eugeneswalker / spack

来自 GitHub 依赖图的完整解析依赖集合：1 个直接依赖与 25 个间接（传递）软件包。仓库提交锁文件时，传递闭包才是完整的。

该仓库未发布可被索引解析的包，因此评估的是其自身的依赖图——共 24 个包，其中也包含从不交付的开发与测试版本固定：1 个存在已知公告，0 个为直接依赖。 有 2 个无法评估——没有已解析的版本、生态系统不受支持，或不在所列包清单之内。

公告表示依赖图中记录的版本落入某条公告的受影响范围。可达性未经分析，且依赖图包含开发与测试的版本固定——某项发现可能只涉及工具链而非交付的软件。

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": true,
      "size_kb": 235167,
      "has_wiki": true,
      "homepage": "https://spack.io",
      "languages": {
        "C": 38431,
        "Lua": 3080,
        "Tcl": 3709,
        "HTML": 2418,
        "CMake": 4652,
        "Shell": 527947,
        "Python": 8237152,
        "Lambdapi": 127837,
        "Makefile": 9844,
        "Batchfile": 12132,
        "Dockerfile": 11727,
        "PowerShell": 8058,
        "Standard ML": 22142,
        "Answer Set Programming": 14743
      },
      "pushed_at": "2026-07-06T22:42:57Z",
      "created_at": "2019-08-29T17:04:43Z",
      "owner_type": "User",
      "updated_at": "2026-07-04T16:35:08Z",
      "description": "A flexible package manager that supports multiple versions, configurations, platforms, and compilers.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "develop",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Python",
      "significant_languages": [
        "Python"
      ]
    },
    "owner": {
      "blog": null,
      "name": null,
      "type": "User",
      "login": "eugeneswalker",
      "company": null,
      "location": null,
      "followers": 3,
      "avatar_url": "https://avatars.githubusercontent.com/u/38933153?v=4",
      "created_at": "2018-05-03T04:28:18Z",
      "is_verified": null,
      "public_repos": 64,
      "account_age_days": 3006
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": false
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.13.3",
          "kind": "patch",
          "published_at": "2019-12-24T07:48:11Z"
        },
        {
          "tag": "v0.12.1",
          "kind": "patch",
          "published_at": "2019-01-13T22:29:07Z"
        },
        {
          "tag": "v0.12.0",
          "kind": "minor",
          "published_at": "2018-11-13T17:05:17Z"
        },
        {
          "tag": "v0.11.2",
          "kind": "patch",
          "published_at": "2018-02-07T16:45:29Z"
        },
        {
          "tag": "v0.11.1",
          "kind": "patch",
          "published_at": "2018-01-19T21:28:26Z"
        },
        {
          "tag": "v0.11.0",
          "kind": "minor",
          "published_at": "2018-01-17T22:14:45Z"
        },
        {
          "tag": "v0.10.0",
          "kind": "minor",
          "published_at": "2017-01-17T09:36:03Z"
        },
        {
          "tag": "v0.9.1",
          "kind": "patch",
          "published_at": "2016-05-18T15:30:13Z"
        },
        {
          "tag": "v0.8.17",
          "kind": "patch",
          "published_at": "2015-03-24T17:17:18Z"
        },
        {
          "tag": "v0.8.16",
          "kind": "patch",
          "published_at": "2015-03-14T03:41:59Z"
        },
        {
          "tag": "v0.8.15",
          "kind": "patch",
          "published_at": "2015-02-24T18:42:58Z"
        },
        {
          "tag": "v0.8.11",
          "kind": "patch",
          "published_at": "2014-11-06T21:22:15Z"
        },
        {
          "tag": "v0.8.10",
          "kind": "patch",
          "published_at": "2014-10-28T06:04:47Z"
        },
        {
          "tag": "v0.8.5",
          "kind": "patch",
          "published_at": "2014-09-19T16:56:00Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "e2e5041cc1813b8a57a0acedd580f3bb6d80ba25",
          "body": "…and (#52655)\n\n`spack solve` is deprecated in favor of options on `spack spec`.\nClean up all references and uses in CI.\n\nSigned-off-by: Gregory Becker <becker33@llnl.gov>",
          "is_bot": false,
          "headline": "Remove all usage and docs references to deprecated `spack solve` comm…",
          "author_name": "Greg Becker",
          "author_login": "becker33",
          "committed_at": "2026-07-03T18:37:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c1fdef46c84f062882e042a689c2fed48e59d0b6",
          "body": "Check when validating input if any virtual assignment corresponds to\nvirtuals the package cannot depend on.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "solver: improve input checking for virtuals (#52645)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-03T12:57:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "913c85673a3ce076ef905489826d3f9d8adb7e54",
          "body": "The new installer has a strict check that ensures uninstalled specs\nupstream cannot be built locally.\n\nIn practice, also thanks to the new installer, build dependencies can be\nmissing in the upstream. Some people use `spack gc`, others prepare the\nupstream using `spack install` from a buildcache, wh\n[…]\n\n\nSo: the installer simply installs the missing specs locally, and when users\nmanage their upstream correctly this is unlikely to be problematic.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer.py: allow local install if missing upstream (#52630)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-03T12:46:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b94f544a06c808220b6d8ab352ce106b66e187e0",
          "body": "When installing a spec explicitly that was already installed implicitly,\nthe action is just to mark it explicit in the database.\n\nThat works fine, but the order of operations is suboptimal. Currently\nyou get stuck in `select` on nothing, which means a second of delay, or\nfive seconds in non-interactive mode.\n\nThis commit improves ordering so it's instant when no other process\nholds a database lock.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer.py: flush DB before select (#52646)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-03T09:46:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b5b06bc036896af346e9ca16ac1183af4333eed7",
          "body": "The input file\n[py-hatchet.lp.zip](https://github.com/user-attachments/files/29584567/py-hatchet.lp.zip)\nis solving very slow ly on 741ddafc339a0b2fde871d29be07d884a4d779a3, and\n`clingo` stalls trying to prove optimality of the \"build unification sets\" criterion.\n\nIn this PR we:\n- Adapt heuristics so that we decide on `build_set_id` early\n- Trim the search space by imposing a no-gap rule on build set ids\n\n---------\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "solver: improve decisions on `build_set_id` (#52634)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-03T06:34:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "107e64610708824fa34afdacf17c89bc18f80692",
          "body": null,
          "is_bot": false,
          "headline": "new_installer.py: import error on wrong platform (#52647)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-02T22:34:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2ec794aa32d627423ae829405e008b18ae75ba7c",
          "body": "The install tests used nixlog, which is heavy machinery to do something\nlike `... | tee test.log`: it spawns a daemon process (even two under\nforkserver), inside a build process that is already redirected. The\njobserver daemon it created also kept the write end of the new\ninstaller's output pipe ope\n[…]\ndio` fd juggling, used by nixlog,\n    threadlog and the new installer's Tee\n\nThe log_output unit tests now run against both nixlog and threadlog.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "install_test.py: do not use multiprocessing for IO (#52618)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-02T21:42:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5e11d599159afe2b22fb4971e07f9ed5b9ee25ee",
          "body": null,
          "is_bot": false,
          "headline": "Fix warning message construction (#52638)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-02T19:28:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "24892c072f374f97f495de1d75a945aeaca2762c",
          "body": "#52411 introduced a regression in the error message reporting mechanism,\nbecause it's not passing `has_provider/1` to `error_message.lp`\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "solver: add missing fact in display.lp (#52640)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-02T15:18:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5ad542d8283cb3e63d2722bdaa4c8f0502d2e8a4",
          "body": "refers #52620\n\nIn 2023 we had `concretization:unify:true`. Now this option is under the\n`concretizer` section, so fix the stale message.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "environment: fix a stale error message (#52639)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-02T14:37:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "741ddafc339a0b2fde871d29be07d884a4d779a3",
          "body": "Rarely used, but used.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "libc.py: fix typo (#52626)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-07-01T14:39:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bd85d21e3b11c41d842c9a6744beddf342e3514c",
          "body": "Currently, config.py depends on the `active_environment()` for path\nsubstitutions, creating a circular dependency between `spack.config` and\n`spack.environment`.\n\nHere we add an attribute to record the active environment's path on the\nConfiguration object during activation in order to remove the circular\ndependency.\n\n---------\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "config: remove circular dependency with env (#52627)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-07-01T14:07:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5817ab9613f211442a2747b304960c556797c40f",
          "body": "Closes #52573.\n\nFixes a hang of the new installer under forkserver (Python 3.14+ on\nLinux and\nmacOS in general)\n\nThe Tee thread exits when log pipe's read end hits EOF, which happens\nwhen all fds referring to the write end have been closed. When using\nforkserver based multiprocessing, the forkserver\n[…]\nol pipe to\nsignal it's time to exit.\n\nIndependently of this I'd like to get rid of multiprocessing in\ninstall_test.py,\nwhich triggered the issue.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer.py: exit tee thread w/ control byte (#52621)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-29T12:32:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8c1fb030538af4121c7889db51adb52c9899be8c",
          "body": "On overlayfs (like docker build) `os.rename(...)` does not work for\ndirectories if the dir is part of a lower layer. If that errors, just\nremove the dir recursively.\n\nSee\nhttps://docs.docker.com/engine/storage/drivers/overlayfs-driver/#renaming-directories.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "view: fix rename on overlayfs issue (#52594)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-29T08:52:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9dc979613c79c9e8233f48dbe0fd71797d6b9b7d",
          "body": "Signed-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "concretize.lp: speed-up solve with grounding improvements (#52605)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-29T08:42:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "32b08c1a451a1fca640e8552a32f93153b4cb310",
          "body": "Modifications:\n\n* Eliminated subclasses for `FileLayout` and `ModuleContext`\n* Reduced the number of time we re-read configuration (less\n`spack.config.get` calls in favor of `get_config` and reading from the\nstored dict)\n* Configuration caches are per-class, not per module\n* `*ModuleFileWriter` take\n[…]\nt during construction\n(a `from_spec()` classmethod replaces the old constructor)\n* Errors have been extracted to `spack.modules.error`\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "modules: refactor classes and clean-up code (#52522)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-06-29T07:25:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c7cea1aa274e796ebb083eaf067cf09ce30d6f2c",
          "body": "Modifications:\n* Introduce the concepts of hierarchical vs. flat layout early\n* Clearly divide layout from content\n* Reorder \"Module content\" subsections to match logical flow:\n  - global modifications first (prefix inspections)\n  - then config rules\n  - then package.py callbacks\n* Flatten \"Maintaining Module Files\" subheadings into prose \n* Tighten prose throughout.\n\n---------\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "modules: overhaul module file documentation (#52536)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-06-27T09:42:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4f0b78faf245b31fd424a77eb000f8f4cf1868dd",
          "body": "This reduces the verbosity of the nodes produced by `spack graph --dot`.\n\n* `{%compiler}` is redundant because the compiler has its own node\n* add `-l/--long`, `-L/--very-long` flags for hash, default to no hash\n\nThat way `spack graph --dot pkg | tred` looks readable (even better with\n`rankdir = \"LR\"`)\n\n---------\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "graph.py: drop compiler, use flags for hashes (#52614)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-26T19:07:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5f7d63e806c554b57e8fcece8dc6647d248cf40f",
          "body": "The `spack develop` and `spack undevelop` short descriptions were vague and\ninconsistent about what they operate on. This updates them to refer to the\nenvironment's `develop:` section:\n\n* `develop`: \"add a spec to an environment's develop: section\"\n* `undevelop`: \"remove specs from an environment's develop: section\"\n\nNo functional change.\n\nSigned-off-by: Todd Gamblin <tgamblin@llnl.gov>",
          "is_bot": false,
          "headline": "Clarify develop and undevelop command descriptions (#52612)",
          "author_name": "Todd Gamblin",
          "author_login": "tgamblin",
          "committed_at": "2026-06-26T17:11:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fa79456782a514ea0713eea9c4aeacdb264d55aa",
          "body": "See https://github.com/spack/spack/issues/52599\nThe unit tests might be a bit overkill but they do test all of the\npossible code paths and are as large as they are mainly because of the\nmocks.\n\n---------\n\nSigned-off-by: dsjense <dsjense@sandia.gov>\nSigned-off-by: John Parent <john.parent@kitware.com>\nCo-authored-by: John Parent <john.parent@kitware.com>",
          "is_bot": false,
          "headline": "Fix temp_cwd logic on non-Windows platforms (#52600)",
          "author_name": "danielsjensen1",
          "author_login": "danielsjensen1",
          "committed_at": "2026-06-26T15:24:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e28340e849f06dfb54b1a972e68b02a4f2563a66",
          "body": "Add a `--no-deprecated` flag to limit outputting deprecated specs in\n`spack repo show-version-updates`.\n\nIf you're creating a mirror with the output of `spack repo\nshow-version-updates` you likely do not want to mirror new deprecated\nversions into your source mirror. (And if you do you'll need to\nsp\n[…]\nrom `spack.repo.PATH.get_pkg_class()` to\n`repo.get_pkg_class()` since we are specifically looking at one\nrepository at a time during this command.\n\n---------\n\nSigned-off-by: Alec Scott <alec@llnl.gov>",
          "is_bot": false,
          "headline": "repo cmd: add --no-deprecated flag to show-version-updates (#52391)",
          "author_name": "Alec Scott",
          "author_login": "alecbcs",
          "committed_at": "2026-06-26T14:58:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a534e6456a11aae3f3306a964eb60a9fb2c4ee91",
          "body": "I think this is not worth pointing out anymore. The user will see\nprogress of the initial git clone anyways.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "getting_started.rst: remove warning about slow start (#52186)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-26T08:16:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d975891ecbbc170178e1313accc668f9fae6a31b",
          "body": "Bumps [actions/setup-python](https://github.com/actions/setup-python)\nfrom 6.2.0 to 6.3.0.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/actions/setup-python/releases\">actions/setup-python's\nreleases</a>.</em></p>\n<blockquote>\n<h2>v6.3.0</h2>\n<h2>What's C\n[…]\nnless you reopen the\nPR or upgrade to it yourself)\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#52608)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-26T07:56:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "11227cfc0fdbbcab7acdd1848a3394806b183126",
          "body": "…ib/spack/docs (#52609)\n\nBumps\n[sphinxcontrib-programoutput](https://github.com/OpenNTI/sphinxcontrib-programoutput)\nfrom 0.19 to 0.20.\n<details>\n<summary>Changelog</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/OpenNTI/sphinxcontrib-programoutput/blob/master/CHANGES.rst\">sphinxcontrib-pr\n[…]\nnless you reopen the\nPR or upgrade to it yourself)\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump sphinxcontrib-programoutput from 0.19 to 0.20 in /l…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-26T07:55:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9627aa7fc4990a175d5e81b992a0b898e2bd7258",
          "body": "I am working on combining the spack.llnl and spack.util.llnl modules\ninto the spack.util module. The abstraction is leaky, the distinction\nbetween the two is weak, and I don't think it's serving us anymore.\n\nI'm going to try to keep these PRs small and separate. They'll probably\nconflict with each other, but I expect the rebasing to be trivial.\n\n---------\n\nSigned-off-by: Gregory Becker <becker33@llnl.gov>",
          "is_bot": false,
          "headline": "Move spack.llnl.util.lock into spack.util.lock (#52511)",
          "author_name": "Greg Becker",
          "author_login": "becker33",
          "committed_at": "2026-06-25T09:58:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e91c987c3e96c7b1d755c4deb53d254cb8f21a04",
          "body": "Fixes #52602 \n\nMacos needs to know about older operating systems, to reconstruct specs\nfrom them, but it doesn't need to expose them to the solver unless they\nare coming in from a reused spec.\n\nGeneralized to a `buildable_oses` method on the `Platform` class.\n\n---------\n\nSigned-off-by: Gregory Becker <becker33@llnl.gov>\nCo-authored-by: becker33 <becker33@users.noreply.github.com>",
          "is_bot": false,
          "headline": "performance bugfix: only expose buildable oses to solver (#52604)",
          "author_name": "Greg Becker",
          "author_login": "becker33",
          "committed_at": "2026-06-25T07:30:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4dfd0a28f90ec890b9f361d8feac0cdb614af677",
          "body": "I am working on combining the spack.llnl and spack.util.llnl modules\ninto the spack.util module. The abstraction is leaky, the distinction\nbetween the two is weak, and I don't think it's serving us anymore.\n\nI'm going to try to keep these PRs small and separate. They'll probably\nconflict with each other, but I expect the rebasing to be trivial.\n\n---------\n\nSigned-off-by: Gregory Becker <becker33@llnl.gov>",
          "is_bot": false,
          "headline": "Move spack.llnl.util.lang to spack.util.lang (#52507)",
          "author_name": "Greg Becker",
          "author_login": "becker33",
          "committed_at": "2026-06-24T17:35:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f9bb703a3a1ccedeb179a6233cecce34d82bcb08",
          "body": "Currently, the rule on OS compatibility is O(E * OS^2).\n\nDue to the large number of edges, this has a huge performance impact on\nthe concretizer on macOS.\n\nThis PR turns it into O(N *O S^2 + E * OS) which should be much more\ntractable, since in our problems the number of nodes is << than the\nnumber of edges.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "solver: improve os compatibility encoding (#52603)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-06-24T11:37:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cc7576db0b1a58283e36cd6cc5333e3aff2aaed3",
          "body": "Bumps [pytest](https://github.com/pytest-dev/pytest) from 9.1.0 to\n9.1.1.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/pytest-dev/pytest/releases\">pytest's\nreleases</a>.</em></p>\n<blockquote>\n<h2>9.1.1</h2>\n<h1>pytest 9.1.1 (2026-06-19)</h1>\n<h2>Bug fixe\n[…]\nnless you reopen the\nPR or upgrade to it yourself)\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump pytest from 9.1.0 to 9.1.1 in /lib/spack/docs (#52601)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-24T04:37:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5074c104d37221fab371a5d2c872e4c7604ec601",
          "body": "This should prevent issues like spack/spack-packages#5223 where a\npackage definition accidentally inherits only from `BasePackage` (or a\nmixin).\n\n---------\n\nSigned-off-by: Seth R Johnson <johnsonsr@ornl.gov>",
          "is_bot": false,
          "headline": "Add audit for testing missing builders (#52577)",
          "author_name": "Seth R. Johnson",
          "author_login": "sethrj",
          "committed_at": "2026-06-24T04:16:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "42fb1da1726b663c595a6433189d43f07e36d25e",
          "body": "Signed-off-by: Gregory Becker <becker33@llnl.gov>",
          "is_bot": false,
          "headline": "spack solve: correct deprecation version from 1.3 to 1.4 (#52597)",
          "author_name": "Greg Becker",
          "author_login": "becker33",
          "committed_at": "2026-06-24T04:14:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5f5d3328847e8e1c50c82951fc7d66cc2c33be41",
          "body": "I am working on combining the spack.llnl and spack.util.llnl modules\ninto the spack.util module. The abstraction is leaky, the distinction\nbetween the two is weak, and I don't think it's serving us anymore.\n\nI'm going to try to keep these PRs small and separate. They'll probably\nconflict with each other, but I expect the rebasing to be trivial.\n\n---------\n\nSigned-off-by: Alec Scott <alec@llnl.gov>\nSigned-off-by: Gregory Becker <becker33@llnl.gov>\nCo-authored-by: Alec Scott <hi@alecbcs.com>",
          "is_bot": false,
          "headline": "Move spack.llnl.util.filesystem into spack.util.filesystem (#52504)",
          "author_name": "Greg Becker",
          "author_login": "becker33",
          "committed_at": "2026-06-23T16:52:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "965d02d8f2a3b29980b1a929585c425427861bcb",
          "body": "Deprecated in favor of `spack spec` with additional flags.\n\n---------\n\nSigned-off-by: Gregory Becker <becker33@llnl.gov>",
          "is_bot": false,
          "headline": "Deprecate spack solve (#52596)",
          "author_name": "Greg Becker",
          "author_login": "becker33",
          "committed_at": "2026-06-23T14:51:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d10dcb72a1b032a9f761045808a88ed9fad7658e",
          "body": "In order to avoid increasing circular imports, this PR also moves the\n`canonicalize_path` and related functions from `spack.util.path` to\n`spack.config`, which is a more natural home for them anyway.\n\nIt also required slight modifications to the\n`spack.util.remote_file_cache.local_path` method to mo\n[…]\nI'm going to try to keep these PRs small and separate. They'll probably\nconflict with each other, but I expect the rebasing to be trivial.\n\n---------\n\nSigned-off-by: Gregory Becker <becker33@llnl.gov>",
          "is_bot": false,
          "headline": "move spack.llnl.path into spack.util.path (#52496)",
          "author_name": "Greg Becker",
          "author_login": "becker33",
          "committed_at": "2026-06-23T14:38:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2b9bbcf9cb4913d1c3af0102052b6fea68836e01",
          "body": "Introduce the `hierarchical` option that defines whether the module\nfiles should be organized in a hierarchical way. With this option it is\nnow possible to organize Tcl module files in hierarchical way and Lua\nmodule files in non-hierarchical way.\n    \nTo preserve compatibility, this option defaults\n[…]\n--------\n\nSigned-off-by: Xavier Delaruelle <xavier.delaruelle@cea.fr>\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>\nCo-authored-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "modules: add the `hierarchical` configuration option (#52024)",
          "author_name": "Xavier Delaruelle",
          "author_login": "xdelaruelle",
          "committed_at": "2026-06-23T12:59:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "271e2c8f01f471fe590fb5b497deea109e9ffc03",
          "body": "Allow multiple `py-setuptools-scm` specs in a dependency graph to help\nwith constrained build dep packages.\n\nSigned-off-by: Alec Scott <alec@llnl.gov>",
          "is_bot": false,
          "headline": "Allow multiple py-setuptools-scm specs in a dependency graph (#52595)",
          "author_name": "Alec Scott",
          "author_login": "alecbcs",
          "committed_at": "2026-06-23T09:44:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b7d28c2b71e6fecc602934a82ba819168e0ceeaf",
          "body": "Bug discovered live in tutorial.\n\n@adamjstewart\n\n---------\n\nSigned-off-by: Gregory Becker <becker33@llnl.gov>",
          "is_bot": false,
          "headline": "fish shell support: add 'spacktivate' alias (#52588)",
          "author_name": "Greg Becker",
          "author_login": "becker33",
          "committed_at": "2026-06-23T09:17:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "92eff58979c874b8345e25e3e3df155f863be973",
          "body": "Bumps [pytest](https://github.com/pytest-dev/pytest) from 9.0.3 to\n9.1.0.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/pytest-dev/pytest/releases\">pytest's\nreleases</a>.</em></p>\n<blockquote>\n<h2>9.1.0</h2>\n<h1>pytest 9.1.0 (2026-06-13)</h1>\n<h2>Removals\n[…]\nnless you reopen the\nPR or upgrade to it yourself)\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump pytest from 9.0.3 to 9.1.0 in /lib/spack/docs (#52548)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-23T05:54:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "65a14f79a9a9a5202105061995ede789f3a3abea",
          "body": "Apply ruff FLY002 where a str.join() over a short, fixed set of values\nis\nclearer as an f-string. Left as-is the few multi-line joins (a large\nalternation regex in solver/asp.py and multi-path test fixtures) that\nread\nbetter as lists.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "style: static join -> f-string (#52593)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-22T14:03:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fcf3f17402d2c11a952a61118a670cec5335c828",
          "body": "Resolves https://github.com/spack/spack/issues/52583\n\nSigned-off-by: Maciej Wójcik <w8jcik@gmail.com>",
          "is_bot": false,
          "headline": "Handle empty list of URLs when generating BOM (#52585)",
          "author_name": "Maciej Wójcik",
          "author_login": "w8jcik",
          "committed_at": "2026-06-22T13:27:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9efb3da39083b2111614618221818c8adf6365cc",
          "body": "I am working on combining the `spack.llnl` and `spack.util.llnl` modules\ninto the `spack.util` module. The abstraction is leaky, the distinction\nbetween the two is weak, and I don't think it's serving us anymore.\n\nI'm going to try to keep these PRs small and separate. They'll probably\nconflict with each other, but I expect the rebasing to be trivial.\n\n---------\n\nSigned-off-by: Gregory Becker <becker33@llnl.gov>\nCo-authored-by: becker33 <becker33@users.noreply.github.com>",
          "is_bot": false,
          "headline": "move spack.llnl.string to spack.util.string (#52492)",
          "author_name": "Greg Becker",
          "author_login": "becker33",
          "committed_at": "2026-06-22T11:38:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4f08bb4b0d17d8b9539ab4a4baaa5b184f14741d",
          "body": "`spack location -v` (or `--view`) crashed when there was no active\nenvironment:\n\n    ==> Error: 'str' object has no attribute 'error'\n\n`require_active_env()` expects the command's subparser (it calls\n`parser.error(...)` and reads `parser.prog`), but it was being passed\nthe string \"location -v\". Pass `args.subparser` instead, consistent with\nthe other calls in this command, so the user gets the proper \"requires\nan active environment\" message.\n\nSigned-off-by: Todd Gamblin <tgamblin@llnl.gov>",
          "is_bot": false,
          "headline": "spack location: fix crash with -v / --view (#52587)",
          "author_name": "Todd Gamblin",
          "author_login": "tgamblin",
          "committed_at": "2026-06-22T10:52:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bb2cdd8222549fdc6acb8925d9af3aefeea5d3cf",
          "body": "I am working on combining the spack.llnl and spack.util.llnl modules\ninto the spack.util module. The abstraction is leaky, the distinction\nbetween the two is weak, and I don't think it's serving us anymore.\n\nI'm going to try to keep these PRs small and separate. They'll probably\nconflict with each other, but I expect the rebasing to be trivial.\n\n---------\n\nSigned-off-by: Gregory Becker <becker33@llnl.gov>",
          "is_bot": false,
          "headline": "move llnl.util.argparsewriter to spack.util.argparsewriter (#52497)",
          "author_name": "Greg Becker",
          "author_login": "becker33",
          "committed_at": "2026-06-22T10:46:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "11c083f4bbece51420eea32e07824bc51dbce534",
          "body": "I am working on combining the spack.llnl and spack.util.llnl modules\ninto the spack.util module. The abstraction is leaky, the distinction\nbetween the two is weak, and I don't think it's serving us anymore.\n\nI'm going to try to keep these PRs small and separate. They'll probably\nconflict with each other, but I expect the rebasing to be trivial.\n\nSigned-off-by: Gregory Becker <becker33@llnl.gov>",
          "is_bot": false,
          "headline": "move spack.llnl.util.link_tree to spack.util.link_tree (#52510)",
          "author_name": "Greg Becker",
          "author_login": "becker33",
          "committed_at": "2026-06-22T10:45:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e92e2e4990fbcc3049ed198627d3f3721f214478",
          "body": "I am working on combining the spack.llnl and spack.util.llnl modules\ninto the spack.util module. The abstraction is leaky, the distinction\nbetween the two is weak, and I don't think it's serving us anymore.\n\nI'm going to try to keep these PRs small and separate. They'll probably\nconflict with each other, but I expect the rebasing to be trivial.\n\nSigned-off-by: Gregory Becker <becker33@llnl.gov>",
          "is_bot": false,
          "headline": "move spack.llnl.url into spack.util.url (#52494)",
          "author_name": "Greg Becker",
          "author_login": "becker33",
          "committed_at": "2026-06-22T10:42:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "faa14e1c4943025dbf14505ebbc97027868950fd",
          "body": "…h (#52586)\n\nThe fish `stream_args` and `shift_args` helpers emitted each argument\nwith `echo $elt`. When an argument was `-e` (or `-n`, `-E`), fish's\n`echo` interpreted it as one of its own flags and dropped it, turning\nthe argument into an empty string.\n\nAs a result `spack cd -e default` was rewri\n[…]\n does not interpret\nleading-dash arguments. This fixes `spack cd -e` and any other\nfish-wrapped subcommand whose arguments include `-e`, `-n`, or `-E`.\n\nSigned-off-by: Todd Gamblin <tgamblin@llnl.gov>",
          "is_bot": false,
          "headline": "setup-env.fish: fix `spack cd -e` and other dash-prefixed args in fis…",
          "author_name": "Todd Gamblin",
          "author_login": "tgamblin",
          "committed_at": "2026-06-22T10:34:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "665899e0c290cfa4b93a78e96b9b11cf0e6bacc1",
          "body": "This module was deprecated in 1.0 and scheduled for removal in 1.1. It\nwill now be removed in v1.3.\n\nSigned-off-by: Gregory Becker <becker33@llnl.gov>",
          "is_bot": false,
          "headline": "llnl.util.symlink: remove symlink shim (#52512)",
          "author_name": "Greg Becker",
          "author_login": "becker33",
          "committed_at": "2026-06-22T10:33:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "92c2db2f835ded6d650b55202c22c773115d4420",
          "body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3\nto 7.0.0.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/actions/checkout/releases\">actions/checkout's\nreleases</a>.</em></p>\n<blockquote>\n<h2>v7.0.0</h2>\n<h2>What's Changed</h2>\n<ul>\n[…]\nnless you reopen the\nPR or upgrade to it yourself)\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#52570)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-22T10:27:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f30720e373b616144e384b32f05a77170077ac12",
          "body": "Bumps [actions/labeler](https://github.com/actions/labeler) from 6.0.1\nto 6.1.0.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/actions/labeler/releases\">actions/labeler's\nreleases</a>.</em></p>\n<blockquote>\n<h2>v6.1.0</h2>\n<h2>Enhancements</h2>\n<ul>\n<li>A\n[…]\nbled on this pull request as it has\nbeen open for over 30 days.\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump actions/labeler from 6.0.1 to 6.1.0 (#52379)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-22T10:24:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7b30caddefda575bb34b28edcc12c621455f2fde",
          "body": "Bumps\n[docker/setup-qemu-action](https://github.com/docker/setup-qemu-action)\nfrom 4.0.0 to 4.1.0.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/docker/setup-qemu-action/releases\">docker/setup-qemu-action's\nreleases</a>.</em></p>\n<blockquote>\n<h2>v4.1.0</\n[…]\n858b16962ea869c3\">compare\nview</a></li>\n</ul>\n</details>\n<br />\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0 (#52454)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-22T10:23:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1b0eecb77f3290c5d03c460239012074fac1e38d",
          "body": "Bumps\n[codecov/codecov-action](https://github.com/codecov/codecov-action) from\n6.0.1 to 7.0.0.\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\nhref=\"https://github.com/codecov/codecov-action/releases\">codecov/codecov-action's\nreleases</a>.</em></p>\n<blockquote>\n<h2>v7.0.0</h2>\n<p>⚠\n[…]\nnless you reopen the\nPR or upgrade to it yourself)\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 (#52509)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-22T10:22:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cfe2cec46723c914869ed2b50d13fd9a888b005b",
          "body": "… (#52576)\n\nFixes a bug reported by @sethrj on slack, in which Spack would error\nbecause the global state is not properly applied to the subprocess.\n\nSigned-off-by: Gregory Becker <becker33@llnl.gov>",
          "is_bot": false,
          "headline": "marshal spack.paths.spack_working_dir as part of GlobalStateMarshaler…",
          "author_name": "Greg Becker",
          "author_login": "becker33",
          "committed_at": "2026-06-22T07:27:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4ce2a5eb8cc9e76b94a33ca0425d2185a23effa1",
          "body": "`v1.2.0` is released, time to bump `develop`\n\nSigned-off-by: Todd Gamblin <tgamblin@llnl.gov>",
          "is_bot": false,
          "headline": "Bump `develop` version to 1.3.0dev0 (#52582)",
          "author_name": "Todd Gamblin",
          "author_login": "tgamblin",
          "committed_at": "2026-06-21T23:23:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2932d76ece6e101d8e4b2d8477a875638de28ba4",
          "body": "YAML example needed a `specs:` section.\n\nSigned-off-by: Todd Gamblin <tgamblin@llnl.gov>",
          "is_bot": false,
          "headline": "docs: fix YAML format for groups of specs in docs (#52579)",
          "author_name": "Todd Gamblin",
          "author_login": "tgamblin",
          "committed_at": "2026-06-21T21:51:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9377a7b31dab3cb3880326de764d0ebb4f782d4f",
          "body": "Signed-off-by: Todd Gamblin <tgamblin@llnl.gov>",
          "is_bot": false,
          "headline": "Update CHANGELOG.md for v1.2 (#52578)",
          "author_name": "Todd Gamblin",
          "author_login": "tgamblin",
          "committed_at": "2026-06-21T21:27:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "be1795c03308d4cd13e32c34f47d30d623672eb4",
          "body": "`spack isolate` aims to keep a Spack instance from writing to\n`~/.spack`. This will become easier (and more complete) after shared\nSpack (#52443), but this PR serves as a stopgap before that feature is\nmerged.\n\n`spack isolate ISO_PATH` does ~4~ 3 things:\n1. Changes the path of the `user` scope in\n`s\n[…]\nff-by: John Gouwar <jgouwar@gmail.com>\nSigned-off-by: Todd Gamblin <tgamblin@llnl.gov>\nCo-authored-by: JohnGouwar <JohnGouwar@users.noreply.github.com>\nCo-authored-by: Todd Gamblin <tgamblin@llnl.gov>",
          "is_bot": false,
          "headline": "New command: spack isolate (#52500)",
          "author_name": "John Gouwar",
          "author_login": "JohnGouwar",
          "committed_at": "2026-06-20T16:55:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4b8c01bf5a2a2fa6f5982d8cf0c96b035ca04e03",
          "body": "…559)\n\nSigned-off-by: John Parent <john.parent@kitware.com>",
          "is_bot": false,
          "headline": "installing.rst: document limitations of new installer on Windows (#52…",
          "author_name": "John W. Parent",
          "author_login": "johnwparent",
          "committed_at": "2026-06-18T21:13:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c5f14b0345b6bdecfc859fd01717c7a27d21c726",
          "body": "Previously `NoopJobserver.acquire` returned 0, which prevented the\ndispatch of parallel package builds on platform using the noop jobserver\n(Windows).\n\nInstead return jobs, which accurately reflects the requested levels of\npackage parallelism.\n\nSigned-off-by: John Parent <john.parent@kitware.com>",
          "is_bot": false,
          "headline": "noopjobserver: return jobs from acquire (#52565)",
          "author_name": "John W. Parent",
          "author_login": "johnwparent",
          "committed_at": "2026-06-18T10:13:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "dd8eb875d0dc879bf0b32b63997fdb94727f88ec",
          "body": "https://github.com/spack/spack/pull/52220 add a permanent config value\nwhich undoes the fix in https://github.com/spack/spack/pull/51305\n\nThis PR moves the config evaluation under the concrete spec check. The\nnon-concrete version is only for finding git commit values from a source\nmirror and doesn't need to respect the config since it is not a user-facing\nstage.\n\n---------\n\nSigned-off-by: Phil Sakievich <psakievich@gmail.com>",
          "is_bot": false,
          "headline": "Resolve regression of commit lookup traversing the DAG (#52563)",
          "author_name": "Phil Sakievich",
          "author_login": "psakievich",
          "committed_at": "2026-06-17T18:25:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "63943396d634faa92cb59474df3558ec9b9b2425",
          "body": "splitting on `\\n` can break on windows when programs emit carriage\nreturns. Evidently, gpg is one of those programs. `splitlines` handles\ncarriage returns correctly while preserveing the newline split\neverywhere else.\n\nSigned-off-by: John Parent <john.parent@kitware.com>",
          "is_bot": false,
          "headline": "Gpg: prevent bad split on carriage return (#52556)",
          "author_name": "John W. Parent",
          "author_login": "johnwparent",
          "committed_at": "2026-06-17T00:56:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "40230194aa022ab0b319d72251a610fc84e17676",
          "body": "PR 52158 introduced a regression where shebangs could be `#!view.new.random/bin/pyton3` instead of `#!view/bin/python3`\n\nFix by constructing the view in the target destination instead of in a staging dir.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "environment.py: construct view in final location (#52551)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-16T18:37:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "05b83b3609573cc3a4b710eaf5d111f0053ed70c",
          "body": "Signed-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "Point the `spack tutorial` command to v1.2 (#52550)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-06-16T09:41:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "78f8357c98040c3124288a7557d534284928bcf0",
          "body": "Add config to mirrors.yaml that enables users to filter what specs are pushed to or fetched from binary caches\n\n```yaml\n   mirrors:\n     <name>:\n       url: <url>\n       include_binary:\n       - \"%gcc\"  # include only specs that depend on gcc\n       exclude_binary:\n       - \"dev_path=*\"  # except development specs\n       - \"^mpich\"  # and any spec that depends on mpich\n```\n\n\nSigned-off-by: Thomas Bouvier <contact@thomas-bouvier.io>\nCo-authored-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "Include or exclude specs from binary caches on install or fetch (#52371)",
          "author_name": "Thomas Bouvier",
          "author_login": "thomas-bouvier",
          "committed_at": "2026-06-15T18:38:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9e3c23f3e247c96fdfa6a668e4c9e13cb600007a",
          "body": "This should restrict running CI on only the latest snapshot ref.\n\nThis can merge now, but to continue to update the packages ref we need\nto also merge https://github.com/spack/spack-infrastructure/pull/867\n\nSigned-off-by: Ryan Krattiger <ryan.krattiger@kitware.com>",
          "is_bot": false,
          "headline": "CI: Point at the latest hidden snapshot ref (#52540)",
          "author_name": "Ryan Krattiger",
          "author_login": "kwryankrattiger",
          "committed_at": "2026-06-15T18:16:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "377a3c9568ea23530666219d6f4fad8499b42823",
          "body": "Extracted from #52542 \n\nSpack right now relies heavily on a few global objects. These objects\nare lazily initialized, to cut on import time, and are technically all\nof type `Singleton` - a wrapper class that calls a factory function on\nfirst access to an attribute or a method.\n\nSometimes though we n\n[…]\nn these cases an `ensure_unwrapped` free function\nmakes more sense than an `.ensure_unwrapped` method in the wrapped class.\n\n---------\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "util.lang: add `ensure_unwrapped` free function (#52545)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-06-15T13:28:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c4440b7df3426da9a57c76ff269e7cc85779ce7c",
          "body": "Signed-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "refactor: move Context class in spack.enums (#52543)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-06-15T13:28:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ced4944c9b4ca0c9171dbffe02866ecb2010a247",
          "body": "The `mock_archive` fixture declared `params=` while `test_fetch` also\nparametrized `mock_archive` indirectly. `pytest 9.1` rejects this\noverlap at collection time.\n\nDrop the fixture-level params and read the archive type from\n`request.param` with a default instead, so non-parametrizing \ntests keep the `(\".tar.gz\", \"z\")` default while `test_fetch` supplies\nits own values.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "test: fix mock_archive parametrization (#52544)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-06-15T11:49:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3d24b94ef3d15a4864794f98807a7fcc17b83f48",
          "body": "@becker33 this may be small and innocuous enough to sneak into 1.2.\n\nReference: https://en.wikipedia.org/wiki/MacOS_Golden_Gate\n\nSigned-off-by: Adam J. Stewart <ajstewart426@gmail.com>",
          "is_bot": false,
          "headline": "Add support for macOS 27: Golden Gate (#52514)",
          "author_name": "Adam J. Stewart",
          "author_login": "adamjstewart",
          "committed_at": "2026-06-11T23:24:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4d464ae5615e8e049c91c6e7236c058e8cd1b682",
          "body": "Add `TryReadTransaction` and `TryWriteTransaction`: non-blocking\nvariants of the\nexisting transaction context managers that yield whether the lock was\nacquired.\nThe call site is responsible for early exit when no lock was acquired.\n\nUse them in the installer event loop, which previously hand-rolled\n\n[…]\ntion's\nexit now forwards exception info to `Database._write`, which skips the\nflush\nand re-reads the database in the next transaction.\n\n---------\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer.py: non-blocking DB transaction API (#52529)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-11T14:21:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4622b96fba274a2db0950606b422aee2ebbd09e3",
          "body": "PosixStdinReader and WindowsStdinReader differed from the base class in\na single expression (os.read on an fd vs socket.recv). Replace the\nhierarchy with one concrete class that takes a partial wrapping the\nplatform-specific raw read call.\n\nThis is consistent with other composition > inheritance refactors done\nearlier.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer: make StdinReader a concrete class (#52534)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-11T13:44:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "22739b47ef96e4c75f58f843f60a4b8ec41ddfa1",
          "body": "`enter_background`, `handle_continue`, and `should_enter_foreground`\nexist for POSIX job control: the first two are only reachable from the\n`SIGTSTP` handler, and the third only applies while headless, which\ncannot be triggered on Windows.\n\nThe abstract methods forced `WindowsTerminalState` to implement dead\ncode. Give them no-op defaults and drop the Windows overrides, along\nwith the empty POSIX `teardown_output`.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer_*.py: terminal state simplifications (#52535)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-11T13:10:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cbbee7faff85a1a32558bfe46ae0ad79c4e00983",
          "body": "Updates Windows default config, no special `config:installer` setting,\njust use Spack's default of the new installer.\n\nSigned-off-by: John Parent <john.parent@kitware.com>",
          "is_bot": false,
          "headline": "windows/config.yaml: use new installer (#52526)",
          "author_name": "John W. Parent",
          "author_login": "johnwparent",
          "committed_at": "2026-06-11T09:42:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5f314fde5c311736f625b342a084ec1b5a2e301c",
          "body": "`makefile(..., buffering=1)` sets the internal buffer size of\nBufferedWriter to 1; it is different from `fdopen(..., buffering=1)`\nwhich means \"line buffering\".\n\nFix by using binary mode for socket.makefile, with an explicitly line\nbuffered TextIOWrapper.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer_windows.py: fix line-buffering (#52533)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-11T09:38:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "57f209d36da0e4d0b1d8567abef571b0ea403ef5",
          "body": "Otherwise it binds to `sys.stdout` at import time.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer: resolve sys.stdout at call time (#52532)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-11T08:05:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4182d54a5350e7763e4e40b46d7711c8932bef21",
          "body": "Fix a minor issue where on failure with fail-fast `pending_expansions` was\nnot cleared. A build that exited with a binary cache miss in the same\nbatch where another fatally failed would have its build deps expanded\nlater in the same loop iteration, repopulating `pending_builds` and\nlaunching new builds after other builds were already terminated.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer.py: fix fail-fast dynamic scheduling (#52531)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-11T07:56:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a66bd55f06ec5d60fd8d806c25aaf554b429549b",
          "body": "Avoid a SIGTTOU when backgrounded. In practice I couldn't trigger it,\nbut it should be there nonetheless, might depend on the terminal if it's\nproblematic or not.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer.py: no terminal title while headless (#52530)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-11T07:56:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fefd24ddcc5288d615bb1982921c14a6d353112e",
          "body": "Enable the new installer for testing on Windows\n\nSigned-off-by: John Parent <john.parent@kitware.com>",
          "is_bot": false,
          "headline": "installer_dispatch.py: enable for tests on Windows (#52527)",
          "author_name": "John W. Parent",
          "author_login": "johnwparent",
          "committed_at": "2026-06-10T21:19:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "48e2284a6de6d51f10446734ebc00643e911f63e",
          "body": "On Windows, if fds 1/2 are still attached to the console when fdopen is\ncalled, Python selects ConsoleIO (WriteConsoleW). Once the Tee has\ndup2'd them to pipe handles, WriteConsoleW returns\nERROR_INVALID_FUNCTION. Fix by saving the encoding strings before the\nTee starts and calling fdopen after Tee.\n[…]\nthe POSIX-only process-group and signal calls (os.setpgid,\nSIGTSTP, os.killpg, os.waitpid).\n\nCo-Authored-By: John Parent <john.parent@kitware.com>\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer: fix stdout/stderr ordering Windows",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-10T16:16:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9b12736d2d4b359fdf6e11cba5cc8f692067e6b6",
          "body": "Use platform specific objects in the installer event loop.\n\nUse socket.socketpair on Windows instead of Pipe because anonymous pipes\ncannot be registered with the Windows selector; set read ends\nnon-blocking at creation time.\n\nCo-Authored-By: John Parent <john.parent@kitware.com>\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer: cross-platform IPC channel setup",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-10T16:16:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "778740943107d20f76e057540524397134495a8c",
          "body": "fs.rename handles cross-device renames, matching the rest of the\ncodebase.\n\nCo-Authored-By: John Parent <john.parent@kitware.com>\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer: use fs.rename",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-10T16:16:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7dfb972cd3aaca85f3564a630588f8b972d20b36",
          "body": "Implement the Windows side of the cross-platform abstractions in\nnew_installer_windows.py:\n\n- WindowsSentinelBridge: a daemon thread joins the child process and\n  pokes a socketpair so the selector wakes on exit, since Windows\n  process handles cannot be registered with a selector directly.\n- Window\n[…]\nam / read_connection / write_connection: socket-based\n  versions of the connection helpers.\n\nCo-Authored-By: John Parent <john.parent@kitware.com>\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer: add Windows IPC implementation",
          "author_name": "John Parent",
          "author_login": "johnwparent",
          "committed_at": "2026-06-10T16:16:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e9c4a62e2ad870923bc86c2401ba93e149518d71",
          "body": "The state messages are ascii JSONL. We receive partial messages, so read\nuntil the next `\\n`, and then pass as binary to `json.load`. This way no\nexplicit UTF-8 decoding is needed, with its associated multi-byte\nissues. ValueError covers both json and UTF-8 decoding problems.\n\nCo-Authored-By: John Parent <john.parent@kitware.com>\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer: improve state message handling",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-10T16:16:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0193add27c779634c3ddc44fe07138b5ffba3253",
          "body": "Replace inline POSIX IPC primitives with helpers from the platform\nmodule (make_state_stream / read_connection / write_connection in\nnew_installer_posix.py) so the same event loop can later drive Windows\nsockets.\n\nThe output/state read handlers take the ChildInfo and pull their own\nconnection from i\n[…]\n return False once their channel hits EOF,\nwhich the drain loops use as the stop condition.\n\nCo-Authored-By: John Parent <john.parent@kitware.com>\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer: abstract IPC channel calls",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-10T16:16:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "110ec084309f2a18b7a92763548c322bc03dca61",
          "body": "Introduce two small abstractions in new_installer_base.py that the platform\nmodules implement:\n\n- ProcessExitNotifier: a selector-watchable handle that becomes readable\n  when the child process exits. On POSIX the multiprocessing sentinel fd\n  is itself watchable; Windows will need a thread+socket b\n[…]\nnnel endpoints are Connection on\n  POSIX and socket on Windows; PosixTee now subclasses it.\n\nCo-Authored-By: John Parent <john.parent@kitware.com>\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer: abstract process exit and Tee",
          "author_name": "John Parent",
          "author_login": "johnwparent",
          "committed_at": "2026-06-10T16:16:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6d7cd45d768f02ef8ec0228d44c11664b7451ad5",
          "body": "A prior change speculatively renamed ChildInfo -> PosixChildInfo and moved it\nto new_installer_posix.py (and DatabaseAction to new_installer_base.py),\nanticipating per-platform subclasses that did not materialize.\n\nCo-Authored-By: John Parent <john.parent@kitware.com>\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer: revert DatabaseAction and ChildInfo",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-10T16:16:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1ff995d633c83b2a153517bf6baefb0eef3e8cb6",
          "body": "The syscall returns `-1` if the fd is invalid, but Python intercepts and\nraises\n`OSError: [Errno 9] Bad file descriptor` instead.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "jobserver.py: fix parent fd validation (#52518)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-09T18:05:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "92c7d589aa00a9525ebfb82441a6a460f2fe8da6",
          "body": "Add a base class for the JobServer, and add a no-op implementation for\nused on Windows.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer.py: no jobserver on windows (#52517)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-09T15:44:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cf9556230f1f236837b1a90c17eaebdeac02b31f",
          "body": "Prior to this commit, `gpg.trust()` would sometimes fail to import a\nsigning key. The underlying issue is that the gpg command-line\ninvocation for inspecting keys stored in a file is version-dependent:\n\n* gpg >= 2.2.8: `--show-keys`\n* gpg >= 2.1.23: `--import-options show-only --import`\n* older vers\n[…]\n restored.\n\n---------\n\nSigned-off-by: Zack Galbreath <zack.galbreath@kitware.com>\nSigned-off-by: Ryan Krattiger <ryan.krattiger@kitware.com>\nCo-authored-by: Ryan Krattiger <ryan.krattiger@kitware.com>",
          "is_bot": false,
          "headline": "gpg: fix trust() silently dropping secret-key files (#52503)",
          "author_name": "Zack Galbreath",
          "author_login": "zackgalbreath",
          "committed_at": "2026-06-09T13:19:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9730ad0dae1e4348d310e39f051dfcca848392cf",
          "body": "Co-Authored-By: John Parent <john.parent@kitware.com>\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer.py: move POSIX classes/functions",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-09T12:42:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4391e16bf7f50696607fc05b75327438bb9ba2c3",
          "body": "The three register calls for each child's output/state/sentinel pipes\nwere inline in the event loop. Moving them into the class makes\nPosixChildInfo self-contained ahead of moving it to its own module.\n\nCo-Authored-By: John Parent <john.parent@kitware.com>\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer.py: refactor selector registering",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-09T12:42:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "380162af6ddd23b0c880d8a177629a9d26c1eae7",
          "body": "The tee function was only ever called as a thread target inside\n`PosixTee.__init__`. This makes moving the Tee related code to a POSIX\nmodules simpler.\n\nCo-Authored-By: John Parent <john.parent@kitware.com>\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer.py: make tee part of PosixTee",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-09T12:42:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "74277a302345d57398304e5406e7917ce8bafd8a",
          "body": "- ChildInfo -> PosixChildInfo\n- Tee -> PosixTee\n- JobServer -> PosixJobServer\n\nCo-Authored-By: John Parent <john.parent@kitware.com>\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer.py: rename POSIX-specific classes",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-09T12:42:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d25b1b4f10a41b4bf61abec99461a026b46a6baa",
          "body": "Prep work for Windows support, so base classes can go into\nnew_installer_base.py.\n\nCo-Authored-By: John Parent <john.parent@kitware.com>\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "new_installer_terminal.py -> new_installer_base.py",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-09T12:42:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "eba668513e7c5669471db66945e3d85f7273c0b5",
          "body": "Modifications:\n- Replace `inspect.getmodule()` calls with explicit `ClassVar` attributes\n- Consolidate factories into `BaseConfiguration`, so each writer\n  subclass only declares `configuration_class`\n- `exclude_env_vars` returned `{}` instead of `[]`. Now fixed\n- `guess_core_compilers` only checked `cc`. Now checks `cxx` and `fc` too\n\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "modules: consolidate per-module boilerplate into base classes (#52516)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-06-09T12:41:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1c98bfdef453d5ee1133f381f7994c1c257a1998",
          "body": "The new installer has nice inline progress reporting, but when switching\naway from a tab, there is currently no way to keep track of progress.\nThis adds support for showing progress in the terminal title, similar to\nthe old installer.\n\nSigned-off-by: Michael Kuhn <michael.kuhn@ovgu.de>",
          "is_bot": false,
          "headline": "new-installer: Support showing progress in terminal title (#52465)",
          "author_name": "Michael Kuhn",
          "author_login": "michaelkuhn",
          "committed_at": "2026-06-08T21:09:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "431b29ccfd7a76a69a1ec4a40795e9bf7dbe5313",
          "body": "OCI binary cache did not change for v3. Use the binary version not the layout versoin.\n\nCurrently OCI caches created with Spack >= v1.0 are not usable with\nSpack < v1.0. This is not because the binaries have changed, the binary\ncontents of v1 caches should still be usable by v0.23. This change\nrever\n[…]\nion has been v3 for a few\nversions the max allowed is left at `v3` to continue allowing users to\nread from their existing caches.\n\n---------\n\nSigned-off-by: Ryan Krattiger <ryan.krattiger@kitware.com>",
          "is_bot": false,
          "headline": "OCI Use the old binary layout in the spec metadata (#52039)",
          "author_name": "Ryan Krattiger",
          "author_login": "kwryankrattiger",
          "committed_at": "2026-06-08T20:43:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ae50e7761c5ee2601f2c740c00ecbd3ab308baf9",
          "body": "Condense the `if self._enabled` branches into a single one in the\nconstructor, instead of sprinkling them in every method. It works by\nextracting the syscalls to a backend class in a composition over\ninheritance style. On Windows the backend is a no-op version.\n\nIn a follow-up PR we could use a mock backend in tests to drop `fcntl`\nmonkeypatching.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "locks.py: composition over inheritance for dummy lock (#52499)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-08T12:09:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a290c6cdded8e628daaf62460cddaee3e78de095",
          "body": "Introduces BaseTerminalState as an abstract base class so that\nWindowsTerminalState and the existing TerminalState (POSIX) share a\ncommon interface without scattering IS_WINDOWS guards through the event\nloop.\n\nTwo new abstract methods:\n- drain_sigwinch(): TerminalState uses os.read(); WindowsTermina\n[…]\n\n- _establish_terminal_state() factory selects the right class at runtime\n- StdinReader gains an optional sock= parameter for Windows socket input\n\nSigned-off-by: John Parent <john.parent@kitware.com>",
          "is_bot": false,
          "headline": "new_installer: add Windows TUI (WindowsTerminalState) (#52482)",
          "author_name": "John W. Parent",
          "author_login": "johnwparent",
          "committed_at": "2026-06-05T20:52:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "698c4cd2bb5aa0ed2b50719d392f36261c28e9b7",
          "body": "Found when looking at #52371\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
          "is_bot": false,
          "headline": "schema/mirrors.py: fix pull/fetch typo (#52490)",
          "author_name": "Harmen Stoppels",
          "author_login": "haampie",
          "committed_at": "2026-06-05T20:35:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "95d3e2083b20748ac4dc8f0e6e50186911f52f2a",
          "body": "In #52471 support for `spack concretize` (and for a few other commands)\nwas missed because the status function was not tied to a `-I` argument.\nFix it in this PR by adding `[b]` support to all commands that use the\nstatus function implicitly.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
          "is_bot": false,
          "headline": "Add [b] support to `spack concretize` and other commands (#52493)",
          "author_name": "Massimiliano Culpo",
          "author_login": "alalazo",
          "committed_at": "2026-06-05T18:50:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 14,
      "commits_last_year": 938,
      "latest_release_at": "2019-12-24T07:48:11Z",
      "latest_release_tag": "v0.13.3",
      "releases_from_tags": true,
      "days_since_last_push": 19,
      "active_weeks_last_year": 49,
      "days_since_latest_release": 2406,
      "mean_days_between_releases": 194
    },
    "community": {
      "has_readme": false,
      "has_license": false,
      "has_description": false,
      "has_contributing": false,
      "health_percentage": null,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": []
    },
    "popularity": {
      "forks": 0,
      "stars": 1,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": null,
      "open_issues_and_prs": 15
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "lib/spack/docs/Makefile",
        "lib/spack/spack/test/data/make/affirmative/capital_makefile/Makefile",
        "lib/spack/spack/test/data/make/affirmative/check_test/Makefile",
        "lib/spack/spack/test/data/make/affirmative/expansion/Makefile",
        "lib/spack/spack/test/data/make/affirmative/gnu_makefile/GNUmakefile",
        "lib/spack/spack/test/data/make/affirmative/include/Makefile",
        "lib/spack/spack/test/data/make/affirmative/lowercase_makefile/makefile",
        "lib/spack/spack/test/data/make/affirmative/prerequisites/Makefile",
        "lib/spack/spack/test/data/make/affirmative/spaces/Makefile",
        "lib/spack/spack/test/data/make/affirmative/test_check/Makefile",
        "lib/spack/spack/test/data/make/affirmative/three_targets/Makefile",
        "lib/spack/spack/test/data/make/negative/partial_match/Makefile",
        "lib/spack/spack/test/data/make/negative/variable/Makefile",
        "share/spack/templates/depfile/Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": true,
      "typecheck_configs": [
        "lib/spack/spack/vendor/attr/py.typed",
        "lib/spack/spack/vendor/attrs/py.typed",
        "lib/spack/spack/vendor/distro/py.typed",
        "lib/spack/spack/vendor/jinja2/py.typed",
        "lib/spack/spack/vendor/markupsafe/py.typed",
        "lib/spack/spack/vendor/pyrsistent/py.typed",
        "lib/spack/spack/vendor/ruamel/yaml/py.typed"
      ],
      "toolchain_manifests": [],
      "largest_source_bytes": 231733,
      "source_files_sampled": 1021,
      "oversized_source_files": 22,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "pyproject.toml"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "black",
            "direct": false,
            "version": "25.12.0",
            "severity": "critical",
            "ecosystem": "pypi",
            "cvss_score": 9.8,
            "advisory_ids": [
              "GHSA-3936-cmfr-pm3m",
              "PYSEC-2026-2120",
              "PYSEC-2026-2121"
            ],
            "fixed_version": "26.3.1",
            "advisory_count": 3,
            "oldest_advisory_days": 136
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "critical": 1
        },
        "advisory_count": 3,
        "affected_count": 1,
        "assessed_count": 24,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 2,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "pypi"
      ],
      "dependencies": [
        {
          "name": "clingo",
          "manifest": "pyproject.toml",
          "ecosystem": "pypi",
          "version_constraint": null
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "clingo",
            "direct": true,
            "version": "5.8.0",
            "ecosystem": "pypi"
          },
          {
            "name": "black",
            "direct": false,
            "version": "25.12.0",
            "ecosystem": "pypi"
          },
          {
            "name": "coverage",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "coverage",
            "direct": false,
            "version": "7.14.0",
            "ecosystem": "pypi"
          },
          {
            "name": "docutils",
            "direct": false,
            "version": "0.22.4",
            "ecosystem": "pypi"
          },
          {
            "name": "flake8",
            "direct": false,
            "version": "7.3.0",
            "ecosystem": "pypi"
          },
          {
            "name": "furo",
            "direct": false,
            "version": "2025.12.19",
            "ecosystem": "pypi"
          },
          {
            "name": "isort",
            "direct": false,
            "version": "7.0.0",
            "ecosystem": "pypi"
          },
          {
            "name": "mypy",
            "direct": false,
            "version": "1.20.1",
            "ecosystem": "pypi"
          },
          {
            "name": "pip",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "pygments",
            "direct": false,
            "version": "2.20.0",
            "ecosystem": "pypi"
          },
          {
            "name": "pylint",
            "direct": false,
            "version": "4.0.5",
            "ecosystem": "pypi"
          },
          {
            "name": "pytest",
            "direct": false,
            "version": "9.0.3",
            "ecosystem": "pypi"
          },
          {
            "name": "pytest",
            "direct": false,
            "version": "9.1.1",
            "ecosystem": "pypi"
          },
          {
            "name": "pytest-cov",
            "direct": false,
            "version": "7.1.0",
            "ecosystem": "pypi"
          },
          {
            "name": "pytest-xdist",
            "direct": false,
            "version": "3.8.0",
            "ecosystem": "pypi"
          },
          {
            "name": "ruamel-yaml",
            "direct": false,
            "version": "0.19.1",
            "ecosystem": "pypi"
          },
          {
            "name": "ruff",
            "direct": false,
            "version": "0.15.14",
            "ecosystem": "pypi"
          },
          {
            "name": "slotscheck",
            "direct": false,
            "version": "0.19.1",
            "ecosystem": "pypi"
          },
          {
            "name": "sphinx",
            "direct": false,
            "version": "9.1.0",
            "ecosystem": "pypi"
          },
          {
            "name": "sphinx-copybutton",
            "direct": false,
            "version": "0.5.2",
            "ecosystem": "pypi"
          },
          {
            "name": "sphinx-last-updated-by-git",
            "direct": false,
            "version": "0.3.8",
            "ecosystem": "pypi"
          },
          {
            "name": "sphinx-sitemap",
            "direct": false,
            "version": "2.9.0",
            "ecosystem": "pypi"
          },
          {
            "name": "sphinxcontrib-programoutput",
            "direct": false,
            "version": "0.20",
            "ecosystem": "pypi"
          },
          {
            "name": "sphinxcontrib-svg2pdfconverter",
            "direct": false,
            "version": "2.1.0",
            "ecosystem": "pypi"
          },
          {
            "name": "vermin",
            "direct": false,
            "version": "1.8.0",
            "ecosystem": "pypi"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 26,
        "direct_count": 1,
        "indirect_count": 25
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 15,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 201
      },
      "bus_factor": 10,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "adamjstewart",
          "commits": 3238,
          "avatar_url": "https://avatars.githubusercontent.com/u/12021217?v=4"
        },
        {
          "type": "User",
          "login": "tgamblin",
          "commits": 2955,
          "avatar_url": "https://avatars.githubusercontent.com/u/299842?v=4"
        },
        {
          "type": "User",
          "login": "alalazo",
          "commits": 2271,
          "avatar_url": "https://avatars.githubusercontent.com/u/4199709?v=4"
        },
        {
          "type": "User",
          "login": "haampie",
          "commits": 2210,
          "avatar_url": "https://avatars.githubusercontent.com/u/194764?v=4"
        },
        {
          "type": "User",
          "login": "alecbcs",
          "commits": 966,
          "avatar_url": "https://avatars.githubusercontent.com/u/19558067?v=4"
        },
        {
          "type": "User",
          "login": "wdconinc",
          "commits": 895,
          "avatar_url": "https://avatars.githubusercontent.com/u/4656391?v=4"
        },
        {
          "type": "User",
          "login": "glennpj",
          "commits": 811,
          "avatar_url": "https://avatars.githubusercontent.com/u/16138574?v=4"
        },
        {
          "type": "User",
          "login": "becker33",
          "commits": 744,
          "avatar_url": "https://avatars.githubusercontent.com/u/13971568?v=4"
        },
        {
          "type": "User",
          "login": "manuelakuhn",
          "commits": 707,
          "avatar_url": "https://avatars.githubusercontent.com/u/36827019?v=4"
        },
        {
          "type": "User",
          "login": "michaelkuhn",
          "commits": 692,
          "avatar_url": "https://avatars.githubusercontent.com/u/4062614?v=4"
        }
      ],
      "contributors_sampled": 99,
      "top_contributor_share": 0.107
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "bootstrap.yml",
        "build-containers.yml",
        "ci.yaml",
        "coverage.yml",
        "import-check.yaml",
        "prechecks.yml",
        "stale.yaml",
        "triage.yml",
        "unit_tests.yaml"
      ],
      "has_docs_dir": false,
      "linter_configs": [
        ".flake8"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 91 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": null,
            "reason": "internal error: internal error: invalid Dockerfile",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "no SAST tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 8,
            "reason": "2 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "e2e5041cc1813b8a57a0acedd580f3bb6d80ba25",
        "ran_at": "2026-07-26T18:36:05Z",
        "aggregate_score": 5.7,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-06T22:42:56Z",
      "oldest_open_prs": [
        {
          "number": 32,
          "created_at": "2022-04-14T22:05:24Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 160,
          "created_at": "2024-07-30T22:45:03Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 161,
          "created_at": "2024-07-31T22:49:04Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 196,
          "created_at": "2024-10-22T22:55:32Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 200,
          "created_at": "2024-11-05T22:12:28Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 201,
          "created_at": "2026-05-04T16:42:19Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 203,
          "created_at": "2026-05-04T16:42:34Z",
          "last_comment_at": "2026-05-27T00:35:20Z",
          "last_comment_author": "dependabot"
        },
        {
          "number": 204,
          "created_at": "2026-05-04T16:42:38Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 205,
          "created_at": "2026-05-04T16:42:44Z",
          "last_comment_at": "2026-05-27T00:35:24Z",
          "last_comment_author": "dependabot"
        },
        {
          "number": 206,
          "created_at": "2026-05-06T22:42:32Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 211,
          "created_at": "2026-05-27T23:52:05Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 212,
          "created_at": "2026-06-03T13:23:04Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 214,
          "created_at": "2026-07-06T22:42:32Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 215,
          "created_at": "2026-07-06T22:42:37Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 216,
          "created_at": "2026-07-06T22:42:53Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ],
      "last_merged_pr_at": null,
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/eugeneswalker/spack",
    "host": "github.com",
    "name": "spack",
    "owner": "eugeneswalker"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 52,
      "inputs": {
        "security": 66,
        "vitality": 67,
        "community": 12,
        "governance": 52,
        "engineering": 58
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "moderate",
        "name": "Vitality",
        "value": 67,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "excellent",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 91,
            "inputs": {
              "commits_last_year": 938,
              "human_commit_share": 0.92,
              "days_since_last_push": 19,
              "active_weeks_last_year": 49
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 19 days ago",
                "points": 28.8,
                "status": "partial",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 19
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "49/52 weeks with commits",
                "points": 33.9,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 49
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "938 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 938
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "at_risk",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 32,
            "inputs": {
              "releases_count": 14,
              "latest_release_tag": "v0.13.3",
              "releases_from_tags": true,
              "days_since_latest_release": 2406,
              "mean_days_between_releases": 194
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "14 version tags (no GitHub releases)",
                "points": 16.2,
                "status": "partial",
                "details": [
                  {
                    "code": "version_tags_no_releases",
                    "params": {
                      "count": 14
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 2406 days ago",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 2406
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~194 days",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 194
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "maintained",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 22,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "last human commit 22 days ago",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_maintained",
                    "params": {
                      "days": 22
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 12,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 1,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "1 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "critical",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 25,
            "inputs": {
              "has_readme": false,
              "has_license": false,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 52,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "excellent",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 98,
            "inputs": {
              "bus_factor": 10,
              "contributors_sampled": 99,
              "top_contributor_share": 0.107
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "10 contributor(s) cover half of all commits",
                "points": 54,
                "status": "met",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 10
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 11% of commits",
                "points": 20.1,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 11
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "99 contributors",
                "points": 13.5,
                "status": "met",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 99
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 91 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 201
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "0/201 decided PRs merged",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 0,
                      "decided": 201
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 49,
            "inputs": {
              "followers": 3,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "eugeneswalker",
              "public_repos": 64,
              "account_age_days": 3006
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "3 followers of eugeneswalker",
                "points": 4.3,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 3,
                      "login": "eugeneswalker"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "64 public repos, account ~8 yr old",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 64
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 8
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 58,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 80,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "9 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 9
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".flake8",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".flake8"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "critical",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 25,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": "https://spack.io",
              "has_readme": false,
              "has_docs_dir": false,
              "has_description": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://spack.io",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 66,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Packaging, Pinned-Dependencies, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "packaging",
                    "pinned_dependencies",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 57,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 14,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 4,
              "scorecard_aggregate": 5.7
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 91 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "internal error: internal error: invalid Dockerfile",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "no SAST tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "2 existing vulnerabilities detected",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 24 resolved dependencies against OSV; 2 could not be assessed (no resolved version, an unsupported ecosystem, or beyond the reported package list). This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories",
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 24
                }
              },
              {
                "code": "advisories_unassessed",
                "params": {
                  "count": 2
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 3,
              "affected_packages": 1,
              "assessed_packages": 24,
              "unassessed_packages": 2,
              "affected_by_severity": "critical 1",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 24,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 14
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 70,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "92 of 92 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 92,
                      "sampled": 92
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "excellent",
            "name": "Verify loop (build / test / typecheck)",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Pinned-Dependencies. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_pinned_dependencies"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 89,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [],
              "has_dockerfile": true,
              "typed_language": false,
              "bootstrap_files": [
                "lib/spack/docs/Makefile",
                "lib/spack/spack/test/data/make/affirmative/capital_makefile/Makefile",
                "lib/spack/spack/test/data/make/affirmative/check_test/Makefile",
                "lib/spack/spack/test/data/make/affirmative/expansion/Makefile",
                "lib/spack/spack/test/data/make/affirmative/gnu_makefile/GNUmakefile",
                "lib/spack/spack/test/data/make/affirmative/include/Makefile",
                "lib/spack/spack/test/data/make/affirmative/lowercase_makefile/makefile",
                "lib/spack/spack/test/data/make/affirmative/prerequisites/Makefile",
                "lib/spack/spack/test/data/make/affirmative/spaces/Makefile",
                "lib/spack/spack/test/data/make/affirmative/test_check/Makefile",
                "lib/spack/spack/test/data/make/affirmative/three_targets/Makefile",
                "lib/spack/spack/test/data/make/negative/partial_match/Makefile",
                "lib/spack/spack/test/data/make/negative/variable/Makefile",
                "share/spack/templates/depfile/Makefile"
              ],
              "has_devcontainer": true,
              "has_linter_config": true,
              "typecheck_configs": [
                "lib/spack/spack/vendor/attr/py.typed",
                "lib/spack/spack/vendor/attrs/py.typed",
                "lib/spack/spack/vendor/distro/py.typed",
                "lib/spack/spack/vendor/jinja2/py.typed",
                "lib/spack/spack/vendor/markupsafe/py.typed",
                "lib/spack/spack/vendor/pyrsistent/py.typed",
                "lib/spack/spack/vendor/ruamel/yaml/py.typed"
              ],
              "agent_commit_share": 0,
              "toolchain_manifests": [],
              "dependency_bot_commit_share": 0.08
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "lib/spack/docs/Makefile, lib/spack/spack/test/data/make/affirmative/capital_makefile/Makefile, lib/spack/spack/test/data/make/affirmative/check_test/Makefile, lib/spack/spack/test/data/make/affirmative/expansion/Makefile, lib/spack/spack/test/data/make/affirmative/gnu_makefile/GNUmakefile, lib/spack/spack/test/data/make/affirmative/include/Makefile, lib/spack/spack/test/data/make/affirmative/lowercase_makefile/makefile, lib/spack/spack/test/data/make/affirmative/prerequisites/Makefile, lib/spack/spack/test/data/make/affirmative/spaces/Makefile, lib/spack/spack/test/data/make/affirmative/test_check/Makefile, lib/spack/spack/test/data/make/affirmative/three_targets/Makefile, lib/spack/spack/test/data/make/negative/partial_match/Makefile, lib/spack/spack/test/data/make/negative/variable/Makefile, share/spack/templates/depfile/Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lib/spack/docs/Makefile, lib/spack/spack/test/data/make/affirmative/capital_makefile/Makefile, lib/spack/spack/test/data/make/affirmative/check_test/Makefile, lib/spack/spack/test/data/make/affirmative/expansion/Makefile, lib/spack/spack/test/data/make/affirmative/gnu_makefile/GNUmakefile, lib/spack/spack/test/data/make/affirmative/include/Makefile, lib/spack/spack/test/data/make/affirmative/lowercase_makefile/makefile, lib/spack/spack/test/data/make/affirmative/prerequisites/Makefile, lib/spack/spack/test/data/make/affirmative/spaces/Makefile, lib/spack/spack/test/data/make/affirmative/test_check/Makefile, lib/spack/spack/test/data/make/affirmative/three_targets/Makefile, lib/spack/spack/test/data/make/negative/partial_match/Makefile, lib/spack/spack/test/data/make/negative/variable/Makefile, share/spack/templates/depfile/Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".flake8",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".flake8"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "lib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "devcontainer, Dockerfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "devcontainer, Dockerfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "8 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 8,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "internal error: internal error: invalid Dockerfile",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "good",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 81,
            "inputs": {
              "primary_language": "Python",
              "largest_source_bytes": 231733,
              "source_files_sampled": 1021,
              "oversized_source_files": 22
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Python with type-check config (lib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed)",
                "points": 27,
                "status": "partial",
                "details": [
                  {
                    "code": "typecheck_config_language",
                    "params": {
                      "files": "lib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed",
                      "language": "Python"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "22/1021 source files over 60KB",
                "points": 53.8,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 1021,
                      "oversized": 22
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "Community profile unavailable",
    "Could not fetch pypi package 'spack' from its registry"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-26T18:36:23.354117Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/e/eugeneswalker/spack.svg",
  "full_name": "eugeneswalker/spack",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}