47存在风险
评分方式
7.5/7.5Binary-Artifacts — no binaries found in the repo
0/7.5Branch-Protection — branch protection not enabled on development/release branches
2.2/2.5CI-Tests — 9 out of 10 merged PRs checked by a CI test -- score normalized to 9
0/2.5CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected
0/7.5Code-Review — Found 1/29 approved changesets -- score normalized to 0
2.5/2.5Contributors — project has 4 contributing companies or organizations
10/10Dangerous-Workflow — no dangerous workflow patterns detected
7.5/7.5Dependency-Update-Tool — update tool detected
0/5Fuzzing — project is not fuzzed
2.5/2.5许可证 — license file detected
7.5/7.5Maintained — 30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
5/5Packaging — packaging workflow detected
0/5Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0
0/5SAST — SAST tool is not run on all commits -- score normalized to 0
5/5Security-Policy — security policy file detected
0/7.5Signed-Releases — Project has not signed or included provenance with any releases.
0/7.5Token-Permissions — detected GitHub workflow tokens with excessive permissions
0/7.5Vulnerabilities — 89 existing vulnerabilities detected
所用输入
sourceopenssf_scorecard
checks_evaluated18
scorecard_versionv5.5.0
checks_inconclusive0
scorecard_aggregate4.7

依赖安全公告

100优秀
评分方式
35/35直接依赖不含已知公告 — 没有直接依赖携带已知公告
25/25间接依赖不含已知公告 — 没有间接依赖携带已知公告
0/40没有长期未处理的公告 — 没有公告带有发布日期
所用输入
sourceosv
advisories0
affected_packages0
assessed_packages16
unassessed_packages0
affected_by_severitynone
direct_affected_packages0
已排除计分（无数据或不适用）：没有长期未处理的公告。 其余权重已重新归一化。 比对的是 npm:@akua-dev/sdk@0.8.25 的运行时依赖闭包——安装已发布的软件包时真正被拉取进来的内容——共 16 个软件包。 未对可达性进行分析。

AI 就绪度

该仓库在多大程度上具备与 AI 编码代理协同开发与维护的条件？这是一枚独立的实验性徽章——权重为 0.0，因此单独呈现，不影响总体健康评分。

71良好 · 占总体的 0%

AI 代理上下文与指引

85优秀
评分方式
45/45代理指令 — AGENTS.md, CLAUDE.md
0/15机器可读文档（llms.txt）
40/40可读的提交历史 — 100 次人类提交中有 100 次说明了意图（结构化标题或解释性正文）
所用输入
has_llms_txt否
legible_history_share1
agent_instruction_filesAGENTS.md, CLAUDE.md
agent_instruction_max_bytes18,329

验证循环（构建 / 测试 / 类型检查）

61中等
评分方式
18/18一条命令的引导启动 — .mise.toml, Taskfile.yml, docs/hero-source/Taskfile.yml
22/22自动化测试
0/11Lint / 格式化配置
11/11静态类型检查 — packages/sdk/tsconfig.json
10/10可复现环境 — Dockerfile, lockfile
0/10已体现的代理实践 — 最近 100 次提交中没有代理编写的提交
0/8自动化维护 — 未观察到自动依赖更新
0/10OpenSSF Scorecard：Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0
所用输入
has_nix否
has_tests是
lockfilesCargo.lock
has_dockerfile是
typed_language是
bootstrap_files.mise.toml, Taskfile.yml, docs/hero-source/Taskfile.yml
has_devcontainer否
has_linter_config否
typecheck_configspackages/sdk/tsconfig.json
agent_commit_share0
toolchain_manifestsCargo.toml, crates/akua-cli/Cargo.toml, crates/akua-core/Cargo.toml, crates/akua-napi/Cargo.toml, crates/akua-render-worker/Cargo.toml, crates/engine-host-wasm/Cargo.toml, crates/helm-engine-wasm/Cargo.toml, crates/helm-engine-wasm/go-src/go.mod, crates/kustomize-engine-wasm/Cargo.toml, crates/kustomize-engine-wasm/go-src/go.mod, crates/source-hash/Cargo.toml
dependency_bot_commit_share0

面向模型的代码可读性

99优秀
评分方式
45/45可类型检查的代码 — Rust（静态类型）
53.9/55可控的文件大小 — 采样的 194 个源文件中有 4 个超过 60KB
所用输入
primary_languageRust
largest_source_bytes84,955
source_files_sampled194
oversized_source_files4

机器可读接口

40存在风险
评分方式
0/40API 模式（OpenAPI/GraphQL/proto）
0/20MCP 服务器
40/40可运行示例 — examples
所用输入
example_dirsexamples
has_mcp_signal否
api_schema_files—

关键数据

5GitHub 星标
2贡献者
523最近 12 个月提交数
4距最近推送天数
26发布版本数
1巴士系数（bus factor）
11开放议题
crates.io, npm软件包生态系统数

数据采集警告

  • Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
  • Could not fetch crates package 'akua-cli' from its registry
  • Could not fetch crates package 'akua-core' from its registry
  • Could not fetch crates package 'akua-napi' from its registry
  • Could not fetch crates package 'source-hash' from its registry
  • Could not fetch crates package 'engine-host-wasm' from its registry
  • Could not fetch crates package 'helm-engine-wasm' from its registry
  • GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

更多细节

OpenSSF Scorecard 4.7 / 10
4.7综合

来自开源项目 OpenSSF Scorecard 的独立、工具无关的安全评估。每项检查奖励的是安全实践本身，而非特定供应商的工具。Scorecard 无法判定的检查项标记为 不适用，并从安全评分中剔除（绝不按零分计）。Scorecard v5.5.0 · 2026-07-29 07:41 UTC

10Binary-Artifactsno binaries found in the repo
0Branch-Protectionbranch protection not enabled on development/release branches
9CI-Tests9 out of 10 merged PRs checked by a CI test -- score normalized to 9
0CII-Best-Practicesno effort to earn an OpenSSF best practices badge detected
0Code-ReviewFound 1/29 approved changesets -- score normalized to 0
10Contributorsproject has 4 contributing companies or organizations
10Dangerous-Workflowno dangerous workflow patterns detected
10Dependency-Update-Toolupdate tool detected
0Fuzzingproject is not fuzzed
10Licenselicense file detected
10Maintained30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
10Packagingpackaging workflow detected
0Pinned-Dependenciesdependency not pinned by hash detected -- score normalized to 0
0SASTSAST tool is not run on all commits -- score normalized to 0
10Security-Policysecurity policy file detected
0Signed-ReleasesProject has not signed or included provenance with any releases.
0Token-Permissionsdetected GitHub workflow tokens with excessive permissions
0Vulnerabilities89 existing vulnerabilities detected
直接依赖 69
注册表软件包版本约束清单文件
crates.ioakua-core—crates/akua-cli/Cargo.toml
crates.ioclap—crates/akua-cli/Cargo.toml
crates.ioserde—crates/akua-cli/Cargo.toml
crates.ioserde_json—crates/akua-cli/Cargo.toml
crates.ioserde_yaml—crates/akua-cli/Cargo.toml
crates.iothiserror—crates/akua-cli/Cargo.toml
crates.iotoml—crates/akua-cli/Cargo.toml
crates.ioreqwest—crates/akua-cli/Cargo.toml
crates.ioctrlc3crates/akua-cli/Cargo.toml
crates.iots-rs12crates/akua-cli/Cargo.toml
crates.ioschemars1crates/akua-cli/Cargo.toml
crates.iowasmtime43crates/akua-cli/Cargo.toml
crates.iowasmtime-wasi43crates/akua-cli/Cargo.toml
crates.ioengine-host-wasm—crates/akua-cli/Cargo.toml
crates.iotracing—crates/akua-cli/Cargo.toml
crates.iotracing-subscriber—crates/akua-cli/Cargo.toml
crates.iotracing-opentelemetry—crates/akua-cli/Cargo.toml
crates.ioopentelemetry—crates/akua-cli/Cargo.toml
crates.ioopentelemetry_sdk—crates/akua-cli/Cargo.toml
crates.ioopentelemetry-otlp—crates/akua-cli/Cargo.toml
crates.iotokio1crates/akua-cli/Cargo.toml
crates.ioserde—crates/akua-core/Cargo.toml
crates.ioserde_json—crates/akua-core/Cargo.toml
crates.ioserde_yaml—crates/akua-core/Cargo.toml
crates.iotoml—crates/akua-core/Cargo.toml
crates.iothiserror—crates/akua-core/Cargo.toml
crates.iobase640.22crates/akua-core/Cargo.toml
crates.iokcl-lang—crates/akua-core/Cargo.toml
crates.iosha20.10crates/akua-core/Cargo.toml
crates.iotempfile3crates/akua-core/Cargo.toml
crates.iots-rs12crates/akua-core/Cargo.toml
crates.ioschemars1crates/akua-core/Cargo.toml
crates.iosemver1crates/akua-core/Cargo.toml
crates.ioakua-cli—crates/akua-napi/Cargo.toml
crates.ioakua-core—crates/akua-napi/Cargo.toml
crates.ionapi3crates/akua-napi/Cargo.toml
crates.ionapi-derive3crates/akua-napi/Cargo.toml
crates.ioserde—crates/akua-napi/Cargo.toml
crates.ioserde_json—crates/akua-napi/Cargo.toml
crates.ioserde_yaml—crates/akua-napi/Cargo.toml
npm@akua-dev/native-engines0.8.8crates/akua-napi/package.json
crates.ioakua-core—crates/akua-render-worker/Cargo.toml
crates.ioserde—crates/akua-render-worker/Cargo.toml
crates.ioserde_json—crates/akua-render-worker/Cargo.toml
crates.ioserde_yaml—crates/akua-render-worker/Cargo.toml
crates.iotracing—crates/akua-render-worker/Cargo.toml
crates.iotracing-subscriber0.3crates/akua-render-worker/Cargo.toml
crates.iowasmtime43crates/engine-host-wasm/Cargo.toml
crates.iowasmtime-wasi43crates/engine-host-wasm/Cargo.toml
crates.iothiserror—crates/engine-host-wasm/Cargo.toml
crates.ioengine-host-wasm—crates/helm-engine-wasm/Cargo.toml
crates.ioserde—crates/helm-engine-wasm/Cargo.toml
crates.ioserde_json—crates/helm-engine-wasm/Cargo.toml
crates.iobase640.22crates/helm-engine-wasm/Cargo.toml
crates.iothiserror—crates/helm-engine-wasm/Cargo.toml
crates.ioflate21crates/helm-engine-wasm/Cargo.toml
crates.iotar0.4crates/helm-engine-wasm/Cargo.toml
crates.ioengine-host-wasm—crates/kustomize-engine-wasm/Cargo.toml
crates.ioserde—crates/kustomize-engine-wasm/Cargo.toml
crates.ioserde_json—crates/kustomize-engine-wasm/Cargo.toml
crates.iobase640.22crates/kustomize-engine-wasm/Cargo.toml
crates.iothiserror—crates/kustomize-engine-wasm/Cargo.toml
crates.ioflate21crates/kustomize-engine-wasm/Cargo.toml
crates.iotar0.4crates/kustomize-engine-wasm/Cargo.toml
crates.iosha20.10crates/source-hash/Cargo.toml
npm@akua-dev/native0.8.8packages/sdk/package.json
npm@standard-schema/spec^1.1.0packages/sdk/package.json
npmajv^8.18.0packages/sdk/package.json
npmyaml^2.8.3packages/sdk/package.json
全部依赖 未采集

本报告未能采集到解析后的依赖集合：GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

依赖安全公告 0

安装 npm:@akua-dev/sdk@0.8.25 会引入 16 个包（直接与传递）：其中 0 个存在已知公告，0 个为直接依赖。

没有已知公告影响已评估的依赖。

公告表示依赖图中记录的版本落入某条公告的受影响范围。可达性未经分析，且依赖图包含开发与测试的版本固定——某项发现可能只涉及工具链而非交付的软件。

原始 JSON 报告 机器可读
{
  "data": {
    "repo": {
      "topics": [
        "devops",
        "helm",
        "infrastructure-as-code",
        "kcl",
        "kubernetes",
        "kustomize",
        "rust",
        "security",
        "webassembly",
        "agentic-infra",
        "aumakua"
      ],
      "is_fork": false,
      "size_kb": 22145,
      "has_wiki": true,
      "homepage": "https://cli.akua.dev",
      "languages": {
        "Go": 10777,
        "KCL": 5485,
        "HTML": 1658098,
        "Rust": 1744189,
        "Shell": 28709,
        "Dockerfile": 829,
        "JavaScript": 29217,
        "PowerShell": 4421,
        "TypeScript": 182905
      },
      "pushed_at": "2026-07-24T12:49:32Z",
      "created_at": "2026-04-17T10:49:09Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-26T16:28:01Z",
      "description": "Replace bureaucratic YAML mass with high-energy, deterministic contracts. The Deno of Infra",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Rust",
      "significant_languages": [
        "Rust",
        "HTML"
      ]
    },
    "owner": {
      "blog": "https://akua.dev",
      "name": "Akua - Build autonomous companies ",
      "type": "Organization",
      "login": "akua-dev",
      "company": null,
      "location": "Germany",
      "followers": 11,
      "avatar_url": "https://avatars.githubusercontent.com/u/173261869?v=4",
      "created_at": "2024-06-19T11:06:33Z",
      "is_verified": null,
      "public_repos": 15,
      "account_age_days": 769
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.8.25",
          "kind": "patch",
          "published_at": "2026-07-11T23:50:28Z"
        },
        {
          "tag": "v0.8.24",
          "kind": "patch",
          "published_at": "2026-07-07T20:08:53Z"
        },
        {
          "tag": "v0.8.23",
          "kind": "patch",
          "published_at": "2026-06-23T12:14:59Z"
        },
        {
          "tag": "v0.8.22",
          "kind": "patch",
          "published_at": "2026-06-18T15:35:19Z"
        },
        {
          "tag": "v0.8.21",
          "kind": "patch",
          "published_at": "2026-06-12T18:19:39Z"
        },
        {
          "tag": "v0.8.20",
          "kind": "patch",
          "published_at": "2026-06-09T07:05:39Z"
        },
        {
          "tag": "v0.8.19",
          "kind": "patch",
          "published_at": "2026-06-01T08:55:56Z"
        },
        {
          "tag": "v0.8.18",
          "kind": "patch",
          "published_at": "2026-05-29T19:31:15Z"
        },
        {
          "tag": "v0.8.17",
          "kind": "patch",
          "published_at": "2026-05-29T17:37:06Z"
        },
        {
          "tag": "v0.8.16",
          "kind": "patch",
          "published_at": "2026-05-29T15:30:50Z"
        },
        {
          "tag": "v0.8.15",
          "kind": "patch",
          "published_at": "2026-05-29T14:22:03Z"
        },
        {
          "tag": "v0.8.14",
          "kind": "patch",
          "published_at": "2026-05-29T12:39:28Z"
        },
        {
          "tag": "v0.8.13",
          "kind": "patch",
          "published_at": "2026-05-20T19:44:51Z"
        },
        {
          "tag": "v0.8.11",
          "kind": "patch",
          "published_at": "2026-05-19T18:18:33Z"
        },
        {
          "tag": "v0.8.10",
          "kind": "patch",
          "published_at": "2026-05-16T15:06:57Z"
        },
        {
          "tag": "v0.8.8",
          "kind": "patch",
          "published_at": "2026-05-07T20:20:19Z"
        },
        {
          "tag": "v0.8.7",
          "kind": "patch",
          "published_at": "2026-05-07T13:33:15Z"
        },
        {
          "tag": "akua-v0.8.6",
          "kind": "other",
          "published_at": "2026-05-06T12:47:59Z"
        },
        {
          "tag": "akua-v0.8.5",
          "kind": "other",
          "published_at": "2026-05-04T22:42:25Z"
        },
        {
          "tag": "akua-v0.8.4",
          "kind": "other",
          "published_at": "2026-05-04T21:47:55Z"
        },
        {
          "tag": "akua-v0.8.3",
          "kind": "other",
          "published_at": "2026-04-29T17:45:12Z"
        },
        {
          "tag": "akua-v0.8.1",
          "kind": "other",
          "published_at": "2026-04-29T14:50:30Z"
        },
        {
          "tag": "akua-v0.8.0",
          "kind": "other",
          "published_at": "2026-04-29T12:12:18Z"
        },
        {
          "tag": "akua-v0.7.0",
          "kind": "other",
          "published_at": "2026-04-28T22:43:00Z"
        },
        {
          "tag": "akua-v0.6.0",
          "kind": "other",
          "published_at": "2026-04-28T09:04:03Z"
        },
        {
          "tag": "akua-v0.1.0",
          "kind": "other",
          "published_at": "2026-04-18T19:28:49Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "1b87537aaa2f3b1aa8f6bf5d8d41313511aee6ef",
          "body": "* fix(ci): stop napi prePublish from writing to the immutable Release\n\nThe `native-publish` job's `@akua-dev/native` publish runs its\n`prepublishOnly` hook (`napi prepublish`), which — beyond injecting the\nper-platform `optionalDependencies` and copying addons — attempted to\nupload the per-platform \n[…]\neak\ninstallation). Add a guard comment in the workflow and an AGENTS.md note\nso the hook is never \"fixed\" back to `--ignore-scripts`.\n\n* no-mistakes(document): Document native prepublish release guard",
          "is_bot": false,
          "headline": "fix(napi): prevent prepublish uploads to immutable releases (#83)",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-07-21T10:30:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "275b0d38dfaa5517e068f604660e7d8ac9356462",
          "body": "* fix(release): harden immutable tag recovery\n\n* no-mistakes(review): Bind release publication to immutable source and workflow SHAs\n\n* no-mistakes(document): Refresh release documentation and lint guards\n\n* fix(release): remove Akua core Homebrew ownership\n\n* no-mistakes(review): Harden SHA-bound r\n[…]\ncredential, or provider action was dispatched or used.\n\n* no-mistakes(review): Correct release artifact handoff documentation\n\n* no-mistakes(document): Document immutable assets and clean release lint",
          "is_bot": false,
          "headline": "fix: harden immutable release recovery (#69)",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-07-21T07:08:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "25ee8f73abccf1d4a8bc158ce6a76c518d376e5d",
          "body": "* fix(core): use canonical CLI error documentation URLs\n\n* test(site): keep error docs deployment triggers aligned\n\n* no-mistakes(review): fix CLI contract inputs error documentation route\n\n* no-mistakes(document): Refresh authoritative CLI and generated documentation",
          "is_bot": false,
          "headline": "fix(cli): use canonical error documentation URLs (#70)",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-07-13T07:12:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6452eb662445d2ad7c108128f93b9c55138729bb",
          "body": "…uth flows (#68)\n\n* fix(git): preserve configured CA with TLS verification\n\n* no-mistakes(review): Preserve Git CA without leaking ambient HTTP configuration\n\n* no-mistakes(document): Document Git HTTPS CA preservation\n\n* no-mistakes: apply CI fixes\n\n* no-mistakes: apply CI fixes\n\n* no-mistakes: apply CI fixes\n\n* no-mistakes: apply CI fixes\n\n* no-mistakes: apply CI fixes\n\n* no-mistakes: apply CI fixes",
          "is_bot": false,
          "headline": "fix(core): preserve configured Git HTTPS CA bundles during vendored a…",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-07-11T21:02:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c40aef40e911067340ed582071f56838a87bc402",
          "body": "Rationale: Package dependency stubs are compiled in the consumer render context. Keeping body-only imports and Akua UI decorators in those stubs can force consumers to resolve upstream render dependencies such as k8s, or fail on render-only decorators, before the real child package render runs. Code\n[…]\nll package_k module tests require helm-engine.wasm in this fresh worktree; package_k::tests::typed_chart_values_reach_helm_template_wrapper previously failed with the documented missing-artifact path.",
          "is_bot": false,
          "headline": "fix(core): keep package stubs schema-only (#66)",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-07-07T19:30:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d2ea88780195f315091eb4de46209e60b2d19740",
          "body": "Rationale: Move the SDK OCI inspection entry from Unreleased into the 0.8.23 section before tagging the release that CNAP will consume.\\n\\nRisk: Docs-only release metadata change; no runtime code paths changed.\\n\\nTested:\\n- mise exec -- task release:validate\\n- mise exec -- task sdk:check\\n- mise e\n[…]\nlease:check-workflows\\n\\nNot-tested: Full GitHub release workflow dry-run was not manually dispatched; release.yml already passed on main for the code commit and local release packaging checks passed.",
          "is_bot": false,
          "headline": "docs: prepare 0.8.23 release notes [skip ci]",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-23T11:39:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "21884a22e35ea3fcb9fb6eca3ccaf5485e49707f",
          "body": "Adds a server-callable SDK/NAPI path for inspecting published Akua OCI package artifacts without shelling out, extracting to disk, or reading ambient Docker/Akua credential files.\n\nRationale:\nExpose a stable SDK-first OCI package inspection contract before CNAP expands package import/create-version \n[…]\n.test.ts\n- cargo test -p akua-cli inspect_oci_package -- --nocapture\n- GitHub CI: Rust (fmt + clippy + test), SDK (bun + node WASI)\n\nNot-tested:\n- SDK/native package publish was intentionally not run.",
          "is_bot": false,
          "headline": "feat(sdk): inspect published OCI packages",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-23T10:19:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dd71215fd6773a4db24ce98e8a4a53baa017ed51",
          "body": "fix: export KCL boolean defaults as JSON booleans",
          "is_bot": false,
          "headline": "Merge pull request #63 from cnap-tech/codex/export-boolean-defaults",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-18T14:10:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5995dfda4222a4c2905ad1dd64ffc151ba6bf057",
          "body": "Rationale: Codezero package input schemas use KCL boolean defaults for UI controls, and the exported JSON Schema must expose those defaults as JSON booleans rather than strings.\n\nRejected: Treating every KCL default as JSON text first leaves True/False as strings because KCL boolean literals are cap\n[…]\n/input.schema.json\\n- jq '{runtime_enabled: .properties.runtime_enabled.default, velorum_enabled: .properties.velorum_enabled.default}' /tmp/codezero-fixed-schema/input.schema.json\\n- git diff --check",
          "is_bot": false,
          "headline": "fix: export KCL boolean defaults as JSON booleans",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-18T13:38:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9f3ac47dd95a3044057b4b6ddf9a9226e1d61bb3",
          "body": "Rationale: release validation uses a live Helm repository example whose manifest and docs promise that a bare chart version is an exact pin. The resolver was passing bare versions directly to semver::VersionReq, which widened them to caret ranges and let newer upstream charts move the lock under the\n[…]\nching the public lockfile contract.\n\nTested: mise exec -- cargo test -p akua-core --lib --features helm-fetch helm_repo_fetcher::tests\n\nTested: mise exec -- cargo fmt --check\n\nTested: git diff --check",
          "is_bot": false,
          "headline": "fix(helm): treat bare repo versions as exact pins",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T17:31:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2d0ce8eaed976eef1d1192ad3a38c8d5f7cef3ca",
          "body": "Rationale: release validation hit a Bun install race because sdk:test ran sdk:install in parallel with native:install through native:build. Keeping sdk:install as a command preserves package availability before bun test without concurrent Bun workspace installs.\n\nRejected: leaving sdk:install as a d\n[…]\n release-gate failure.\n\nRisk: sdk:test may be slightly slower; behavior is otherwise unchanged.\n\nTested: mise exec -- task sdk:test; mise exec -- task --dry sdk:test; git diff --check -- Taskfile.yml.",
          "is_bot": false,
          "headline": "fix(task): serialize sdk test bun installs",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T17:02:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d38a8ab15c7daf4d993b03e83895b2b90b7c7fc3",
          "body": "Rationale: task ci runs clippy with -D warnings before release, and clippy rejects the explicit lifetime on resolve_required_token as needless.\n\nRisk: signature-only lifetime elision; Rust infers the same borrow from the only borrowed input.\n\nTested: cargo fmt --check; cargo test -p akua-cli api_config; cargo clippy -p akua-cli --all-targets -- -D warnings.\n\nNot-tested: full task ci after this commit; running next.",
          "is_bot": false,
          "headline": "fix(cli): elide hosted API token lifetime",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T16:41:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "adb9970c370e7b4ff46c1e30e867e5fc7fdf7820",
          "body": null,
          "is_bot": false,
          "headline": "docs: prepare 0.8.21 release notes [skip ci]",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T16:36:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3f9d064e2cc42e275f57a61fd221a35a66ff80fe",
          "body": "Rationale: publish public-safe CLI docs for akua api/api spec and record the OSS guardrail that local package workflows remain cloud-independent.\n\nRejected: no CodeZero production proof, secret/deploy notes, or internal cloud launch details in OSS docs.\n\nRisk: docs-only plus AGENTS guardrail; no run\n[…]\npackage examples/01-hello-webapp/package.k --format=openapi --json; cargo fmt --check; git diff --check -- AGENTS.md docs/cli.md; git diff --cached --check.\n\nNot-tested: full task ci / task preflight.",
          "is_bot": false,
          "headline": "docs: document hosted API bridge [skip ci]",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T12:53:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3916a26e0a089d764c87c52da35485606d9c8675",
          "body": "Rationale: complete the first bridge convenience command by routing akua api spec through the same hosted API request machinery as version-relative paths.\n\nRejected: no local filtering for partner, admin, or internal OpenAPI audiences; those remain unsupported until the platform serves authorized au\n[…]\n only.\n\nTested: cargo test -p akua-cli api_spec; cargo test -p akua-cli api; cargo fmt --check; git diff --check; git diff --cached --check.\n\nNot-tested: full task ci and real api.akua.dev spec fetch.",
          "is_bot": false,
          "headline": "feat(cli): fetch hosted API spec",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T12:44:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e1bd3d6e71b599fe3db85c3a6f2f3352b914c7b6",
          "body": "Rationale: complete the first executable akua api bridge slice by sending planned requests to the configured API base URL and mapping platform error envelopes to the CLI contract.\n\nRejected: no api spec implementation, hosted profile/login storage, or SDK binding in this slice; api spec remains the \n[…]\nkua-cli api; cargo fmt --check; git diff --check; git diff --cached --check.\n\nNot-tested: full task ci and real api.akua.dev calls; integration coverage uses httpmock to avoid production dependencies.",
          "is_bot": false,
          "headline": "feat(cli): execute hosted API requests",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T12:36:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ab2bfa8105f4a04638dcd479a12855410990a192",
          "body": "Rationale: add the first request-construction layer for the single akua CLI hosted API bridge before wiring network execution.\n\nRejected: no HTTP execution, no stored hosted login/profile state, and no NAPI or TypeScript SDK binding in this slice; the bridge remains CLI-only until the API execution \n[…]\n-token test-token; cargo run -q -p akua-cli -- api /workspaces --token test-token.\n\nNot-tested: full task ci and hosted API HTTP execution; execution is intentionally deferred to the next bridge task.",
          "is_bot": false,
          "headline": "feat(cli): plan hosted API requests",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T12:16:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "950c842a549c96309b6b5270e9c1ef65663c8c78",
          "body": "Rationale: establish token, base URL, workspace context, and hosted API error codes before wiring akua api request execution.\n\nRejected: no stored login/profile state, no OCI auth reuse, and no HTTP command execution in this slice; those would expand the first bridge beyond its planned foundation.\n\n\n[…]\nuild:render-worker; cargo fmt --check; git diff --check; git diff --cached --check.\n\nNot-tested: full task ci and end-to-end akua api HTTP execution; the command path is not implemented in this slice.",
          "is_bot": false,
          "headline": "feat(cli): add hosted API config resolution",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T11:42:02Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "20ff9b0248301e0b56913020a5e07668b2f72812",
          "body": "Rationale: Close the OSS-safe launch-readiness slice by keeping public SDK docs, generated site output, large render/export regressions, CLI/NAPI/SDK drift guards, and render-worker schema-default coverage aligned on one branch.\n\nRejected: Did not fold the contradictory-defaults render case into the\n[…]\nn; cargo fmt --check; git diff --check; git diff --cached --check.\n\nNot-tested: Full task ci / release:validate not run; this was scoped to focused OSS launch-hardening regressions and generated docs.",
          "is_bot": false,
          "headline": "test: finish Akua OSS launch hardening",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T11:10:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d32b9df64bc430d3265afbdf2b0c8956c257fdf7",
          "body": "Rationale: Some Helm values.schema.json files publish defaults that contradict their declared type. Akua lowered those defaults directly into generated KCL, which can create schema/default contradictions such as 'field: str = 80' and abort the KCL evaluator during render.\n\nRejected: Did not attempt \n[…]\nrgo test -p akua-cli --features cosign-verify,dev-watch --test helm_union_schema -- renders_chart_with_union_typed_schema_default --nocapture\n\nTested: cargo test -p akua-core\n\nTested: git diff --check",
          "is_bot": false,
          "headline": "fix(core): omit unsafe chart schema defaults",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T10:45:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "33048b54d4d7f63abb35fd05ff193b8fb07f457f",
          "body": "Rationale: Keep the public OSS SDK surface aligned with implemented package/render/export behavior before the Akua Cloud launch bridge work. The SDK docs now describe the current NAPI-backed package SDK instead of future cloud/client APIs, and regression coverage locks down large render summaries, e\n[…]\nrc/render.test.ts packages/sdk/src/ciGates.test.ts\n\nTested: bun test packages/sdk/src/ciGates.test.ts -t drift\n\nTested: bunx tsc --noEmit --project packages/sdk/tsconfig.json\n\nTested: git diff --check",
          "is_bot": false,
          "headline": "test: harden Akua SDK launch surface",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T10:45:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6101afa17e89b19ea1cdfe9d9db83830c8d51a3a",
          "body": null,
          "is_bot": false,
          "headline": "docs: point CLI docs at cli subdomain [skip ci]",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-10T07:54:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f83ddc608edad38181ba6660303919909f850784",
          "body": "Rationale: Publish the verified render timeout/stale-engine fix so downstream CNAP can depend on a durable @akua-dev SDK/native package instead of local overrides.\n\nRisk: This triggers the normal Akua release path once tagged. The code changes were already merged via PR #62 with Rust and SDK CI green; this commit only stamps version metadata and changelog.\n\nTested: git diff --check; cargo metadata --locked --format-version 1 --no-deps; cargo check -p source-hash.",
          "is_bot": false,
          "headline": "release: 0.8.20 — refresh render budget handling",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-09T06:27:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "df05f4e4d7468d635e405e352596ed87dfdb77cc",
          "body": "Rationale: CNAP platform renders exposed persistent nested engine sessions reusing expired Wasmtime epoch deadlines, and worker interrupt traps surfaced as generic KCL errors instead of timeout budget failures.\n\nThis refreshes per-call nested engine deadlines, routes interrupt traps to E_RENDER_BUDGET_DEADLINE with timeout exit code, and includes CI lint cleanups required by the current toolchain.\n\nTested: Akua CI Rust (fmt + clippy + test) and SDK (bun + node WASI) passed on PR #62.",
          "is_bot": false,
          "headline": "fix(render): refresh wasm engine deadlines",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-09T06:24:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b00ae6c7eafa58b46e9dc279a9d6c38bc0bf0629",
          "body": null,
          "is_bot": false,
          "headline": "Add higher quality logo (#61)",
          "author_name": "Marcus Klingler",
          "author_login": "marcus-klingler",
          "committed_at": "2026-06-08T22:56:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0f261d8d0c27228c7093a28362dc56026cf3da8b",
          "body": null,
          "is_bot": false,
          "headline": "release: 0.8.19 — helm-repo resolver tolerates v-prefixed chart versions",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-01T07:47:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "42aee1910ae09aea96d17675eb44a51c82208ffb",
          "body": "…skip only truly-malformed entries",
          "is_bot": false,
          "headline": "fix(helm-repo): tolerate leading-v chart versions (Helm-compatible), …",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-01T07:47:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0a21cc3958083991d535f7f5159418a7b6da2266",
          "body": null,
          "is_bot": false,
          "headline": "release: 0.8.18 — akua cache manages the helm chart cache",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T18:54:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d14c4f12b8499c9e95f850f8478231bcd0f2ec85",
          "body": "akua cache list, clear, and path now cover the helm chart cache\n($XDG_CACHE_HOME/akua/helm/) added with the helm-repo dep source.\nPreviously the cache grew unmanaged across deploys.\n\nChanges:\n- cache_inventory: add helm_root to CacheInventory, collect_helm\n  (layout: <helm_root>/<hex>/<chart-name>/ \n[…]\nua cache clear`; cache_scope ArgGroup\n  extended; ClearScope::All wired for the no-flag default.\n- docs/roadmap.md: update cache line to {oci,git,helm}.\n- CHANGELOG.md: fixed entry under [Unreleased].",
          "is_bot": false,
          "headline": "feat(cache): inventory + clear the helm chart cache",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T18:20:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "76ed8b7c9fdc171efca074ac9548b6fc1c90fccc",
          "body": "Match the accurate model (already in CLAUDE.md/security-model.md after\naudit #9): digest-pin is the universal verified-before-write gate;\ncosign/SLSA verification engages fail-closed when a key is configured.",
          "is_bot": false,
          "headline": "docs: reconcile 'verify by default' signing claim across README + docs",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T18:05:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "24881ff73ad0046fc7f06cf6d8022b4e12d1ef11",
          "body": "…ld/feature wiring, release batching",
          "is_bot": false,
          "headline": "docs(agents): capture session gotchas — napi 3-place sync, engine-bui…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T18:01:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d9551caa8744bfafecc34f7bd8e2266175050d3c",
          "body": "AGENTS.md is the cross-tool standard; CLAUDE.md → AGENTS.md so Claude\nCode and other agents read one source.",
          "is_bot": false,
          "headline": "docs: make AGENTS.md canonical, CLAUDE.md a symlink to it",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T17:58:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "93d0d584cadb0910f2dcbac4aee73eac97134873",
          "body": null,
          "is_bot": false,
          "headline": "release: 0.8.17 — honor helm subchart condition/tags disabling",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T17:02:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fd3732caaa94d0a6c6f4592cfc6fff9e92a117b3",
          "body": "…Dependencies\n\nrenderInternal went load -> ToRenderValues -> engine.Render and never\ncalled chartutil.ProcessDependencies, the Helm step that reads each\ndependency's condition/tags from the values and prunes disabled\nsubcharts. Upstream Helm runs it in pkg/action/install.go before\nToRenderValues. Be\n[…]\nional\nsubchart: sub.enabled=false omits sub-cm, sub.enabled=true includes it.\nFailed before the fix (sub-cm leaked), passes after.\n\nThe generated assets/helm-engine.wasm is gitignored; CI rebuilds it.",
          "is_bot": false,
          "headline": "fix(helm-engine): honor subchart condition/tags disabling via Process…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T16:50:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ac9ce346a62c39adec8ea71209c43ed5dc088148",
          "body": null,
          "is_bot": false,
          "headline": "release: 0.8.16 — security audit hardening (all 17 findings remediated)",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:57:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "79aa75bd3bc0bf79bb404a599af212a861d18f6c",
          "body": "… fix stale preopen comment\n\nCloses the last 3 audit follow-ups (#9, #16, #17). --timeout now derives\nthe render worker's epoch deadline (was always the 6s default), with a\nunit test. CLAUDE.md's 'verify by default' wording now states the real\nmodel (digest-pin universal; cosign engages when a key is configured).\nWorker preopen doc comment corrected (preopens are read-only).",
          "is_bot": false,
          "headline": "fix(security): --timeout bounds worker epoch; reconcile signing docs;…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:48:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ddb9087fd46833c2c2147d4cdf016f6a5c37ea1c",
          "body": null,
          "is_bot": false,
          "headline": "docs(security): mark audit findings remediated + changelog",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:36:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e92db226cea184d320769ccc1fdab9da14583e7c",
          "body": "…ifest\n\n`akua publish` previously appended the workspace `akua.toml` byte-for-byte\ninto the tarball that is digested, cosign-signed, and SLSA-attested. A\npublisher's `replace = { path = \"...\" }` (or replace on an oci/git dep) — a\nlocal fast-iteration override — therefore survived into the signed art\n[…]\nso dropping the local redirect removes\nnothing the consumer needs.\n\npublish.rs is unchanged — it already packs via\npack_workspace_with_vendored_deps, so the strip applies centrally before\ndigest/sign.",
          "is_bot": false,
          "headline": "fix(security): strip replace directives from the published+signed man…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:28:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "df5de413bd0704a60795c19c125a103306e65bc1",
          "body": "…date helm chart name + OCI userinfo\n\n- Drop `Serialize` from `BasicAuth` (unused — `auth_parse` only deserializes\n  INTO `HostAuthMap`; nothing serializes it back out) and implement manual\n  `Debug` that replaces the password with `[REDACTED]`. Prevents any `{:?}`\n  on a containing struct (e.g. `Ve\n[…]\nuser:pass@host/...`) are\n  now rejected at parse time, completing the symmetry with the existing\n  git and helm-repo userinfo guards.\n\nAll four changes are covered by new TDD tests; 74 lib tests pass.",
          "is_bot": false,
          "headline": "fix(security): redact BasicAuth, canonicalize vendor source_ref, vali…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:28:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "24e7a4ad797093ab2cc123e64d0dbdd3a2862f14",
          "body": "… reject scheme downgrade\n\nHarden the OCI/Helm/git fetch paths against malicious registries and\npoisoned environments:\n\n- oci_transport: char-boundary-safe error-body truncation (was a byte\n  slice that panicked when a multibyte char straddled byte 300); cap\n  response bodies via a streamed counting\n[…]\non tree-entry names before dest.join.\n\nFinding #5 was fixed in code (force_tls_verification), not merely\ndocumented — gix exposes per-connection transport options that win over\nthe env-derived config.",
          "is_bot": false,
          "headline": "fix(security): bound fetch buffering + decompression, fix utf8 panic,…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:28:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6c4f5fc317daf23b63fa3503d4892afd4d108190",
          "body": "Engine Sessions (helm, kustomize) were created with no StoreLimits and\nset_epoch_deadline(i64::MAX as u64), making them effectively uncapped.\nA declared malicious chart with pathological templating could consume\nup to ~4 GiB of linear memory and run indefinitely on a shared host.\nNot a sandbox escap\n[…]\n_generous,\nengine_epoch_deadline_is_finite_and_generous), and a well-formed module\nwith the full allocator ABI still initializes under the new caps\n(init_with_resource_caps_succeeds_for_valid_module).",
          "is_bot": false,
          "headline": "fix(security): bound helm/kustomize engine memory + wall-clock",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:28:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "aad5b4f4bc9fbc1a094fe73cb347788898c52393",
          "body": "…KCL codegen\n\nA malicious values.schema.json could inject KCL via verbatim property\nnames or an unescaped triple-quote in descriptions. Validate names\nagainst the KCL identifier grammar and neutralize \"\"\" in descriptions.",
          "is_bot": false,
          "headline": "fix(security): escape untrusted chart schema names + descriptions in …",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:28:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7ebba58ccd9d9c238540fe43ddf3758ea1059691",
          "body": null,
          "is_bot": false,
          "headline": "docs(security): 2026-05-29 multi-reviewer security audit report",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:04:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e0d059a66729cdeed7a463339938c8a65c8b6944",
          "body": "Nested/inner-render scopes now build resolved_pkgs via enter_for_render\n(the path-removal work landed that); the 'nested deps resolution is a\nfollow-up' note was stale.",
          "is_bot": false,
          "headline": "docs(kcl_plugin): correct stale resolved_pkgs comment",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T13:46:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c74c3810b49aa56ca5e0d85f88459b0031a21a47",
          "body": null,
          "is_bot": false,
          "headline": "release: 0.8.15 — typed-only composition + Bun engine loader",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T13:43:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "23c396be4c166333d8ec68cfe30287d217cf2b78",
          "body": "The SDK's helm/kustomize rendering failed under Bun with\n'helm-engine.wasm not built': loader.js set process.env\nAKUA_NATIVE_ENGINES_DIR, but Bun doesn't propagate process.env writes\nto the OS environment that the addon's std::env::var_os reads (Node\ndoes). Add a programmatic engines-dir override (R\n[…]\nxposed as napi\nsetEnginesDir and called by loader.js with the resolved\n@akua-dev/native-engines dir. Verified: helm renders under Bun with no\nshell env var. Env var path retained for Node back-compat.",
          "is_bot": false,
          "headline": "fix(napi): load engines via programmatic setEnginesDir (Bun-safe)",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T13:39:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bc118d4b035c6e673a129dda97b4bc53bedbf9c3",
          "body": "…form\n\nNested renders now resolve typed dep aliases against the frame's own\nakua.toml: render_opts enters each frame via RenderScope::enter_for_render,\nwhich derives both allowed_roots and the resolved_pkgs alias map from the\nframe's resolved charts (budget inheritance preserved). This lets a compos\n[…]\nher engines (kustomize.build, helm chart paths)\nare untouched.\n\nBREAKING CHANGE: pkg.render no longer accepts path; declare the sub-package\nunder [dependencies] and compose it via package = \"<alias>\".",
          "is_bot": false,
          "headline": "feat(pkg-render)!: typed-alias-only composition; remove untyped path …",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T13:01:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e9b019ccfaab0a822e2cccceb8fe22aee3b41055",
          "body": "… fixes",
          "is_bot": false,
          "headline": "docs(changelog): 0.8.14 — helm-repo deps, sub-package context, render…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T12:36:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d21dbf7b1c3789ddb3c76c401e358f369927e84f",
          "body": "The SDK Akua.add() calls napi.add(), but NapiAddon (the hand-maintained\ntyped view of the addon in napi.ts) never declared it, so the release\nsdk-build's tsc --emitDeclarationOnly failed with TS2339. Add the\nsignature mirroring the napi NapiAddArgs shape.",
          "is_bot": false,
          "headline": "fix(sdk): declare add() on the NapiAddon interface",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T12:14:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d9605b58575dc094543c80e51123483ead51df95",
          "body": "…itory\n\nDemonstrates the `repo`/`chart`/`version` dependency source: podinfo 6.12.0\npulled from stefanprodan.github.io/podinfo, sha256-pinned in akua.lock.\nE2e test mirrors examples_kcl_ecosystem — #[ignore]-gated by default (live\nnetwork pull), wired into task release:validate alongside the other online\nexamples.",
          "is_bot": false,
          "headline": "docs(examples): add 14-helm-repo-dep — chart from an HTTPS Helm repos…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T11:55:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "db92db846827b2d93b9aca4058f57e1d3d0dc354",
          "body": "… chart\n\nDemonstrates and regression-tests that `charts.*` context now propagates\ninto `pkgs.<alias>`-composed sub-packages: the root Package composes a\n`webserver` sub-package (via `import pkgs.webserver`) whose own `akua.toml`\ndeclares a local Helm chart dep (`nginx = { path = \"./vendor/nginx\" }`)\n[…]\nynthesized package stubs — those per-render synthetic modules only\nexist in the rendering package's context, never in the consumer's stub\ncompilation context. Adds a unit test that pins the behaviour.",
          "is_bot": false,
          "headline": "docs(examples): add 13-subpackage-helm — sub-package composing a Helm…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T11:37:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "254e28fba1977da7df013a3956c46e53e005647c",
          "body": "Union JSON-Schema types now generate `T1 | T2` KCL annotations\n(nullable -> optional) instead of collapsing to the first member with a\npossibly-mismatched default, which aborted the evaluator. A field like\n{\"type\":[\"string\",\"integer\",\"null\"],\"default\":8080} previously\nemitted `port: str = 8080` — a contradictory annotation that packed the\nint default against a str type at schema instantiation and triggered a\nwasm abort even with values = {}.",
          "is_bot": false,
          "headline": "fix(values-schema): emit KCL unions for multi-type schema fields",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T11:15:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a71356592569e1d4999039b43b91d2f859a4d597",
          "body": "…ckages\n\n`pkg.render` (and the typed `import pkgs.x; x.render(...)` form that\ndispatches to it) now resolves the composed CHILD package's own\n`akua.toml` deps — Helm `charts.*` and KCL-ecosystem imports like\n`import k8s.api.apps.v1` — and registers them for the child eval.\nPreviously the handler cal\n[…]\nhe child's OWN `akua.lock`, not the parent's. Missing child\n`akua.toml` falls back to empty charts, preserving the pure-KCL\nsub-package path. Cycle/depth/wall-clock guards still run before\nresolution.",
          "is_bot": false,
          "headline": "feat(render): propagate external-package context into composed sub-pa…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T11:05:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3a9df6b56ca1d2002ac03bafea9a52adc97f0850",
          "body": "…al identifier",
          "is_bot": false,
          "headline": "fix(render): prefix digit-leading dep names so kcl_ident yields a leg…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T10:43:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9bcd8a35ab974a3e6c768c1513cead58bce48c60",
          "body": "The render worker wrote its entire JSON+YAML response to a host stdout pipe\ncapped at 1 MiB (MemoryOutputPipe::new(1 << 20)). Real charts overflow it —\nargo-cd 7.7.0 renders ~1.36 MB — so the guest's write_all failed with errno 29,\nsurfacing as an opaque `os error 29` (exit 3). traefik (~7 KB) and t\n[…]\nENDER_OUTPUT_TOO_LARGE code via the KclEval\nmarker table, with a split-the-Package suggestion — instead of os error 29.\n\nThe 64 KiB stderr cap is left as-is (deliberately small for structured errors).",
          "is_bot": false,
          "headline": "fix(worker): raise render-output cap above 1MiB + typed overflow error",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T10:34:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b7aa32140ca321b077aff99a631dab145bfe7c73",
          "body": "A dep keyed with a hyphen in akua.toml (e.g. [dependencies.cnpg-operator])\nmade akua write the synthetic chart/pkg module file under the literal name\n(cnpg-operator.k). KCL binds that module's symbols under cnpg-operator, but\n`-` is not a legal KCL identifier, so `import charts.cnpg_operator` resolv\n[…]\nerwriting one module.\n\nThe pkg-stub `package = \"...\"` lookup string keeps the original dep key\n(pkg.render keys its resolved-pkg map on the raw name); only the filename and\nimport alias are sanitized.",
          "is_bot": false,
          "headline": "fix(render): sanitize hyphenated dep names to KCL identifiers",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T10:34:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3aa7968e290a5107efda5d87cebd73e86d93962a",
          "body": null,
          "is_bot": false,
          "headline": "chore(gitignore): ignore .akua/cache resolver artifact",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T10:11:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e23bbef27524f895d495551f20ca0baca90cbb9c",
          "body": "Without this the shipped binary + napi addon compiled the\n`#[cfg(not(feature=\"helm-fetch\"))]` resolve_helm stub, so repo deps\nerrored at runtime despite passing feature-gated tests. Wired the same\nway git-fetch is (unconditional on the akua-core dep).",
          "is_bot": false,
          "headline": "build(cli,napi): enable helm-fetch feature on akua-core",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:53:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a3faead8e1fe612a55bb3b32c4fd694035b755c8",
          "body": "- docs/cli.md: rewrite `akua add` section to match the real CLI (flag-\n  based, not positional subcommand); add four-source table including\n  `--repo`/`--chart`; update `vendor add` note to mention helm deps.\n- docs/lockfile-format.md: add Helm-repo row to the dependency forms\n  table; update `sourc\n[…]\nsingle-line dep-shape sentence\n  with a four-source table and a `akua add --repo` usage example.\n- CHANGELOG.md: add `### Added` entry under `[Unreleased]` for the\n  HTTPS helm-repo dependency source.",
          "is_bot": false,
          "headline": "docs(helm-repo): document repo/chart dependency source",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:48:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c0d7f0e0a8c06d3258f9802c024d2d3e264ed8f7",
          "body": "Extend `akua add` with a fourth dependency source: HTTPS Helm repository.\n\n- clap: add `--repo` / `--chart` to `Commands::Add`; include `repo` in\n  the `source` ArgGroup so exactly-one-source validation holds.\n- `AddSource::Repo { repo, chart }` variant; `build_dependency`,\n  `source_label` (\"helm\")\n[…]\nclaration.\n- SDK: `AddOptions` / `AddOutput` types; `Akua.add(name, opts)` method.\n- Tests: `adds_helm_repo_dep_with_repo_chart_version` and\n  `helm_repo_source_label_is_helm` (all 10 add tests pass).",
          "is_bot": false,
          "headline": "feat(add): akua add --repo --chart helm-repo form + SDK",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:46:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "00e9753208456a2fbbf7cdfaf9a1eac327690a03",
          "body": null,
          "is_bot": false,
          "headline": "test(helm-repo): online fetch over local HTTP server + digest-pin guard",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:33:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aa4ce83ea975daaff2f7e895a50d0ead92fafa3a",
          "body": "Verify a helm+<repo>#<chart> source string with a sha256 digest\nsurvives a TOML round-trip and passes digest validation — no\nLockedPackage schema change.",
          "is_bot": false,
          "headline": "test(lockfile): helm-repo source round-trip",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:28:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f7742859b95c781394156f11879c64f970ed3932",
          "body": "Take the chart dir name and locate the unpacked root at\n<dest>/<chart>/ (with an archive-root fallback) instead of scanning\nfor the single subdir holding Chart.yaml.",
          "is_bot": false,
          "headline": "fix(helm-repo): deterministic fetch_from_cache by chart dir name",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:28:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0670f83e0af109a53da69ea3fd4227a86f210c03",
          "body": "Route helm-repo deps through a new resolve_helm that mirrors resolve_oci:\nthe .tgz sha256 is the cache key, lockfile pin, and fetcher-verified\ndigest. Helm skips vendor-first (vendored-helm embedding is deferred).\nAdds the ChartResolveError::HelmFetch variant and an offline-from-cache\nresolver test.",
          "is_bot": false,
          "headline": "feat(helm-repo): ResolvedSource::Helm + resolver arm",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:28:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5a155899cba707962b2efa02ed2fbad973d4e710",
          "body": "…cache",
          "is_bot": false,
          "headline": "feat(helm-repo): http fetch + extract + content-digest pin + offline …",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:16:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aa1e8ab9c5770e12965155c1dca287d15ba2b177",
          "body": null,
          "is_bot": false,
          "headline": "feat(helm-repo): resolve relative/absolute tarball URLs",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:15:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9099a9c8a442201be9dc6747db1b09fc3b920cb9",
          "body": null,
          "is_bot": false,
          "headline": "feat(helm-repo): semver version selection against index",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:14:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9ff4be93a5d0edabb0e41a082eff25dd0431b644",
          "body": null,
          "is_bot": false,
          "headline": "feat(helm-repo): index.yaml types + parser",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:13:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a26f20e36d07b6be23fb7bcc0b5091ed46f016ca",
          "body": "Adds `repo`/`chart` fields to `Dependency`, `DependencySource::Helm`,\n`DependencySpec::Helm { repo, chart, version }`, and three new\n`ManifestError` variants with stable error codes. Validation rejects\nmissing `chart`, missing `version`, and embedded userinfo in the repo\nURL. Exhaustiveness gaps in \n[…]\n-fetch returns\n`UnsupportedSource` until Tasks 4-9 wire the helm_repo_fetcher;\n`vendor_lock_source` panics (unreachable pre-fetcher); `resolve_source`\nreturns the new `VendorError::UnsupportedSource`.",
          "is_bot": false,
          "headline": "feat(manifest): repo/chart helm-repo dependency source + validation",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:11:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f1502949bc35182a38bf038ed42d9789a3338faf",
          "body": null,
          "is_bot": false,
          "headline": "feat(cli-contract): error codes for helm-repo dep validation",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T08:50:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9a1f1bdb89a43ebeeec77ce7a66d274c88263aaa",
          "body": null,
          "is_bot": false,
          "headline": "build(akua-core): add semver dep + helm-fetch feature",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T08:48:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9b4a5a750917b3f06f65f911c12a46b14f72656a",
          "body": null,
          "is_bot": false,
          "headline": "docs(plan): HTTPS helm-repo dependency implementation plan",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T08:44:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8854aa5fec3c01f7febcfc299a78c97670227193",
          "body": "Fourth akua.toml dependency source alongside oci/git/path: classic HTTPS\nHelm repositories (index.yaml + .tgz). Content-pinned like git deps\n(sha256 in akua.lock, verify-on-pull, no cosign), full scope including\nsemver-range resolution against index.yaml. Reuses the reqwest+rustls\ntransport, host_auth map, content-addressed cache, and vendor machinery.",
          "is_bot": false,
          "headline": "docs(spec): HTTPS helm-repo dependency source design",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T08:34:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "064c6f184877185521d91b910d3346f8121064d4",
          "body": "The embedded helm engine returns NOTES.txt (top-level and per-subchart)\namong its rendered files, but those are free-form usage prose, not\nmanifests — helm template keeps them out of the YAML stream. akua parsed\nevery returned file as YAML, so any chart whose notes contain lines like\n'kubectl logs .\n[…]\n.\n\nAdds parse_manifests + is_notes_file with a regression test, plus\nmulti-doc parser guards (block-scalar-with-empty-line, real 59-doc helm\nfixture) and propagates the 0.8.14 version into Cargo.lock.",
          "is_bot": false,
          "headline": "fix(helm): skip NOTES.txt instead of parsing it as YAML",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T08:17:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2972b28ae70cf17355e23a572966cae4ffc32f49",
          "body": "The release pipeline bumped package.json from the tag but never the Rust\nworkspace Cargo.toml, so binaries compiled with the committed version\n(0.8.8) regardless of tag. That string feeds akua -V, SLSA provenance,\nOCI annotations, and the HTTP user-agent — all stale on 0.8.9..0.8.13.\n\n- scripts/set-\n[…]\n with the detect-version tag.\n- cli-build smoke-test asserts akua -V == tag, failing the release on\n  any future injection regression.\n- bump committed Cargo.toml placeholder to 0.8.14 (next release).",
          "is_bot": false,
          "headline": "ci(release): derive Cargo version from git tag",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T07:28:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2641857b3528ae343533a79ed679d5613dfeaf41",
          "body": "Keep gix on curl transport for Git TLS config support, but enable vendored OpenSSL for git-fetch so release cross-builds do not depend on target system OpenSSL packages.",
          "is_bot": false,
          "headline": "fix(core): vendor curl OpenSSL for git transport",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-20T17:05:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f696d2477c6465fa6832f53bfa08f654b28b90d3",
          "body": "Switch gix Git fetches to the curl transport so Git-compatible TLS config is applied, and keep pre-push lightweight by default.",
          "is_bot": false,
          "headline": "Fix Git TLS trust for vendored sources",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-20T14:39:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4882d33509fd83c7cf6bf032f449ac1caecfa2c8",
          "body": "* fix(core): refresh stale git dependency caches\n\n* fix(core): allow gix credential callback lint",
          "is_bot": false,
          "headline": "fix(core): refresh stale git dependency caches (#58)",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-19T17:02:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "458398458ab77c58b954e6a14748d6fa73b33eec",
          "body": "* fix(core): render helm values schemas as valid kcl\n\n* fix(core): make helm values schema test render a resource",
          "is_bot": false,
          "headline": "fix(core): render Helm values schemas as valid KCL (#56)",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-19T17:02:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ecc1fe3e98b0e5d7d790d9ce21af658976825574",
          "body": "Install release deps before mutating package manifests to tag-pinned versions, and add release workflow ordering checks.",
          "is_bot": false,
          "headline": "fix(release): install deps before tag manifest pins",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-16T14:33:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9d603df28c778c7444481eacab5469847c7744b5",
          "body": "Allow Akua-published OCI package layers to resolve through vendor dependency fetches.",
          "is_bot": false,
          "headline": "fix(oci): let vendor fetch akua packages",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-16T13:32:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4ade6ec3a041eebe88b7fe9c80a592af4006beaa",
          "body": "* docs(readme): replace hero gif with motion piece + scrubbable terminal embed\n\nSix-scene composition at docs/assets/hero.mp4 (3.2 MB, 52 s, 1920×1080)\nwith a docs/assets/hero.gif fallback (1.9 MB, 960×540) for renderers\nthat don't support <video>. Scenes:\n\n  1. Wordmark + Typed/Signed/Sandboxed tag\n[…]\ne structural fact.\n- design/handoff/README.md: flag as historical artifact pointing at\n  the current production README; the inline \"replace with hero.gif\"\n  hint pre-dates the embedded-video approach.",
          "is_bot": false,
          "headline": "docs(readme): hero motion piece — Typed. Signed. Sandboxed. (#53)",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-13T13:28:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2de793c8cdf9bdedb0a935253acead4da7e01e04",
          "body": "The 0.8.8 release run failed sdk-build because crates/akua-napi/index.d.ts\nwas committed before NapiVendorAddArgs gained its `auth` field. tsc\ncaught it on the SDK call site at packages/sdk/src/mod.ts:433.\n\n- Regenerated index.d.ts via `task native:build` — picks up\n  NapiBasicAuth + auth?: Record<s\n[…]\n.8.8 (was 0.8.7-rc4 — stale from\n  a prior local napi build).\n- packages/sdk/src/napi.ts hand-mirrors the napi shape (deliberately,\n  per the file's own comment); added `auth` to vendorAdd's arg type.",
          "is_bot": false,
          "headline": "fix(napi): regenerate index.d.ts + sync sdk napi shim for vendor auth",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T19:51:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1733f36a45a1ea80920e81f01d59077109354e7a",
          "body": "- gix HTTPS transport: closure-based credential helper installed in\n  clone_bare runs host_auth::lookup on 401 retries; longest-prefix\n  match selects the credential, gix serializes it as Authorization:\n  Basic <b64> on the retry. Arc-shared map for cheap reuse across\n  configure_connection / set_cr\n[…]\n wrong-auth 401, longest-prefix\n  selection. No real network — fully hermetic.\n- New error page docs/errors/E_AUTH_PARSE.md covering all four CLI\n  --auth / --auth-file shape errors with remediations.",
          "is_bot": false,
          "headline": "release: 0.8.8 — host-keyed HTTPS basic auth for vendor add",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T19:07:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8d3e5b5773f182f2cade03212effb7491d0b2813",
          "body": "…dedicated E_AUTH_PARSE, drop stale TODO\n\n- Move url_has_userinfo from mod_file (private) to host_auth (pub)\n  and have mod_file::Dependency::validate call it. One implementation\n  of 'does this URL embed user:pass@'.\n- New error code E_AUTH_PARSE for --auth / --auth-file shape errors.\n  Was previou\n[…]\nrs it.\n\nFindings deferred to follow-ups: BasicAuth ↔ oci_auth::Credentials\nconsolidation (cross-feature-gate refactor), generic load_toml<T>\nhelper to absorb 4 open-coded loaders, HostAuthMap newtype.",
          "is_bot": false,
          "headline": "refactor(host-auth): simplify findings — dedupe url-userinfo helper, …",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T17:45:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7d3983bb12917ab6b289a3bcc8ecb05b3f546fd7",
          "body": "- docs/cli.md gains an \"Auth flags\" subsection under `akua vendor`\n  with --auth / --auth-file syntax, --auth-file TOML shape, and the\n  lockfile-canonicalization guarantee.\n- docs/sdk.md gains a \"Credentials — auth\" universal-option section\n  with longest-prefix examples (single-host + per-org scop\n[…]\nents the new auth surface,\n  lockfile canonicalization, and manifest hardening.\n\nSite regenerated via task site:gen — link checker green\n(101 pages, 0 broken links). Includes minor cargo fmt cleanups.",
          "is_bot": false,
          "headline": "docs(host-auth): cli.md, sdk.md, error page, CHANGELOG",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T17:34:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7b21f3d2ab9a7e8189262974e307b802f893103f",
          "body": "- New crates/akua-cli/src/auth_parse.rs: parses repeatable\n  `--auth <prefix>=<user>:<password>` strings + optional\n  `--auth-file <path>` (TOML, `[auth]` keyed by URL prefix).\n  Flag values override file entries on conflict (helm/docker\n  convention).\n- `akua vendor add` gains --auth (repeatable) +\n[…]\ng longest-prefix-match resolution.\n- 10 auth_parse unit tests cover pair parsing (incl. passwords\n  with `:` / `=`), empty-prefix / empty-username rejection,\n  TOML file loading, and merge precedence.",
          "is_bot": false,
          "headline": "feat(cli/napi): --auth flag, --auth-file, SDK auth parameter",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T17:27:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "70de755e820fc973e2ba3eb2e4ac9d9abcf9f5f7",
          "body": "Threads `auth: Option<&HostAuthMap>` through the public verb surface\ndown into git_fetcher::fetch and the gix transport. When the URL\nmatches an entry in the map (longest-prefix), the credential is sent\nas `Authorization: Basic <b64>` via gix's in-memory config override\n(`http.extraHeader`). Anonymo\n[…]\n7 lib tests + integration tests pass.\n\nbase64 + host_auth moved from feature-gated to always-built (~12 KB\non linker output) — host_auth::BasicAuth needs to be reachable from\nnon-git-fetch builds too.",
          "is_bot": false,
          "headline": "feat(git_fetcher): host-keyed HTTPS basic auth",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T17:19:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e3e776d4f0b0f2aef176da3823cff677523341c7",
          "body": "akua.toml is version-controlled; embedding 'user:pass@host' in a git\ndep URL would persist the credential into the lockfile + git\nhistory. Reject at parse time with a typed error.\n\n- New error code E_MANIFEST_GIT_USERINFO with rich message pointing\n  callers to the SDK auth parameter / CLI --auth fl\n[…]\nstructured_code() lets to_structured() route this\n  variant to the dedicated code instead of the generic\n  E_MANIFEST_PARSE bucket\n\nTwo new tests: rejects user:pass@ in authority; accepts '@' in path.",
          "is_bot": false,
          "headline": "feat(mod_file): reject git URLs with embedded credentials",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T17:01:45Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bd959c70db246a35d3c69c80da403be12d4e7355",
          "body": "New module crates/akua-core/src/host_auth.rs:\n- BasicAuth { username, password } + to_authorization_header()\n- HostAuthMap = HashMap<String, BasicAuth>\n- lookup() — longest-URL-prefix match (path-segment-aware), matches\n  git's credential-helper / .npmrc resolution rule\n- canonicalize_url() — strips\n[…]\nso credentials never leak into akua.lock\n\nGated on the git-fetch feature; base64 dep activated alongside.\n13 unit tests covering prefix selection, path-segment boundaries,\ncanonicalization edge cases.",
          "is_bot": false,
          "headline": "feat(host_auth): URL-prefix-keyed credential map + canonicalization",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T17:01:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5c6f2e0bc13a2aa7e3ba8420515194361d513396",
          "body": "The sdk-staged tarball already contains dist/ pre-built by sdk-build in\nrelease.yml. Without --ignore-scripts, npm fires the package's\nprepublishOnly hook which re-runs `bun run build`, requiring bun on\nPATH and a fully-installed node_modules tree (transitive deps like\nfast-uri, fast-deep-equal). All wasted work, since the tarball is\nalready what we want to publish.",
          "is_bot": false,
          "headline": "fix(release-publish): npm publish --ignore-scripts for the SDK",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T15:14:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d647027a0c2b02e87078475e51b7fb947f30a447",
          "body": "…eds it)",
          "is_bot": false,
          "headline": "fix(release-publish): add bun setup to sdk-publish (prepublishOnly ne…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T15:11:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7f215db3b66e72182914bcb64ccab885b1a5e5c2",
          "body": "`gh release download` was failing with 'not a git repository' because\nthe sdk-publish job has no actions/checkout step (intentional — the\nsdk staging tree is fully reconstructed from the asset tarball).\nExplicit --repo flag bypasses the git-config inference path.",
          "is_bot": false,
          "headline": "fix(release-publish): pass --repo so sdk-publish doesn't need a checkout",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T15:09:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a7096bb1b477810130c7b1617ae360642cbfe29a",
          "body": "…lease-publish.yml\n\nThe job's 'gh workflow run release-publish.yml' got HTTP 403:\n'Resource not accessible by integration' because the job-level\nGITHUB_TOKEN inherits the workflow permissions block, which only\nlisted contents/packages/id-token. Per Actions docs, dispatching a\nworkflow_dispatch event\n[…]\n step was right that the\nworkflow_dispatch event itself is exempt from the no-recursion\nrule — but the API call to register the dispatch still needs\nactions:write on the token. Fix in run 25497355509.",
          "is_bot": false,
          "headline": "fix(release): grant actions: write so trigger-publish can dispatch re…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T13:35:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a850be6166c393cebe6b13dbcfb0fb33d6184344",
          "body": "…ploads\n\nRefactor commit ff5f076 used 'cli-*' as a defensive download-artifact\nfilter, but the cli-build job uploads with name 'akua-${{ matrix.target }}'.\nPattern matched zero artifacts → github-release + docker + homebrew-tap\nall failed with no matches found / file not found.\n\nConfirmed by run 25495656081 logs: 'Found 13 artifact(s); Filtering by\npattern cli-*; Total of 0 artifact(s) downloaded'.",
          "is_bot": false,
          "headline": "fix(release): pattern 'akua-*' (not 'cli-*') matches what cli-build u…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T13:00:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c898e17bcb9c7cc6c7d3f5e3e4422154cec665b2",
          "body": null,
          "is_bot": false,
          "headline": "ci: skip CI on changes to scripts/check-site-links.ts (site-only)",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T12:53:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7dff06f8a0ed447a7c3a178e9b820fc07587821e",
          "body": "The `cli-contract.md §1.5` link (and similar) 404'd because the markdown\nrewriter only matched `.md$`, missing URLs with `#fragment`. While\nfixing that, audited every internal link in the generated site and found\n24 more broken — examples-gallery cross-links, agent-usage skill paths,\ncli.md `#akua-r\n[…]\nth filter so dead links fail the deploy.\n- `docs/sdk.md` — transport table rewritten. The SDK is NAPI-only;\n  the WASM + shell-out tiers were aspirational. Lists the 14 verbs\n  actually exposed today.",
          "is_bot": false,
          "headline": "fix(site): kill dead links + add a checker that fails CI on regression",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T12:47:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "397e9ce182e478ada2cd50ada6854b32606c1280",
          "body": null,
          "is_bot": false,
          "headline": "fix(docs/sdk): npm link missing @akua scope (was /package/-dev/sdk)",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T12:36:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "09530b3921fa1d04f2c65022b00910dbf544965a",
          "body": "…links\n\nThree design fixes:\n\n1. Landing is back to a tight, vertical-centered single column. The\n   prior \"logo hero + giant tagline\" pushed the install command well\n   below the fold; now `akua` headline + tagline sit ~6px apart and\n   the install pre block is the second visible element. Footer + D\n[…]\ne click target is consistent and the\n   text sits dead-center. Brand img dropped from 28→26 to better match\n   the text x-height.\n\nSidebar `top: 76px → 24px` since the topnav no longer reserves space.",
          "is_bot": false,
          "headline": "fix(site): tighter centered landing, scroll-fade topnav, aligned nav …",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T12:35:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ff5f076874f2fa78dd5b2e275e0af5622aee7aaa",
          "body": "`npm publish` is the most failure-prone step in the release pipeline\n(OIDC config drift, registry hiccups, version-pin mismatch, …). When\nit fails today, the only recovery path is to push a workflow fix and\nre-tag, which re-runs the full build matrix — hours of CI time for a\n3-line YAML fix.\n\nThis s\n[…]\nublish failure — without a pattern,\ndownload-artifact also pulls the docker job's auto-attached\n`cnap-tech~akua~<id>.dockerbuild` provenance artifact, whose\n`~`-containing name fails path validation).",
          "is_bot": false,
          "headline": "refactor(release): split publish into separately-dispatchable workflow",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T12:25:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 26,
      "commits_last_year": 523,
      "latest_release_at": "2026-07-11T23:50:28Z",
      "latest_release_tag": "v0.8.25",
      "releases_from_tags": false,
      "days_since_last_push": 4,
      "active_weeks_last_year": 13,
      "days_since_latest_release": 17,
      "mean_days_between_releases": 4.8
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 87,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "@akua-dev/sdk",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@akua-dev/sdk",
          "is_deprecated": false,
          "latest_version": "0.8.25",
          "repository_url": "https://github.com/akua-dev/akua",
          "versions_count": 26,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 2005,
          "first_published_at": "2026-04-27T12:42:24.932000Z",
          "latest_published_at": "2026-07-21T08:15:17.042000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 7
        },
        {
          "name": "@akua-dev/native",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [
            "akua",
            "napi-rs",
            "NAPI",
            "node-addon",
            "helm",
            "kustomize",
            "kcl"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@akua-dev/native",
          "is_deprecated": false,
          "latest_version": "0.8.25",
          "repository_url": "https://github.com/akua-dev/akua",
          "versions_count": 26,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 2109,
          "first_published_at": "2026-04-27T12:42:19.969000Z",
          "latest_published_at": "2026-07-21T08:15:02.097000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 7
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 5,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": null,
      "open_issues_and_prs": 25
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        ".mise.toml",
        "Taskfile.yml",
        "docs/hero-source/Taskfile.yml"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "packages/sdk/tsconfig.json"
      ],
      "toolchain_manifests": [
        "Cargo.toml",
        "crates/akua-cli/Cargo.toml",
        "crates/akua-core/Cargo.toml",
        "crates/akua-napi/Cargo.toml",
        "crates/akua-render-worker/Cargo.toml",
        "crates/engine-host-wasm/Cargo.toml",
        "crates/helm-engine-wasm/Cargo.toml",
        "crates/helm-engine-wasm/go-src/go.mod",
        "crates/kustomize-engine-wasm/Cargo.toml",
        "crates/kustomize-engine-wasm/go-src/go.mod",
        "crates/source-hash/Cargo.toml"
      ],
      "largest_source_bytes": 84955,
      "source_files_sampled": 194,
      "oversized_source_files": 4,
      "agent_instruction_files": [
        "AGENTS.md",
        "CLAUDE.md"
      ],
      "agent_instruction_max_bytes": 18329
    },
    "dependencies": {
      "manifests": [
        "Cargo.toml",
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": "published_package",
        "source": "osv",
        "findings": [],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 16,
        "malicious_count": 0,
        "assessed_package": "npm:@akua-dev/sdk@0.8.25",
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "crates",
        "npm"
      ],
      "dependencies": [
        {
          "name": "akua-core",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "clap",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_yaml",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "thiserror",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "toml",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "reqwest",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "ctrlc",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "3"
        },
        {
          "name": "ts-rs",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "12"
        },
        {
          "name": "schemars",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "wasmtime",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "43"
        },
        {
          "name": "wasmtime-wasi",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "43"
        },
        {
          "name": "engine-host-wasm",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tracing",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tracing-subscriber",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tracing-opentelemetry",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "opentelemetry",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "opentelemetry_sdk",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "opentelemetry-otlp",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tokio",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "serde",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_yaml",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "toml",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "thiserror",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "base64",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.22"
        },
        {
          "name": "kcl-lang",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "sha2",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.10"
        },
        {
          "name": "tempfile",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "3"
        },
        {
          "name": "ts-rs",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "12"
        },
        {
          "name": "schemars",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "semver",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "akua-cli",
          "manifest": "crates/akua-napi/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "akua-core",
          "manifest": "crates/akua-napi/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "napi",
          "manifest": "crates/akua-napi/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "3"
        },
        {
          "name": "napi-derive",
          "manifest": "crates/akua-napi/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "3"
        },
        {
          "name": "serde",
          "manifest": "crates/akua-napi/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "crates/akua-napi/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_yaml",
          "manifest": "crates/akua-napi/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "@akua-dev/native-engines",
          "manifest": "crates/akua-napi/package.json",
          "ecosystem": "npm",
          "version_constraint": "0.8.8"
        },
        {
          "name": "akua-core",
          "manifest": "crates/akua-render-worker/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde",
          "manifest": "crates/akua-render-worker/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "crates/akua-render-worker/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_yaml",
          "manifest": "crates/akua-render-worker/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tracing",
          "manifest": "crates/akua-render-worker/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tracing-subscriber",
          "manifest": "crates/akua-render-worker/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.3"
        },
        {
          "name": "wasmtime",
          "manifest": "crates/engine-host-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "43"
        },
        {
          "name": "wasmtime-wasi",
          "manifest": "crates/engine-host-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "43"
        },
        {
          "name": "thiserror",
          "manifest": "crates/engine-host-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "engine-host-wasm",
          "manifest": "crates/helm-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde",
          "manifest": "crates/helm-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "crates/helm-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "base64",
          "manifest": "crates/helm-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.22"
        },
        {
          "name": "thiserror",
          "manifest": "crates/helm-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "flate2",
          "manifest": "crates/helm-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "tar",
          "manifest": "crates/helm-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.4"
        },
        {
          "name": "engine-host-wasm",
          "manifest": "crates/kustomize-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde",
          "manifest": "crates/kustomize-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "crates/kustomize-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "base64",
          "manifest": "crates/kustomize-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.22"
        },
        {
          "name": "thiserror",
          "manifest": "crates/kustomize-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "flate2",
          "manifest": "crates/kustomize-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "tar",
          "manifest": "crates/kustomize-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.4"
        },
        {
          "name": "sha2",
          "manifest": "crates/source-hash/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.10"
        },
        {
          "name": "@akua-dev/native",
          "manifest": "packages/sdk/package.json",
          "ecosystem": "npm",
          "version_constraint": "0.8.8"
        },
        {
          "name": "@standard-schema/spec",
          "manifest": "packages/sdk/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.1.0"
        },
        {
          "name": "ajv",
          "manifest": "packages/sdk/package.json",
          "ecosystem": "npm",
          "version_constraint": "^8.18.0"
        },
        {
          "name": "yaml",
          "manifest": "packages/sdk/package.json",
          "ecosystem": "npm",
          "version_constraint": "^2.8.3"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 14,
        "merged_prs": 46,
        "open_issues": 11,
        "closed_ratio": 0.214,
        "closed_issues": 3,
        "closed_unmerged_prs": 15
      },
      "bus_factor": 1,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "robinbraemer",
          "commits": 517,
          "avatar_url": "https://avatars.githubusercontent.com/u/22003767?v=4"
        },
        {
          "type": "User",
          "login": "marcus-klingler",
          "commits": 1,
          "avatar_url": "https://avatars.githubusercontent.com/u/181632184?v=4"
        }
      ],
      "contributors_sampled": 2,
      "top_contributor_share": 0.998
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "pages.yml",
        "release-publish.yml",
        "release.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "Cargo.lock"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 9,
            "reason": "9 out of 10 merged PRs checked by a CI test -- score normalized to 9",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 1/29 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 4 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "89 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "1b87537aaa2f3b1aa8f6bf5d8d41313511aee6ef",
        "ran_at": "2026-07-29T07:41:12Z",
        "aggregate_score": 4.7,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-21T10:30:47Z",
      "oldest_open_prs": [
        {
          "number": 5,
          "created_at": "2026-04-18T05:52:46Z",
          "last_comment_at": "2026-07-24T05:17:43Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 8,
          "created_at": "2026-04-18T13:26:21Z",
          "last_comment_at": "2026-07-24T05:17:42Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 25,
          "created_at": "2026-04-26T03:46:15Z",
          "last_comment_at": "2026-05-07T21:12:53Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 28,
          "created_at": "2026-04-26T06:24:19Z",
          "last_comment_at": "2026-07-24T05:17:44Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 29,
          "created_at": "2026-04-26T06:24:27Z",
          "last_comment_at": "2026-07-24T05:17:45Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 30,
          "created_at": "2026-04-27T14:19:36Z",
          "last_comment_at": "2026-07-24T05:17:41Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 31,
          "created_at": "2026-04-27T14:19:57Z",
          "last_comment_at": "2026-05-07T21:12:51Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 52,
          "created_at": "2026-05-07T21:14:46Z",
          "last_comment_at": "2026-05-08T03:40:55Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 84,
          "created_at": "2026-07-24T05:17:34Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 85,
          "created_at": "2026-07-24T05:17:39Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 86,
          "created_at": "2026-07-24T09:08:19Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 87,
          "created_at": "2026-07-24T09:08:25Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 88,
          "created_at": "2026-07-24T12:47:38Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 89,
          "created_at": "2026-07-24T12:49:29Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ],
      "last_merged_pr_at": "2026-07-21T10:30:05Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 67,
          "created_at": "2026-07-07T22:28:32Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 73,
          "created_at": "2026-07-13T16:40:34Z",
          "last_comment_at": "2026-07-14T07:01:46Z",
          "last_comment_author": "robinbraemer"
        },
        {
          "number": 74,
          "created_at": "2026-07-13T16:41:36Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 75,
          "created_at": "2026-07-13T16:44:22Z",
          "last_comment_at": "2026-07-14T07:01:58Z",
          "last_comment_author": "robinbraemer"
        },
        {
          "number": 76,
          "created_at": "2026-07-13T16:56:08Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 77,
          "created_at": "2026-07-13T16:58:28Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 78,
          "created_at": "2026-07-13T16:58:39Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 79,
          "created_at": "2026-07-13T16:58:51Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 80,
          "created_at": "2026-07-13T17:03:38Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 81,
          "created_at": "2026-07-13T17:03:55Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 82,
          "created_at": "2026-07-13T17:04:24Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/akua-dev/akua",
    "host": "github.com",
    "name": "akua",
    "owner": "akua-dev"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 63,
      "inputs": {
        "security": 58,
        "vitality": 80,
        "community": 49,
        "governance": 49,
        "engineering": 80
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 80,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "good",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 73,
            "inputs": {
              "commits_last_year": 523,
              "human_commit_share": 1,
              "days_since_last_push": 4,
              "active_weeks_last_year": 13
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 4 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 4
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "13/52 weeks with commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 13
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "523 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 523
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "releases_count": 26,
              "latest_release_tag": "v0.8.25",
              "releases_from_tags": false,
              "days_since_latest_release": 17,
              "mean_days_between_releases": 4.8
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "26 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 26
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 17 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 17
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~4.8 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 4.8
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 49,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "forks": 0,
              "stars": 5,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "5 stars",
                "points": 9.8,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 5
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "excellent",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 60,
            "inputs": {
              "packages": [
                "@akua-dev/sdk",
                "@akua-dev/native"
              ],
              "dependents": null,
              "ecosystems": "npm",
              "total_downloads": null,
              "monthly_downloads": 4114
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "4,114 downloads/month across npm",
                "points": 48.2,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 4114,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 49,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 22,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 2,
              "top_contributor_share": 0.998
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "2 contributors",
                "points": 2.7,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 4 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "at_risk",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 39,
            "inputs": {
              "merged_prs": 46,
              "open_issues": 11,
              "closed_issues": 3,
              "issue_closed_ratio": 0.214,
              "closed_unmerged_prs": 15
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "21% of issues closed",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 21
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "46/61 decided PRs merged",
                "points": 28.8,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 46,
                      "decided": 61
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 1/29 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 51,
            "inputs": {
              "followers": 11,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "akua-dev",
              "public_repos": 15,
              "account_age_days": 769
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "11 followers of akua-dev",
                "points": 7.8,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 11,
                      "login": "akua-dev"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "15 public repos, account ~2 yr old",
                "points": 13,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 15
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 2
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "@akua-dev/sdk",
                "@akua-dev/native"
              ],
              "ecosystems": "npm",
              "any_deprecated": false,
              "min_days_since_publish": 7
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "2 package(s) on npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 2,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 7 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 7
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "26 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 26
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 80,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 66,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "4 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "9 out of 10 merged PRs checked by a CI test -- score normalized to 9",
                "points": 18,
                "status": "partial",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "topics": [
                "devops",
                "helm",
                "infrastructure-as-code",
                "kcl",
                "kubernetes",
                "kustomize",
                "rust",
                "security",
                "webassembly",
                "agentic-infra",
                "aumakua"
              ],
              "has_wiki": true,
              "homepage": "https://cli.akua.dev",
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://cli.akua.dev",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "11 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 11
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 58,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": null,
            "notes": [],
            "value": 47,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 18,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 0,
              "scorecard_aggregate": 4.7
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "9 out of 10 merged PRs checked by a CI test -- score normalized to 9",
                "points": 2.2,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 1/29 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 4 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "89 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:@akua-dev/sdk@0.8.25 runtime dependency closure — what installing the published package pulls in — 16 packages. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_published",
                "params": {
                  "package": "npm:@akua-dev/sdk@0.8.25",
                  "assessed": 16
                }
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 0,
              "affected_packages": 0,
              "assessed_packages": 16,
              "unassessed_packages": 0,
              "affected_by_severity": "none",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "no indirect dependency carries a known advisory",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "no_indirect_advisories",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 16,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 5
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 71,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [
                "AGENTS.md",
                "CLAUDE.md"
              ],
              "agent_instruction_max_bytes": 18329
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "AGENTS.md, CLAUDE.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "AGENTS.md, CLAUDE.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "100 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 100,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 61,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "Cargo.lock"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                ".mise.toml",
                "Taskfile.yml",
                "docs/hero-source/Taskfile.yml"
              ],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [
                "packages/sdk/tsconfig.json"
              ],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "Cargo.toml",
                "crates/akua-cli/Cargo.toml",
                "crates/akua-core/Cargo.toml",
                "crates/akua-napi/Cargo.toml",
                "crates/akua-render-worker/Cargo.toml",
                "crates/engine-host-wasm/Cargo.toml",
                "crates/helm-engine-wasm/Cargo.toml",
                "crates/helm-engine-wasm/go-src/go.mod",
                "crates/kustomize-engine-wasm/Cargo.toml",
                "crates/kustomize-engine-wasm/go-src/go.mod",
                "crates/source-hash/Cargo.toml"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": ".mise.toml, Taskfile.yml, docs/hero-source/Taskfile.yml",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".mise.toml, Taskfile.yml, docs/hero-source/Taskfile.yml"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "packages/sdk/tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "packages/sdk/tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 99,
            "inputs": {
              "primary_language": "Rust",
              "largest_source_bytes": 84955,
              "source_files_sampled": 194,
              "oversized_source_files": 4
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Rust (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Rust"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "4/194 source files over 60KB",
                "points": 53.9,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 194,
                      "oversized": 4
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "Could not fetch crates package 'akua-cli' from its registry",
    "Could not fetch crates package 'akua-core' from its registry",
    "Could not fetch crates package 'akua-napi' from its registry",
    "Could not fetch crates package 'source-hash' from its registry",
    "Could not fetch crates package 'engine-host-wasm' from its registry",
    "Could not fetch crates package 'helm-engine-wasm' from its registry",
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-29T07:41:23.917526Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/a/akua-dev/akua.svg",
  "full_name": "akua-dev/akua",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}

相关记录

与 akua-dev/akua 共享目录标签或生态系统的已检测仓库。 并排阅读 →

87fluxcd/flux2Open and extensible continuous delivery solution for Kubernetes. Powered by GitOps Toolkit.优秀89Gravitational/teleportThe easiest, and most secure way to access and protect all of your infrastructure.优秀88valkey-io/valkey-glideAn open source Valkey client library that supports Valkey, and Redis open source 6.2, 7.0 and 7.2. Valkey GLIDE is designed for reliability, optimized performance, and high-availability, for Valkey and Redis OSS based applications. GLIDE is a multi language client library, written in Rust with programming language bindings, such as Java and Python优秀91authelia/autheliaThe Single Sign-On Multi-Factor portal for web apps, now OpenID Certified™优秀89dynemo-ai/dynemoA Datacenter Scale Distributed Inference Serving Framework优秀88marapongo/muPulumi - Infrastructure as Code in any programming language 🚀优秀

评分是信号，而非担保。 评分反映的是 GitHub 上公开可见的实践——不是代码审计，也不是安全保证。

缺失数据将被剔除并重新归一化权重，绝不按零分计。方法论已版本化并公开：指标 v1.13.0、模式 v0.27.0—— 完整方法论 · 指标知识库.

单项结果在整体记录中的位置： 汇总统计 — npm.