getporter / porter

每颗 star 和每个 fork 的添加时间，来自 GitHub 并按天汇总。累计增长位于其构成来源——每日新增——的正上方，二者可相互对照：稳定的自然增长与短暂的突增形态截然不同。当这一差别可被衡量时，它会作为增长真实性予以报告。

每个点涵盖 7 天。

来自 GitHub 依赖图的完整解析依赖集合：67 个直接依赖与 226 个间接（传递）软件包。仓库提交锁文件时，传递闭包才是完整的。

该仓库未发布可被索引解析的包，因此评估的是其自身的依赖图——共 293 个包，其中也包含从不交付的开发与测试版本固定：4 个存在已知公告，0 个为直接依赖。

公告表示依赖图中记录的版本落入某条公告的受影响范围。可达性未经分析，且依赖图包含开发与测试的版本固定——某项发现可能只涉及工具链而非交付的软件。

{
  "data": {
    "repo": {
      "topics": [
        "porter",
        "cnab",
        "cncf"
      ],
      "is_fork": false,
      "size_kb": 41790,
      "has_wiki": false,
      "homepage": "https://porter.sh",
      "languages": {
        "Go": 2437938,
        "Shell": 7029,
        "Dockerfile": 4344,
        "PowerShell": 1730
      },
      "pushed_at": "2026-07-22T13:31:47Z",
      "created_at": "2018-11-02T16:34:04Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-22T12:33:05Z",
      "description": "Porter enables you to package your application artifact, client tools, configuration and deployment logic together as an installer that you can distribute, and install with a single command.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": "https://porter.sh",
      "name": "Porter",
      "type": "Organization",
      "login": "getporter",
      "company": null,
      "location": null,
      "followers": 48,
      "avatar_url": "https://avatars.githubusercontent.com/u/57189554?v=4",
      "created_at": "2019-10-30T16:22:52Z",
      "is_verified": null,
      "public_repos": 48,
      "account_age_days": 2457
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "canary",
          "kind": "other",
          "published_at": "2021-04-06T21:29:46Z"
        },
        {
          "tag": "v1.6.1",
          "kind": "patch",
          "published_at": "2026-07-17T23:06:03Z"
        },
        {
          "tag": "latest",
          "kind": "other",
          "published_at": "2021-04-06T21:13:34Z"
        },
        {
          "tag": "v1.6.0",
          "kind": "minor",
          "published_at": "2026-07-08T07:25:57Z"
        },
        {
          "tag": "v1.5.0",
          "kind": "minor",
          "published_at": "2026-04-11T20:14:16Z"
        },
        {
          "tag": "v1.4.0",
          "kind": "minor",
          "published_at": "2025-12-03T09:32:05Z"
        },
        {
          "tag": "v1.3.0",
          "kind": "minor",
          "published_at": "2025-08-03T19:20:50Z"
        },
        {
          "tag": "v1.2.1",
          "kind": "patch",
          "published_at": "2024-12-22T21:54:11Z"
        },
        {
          "tag": "v1.2.0",
          "kind": "minor",
          "published_at": "2024-11-14T22:07:22Z"
        },
        {
          "tag": "v1.1.1",
          "kind": "patch",
          "published_at": "2024-09-29T19:41:00Z"
        },
        {
          "tag": "v1.1.0",
          "kind": "minor",
          "published_at": "2024-06-27T15:00:59Z"
        },
        {
          "tag": "v1.1.0-rc",
          "kind": "prerelease",
          "published_at": "2024-06-13T16:14:53Z"
        },
        {
          "tag": "v1.0.17",
          "kind": "patch",
          "published_at": "2024-03-27T00:49:11Z"
        },
        {
          "tag": "v1.0.16",
          "kind": "patch",
          "published_at": "2024-01-28T02:48:52Z"
        },
        {
          "tag": "v1.0.15",
          "kind": "patch",
          "published_at": "2023-07-14T03:26:04Z"
        },
        {
          "tag": "v1.0.14",
          "kind": "patch",
          "published_at": "2023-04-24T21:56:56Z"
        },
        {
          "tag": "v1.0.13",
          "kind": "patch",
          "published_at": "2023-04-12T20:16:03Z"
        },
        {
          "tag": "v1.0.12",
          "kind": "patch",
          "published_at": "2023-04-12T20:20:58Z"
        },
        {
          "tag": "v1.0.11",
          "kind": "patch",
          "published_at": "2023-03-30T15:07:45Z"
        },
        {
          "tag": "v1.0.10",
          "kind": "patch",
          "published_at": "2023-03-23T19:20:38Z"
        },
        {
          "tag": "v1.0.9",
          "kind": "patch",
          "published_at": "2023-02-22T17:58:48Z"
        },
        {
          "tag": "v1.0.8",
          "kind": "patch",
          "published_at": "2023-02-14T22:24:11Z"
        },
        {
          "tag": "v1.0.7",
          "kind": "patch",
          "published_at": "2023-01-31T21:00:00Z"
        },
        {
          "tag": "v1.0.6",
          "kind": "patch",
          "published_at": "2023-01-25T18:14:54Z"
        },
        {
          "tag": "v1.0.5",
          "kind": "patch",
          "published_at": "2023-01-18T18:59:49Z"
        },
        {
          "tag": "v1.0.4",
          "kind": "patch",
          "published_at": "2022-12-09T14:56:16Z"
        },
        {
          "tag": "v1.0.3",
          "kind": "patch",
          "published_at": "2022-12-05T15:32:57Z"
        },
        {
          "tag": "v1.0.2",
          "kind": "patch",
          "published_at": "2022-11-09T18:40:22Z"
        },
        {
          "tag": "v1.0.1",
          "kind": "patch",
          "published_at": "2022-10-14T15:03:26Z"
        },
        {
          "tag": "v1.0.0",
          "kind": "major",
          "published_at": "2022-10-03T15:13:50Z"
        },
        {
          "tag": "v1.0.0-rc.3",
          "kind": "prerelease",
          "published_at": "2022-09-26T18:19:12Z"
        },
        {
          "tag": "v1.0.0-rc.2",
          "kind": "prerelease",
          "published_at": "2022-09-21T17:57:23Z"
        },
        {
          "tag": "v0.38.13",
          "kind": "patch",
          "published_at": "2022-09-21T16:33:35Z"
        },
        {
          "tag": "v1.0.0-rc.1",
          "kind": "prerelease",
          "published_at": "2022-09-07T16:52:25Z"
        },
        {
          "tag": "v1.0.0-beta.4",
          "kind": "prerelease",
          "published_at": "2022-08-31T16:25:59Z"
        },
        {
          "tag": "v1.0.0-beta.3",
          "kind": "prerelease",
          "published_at": "2022-08-04T20:03:49Z"
        },
        {
          "tag": "v1.0.0-beta.2",
          "kind": "prerelease",
          "published_at": "2022-08-01T17:11:38Z"
        },
        {
          "tag": "v1.0.0-beta.1",
          "kind": "prerelease",
          "published_at": "2022-07-05T17:24:35Z"
        },
        {
          "tag": "v1.0.0-alpha.22",
          "kind": "prerelease",
          "published_at": "2022-06-16T21:17:05Z"
        },
        {
          "tag": "v1.0.0-alpha.21",
          "kind": "prerelease",
          "published_at": "2022-06-16T18:04:50Z"
        },
        {
          "tag": "v0.38.12",
          "kind": "patch",
          "published_at": "2022-06-09T18:30:44Z"
        },
        {
          "tag": "v1.0.0-alpha.20",
          "kind": "prerelease",
          "published_at": "2022-05-31T14:33:53Z"
        },
        {
          "tag": "canary-v1",
          "kind": "other",
          "published_at": "2022-05-20T18:55:16Z"
        },
        {
          "tag": "v0.38.11",
          "kind": "patch",
          "published_at": "2022-05-02T14:27:33Z"
        },
        {
          "tag": "v1.0.0-alpha.19",
          "kind": "prerelease",
          "published_at": "2022-04-08T18:29:07Z"
        },
        {
          "tag": "v1.0.0-alpha.18",
          "kind": "prerelease",
          "published_at": "2022-04-05T19:03:24Z"
        },
        {
          "tag": "v1.0.0-alpha.17",
          "kind": "prerelease",
          "published_at": "2022-03-30T16:52:15Z"
        },
        {
          "tag": "v1.0.0-alpha.15",
          "kind": "prerelease",
          "published_at": "2022-03-23T16:06:23Z"
        },
        {
          "tag": "v1.0.0-alpha.14",
          "kind": "prerelease",
          "published_at": "2022-03-22T21:20:58Z"
        },
        {
          "tag": "v0.38.10",
          "kind": "patch",
          "published_at": "2022-03-22T20:25:35Z"
        },
        {
          "tag": "v1.0.0-alpha.13",
          "kind": "prerelease",
          "published_at": "2022-03-04T17:02:05Z"
        },
        {
          "tag": "v1.0.0-alpha.12",
          "kind": "prerelease",
          "published_at": "2022-03-03T16:18:58Z"
        },
        {
          "tag": "v1.0.0-alpha.11",
          "kind": "prerelease",
          "published_at": "2022-02-28T15:51:46Z"
        },
        {
          "tag": "v1.0.0-alpha.10",
          "kind": "prerelease",
          "published_at": "2022-02-16T22:24:32Z"
        },
        {
          "tag": "v0.38.9",
          "kind": "patch",
          "published_at": "2022-02-16T14:26:19Z"
        },
        {
          "tag": "v1.0.0-alpha.9",
          "kind": "prerelease",
          "published_at": "2022-02-07T14:45:41Z"
        },
        {
          "tag": "v1.0.0-alpha.8",
          "kind": "prerelease",
          "published_at": "2022-01-26T20:01:18Z"
        },
        {
          "tag": "v1.0.0-alpha.7",
          "kind": "prerelease",
          "published_at": "2022-01-12T20:34:59Z"
        },
        {
          "tag": "v1.0.0-alpha.6",
          "kind": "prerelease",
          "published_at": "2022-01-12T18:10:16Z"
        },
        {
          "tag": "v0.38.8",
          "kind": "patch",
          "published_at": "2021-11-22T18:50:34Z"
        },
        {
          "tag": "v1.0.0-alpha.5",
          "kind": "prerelease",
          "published_at": "2021-10-20T21:35:14Z"
        },
        {
          "tag": "v1.0.0-alpha.4",
          "kind": "prerelease",
          "published_at": "2021-10-13T17:36:28Z"
        },
        {
          "tag": "v0.38.7",
          "kind": "patch",
          "published_at": "2021-09-28T15:14:40Z"
        },
        {
          "tag": "v1.0.0-alpha.3",
          "kind": "prerelease",
          "published_at": "2021-09-21T14:59:15Z"
        },
        {
          "tag": "v0.38.6",
          "kind": "patch",
          "published_at": "2021-09-15T18:48:30Z"
        },
        {
          "tag": "v0.38.5",
          "kind": "patch",
          "published_at": "2021-08-23T14:41:28Z"
        },
        {
          "tag": "v0.38.4",
          "kind": "patch",
          "published_at": "2021-07-12T21:29:36Z"
        },
        {
          "tag": "v0.38.3",
          "kind": "patch",
          "published_at": "2021-06-16T15:56:04Z"
        },
        {
          "tag": "v1.0.0-alpha.2",
          "kind": "prerelease",
          "published_at": "2021-06-16T14:30:20Z"
        },
        {
          "tag": "v1.0.0-alpha.1",
          "kind": "prerelease",
          "published_at": "2021-06-15T21:13:57Z"
        },
        {
          "tag": "v0.38.2",
          "kind": "patch",
          "published_at": "2021-06-15T18:14:12Z"
        },
        {
          "tag": "v0.38.1",
          "kind": "patch",
          "published_at": "2021-05-04T23:04:16Z"
        },
        {
          "tag": "v0.38.0",
          "kind": "minor",
          "published_at": "2021-05-04T17:46:17Z"
        },
        {
          "tag": "v0.37.3",
          "kind": "patch",
          "published_at": "2021-04-27T21:01:20Z"
        },
        {
          "tag": "v0.37.2",
          "kind": "patch",
          "published_at": "2021-04-08T16:11:48Z"
        },
        {
          "tag": "v0.37.1",
          "kind": "patch",
          "published_at": "2021-04-08T13:14:37Z"
        },
        {
          "tag": "v0.37.0",
          "kind": "minor",
          "published_at": "2021-03-31T15:12:32Z"
        },
        {
          "tag": "v0.36.0",
          "kind": "minor",
          "published_at": "2021-03-23T21:31:15Z"
        },
        {
          "tag": "v0.35.0",
          "kind": "minor",
          "published_at": "2021-03-22T14:54:25Z"
        },
        {
          "tag": "v0.34.4",
          "kind": "patch",
          "published_at": "2021-04-05T18:22:29Z"
        },
        {
          "tag": "v0.34.3",
          "kind": "patch",
          "published_at": "2021-04-05T18:30:07Z"
        },
        {
          "tag": "v0.34.2",
          "kind": "patch",
          "published_at": "2021-04-05T18:30:03Z"
        },
        {
          "tag": "v0.34.1",
          "kind": "patch",
          "published_at": "2021-04-05T18:29:58Z"
        },
        {
          "tag": "v0.34.0",
          "kind": "minor",
          "published_at": "2021-02-23T14:22:56Z"
        },
        {
          "tag": "v0.33.1",
          "kind": "patch",
          "published_at": "2021-02-23T14:24:23Z"
        },
        {
          "tag": "v0.33.0",
          "kind": "minor",
          "published_at": "2021-02-04T16:15:19Z"
        },
        {
          "tag": "v0.32.0",
          "kind": "minor",
          "published_at": "2021-02-04T15:07:22Z"
        },
        {
          "tag": "v0.31.2",
          "kind": "patch",
          "published_at": "2021-01-15T21:11:07Z"
        },
        {
          "tag": "v0.31.1",
          "kind": "patch",
          "published_at": "2021-01-14T23:11:45Z"
        },
        {
          "tag": "v0.31.0",
          "kind": "minor",
          "published_at": "2021-01-13T19:09:09Z"
        },
        {
          "tag": "v0.30.1",
          "kind": "patch",
          "published_at": "2020-11-05T20:18:01Z"
        },
        {
          "tag": "v0.30.0",
          "kind": "minor",
          "published_at": "2020-10-29T21:03:10Z"
        },
        {
          "tag": "v0.29.1",
          "kind": "patch",
          "published_at": "2020-09-24T19:11:21Z"
        },
        {
          "tag": "v0.29.0",
          "kind": "minor",
          "published_at": "2020-09-10T14:28:26Z"
        },
        {
          "tag": "v0.28.1",
          "kind": "patch",
          "published_at": "2020-08-27T18:13:42Z"
        },
        {
          "tag": "v0.28.0",
          "kind": "minor",
          "published_at": "2020-08-25T22:43:21Z"
        },
        {
          "tag": "v0.27.2",
          "kind": "patch",
          "published_at": "2020-07-22T15:40:26Z"
        },
        {
          "tag": "v0.27.1",
          "kind": "patch",
          "published_at": "2020-07-07T17:31:15Z"
        },
        {
          "tag": "v0.27.0",
          "kind": "minor",
          "published_at": "2020-06-25T21:47:30Z"
        },
        {
          "tag": "v0.26.3-beta.1",
          "kind": "prerelease",
          "published_at": "2020-06-03T14:16:41Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "cd545ed2901976b77590f03b695dc63df2acc3f2",
          "body": "feat(copy): report layer copy progress (#748)\n\ncopy/publish push image layers via cnab-to-oci, no feedback,\nlooks hung on large bundles. displayEvent now consumes\nFixupEventTypeProgress: live overwritten line on tty, throttled\nper-line on non-tty. no new deps, reuse term+humanize.\n\nadd unit tests for progress formatting/throttling and an\nintegration test asserting copy reports full layer progress.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Report layer copy progress (#3636)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-22T12:31:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "914b3a6add32b14477a61386999d0535f58066aa",
          "body": "* feat(inspect): resolve deps to existing installations\n\nResolve #2627 for the inspect-time dependency graph builder\nonly (per #3623): a v2 dependency with no bundle interface\ndeclared, sharing enabled, and a matching group can now reuse\nan already-installed installation instead of always pulling a\n\n[…]\nundleDigest at query\ntime instead of loading all candidates and matching in Go.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Resolve dependency to existing installation (inspect only) (#3631)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-22T10:11:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7ac7bdb88ab013e1e2ca729b6719d398f633598a",
          "body": "docs: document reaching Docker host from a bundle\n\nAdd DOCKER_NETWORK=host section to connect-to-docker.md and an\nFAQ entry to troubleshooting covering host.docker.internal.\nCloses #1347.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Document reaching Docker host from a bundle (#3635)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-21T08:32:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0e36cc23d3817642e2954e2498e3306a27e36258",
          "body": "docs: add local debugging tips to CONTRIBUTING\n\nAdd section covering --debug/porter-debug param, PORTER_HOME\ninspection, invocation image shell access, and .cnab/Dockerfile.\n\nFixes #713\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Add local debugging tips to CONTRIBUTING (#3634)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-21T07:58:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0e399050b09cf7e0aa9a1f7580cd4758e85e1b61",
          "body": "* Chore(deps): Bump the go-dependencies group with 3 updates\n\nBumps the go-dependencies group with 3 updates: [github.com/cnabio/cnab-to-oci](https://github.com/cnabio/cnab-to-oci), [github.com/docker/cli](https://github.com/docker/cli) and [github.com/moby/buildkit](https://github.com/moby/buildkit\n[…]\nub.com>\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump the go-dependencies group with 3 updates (#3632)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-19T21:14:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1ff86a7ce2de5a41c66829c1d7bbe683eaa7c540",
          "body": "…(#3627)\n\n* migration: error instead of panic when an installation has no claims\n\nmigrateInstallation indexed claimIDs[0] after listItems returned an empty slice (e.g. when the legacy plugin reports no items for the installation), panicking the migration. Return a clear error when there are no claim\n[…]\ne and obscure the real cause. Also add\nmyself to the contributors list.\n\nSigned-off-by: Arunesh Dwivedi <arunesh.devops@gmail.com>\n\n---------\n\nSigned-off-by: Arunesh Dwivedi <arunesh.devops@gmail.com>",
          "is_bot": false,
          "headline": "migration: error instead of panic when an installation has no claims …",
          "author_name": "Arunesh Dwivedi",
          "author_login": "AruneshDwivedi",
          "committed_at": "2026-07-19T20:46:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ba895a3a96ad4dd0e77ef13a489534e18311470a",
          "body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6 to 7.\n- [Release notes](https://github.com/actions/setup-go/releases)\n- [Commits](https://github.com/actions/setup-go/compare/v6...v7)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-go\n  dependency-version: '7'\n  depen\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump actions/setup-go from 6 to 7 (#3633)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-19T15:44:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c28b780cea736c5060bc25642eddf5be297c0974",
          "body": "* test: share setup across archive integration tests\n\nMerge TestArchive_StableDigest and TestArchive_WithNoCompression\ninto TestArchive with subtests, sharing one NewTestPorter and\nSetupIntegrationTest call instead of duplicating it per test.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n*\n[…]\nrnally, which could FailNow on\nwrong goroutine when called from t.Run subtests.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Consolidate archive and output integration tests (#3626)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-17T12:27:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2af109cbad2a6d6f0f481c832245a7e48baa5b6e",
          "body": "Bumps the go-dependencies group with 3 updates: [github.com/cnabio/cnab-go](https://github.com/cnabio/cnab-go), [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) and [google.golang.org/grpc](https://github.com/grpc/grpc-go).\n\n\nUpdates `github.com/cnabio/cnab-go` from 0.26.3 to 0.26.4\n\n[…]\nion-update:semver-patch\n  dependency-group: go-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump the go-dependencies group with 3 updates (#3630)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-16T15:34:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2d1778cdd5fd106e9a6ed23fc5d133ebb3124c16",
          "body": "Bumps the go-dependencies group with 6 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [github.com/containerd/containerd](https://github.com/containerd/containerd) | `1.7.33` | `1.7.34` |\n| [github.com/docker/cli](https://github.com/docker/cli) | `29.5.3+incompatible` | `29.6.1+incompatible`\n[…]\nion-update:semver-minor\n  dependency-group: go-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump the go-dependencies group with 6 updates (#3628)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-13T08:11:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "842ec1b0549699ab0e4f0f66ebb77cc13693e243",
          "body": "* feat(deps): resolve dependency graph for inspect\n\nReplace tree-only DependencyTreeBuilder with GraphBuilder for\n`porter inspect --show-dependencies`.\n\n- Dedup nodes by ref+params+creds+sharing group instead of\n  cloning duplicate subtrees for shared deps.\n- Detect wiring edges: v2 dependency param\n[…]\null-field NodeKey.less comparator.\n\nUpdate tests for new dedup/cycle semantics.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Resolve dependency graph for inspect (#3623)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-11T15:42:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bed3ab51ba4f76ea5e7e62c12dcf0d4f87013b4c",
          "body": "* fix(tests): make smoke test framework parallel-safe\n\nReplace process-wide os.Setenv/os.Chdir in tests/tester with\nper-invocation cwd/env on each porter subprocess, so tests can\nsafely add t.Parallel(). Fixes #2303.\n\n- invoke porter by absolute path, not bare name, to avoid a\n  LookPath race agains\n[…]\ntensen <kimworking@gmail.com>\nSigned-off-by: Kim Christensen <2461567+kichristensen@users.noreply.github.com>\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Make smoke test framework parallel-safe (#3625)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-11T15:41:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e785a14053c8b9738a7666d2bb341771fd6661e5",
          "body": "* feat: lock installations w/ incomplete runs\n\nAdd GetActiveRuns query + gate Execute on it behind dependencies-v2\nflag; add --force-run to bypass. Closes getporter/porter#2651.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n* test: add integration test for installation lock\n\nCover porter i\n[…]\nChristensen <kimworking@gmail.com>\n\n* docs: regen cli docs for --force-run flag\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Lock installations with incomplete runs (#3624)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-11T14:57:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c273540f8c42938e9cad5ece2416117ae28c1af7",
          "body": "…7 updates (#3617)\n\n* Chore(deps): Bump the go-dependencies group across 1 directory with 17 updates\n\nBumps the go-dependencies group with 6 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [github.com/docker/buildx](https://github.com/docker/buildx) | `0.34.0` | `0.35.0` |\n[…]\nub.com>\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump the go-dependencies group across 1 directory with 1…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-07T20:38:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7dbb4a1ec3360b6ab256f39fad77e2f602a7c7af",
          "body": "* fix: nil run parameters in list output\n\nResolvedValue is never persisted, so a Run read back from\nstorage always has blank parameter values. NewDisplayRun\nshowed these as misleading empty strings; leave Parameters\nnil instead so it's omitted from list output.\n\nCloses #2199\n\nSigned-off-by: Kim Chri\n[…]\nfiles\n\nRegenerate fixtures to match nil'd Parameters in\nDisplayRun list output.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Nil run parameters in list output (#3622)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-07T12:13:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1c075d60b2a7d2b04c44ce4eb10ff4338587869f",
          "body": "* fix(build): correct --no-lint hint on autobuild\n\nLint errors during autobuild (install/upgrade/invoke/\nuninstall/publish) told users to rerun with --no-lint,\nbut that flag only exists on porter build.\n\nAdd ErrLintFailed sentinel and detect it in\nensureLocalBundleIsUpToDate, rewriting the message t\n[…]\nflag message still leaked\ninto output. Drop the wrap; add test for the rewrite.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Correct --no-lint hint on autobuild lint errors (#3620)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-07T12:11:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ca6994d5d31ba3a515b25305bdb2447a63e94aea",
          "body": "fix(publish): support OCI index invocation images\n\nDocker 29.x containerd store archives invocation images\nas an OCI index (manifest + attestation) not a plain\nmanifest. Publish-from-archive assumed a plain manifest\nand failed with \"unexpected media type\".\n\nfindImageInLayout now returns the descript\n[…]\nrs\nknow the media type; pushImageFromLayout pushes via\nremote.WriteIndex when it's an index, recursing into\nchild manifests/layers.\n\nCloses #3615\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Support OCI index invocation images (#3618)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-07T12:11:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d40f89f1f8eac8de2f7d0ed41350bc27118fc0f6",
          "body": "* docs: document CLEANUP_CONTAINERS setting\n\nAdd CLEANUP_CONTAINERS env var to connect-to-docker docs,\nw/ example for inspecting a bundle-action container after\nit runs. Cross-link from troubleshooting page.\n\nCloses #803\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n* docs: improve finding\n[…]\ning by the\n`/cnab/app/run` command when other containers were created\nafter it.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Document CLEANUP_CONTAINERS setting (#3621)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-06T13:24:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "42b69afa6b438a0b7090dcedac4e1ea0f17a0ef6",
          "body": "Bumps [docker/login-action](https://github.com/docker/login-action) from 4.2.0 to 4.4.0.\n- [Release notes](https://github.com/docker/login-action/releases)\n- [Commits](https://github.com/docker/login-action/compare/v4.2.0...v4.4.0)\n\n---\nupdated-dependencies:\n- dependency-name: docker/login-action\n  \n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump docker/login-action from 4.2.0 to 4.4.0 (#3619)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-05T21:38:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a76f6af4cdd8a912dbe27a38a8905d316c5f3473",
          "body": "* fix: skip porter-state for modifies: false actions\n\nWhen a custom action has modifies: false, Finalize() now skips\npackStateBag(), preventing porter-state from being written back\nto the installation. Run records and user-defined outputs are\nstill persisted as expected.\n\nFixes #3579\n\nSigned-off-by:\n[…]\ntion\n\nPoint to SaveOperationResult(), not Finalize(), which\nwas never modified.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Skip porter-state for `modifies: false` custom actions (#3582)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-05T21:30:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ab3b8917c56a1ae8507f7c692b926830ab860d0d",
          "body": "…rter build (#3614)\n\n* feat(experimental): add file-sources feature flag\n\nRegister the file-sources experimental flag in ParseFlags and\nadd tests covering flag parsing and enablement behavior.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n* fix(manifest): broaden schema checks for feature \n[…]\ntents error in config_test\n- drop redundant Manifest selector on embedded field\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Add file-sources experimental feature for downloading files during po…",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-05T21:24:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ece392c079146cff5a8600ba618bd1d5c8a1fa51",
          "body": "go.mod requires go>=1.26.0, default was 1.25.10, breaking\nbuild. Use 1.26.4 for latest security fixes.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "fix(ci): bump default go version to 1.26.4",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-02T08:21:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ab34af87a8916a9be7f090db4943346bd102277a",
          "body": "….6 to 2.1.0 (#3616)\n\nChore(deps): Bump github.com/sigstore/timestamp-authority/v2\n\nBumps [github.com/sigstore/timestamp-authority/v2](https://github.com/sigstore/timestamp-authority) from 2.0.6 to 2.1.0.\n- [Release notes](https://github.com/sigstore/timestamp-authority/releases)\n- [Changelog](https\n[…]\n/v2\n  dependency-version: 2.1.0\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump github.com/sigstore/timestamp-authority/v2 from 2.0…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-02T08:09:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "27a5693da6bfc7a7cbed85227bbdca0ead075bbd",
          "body": "* feat: forward SIGTERM to bundle steps for graceful shutdown (#3602)\n\nWhen a user cancels porter with SIGINT, the cancellation now propagates\ngracefully to the running bundle step instead of hard-killing it.\n\n- Porter runtime (PID 1 in the invocation image) now handles SIGTERM in\n  addition to SIGI\n[…]\n a non-zero exit from the\ncleanup script (ExitError) is caught as a regression.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Forward SIGTERM to bundle steps for graceful shutdown (#3603)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-07-02T08:08:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e6e6f4b061ddb55b9b6dcef7b9e740b8a0fb3744",
          "body": "Bumps [actions/cache](https://github.com/actions/cache) from 5 to 6.\n- [Release notes](https://github.com/actions/cache/releases)\n- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)\n- [Commits](https://github.com/actions/cache/compare/v5...v6)\n\n---\nupdated-dependencies:\n- dependenc\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump actions/cache from 5 to 6 (#3613)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-28T21:34:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5c8e10143bd6d511e59c336ca8670e325e1cbeb8",
          "body": "* fix: show params with sources in explain output\n\nParameters with a source (e.g. output injection) were\nhidden from `porter explain`. Show them with an\n`(injected)` default label so users know Porter will\nattempt to populate them from a prior run's output.\n\nFor install and stateless actions where i\n[…]\nnil passed as interface{}\nwhere a concrete cnabtooci.RegistryOptions is needed.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Show params with sources in porter explain output (#3604)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-06-27T22:13:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c8b89caea58645a1e2813a0c12a2b848d66dbcd1",
          "body": "Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.5.1 to 1.5.2.\n- [Release notes](https://github.com/sigstore/rekor/releases)\n- [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/sigstore/rekor/compare/v1.5.1...v1.5.2)\n\n---\n\n[…]\nkor\n  dependency-version: 1.5.2\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump github.com/sigstore/rekor from 1.5.1 to 1.5.2 (#3611)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-26T11:39:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5497e64df8efe210b67f73c205fa960282abd4a6",
          "body": "* fix: param sets override persisted --param values\n\nWhen upgrading, parameters previously set via --param were\npersisted on the installation and incorrectly suppressed\nresolution of values from a named parameter set. Parameter\nsets should take precedence over old persisted values, with\nonly current\n[…]\ndled correctly, and TrimSpace corruption of whitespace\nin values is eliminated.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Param sets override persisted --param values on upgrade (#3600)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-06-26T11:35:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "79304bdf8b507694f0c3b67b422ed4aa3fd419df",
          "body": "….33 (#3610)\n\nBumps [github.com/containerd/containerd](https://github.com/containerd/containerd) from 1.7.31 to 1.7.33.\n- [Release notes](https://github.com/containerd/containerd/releases)\n- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)\n- [Commits](https://github.com/co\n[…]\nndency-version: 1.7.33\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump github.com/containerd/containerd from 1.7.31 to 1.7…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-26T10:49:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ccb683b2cfddb3261d6b67d91fd9c9022241a5d8",
          "body": "….2.5 (#3608)\n\nChore(deps): Bump github.com/containerd/containerd/v2\n\nBumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) from 2.2.3 to 2.2.5.\n- [Release notes](https://github.com/containerd/containerd/releases)\n- [Changelog](https://github.com/containerd/containerd\n[…]\n/v2\n  dependency-version: 2.2.5\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump github.com/containerd/containerd/v2 from 2.2.3 to 2…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-23T09:54:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c6bcee2f22e7d4bfc8deba78f19775aa77b96ba6",
          "body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/v6...v7)\n\n---\nupdated-dependenc\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump actions/checkout from 6 to 7 (#3606)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-23T09:52:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "07c927850f697ae2935a736c5d652a79937d847e",
          "body": "* feat(config): add dependencies.version-strategy setting\n\nAdd DependenciesConfig struct, constants for the four strategies\n(exact, max-patch, max-minor, min), and GetDependenciesVersionStrategy\naccessor that defaults to \"exact\".\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n* feat(cnab): \n[…]\n ref rather than error.\nOnly error when there is no pinned ref to fall back to.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Resolve dependency version ranges (#3572)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-06-13T22:35:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "478d31a7014ad9ad7ec1698cd649feff551ceb05",
          "body": "* fix: print errors once, not per span level\n\nRemove console logging from TraceLogger.Error() so errors are\nonly recorded to the OTel span. main.go (porter and exec) now\nprints the final error to stderr exactly once after command\nexecution fails, eliminating the repeated/growing error chain\nvisible \n[…]\nngly.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\nCo-authored-by: schristoff <28318173+schristoff@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Print errors once, not per span level (#3592)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-05-27T09:32:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a5b4e3e17175f69555c7d6268f0a17b0d8b9e2be",
          "body": "Bumps [docker/login-action](https://github.com/docker/login-action) from 4.1.0 to 4.2.0.\n- [Release notes](https://github.com/docker/login-action/releases)\n- [Commits](https://github.com/docker/login-action/compare/v4.1.0...v4.2.0)\n\n---\nupdated-dependencies:\n- dependency-name: docker/login-action\n  \n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump docker/login-action from 4.1.0 to 4.2.0 (#3597)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-27T09:31:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "35dbbc2c9d3e0fc8464e142772f77c31c56978a8",
          "body": "chore: update Go to 1.25.10\n\nBump go.mod and all workflow files from 1.25.8 to 1.25.10.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Update Go to 1.25.10 (#3593)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-05-18T21:36:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "94395e35c04ccbcc2cd771ee5ee2c8e343bca2b6",
          "body": "docs: add .dockerignore page for bundles\n\nExplain why .dockerignore exists, what the default\nfile contains, and how to use it to reduce installer\nimage size. Link from the bundle index and from the\ncustom-dockerfile page.\n\nCloses #1264\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Add .dockerignore page for bundles (#3594)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-05-18T09:43:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bb128f54ba69ca5eb3423235c1ea65dd06aeadc2",
          "body": "… updates (#3591)\n\nBumps the go-dependencies group with 3 updates in the / directory: [github.com/docker/buildx](https://github.com/docker/buildx), [github.com/tidwall/gjson](https://github.com/tidwall/gjson) and [google.golang.org/grpc](https://github.com/grpc/grpc-go).\n\n\nUpdates `github.com/docker\n[…]\nion-update:semver-minor\n  dependency-group: go-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump the go-dependencies group across 1 directory with 5…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-17T20:46:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d09ee7ab896da84957eb444c371aaff58a28b5d7",
          "body": "* feat: Add MCP server\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n* ci: ignore segmentio/asm in license check\n\nLicense lives at repo root; subpackages have no own LICENSE\nfiles, causing go-licenses to fail. Introduced transitively\nvia github.com/modelcontextprotocol/go-sdk.\n\nSigned-off-\n[…]\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n* docs: Update CLI docs\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Add MCP server (#3577)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-05-17T13:55:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "34f99cc8c5f4d5918693366428f76550963db407",
          "body": "…com/in-toto/in-toto-golang-0.11.0\n\nChore(deps): Bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0",
          "is_bot": false,
          "headline": "Merge pull request #3589 from getporter/dependabot/go_modules/github.…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-05-10T10:43:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c06754cfde9e70f37655969acd7149d56ec2c71d",
          "body": "Bumps [github.com/in-toto/in-toto-golang](https://github.com/in-toto/in-toto-golang) from 0.10.0 to 0.11.0.\n- [Release notes](https://github.com/in-toto/in-toto-golang/releases)\n- [Changelog](https://github.com/in-toto/in-toto-golang/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/in-toto/i\n[…]\n.11.0)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/in-toto/in-toto-golang\n  dependency-version: 0.11.0\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump github.com/in-toto/in-toto-golang",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-08T22:27:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4cb9c9597ac720298bf541430d77f2a78a201289",
          "body": "…ndencies-6fcea45fc3\n\nChore(deps): Bump the go-dependencies group with 4 updates",
          "is_bot": false,
          "headline": "Merge pull request #3588 from getporter/dependabot/go_modules/go-depe…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-05-04T16:07:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "87fc7268516c93c0a7c3f3f32b8e37713625a6ea",
          "body": "Bumps the go-dependencies group with 4 updates: [github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver), [github.com/docker/cli](https://github.com/docker/cli), [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) and [go.uber.org/zap](https://github.com/uber-go/zap).\n\n\n[…]\n dependency-version: 1.28.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n  dependency-group: go-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump the go-dependencies group with 4 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-03T04:53:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3185c8c96f8ec034e75261d2ea12375f3769573d",
          "body": "…ndencies-cd0d47135c\n\nChore(deps): Bump the go-dependencies group with 4 updates",
          "is_bot": false,
          "headline": "Merge pull request #3587 from getporter/dependabot/go_modules/go-depe…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-04-26T09:41:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f7ff4bed53d712252275be29742f30816ed3b39a",
          "body": "Bumps the go-dependencies group with 4 updates: [github.com/docker/cli](https://github.com/docker/cli), [github.com/magefile/mage](https://github.com/magefile/mage), [github.com/moby/moby/api](https://github.com/moby/moby) and [github.com/moby/moby/client](https://github.com/moby/moby).\n\n\nUpdates `g\n[…]\n  dependency-version: 0.4.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: go-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump the go-dependencies group with 4 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-26T04:53:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4dd49bf479a4a546573c9272b23ae32e6fb1e812",
          "body": "…com/sigstore/timestamp-authority/v2-2.0.6\n\nChore(deps): Bump github.com/sigstore/timestamp-authority/v2 from 2.0.5 to 2.0.6",
          "is_bot": false,
          "headline": "Merge pull request #3586 from getporter/dependabot/go_modules/github.…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-04-19T16:46:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "96aad64dd4dfd12829a59e23fad4b64944060d06",
          "body": "Bumps [github.com/sigstore/timestamp-authority/v2](https://github.com/sigstore/timestamp-authority) from 2.0.5 to 2.0.6.\n- [Release notes](https://github.com/sigstore/timestamp-authority/releases)\n- [Changelog](https://github.com/sigstore/timestamp-authority/blob/main/CHANGELOG.md)\n- [Commits](https\n[…]\n---\nupdated-dependencies:\n- dependency-name: github.com/sigstore/timestamp-authority/v2\n  dependency-version: 2.0.6\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump github.com/sigstore/timestamp-authority/v2",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-19T07:36:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "df193514ea1c2a0687a7fd2c362b90afb165bb5a",
          "body": "….31 in the go-dependencies group (#3585)\n\nChore(deps): Bump github.com/containerd/containerd\n\nBumps the go-dependencies group with 1 update: [github.com/containerd/containerd](https://github.com/containerd/containerd).\n\n\nUpdates `github.com/containerd/containerd` from 1.7.30 to 1.7.31\n- [Release no\n[…]\nion-update:semver-patch\n  dependency-group: go-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump github.com/containerd/containerd from 1.7.30 to 1.7…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-19T07:35:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c9ce8e1e67c7aab88fb565afecf435d98a8d2006",
          "body": "…ions/upload-artifact-7.0.1\n\nChore(deps): Bump actions/upload-artifact from 7.0.0 to 7.0.1",
          "is_bot": false,
          "headline": "Merge pull request #3583 from getporter/dependabot/github_actions/act…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-04-12T15:16:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1a757e5955b788806502515071abb24445210b69",
          "body": "…ifact-7.0.1",
          "is_bot": false,
          "headline": "Merge branch 'main' into dependabot/github_actions/actions/upload-art…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-04-12T14:49:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c27de1a10d771d884bc4a0aec4982abdbaf82385",
          "body": "…ndencies-3af53f2ad0\n\nChore(deps): Bump the go-dependencies group with 4 updates",
          "is_bot": false,
          "headline": "Merge pull request #3584 from getporter/dependabot/go_modules/go-depe…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-04-12T14:48:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "69240c38476d8105c8c9fb2c3a50888171b1b848",
          "body": "Bumps the go-dependencies group with 4 updates: [github.com/docker/cli](https://github.com/docker/cli), [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry), [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) and [go.opentelemetry.io/contrib/instrume\n[…]\n dependency-version: 0.68.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n  dependency-group: go-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump the go-dependencies group with 4 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-12T04:53:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f781bcda8a19a772d10d3cd9502a8898e2b1da07",
          "body": "Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 7.0.0 to 7.0.1.\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-artifact/compare/v7.0.0...v7.0.1)\n\n---\nupdated-dependencies:\n- dependency-name: actions/upload-artifact\n  dependency-version: 7.0.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump actions/upload-artifact from 7.0.0 to 7.0.1",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-12T04:52:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a81c51a810dcab466285335357dd013e54dcbfa1",
          "body": "* fix: scope secret resolution to selected context\n\nIn multi-context configs, ${secret.*} references were collected\nfrom the entire file before the active context was known. This\ncaused secrets from unselected contexts to be resolved, failing\nwhen those secrets don't exist in the active plugin.\n\nNow\n[…]\nll\nprevents redundant scanning across the two passes within a\nsingle Load call.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Scope secret resolution to selected context (#3561)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-04-10T22:09:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bd5b8206f94aec73ed49391fdb3b3f02808410c3",
          "body": "…ker/login-action-4.1.0\n\nChore(deps): Bump docker/login-action from 4.0.0 to 4.1.0",
          "is_bot": false,
          "headline": "Merge pull request #3580 from getporter/dependabot/github_actions/doc…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-04-05T21:07:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1a3153d354ca67c39b4808d990ea37f088171ae8",
          "body": "…n-4.1.0",
          "is_bot": false,
          "headline": "Merge branch 'main' into dependabot/github_actions/docker/login-actio…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-04-05T20:01:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "af90c5c99de70ae758a425289052531a36a5988f",
          "body": "…ndencies-d6ac97ecb2\n\nChore(deps): Bump the go-dependencies group with 13 updates",
          "is_bot": false,
          "headline": "Merge pull request #3581 from getporter/dependabot/go_modules/go-depe…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-04-05T19:54:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "03372cd8ca81f3659287550b6781ec6809fef60f",
          "body": "Bumps the go-dependencies group with 13 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [github.com/docker/buildx](https://github.com/docker/buildx) | `0.32.1` | `0.33.0` |\n| [github.com/magefile/mage](https://github.com/magefile/mage) | `1.17.0` | `1.17.1` |\n| [github.com/moby/buildkit](htt\n[…]\n dependency-version: 1.80.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n  dependency-group: go-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump the go-dependencies group with 13 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-05T04:53:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "97bf5f8395dd892b4a1b8258cd3d735a9989f23b",
          "body": "Bumps [docker/login-action](https://github.com/docker/login-action) from 4.0.0 to 4.1.0.\n- [Release notes](https://github.com/docker/login-action/releases)\n- [Commits](https://github.com/docker/login-action/compare/v4.0.0...v4.1.0)\n\n---\nupdated-dependencies:\n- dependency-name: docker/login-action\n  dependency-version: 4.1.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump docker/login-action from 4.0.0 to 4.1.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-05T04:52:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c9278496ddf9b1a6a849116f7db0afb587b2b19e",
          "body": "…ndencies-acda7f0ef0\n\nChore(deps): Bump the go-dependencies group with 3 updates",
          "is_bot": false,
          "headline": "Merge pull request #3578 from getporter/dependabot/go_modules/go-depe…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-04-01T19:46:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "71173c3940ad21df34c5c3c23078aba87e9879ee",
          "body": "…0ef0",
          "is_bot": false,
          "headline": "Merge branch 'main' into dependabot/go_modules/go-dependencies-acda7f…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-04-01T19:19:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0adcbe213fffc328400e874aa871b7d184f57c47",
          "body": "* feat: add persistent parameter shorthand\n\nAdd `persistent: true` on a parameter as shorthand for\nwiring up a matching output so the value is remembered\nacross bundle executions (install → upgrade/uninstall).\n\nRequires schema version 1.2.0 and the\n`persistent-parameters` experimental feature flag.\n\n[…]\nersistent-parameters (schema 1.2.0) should also\nbe able to use dependencies-v2.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "feat: add persistent parameter shorthand (#3574)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-03-30T11:58:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2bb4c9b830c979607cb259872be19b883dc1f73c",
          "body": "Bumps the go-dependencies group with 3 updates: [github.com/docker/cli](https://github.com/docker/cli), [github.com/magefile/mage](https://github.com/magefile/mage) and [github.com/moby/buildkit](https://github.com/moby/buildkit).\n\n\nUpdates `github.com/docker/cli` from 29.3.0+incompatible to 29.3.1+\n[…]\n dependency-version: 0.28.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: go-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump the go-dependencies group with 3 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-29T04:53:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "de01a51d53c8df655e15a48897ea9e4747d56456",
          "body": "Add a best-practices page explaining when to use the\n`images` section vs hardcoded image references, including\nhow relocation works and an approach decision table.\n\nUpdate the manifest images section with context on when\nto use or skip the images section. Add cross-links from\nairgap and manifest docs to the new page.\n\nCloses #2708\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "docs: add best practice for bundle image refs (#3575)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-03-24T16:23:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "787de67cb852de21ac1aa674830124846e64c537",
          "body": "…e go-dependencies group across 1 directory (#3576)\n\nChore(deps): Bump get.porter.sh/magefiles\n\nBumps the go-dependencies group with 1 update in the / directory: [get.porter.sh/magefiles](https://github.com/getporter/magefiles).\n\n\nUpdates `get.porter.sh/magefiles` from 0.6.13 to 0.6.14\n- [Release no\n[…]\nion-update:semver-patch\n  dependency-group: go-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump get.porter.sh/magefiles from 0.6.13 to 0.6.14 in th…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-24T16:23:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f2e05dc7aa84456e90998d04cab8f815c7fdc84c",
          "body": "Migrate away from docker/docker to moby/moby/X",
          "is_bot": false,
          "headline": "Merge pull request #3559 from dgannon991/chore/replace-docker-docker",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-23T20:53:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d2182f53c458664bba12ad10b05e8141ecee3823",
          "body": "Signed-off-by: David Gannon <19214156+dgannon991@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Bumped dependencies",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-22T21:01:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "571549f5af4d875960dc0ea954c4bc2f9df159d4",
          "body": "Signed-off-by: David Gannon <19214156+dgannon991@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Addressed PR feedback",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-21T22:58:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fa3483024df65fde70c673190e48d2d72e298766",
          "body": "Signed-off-by: David Gannon <19214156+dgannon991@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Migrated from docker/docker to moby/moby/x",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-21T22:58:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7024fd98431fa39b4e2d50bc31b98aa9f9cd206b",
          "body": "Signed-off-by: David Gannon <19214156+dgannon991@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Moved away from docker/docker to moby/moby/x",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-21T22:58:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5aa52bf6dfdf2485a4e704e19b654377ef63dd3f",
          "body": "Adds a references/glossary.md page covering 12 terms used in\nPorter and CNAB documentation (Bundle, CNAB, Config File,\nDigest, Docker Host/Daemon, Installation, Manifest, Mixin,\nPlugin, Registry, Repository, Tag).\n\nCloses #1886\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "docs: add glossary page (#3573)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-03-21T22:50:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1b73bb4049c69961b656fdb2d6e78deaceddc30d",
          "body": "Bumped to go1.25",
          "is_bot": false,
          "headline": "Merge pull request #3566 from dgannon991/chore/go-1.25-upgrade",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-21T22:20:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "79756757d7977939e8aefdd53f0bf2c3e1b67b96",
          "body": "Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.79.1 to 1.79.3.\n- [Release notes](https://github.com/grpc/grpc-go/releases)\n- [Commits](https://github.com/grpc/grpc-go/compare/v1.79.1...v1.79.3)\n\n---\nupdated-dependencies:\n- dependency-name: google.golang.org/grpc\n  dependency-version: 1.79.3\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump google.golang.org/grpc from 1.79.1 to 1.79.3 (#3570)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-20T20:12:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8b9f641715530d0dfec3190e9b32126ff96d5dba",
          "body": "Signed-off-by: David Gannon <19214156+dgannon991@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Bumped to go1.25",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-16T21:25:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "39ad175691f1cb302b31c0264420e476888f968d",
          "body": "Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 8.0.0 to 8.0.1.\n- [Release notes](https://github.com/actions/download-artifact/releases)\n- [Commits](https://github.com/actions/download-artifact/compare/v8.0.0...v8.0.1)\n\n---\nupdated-dependencies:\n- dependency-name\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump actions/download-artifact from 8.0.0 to 8.0.1 (#3567)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-16T13:01:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cfac0dd993c2e26e7bf3e566d1801b250d26afef",
          "body": "…ker/setup-buildx-action-4\n\nChore(deps): Bump docker/setup-buildx-action from 3 to 4",
          "is_bot": false,
          "headline": "Merge pull request #3563 from getporter/dependabot/github_actions/doc…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-10T20:31:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "56207ecca4eee6fcc0092bb3845cba29ec03977d",
          "body": "…x-action-4",
          "is_bot": false,
          "headline": "Merge branch 'main' into dependabot/github_actions/docker/setup-build…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-09T22:05:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "460de1dbda90e45806fc841f0073a486866696a1",
          "body": "…ker/login-action-4.0.0\n\nChore(deps): Bump docker/login-action from 3.7.0 to 4.0.0",
          "is_bot": false,
          "headline": "Merge pull request #3562 from getporter/dependabot/github_actions/doc…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-08T19:59:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "45b2bd8e48ad14e3a1ab801e32e8658ad5db875b",
          "body": "Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3 to 4.\n- [Release notes](https://github.com/docker/setup-buildx-action/releases)\n- [Commits](https://github.com/docker/setup-buildx-action/compare/v3...v4)\n\n---\nupdated-dependencies:\n- dependency-name: docker/setup-buildx-action\n  dependency-version: '4'\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump docker/setup-buildx-action from 3 to 4",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-08T04:52:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "33896f187fa4b34584e5123853d27984da0beac5",
          "body": "Bumps [docker/login-action](https://github.com/docker/login-action) from 3.7.0 to 4.0.0.\n- [Release notes](https://github.com/docker/login-action/releases)\n- [Commits](https://github.com/docker/login-action/compare/v3.7.0...v4.0.0)\n\n---\nupdated-dependencies:\n- dependency-name: docker/login-action\n  dependency-version: 4.0.0\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump docker/login-action from 3.7.0 to 4.0.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-08T04:52:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "da4b9fcec91c2075928740f294b8614279de2d13",
          "body": "Only v-prefix tags with at least a major and minor version",
          "is_bot": false,
          "headline": "Merge pull request #3554 from erikced/fix-do-not-v-prefix-digits",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-02T21:33:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "407bb5777e3ab5bfb01f24cc339036bbc03da9f9",
          "body": "Update `tagIsSemverLike` to make it validate that the tag has nonzero\nlength instead of assuming the calling code has done this.\nSubsequently, remove `TasTag` check from `ensureVPrefix`. \n\nSigned-off-by: Erik Cederberg <erik.cederberg@sectra.com>",
          "is_bot": false,
          "headline": "refactor: move tag existence check",
          "author_name": "Erik Cederberg",
          "author_login": "erikced",
          "committed_at": "2026-03-02T11:20:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "327308c18f36acae16633de4dd3459f3c7e7c89f",
          "body": "Update auto v-prefixing on pull: only prefix tags with at least major\nand minor version, to avoid enforcing v-prefix on all-digit refs like\nhashes and build numbers.\n\nSigned-off-by: Erik Cederberg <erik.cederberg@sectra.com>",
          "is_bot": false,
          "headline": "fix: only v-prefix tags with at least a major and minor version",
          "author_name": "Erik Cederberg",
          "author_login": "erikced",
          "committed_at": "2026-03-02T11:20:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "424ae2c502f3b2e9c9aeb8546862f856dddb0962",
          "body": "* feat: multi-environment config via named contexts\n\nAdd kubectl-style multi-context support to the Porter config\nfile using a new schemaVersion: \"2.0.0\" format. Users can\ndefine multiple named contexts in a single config file and\nselect between them at runtime.\n\nChanges:\n- New config format: schema\n[…]\ned-off-by: Kim Christensen <kimworking@gmail.com>\n\n* docs: Update documentation\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Multi-environment config via named contexts (#3547)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-03-01T22:18:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "572620077caa39e9f475dce8a50723491aec6c81",
          "body": "…ions/download-artifact-8.0.0\n\nChore(deps): Bump actions/download-artifact from 7.0.0 to 8.0.0",
          "is_bot": false,
          "headline": "Merge pull request #3556 from getporter/dependabot/github_actions/act…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-01T15:10:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7f4f8a3ccc9837374d148bdb9214207d30dd3ce8",
          "body": "…rtifact-8.0.0",
          "is_bot": false,
          "headline": "Merge branch 'main' into dependabot/github_actions/actions/download-a…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-01T12:42:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "590aca0125d4d12fbfb265d938944fbed2642a20",
          "body": "…ions/upload-artifact-7.0.0\n\nChore(deps): Bump actions/upload-artifact from 6.0.0 to 7.0.0",
          "is_bot": false,
          "headline": "Merge pull request #3557 from getporter/dependabot/github_actions/act…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-03-01T12:40:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4203f68adb6a5dca8fb702e83c3cfed009f1a079",
          "body": "Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.0.\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-artifact/compare/v6.0.0...v7.0.0)\n\n---\nupdated-dependencies:\n- dependency-name: actions/upload-artifact\n  dependency-version: 7.0.0\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump actions/upload-artifact from 6.0.0 to 7.0.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-01T04:57:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9171c49ab25024e0072728fe1f1b68100cb6b24d",
          "body": "Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7.0.0 to 8.0.0.\n- [Release notes](https://github.com/actions/download-artifact/releases)\n- [Commits](https://github.com/actions/download-artifact/compare/v7.0.0...v8.0.0)\n\n---\nupdated-dependencies:\n- dependency-name: actions/download-artifact\n  dependency-version: 8.0.0\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump actions/download-artifact from 7.0.0 to 8.0.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-01T04:57:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e73c5056bc1b14b124c49b5b1f0326e38cf97114",
          "body": "chore: Update dependencies\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Update dependencies (#3552)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-02-25T12:36:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ea50a94feb3397fe97f46e67023b20fc862caeb7",
          "body": "chore(deps): Update OpenTelemetry dependencies\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Update OpenTelemetry dependencies (#3550)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-02-22T22:08:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "50754d279fe3f4db44b55229a627936493c26975",
          "body": "…#3549)\n\n* feat: add installation.id template var\n\nExpose installation UUID as PORTER_INSTALLATION_ID env var\nand installation.id template variable, giving bundles a\nglobally unique value for resource naming.\n\nCloses #2006\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n* docs: document inst\n[…]\nithin an installation's\nlifecycle but changes if the installation is recreated.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Add installation.id template var and PORTER_INSTALLATION_ID env var (…",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-02-22T22:07:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cb7f33cfe4a0a0d8f1411c9b33083426713a9109",
          "body": "chore: bump Go to 1.24.13\n\nUpdate Go version from 1.24.11 to 1.24.13 across all\nworkflows, go.mod, and Netlify config.\n\nResolves security vulnerabilities in the Go standard\nlibrary fixed in 1.24.13.\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Bump Go to 1.24.13 (#3548)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-02-20T22:27:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "475ca03ca6fb10a0276daa991b26f530a1ab121c",
          "body": "* feat: add porter config show/edit commands\n\nAdd CLI commands to view and edit porter config file.\n- show: displays raw config, preserves template vars\n- edit: opens in $EDITOR, creates default if missing\n\nCloses #1077\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n* docs: Update documenta\n[…]\nned-off-by: Kim Christensen <kimworking@gmail.com>\n\n* fix: Use Fprintln instead\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>\n\n---------\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Add porter config show/edit commands (#3544)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-02-11T21:06:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "23f826d183d62e0dd92a06dfd9d9c8d3b08f1b3c",
          "body": "…ker/login-action-3.7.0\n\nChore(deps): Bump docker/login-action from 3.6.0 to 3.7.0",
          "is_bot": false,
          "headline": "Merge pull request #3545 from getporter/dependabot/github_actions/doc…",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-02-01T14:57:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "969bcd843f32a0d71bd94e61f5ce6f2871f67d52",
          "body": "Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.\n- [Release notes](https://github.com/docker/login-action/releases)\n- [Commits](https://github.com/docker/login-action/compare/v3.6.0...v3.7.0)\n\n---\nupdated-dependencies:\n- dependency-name: docker/login-action\n  dependency-version: 3.7.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "Chore(deps): Bump docker/login-action from 3.6.0 to 3.7.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-01T05:01:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "32e0799e4800d8c9b5cde248503b64b96cfc698f",
          "body": "* feat: optimize bundle image size by restructuring build\n\nChange build context from project root to .cnab directory and use\nnamed build context for user files. This eliminates duplicate COPY\nlayers and unnecessary RUN commands for file deletion.\n\nKey changes:\n- Build from .cnab directory instead of\n[…]\nigned-off-by: Claude <noreply@anthropic.com>\nSigned-off-by: Kim Christensen <2461567+kichristensen@users.noreply.github.com>\nCo-authored-by: David Gannon <19214156+dgannon991@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Optimize bundle size (#3488)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-01-28T22:50:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "24f608b02404749233bd860f47e102b128fcfd27",
          "body": "Pass in context to cnab-go Run()",
          "is_bot": false,
          "headline": "Merge pull request #3253 from dgannon991/feat/2234/cancel-context",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-01-19T22:00:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "25124b5dc57fd803993d7abd9bc97a77811263a3",
          "body": "Signed-off-by: David Gannon <19214156+dgannon991@users.noreply.github.com>",
          "is_bot": false,
          "headline": "#2234: Use the new published cnab-go library and provide our context",
          "author_name": "David Gannon",
          "author_login": "dgannon991",
          "committed_at": "2026-01-14T20:11:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d6f1fe95adc29f6b0bee889ba596aec96cfafac1",
          "body": "fix: validate porter file/dir conflicts\n\nDetect if file/directory named \"porter\" exists in bundle\ndirectory during build validation. Return clear error before\nconfusing runtime failure occurs.\n\nFixes #3536\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Validate porter file/dir conflicts (#3539)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-01-14T08:43:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b311a089b320758991d84dc0ac971d184669de2d",
          "body": "Expand paths-ignore filters to skip running CI/CD pipelines when only\ndocumentation files are modified. This includes:\n- All markdown files (*.md)\n- docs/ directory\n- LICENSE file\n- netlify.toml\n\nPreviously, paths-ignore was inconsistently applied - some workflows\nonly ignored docs/ on push events b\n[…]\nrkflows:\n- porter.yml\n- porter-integration-pr.yml\n- porter-canary.yml\n- porter-install-check.yml\n- codeql.yaml\n- trivy.yaml\n- check-licenses.yaml\n\nSigned-off-by: Kim Christensen <kimworking@gmail.com>",
          "is_bot": false,
          "headline": "Skip CI pipelines for documentation-only changes (#3538)",
          "author_name": "Kim Christensen",
          "author_login": "kichristensen",
          "committed_at": "2026-01-13T21:52:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 100,
      "commits_last_year": 265,
      "latest_release_at": "2021-04-06T21:29:46Z",
      "latest_release_tag": "canary",
      "releases_from_tags": false,
      "days_since_last_push": 0,
      "active_weeks_last_year": 48,
      "days_since_latest_release": 1933,
      "mean_days_between_releases": -141.3
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 100,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": true
    },
    "ecosystem": {
      "packages": [
        {
          "name": "get.porter.sh/porter",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": null,
          "registry_url": "https://pkg.go.dev/get.porter.sh/porter",
          "is_deprecated": false,
          "latest_version": "v1.6.1",
          "repository_url": null,
          "versions_count": 136,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-17T12:27:11Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 5
        }
      ]
    },
    "popularity": {
      "forks": 222,
      "stars": 1422,
      "watchers": 24,
      "fork_history": {
        "days": [
          {
            "date": "2018-12-10",
            "count": 1
          },
          {
            "date": "2018-12-11",
            "count": 2
          },
          {
            "date": "2018-12-13",
            "count": 1
          },
          {
            "date": "2018-12-15",
            "count": 1
          },
          {
            "date": "2019-01-02",
            "count": 2
          },
          {
            "date": "2019-01-11",
            "count": 1
          },
          {
            "date": "2019-01-14",
            "count": 1
          },
          {
            "date": "2019-02-12",
            "count": 1
          },
          {
            "date": "2019-02-20",
            "count": 1
          },
          {
            "date": "2019-02-23",
            "count": 1
          },
          {
            "date": "2019-03-05",
            "count": 1
          },
          {
            "date": "2019-04-19",
            "count": 1
          },
          {
            "date": "2019-05-29",
            "count": 1
          },
          {
            "date": "2019-05-30",
            "count": 1
          },
          {
            "date": "2019-07-17",
            "count": 1
          },
          {
            "date": "2019-07-25",
            "count": 2
          },
          {
            "date": "2019-08-06",
            "count": 2
          },
          {
            "date": "2019-08-09",
            "count": 1
          },
          {
            "date": "2019-09-12",
            "count": 1
          },
          {
            "date": "2019-09-17",
            "count": 1
          },
          {
            "date": "2019-09-21",
            "count": 1
          },
          {
            "date": "2019-09-24",
            "count": 1
          },
          {
            "date": "2019-09-26",
            "count": 2
          },
          {
            "date": "2019-09-27",
            "count": 1
          },
          {
            "date": "2019-09-28",
            "count": 1
          },
          {
            "date": "2019-10-01",
            "count": 1
          },
          {
            "date": "2019-10-12",
            "count": 1
          },
          {
            "date": "2019-10-16",
            "count": 1
          },
          {
            "date": "2019-10-24",
            "count": 1
          },
          {
            "date": "2019-10-25",
            "count": 1
          },
          {
            "date": "2019-11-04",
            "count": 1
          },
          {
            "date": "2019-11-06",
            "count": 1
          },
          {
            "date": "2019-11-07",
            "count": 1
          },
          {
            "date": "2019-11-20",
            "count": 1
          },
          {
            "date": "2019-11-24",
            "count": 1
          },
          {
            "date": "2019-12-11",
            "count": 1
          },
          {
            "date": "2020-01-02",
            "count": 1
          },
          {
            "date": "2020-01-15",
            "count": 1
          },
          {
            "date": "2020-01-24",
            "count": 1
          },
          {
            "date": "2020-01-29",
            "count": 1
          },
          {
            "date": "2020-02-07",
            "count": 2
          },
          {
            "date": "2020-02-10",
            "count": 2
          },
          {
            "date": "2020-02-18",
            "count": 1
          },
          {
            "date": "2020-03-16",
            "count": 1
          },
          {
            "date": "2020-03-20",
            "count": 1
          },
          {
            "date": "2020-06-03",
            "count": 1
          },
          {
            "date": "2020-06-08",
            "count": 1
          },
          {
            "date": "2020-06-09",
            "count": 1
          },
          {
            "date": "2020-06-15",
            "count": 1
          },
          {
            "date": "2020-06-22",
            "count": 1
          },
          {
            "date": "2020-07-01",
            "count": 1
          },
          {
            "date": "2020-07-08",
            "count": 1
          },
          {
            "date": "2020-08-13",
            "count": 1
          },
          {
            "date": "2020-09-03",
            "count": 1
          },
          {
            "date": "2020-10-14",
            "count": 1
          },
          {
            "date": "2020-10-17",
            "count": 1
          },
          {
            "date": "2020-10-18",
            "count": 1
          },
          {
            "date": "2020-10-28",
            "count": 1
          },
          {
            "date": "2020-11-12",
            "count": 1
          },
          {
            "date": "2020-11-22",
            "count": 1
          },
          {
            "date": "2020-12-15",
            "count": 1
          },
          {
            "date": "2020-12-20",
            "count": 1
          },
          {
            "date": "2021-01-20",
            "count": 1
          },
          {
            "date": "2021-02-08",
            "count": 1
          },
          {
            "date": "2021-02-24",
            "count": 1
          },
          {
            "date": "2021-02-26",
            "count": 1
          },
          {
            "date": "2021-04-08",
            "count": 2
          },
          {
            "date": "2021-04-21",
            "count": 1
          },
          {
            "date": "2021-05-05",
            "count": 1
          },
          {
            "date": "2021-05-23",
            "count": 1
          },
          {
            "date": "2021-05-26",
            "count": 1
          },
          {
            "date": "2021-06-04",
            "count": 1
          },
          {
            "date": "2021-06-12",
            "count": 1
          },
          {
            "date": "2021-06-15",
            "count": 1
          },
          {
            "date": "2021-06-16",
            "count": 1
          },
          {
            "date": "2021-06-18",
            "count": 1
          },
          {
            "date": "2021-06-22",
            "count": 1
          },
          {
            "date": "2021-06-23",
            "count": 1
          },
          {
            "date": "2021-06-25",
            "count": 1
          },
          {
            "date": "2021-07-22",
            "count": 1
          },
          {
            "date": "2021-07-24",
            "count": 2
          },
          {
            "date": "2021-07-26",
            "count": 1
          },
          {
            "date": "2021-08-23",
            "count": 3
          },
          {
            "date": "2021-09-22",
            "count": 1
          },
          {
            "date": "2021-09-28",
            "count": 1
          },
          {
            "date": "2021-10-07",
            "count": 1
          },
          {
            "date": "2021-10-08",
            "count": 1
          },
          {
            "date": "2021-10-26",
            "count": 1
          },
          {
            "date": "2021-10-30",
            "count": 1
          },
          {
            "date": "2021-10-31",
            "count": 1
          },
          {
            "date": "2021-11-03",
            "count": 1
          },
          {
            "date": "2021-11-05",
            "count": 3
          },
          {
            "date": "2021-11-27",
            "count": 1
          },
          {
            "date": "2021-12-13",
            "count": 1
          },
          {
            "date": "2021-12-17",
            "count": 1
          },
          {
            "date": "2021-12-30",
            "count": 1
          },
          {
            "date": "2022-01-08",
            "count": 1
          },
          {
            "date": "2022-01-09",
            "count": 2
          },
          {
            "date": "2022-01-14",
            "count": 1
          },
          {
            "date": "2022-02-17",
            "count": 1
          },
          {
            "date": "2022-02-18",
            "count": 2
          },
          {
            "date": "2022-04-16",
            "count": 1
          },
          {
            "date": "2022-04-20",
            "count": 1
          },
          {
            "date": "2022-05-24",
            "count": 1
          },
          {
            "date": "2022-05-25",
            "count": 1
          },
          {
            "date": "2022-05-31",
            "count": 2
          },
          {
            "date": "2022-06-10",
            "count": 1
          },
          {
            "date": "2022-06-14",
            "count": 1
          },
          {
            "date": "2022-06-18",
            "count": 1
          },
          {
            "date": "2022-07-25",
            "count": 1
          },
          {
            "date": "2022-08-04",
            "count": 1
          },
          {
            "date": "2022-08-08",
            "count": 1
          },
          {
            "date": "2022-08-10",
            "count": 1
          },
          {
            "date": "2022-08-19",
            "count": 1
          },
          {
            "date": "2022-09-30",
            "count": 1
          },
          {
            "date": "2022-10-07",
            "count": 1
          },
          {
            "date": "2022-10-22",
            "count": 1
          },
          {
            "date": "2022-11-07",
            "count": 1
          },
          {
            "date": "2022-11-16",
            "count": 1
          },
          {
            "date": "2022-11-30",
            "count": 1
          },
          {
            "date": "2022-12-08",
            "count": 1
          },
          {
            "date": "2022-12-12",
            "count": 1
          },
          {
            "date": "2022-12-26",
            "count": 1
          },
          {
            "date": "2022-12-30",
            "count": 1
          },
          {
            "date": "2023-01-09",
            "count": 1
          },
          {
            "date": "2023-02-02",
            "count": 1
          },
          {
            "date": "2023-03-29",
            "count": 1
          },
          {
            "date": "2023-04-04",
            "count": 1
          },
          {
            "date": "2023-04-10",
            "count": 1
          },
          {
            "date": "2023-04-18",
            "count": 1
          },
          {
            "date": "2023-05-03",
            "count": 1
          },
          {
            "date": "2023-05-09",
            "count": 1
          },
          {
            "date": "2023-05-22",
            "count": 1
          },
          {
            "date": "2023-06-08",
            "count": 3
          },
          {
            "date": "2023-06-10",
            "count": 1
          },
          {
            "date": "2023-06-20",
            "count": 1
          },
          {
            "date": "2023-06-22",
            "count": 1
          },
          {
            "date": "2023-06-30",
            "count": 1
          },
          {
            "date": "2023-07-04",
            "count": 1
          },
          {
            "date": "2023-07-24",
            "count": 2
          },
          {
            "date": "2023-07-25",
            "count": 1
          },
          {
            "date": "2023-08-18",
            "count": 2
          },
          {
            "date": "2023-08-20",
            "count": 1
          },
          {
            "date": "2023-08-21",
            "count": 1
          },
          {
            "date": "2023-08-29",
            "count": 1
          },
          {
            "date": "2023-09-13",
            "count": 1
          },
          {
            "date": "2023-09-24",
            "count": 1
          },
          {
            "date": "2023-09-27",
            "count": 1
          },
          {
            "date": "2023-11-09",
            "count": 1
          },
          {
            "date": "2023-11-17",
            "count": 1
          },
          {
            "date": "2023-12-08",
            "count": 1
          },
          {
            "date": "2023-12-24",
            "count": 1
          },
          {
            "date": "2024-01-05",
            "count": 1
          },
          {
            "date": "2024-01-24",
            "count": 1
          },
          {
            "date": "2024-02-05",
            "count": 1
          },
          {
            "date": "2024-02-09",
            "count": 1
          },
          {
            "date": "2024-02-13",
            "count": 2
          },
          {
            "date": "2024-03-14",
            "count": 1
          },
          {
            "date": "2024-03-21",
            "count": 2
          },
          {
            "date": "2024-04-04",
            "count": 1
          },
          {
            "date": "2024-04-18",
            "count": 1
          },
          {
            "date": "2024-06-04",
            "count": 1
          },
          {
            "date": "2024-06-06",
            "count": 1
          },
          {
            "date": "2024-06-18",
            "count": 1
          },
          {
            "date": "2024-07-11",
            "count": 1
          },
          {
            "date": "2024-08-14",
            "count": 1
          },
          {
            "date": "2024-08-17",
            "count": 1
          },
          {
            "date": "2024-08-26",
            "count": 1
          },
          {
            "date": "2024-09-04",
            "count": 1
          },
          {
            "date": "2024-09-17",
            "count": 1
          },
          {
            "date": "2024-10-08",
            "count": 1
          },
          {
            "date": "2024-10-28",
            "count": 1
          },
          {
            "date": "2024-11-08",
            "count": 1
          },
          {
            "date": "2024-11-12",
            "count": 1
          },
          {
            "date": "2024-12-03",
            "count": 1
          },
          {
            "date": "2025-02-12",
            "count": 1
          },
          {
            "date": "2025-02-20",
            "count": 1
          },
          {
            "date": "2025-02-28",
            "count": 1
          },
          {
            "date": "2025-03-25",
            "count": 1
          },
          {
            "date": "2025-03-26",
            "count": 1
          },
          {
            "date": "2025-03-29",
            "count": 1
          },
          {
            "date": "2025-04-08",
            "count": 1
          },
          {
            "date": "2025-04-16",
            "count": 1
          },
          {
            "date": "2025-04-26",
            "count": 1
          },
          {
            "date": "2025-05-03",
            "count": 1
          },
          {
            "date": "2025-05-24",
            "count": 1
          },
          {
            "date": "2025-06-13",
            "count": 1
          },
          {
            "date": "2025-07-02",
            "count": 1
          },
          {
            "date": "2025-07-21",
            "count": 1
          },
          {
            "date": "2025-07-30",
            "count": 1
          },
          {
            "date": "2025-09-07",
            "count": 1
          },
          {
            "date": "2025-09-09",
            "count": 1
          },
          {
            "date": "2025-11-17",
            "count": 1
          },
          {
            "date": "2025-12-28",
            "count": 1
          },
          {
            "date": "2026-02-28",
            "count": 1
          },
          {
            "date": "2026-03-08",
            "count": 1
          },
          {
            "date": "2026-05-26",
            "count": 1
          },
          {
            "date": "2026-07-12",
            "count": 1
          },
          {
            "date": "2026-07-19",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 221,
        "total_forks": 222
      },
      "star_history": null,
      "open_issues_and_prs": 129
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": true,
      "bootstrap_files": [],
      "api_schema_files": [
        "pkg/secrets/plugins/proto/secrets_protocol.proto",
        "pkg/signing/plugins/proto/signing_protocol.proto",
        "pkg/storage/plugins/proto/storage_protocol.proto",
        "proto/porterapis/installation/v1alpha1/installation.proto",
        "proto/porterapis/porter/v1alpha1/porter.proto"
      ],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "docs/go.mod",
        "go.mod"
      ],
      "largest_source_bytes": 55257,
      "source_files_sampled": 584,
      "oversized_source_files": 0,
      "agent_instruction_files": [
        "docs/content/docs/references/docker-images/agent.md"
      ],
      "agent_instruction_max_bytes": 4506
    },
    "dependencies": {
      "manifests": [
        "docs/go.mod",
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "github.com/distribution/distribution",
            "direct": false,
            "version": "v2.8.3+incompatible",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-3p65-76g6-3w7r",
              "GHSA-6pjf-3r9x-m592",
              "GHSA-f2g3-hh2r-cwgc",
              "GO-2025-3460",
              "GO-2026-5094",
              "GO-2026-5185"
            ],
            "fixed_version": "3.1.1",
            "advisory_count": 6,
            "oldest_advisory_days": 506
          },
          {
            "name": "github.com/docker/docker",
            "direct": false,
            "version": "v28.5.2+incompatible",
            "severity": "high",
            "ecosystem": "go",
            "cvss_score": 8.8,
            "advisory_ids": [
              "GHSA-pxq6-2prw-chj9",
              "GHSA-rg2x-37c3-w2rh",
              "GHSA-vp62-88p7-qqf5",
              "GHSA-x744-4wpc-v9h2",
              "GHSA-x86f-5xw2-fm2r",
              "GO-2026-4883",
              "GO-2026-4887",
              "GO-2026-5617",
              "GO-2026-5668",
              "GO-2026-5746"
            ],
            "fixed_version": "29.3.1",
            "advisory_count": 10,
            "oldest_advisory_days": 117
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.53.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5932"
            ],
            "fixed_version": null,
            "advisory_count": 1,
            "oldest_advisory_days": 15
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.38.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 8
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "high": 2,
          "unknown": 2
        },
        "advisory_count": 18,
        "affected_count": 4,
        "assessed_count": 293,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "get.porter.sh/magefiles",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.14"
        },
        {
          "name": "github.com/Masterminds/semver/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.5.0"
        },
        {
          "name": "github.com/PaesslerAG/jsonpath",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.1"
        },
        {
          "name": "github.com/carolynvs/aferox",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.0"
        },
        {
          "name": "github.com/carolynvs/datetime-printer",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.2.0"
        },
        {
          "name": "github.com/cbroglie/mustache",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.0"
        },
        {
          "name": "github.com/cnabio/cnab-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.26.4"
        },
        {
          "name": "github.com/cnabio/cnab-to-oci",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.1"
        },
        {
          "name": "github.com/cnabio/image-relocation",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.9.2"
        },
        {
          "name": "github.com/containerd/containerd/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.3.3"
        },
        {
          "name": "github.com/davecgh/go-spew",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.2-0.20180830191138-d8f796af33cc"
        },
        {
          "name": "github.com/distribution/reference",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.1-0.20240718132515-8c942b0459df"
        },
        {
          "name": "github.com/docker/buildx",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.35.0"
        },
        {
          "name": "github.com/docker/cli",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v29.6.2+incompatible"
        },
        {
          "name": "github.com/dustin/go-humanize",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.1"
        },
        {
          "name": "github.com/ghodss/yaml",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/google/go-cmp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.0"
        },
        {
          "name": "github.com/google/go-containerregistry",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.21.7"
        },
        {
          "name": "github.com/google/uuid",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/grpc-ecosystem/go-grpc-middleware",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.0"
        },
        {
          "name": "github.com/grpc-ecosystem/go-grpc-prometheus",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.0"
        },
        {
          "name": "github.com/hashicorp/go-hclog",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.3"
        },
        {
          "name": "github.com/hashicorp/go-multierror",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1"
        },
        {
          "name": "github.com/hashicorp/go-plugin",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.7.0"
        },
        {
          "name": "github.com/jeremywohl/flatten",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.1"
        },
        {
          "name": "github.com/magefile/mage",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.17.2"
        },
        {
          "name": "github.com/mattn/go-colorable",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.15"
        },
        {
          "name": "github.com/mattn/go-isatty",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.23"
        },
        {
          "name": "github.com/mikefarah/yq/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.0-20201202084205-8846255d1c37"
        },
        {
          "name": "github.com/mitchellh/mapstructure",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.5.0"
        },
        {
          "name": "github.com/mmcdole/gofeed",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.4.0"
        },
        {
          "name": "github.com/moby/buildkit",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.31.2"
        },
        {
          "name": "github.com/moby/moby/api",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.55.0"
        },
        {
          "name": "github.com/moby/moby/client",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.0"
        },
        {
          "name": "github.com/moby/term",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.2"
        },
        {
          "name": "github.com/modelcontextprotocol/go-sdk",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.1"
        },
        {
          "name": "github.com/olekukonko/tablewriter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.4"
        },
        {
          "name": "github.com/opencontainers/go-digest",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/opencontainers/image-spec",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1"
        },
        {
          "name": "github.com/osteele/liquid",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.1"
        },
        {
          "name": "github.com/pelletier/go-toml",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.9.5"
        },
        {
          "name": "github.com/prometheus/client_golang",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.23.2"
        },
        {
          "name": "github.com/spf13/afero",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.15.0"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.2"
        },
        {
          "name": "github.com/spf13/pflag",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.10"
        },
        {
          "name": "github.com/spf13/viper",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.21.0"
        },
        {
          "name": "github.com/stretchr/testify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.11.1"
        },
        {
          "name": "github.com/tidwall/gjson",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.19.0"
        },
        {
          "name": "github.com/tidwall/sjson",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.5"
        },
        {
          "name": "github.com/uwu-tools/magex",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.10.1"
        },
        {
          "name": "github.com/xeipuuv/gojsonschema",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.0"
        },
        {
          "name": "go.mongodb.org/mongo-driver",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.17.9"
        },
        {
          "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.69.0"
        },
        {
          "name": "go.opentelemetry.io/otel",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/exporters/stdout/stdouttrace",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/sdk",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.opentelemetry.io/otel/trace",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.44.0"
        },
        {
          "name": "go.uber.org/zap",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.28.0"
        },
        {
          "name": "golang.org/x/sync",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.22.0"
        },
        {
          "name": "google.golang.org/grpc",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.82.1"
        },
        {
          "name": "google.golang.org/protobuf",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.36.12-0.20260120151049-f2248ac996af"
        },
        {
          "name": "gopkg.in/AlecAivazis/survey.v1",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.8"
        },
        {
          "name": "gopkg.in/op/go-logging.v1",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0-20160211212156-b2cb9fa56473"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        },
        {
          "name": "k8s.io/utils",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20260319190234-28399d86e0b5"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "get.porter.sh/magefiles",
            "direct": true,
            "version": "v0.6.14",
            "ecosystem": "go"
          },
          {
            "name": "github.com/carolynvs/aferox",
            "direct": true,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/carolynvs/datetime-printer",
            "direct": true,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cbroglie/mustache",
            "direct": true,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cnabio/cnab-go",
            "direct": true,
            "version": "v0.26.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cnabio/cnab-to-oci",
            "direct": true,
            "version": "v0.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cnabio/image-relocation",
            "direct": true,
            "version": "v0.9.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/containerd/v2",
            "direct": true,
            "version": "v2.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": true,
            "version": "v1.1.2-0.20180830191138-d8f796af33cc",
            "ecosystem": "go"
          },
          {
            "name": "github.com/distribution/reference",
            "direct": true,
            "version": "v0.6.1-0.20240718132515-8c942b0459df",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/buildx",
            "direct": true,
            "version": "v0.35.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/cli",
            "direct": true,
            "version": "v29.6.2+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dustin/go-humanize",
            "direct": true,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ghodss/yaml",
            "direct": true,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-cmp",
            "direct": true,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-containerregistry",
            "direct": true,
            "version": "v0.21.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/uuid",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/grpc-ecosystem/go-grpc-middleware",
            "direct": true,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/grpc-ecosystem/go-grpc-prometheus",
            "direct": true,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-hclog",
            "direct": true,
            "version": "v1.6.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-multierror",
            "direct": true,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jeremywohl/flatten",
            "direct": true,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/magefile/mage",
            "direct": true,
            "version": "v1.17.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/semver/v3",
            "direct": true,
            "version": "v3.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-colorable",
            "direct": true,
            "version": "v0.1.15",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-isatty",
            "direct": true,
            "version": "v0.0.23",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mikefarah/yq/v3",
            "direct": true,
            "version": "v3.0.0-20201202084205-8846255d1c37",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/mapstructure",
            "direct": true,
            "version": "v1.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mmcdole/gofeed",
            "direct": true,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/buildkit",
            "direct": true,
            "version": "v0.31.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/moby/api",
            "direct": true,
            "version": "v1.55.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/moby/client",
            "direct": true,
            "version": "v0.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/term",
            "direct": true,
            "version": "v0.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modelcontextprotocol/go-sdk",
            "direct": true,
            "version": "v1.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/tablewriter",
            "direct": true,
            "version": "v1.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/go-digest",
            "direct": true,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/image-spec",
            "direct": true,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/osteele/liquid",
            "direct": true,
            "version": "v1.8.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/paesslerag/jsonpath",
            "direct": true,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml",
            "direct": true,
            "version": "v1.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/client_golang",
            "direct": true,
            "version": "v1.23.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/afero",
            "direct": true,
            "version": "v1.15.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cobra",
            "direct": true,
            "version": "v1.10.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": true,
            "version": "v1.0.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/viper",
            "direct": true,
            "version": "v1.21.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/stretchr/testify",
            "direct": true,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/gjson",
            "direct": true,
            "version": "v1.19.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/sjson",
            "direct": true,
            "version": "v1.2.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/uwu-tools/magex",
            "direct": true,
            "version": "v0.10.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonschema",
            "direct": true,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "go.mongodb.org/mongo-driver",
            "direct": true,
            "version": "v1.17.9",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
            "direct": true,
            "version": "v0.69.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/stdout/stdouttrace",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/trace",
            "direct": true,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/zap",
            "direct": true,
            "version": "v1.28.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sync",
            "direct": true,
            "version": "v0.22.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/grpc",
            "direct": true,
            "version": "v1.82.1",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/protobuf",
            "direct": true,
            "version": "v1.36.12-0.20260120151049-f2248ac996af",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/alecaivazis/survey.v1",
            "direct": true,
            "version": "v1.8.8",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/op/go-logging.v1",
            "direct": true,
            "version": "v1.0.0-20160211212156-b2cb9fa56473",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": true,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/utils",
            "direct": true,
            "version": "v0.0.0-20260319190234-28399d86e0b5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/agnivade/levenshtein",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/apparentlymart/go-textseg/v15",
            "direct": false,
            "version": "v15.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/asaskevich/govalidator",
            "direct": false,
            "version": "v0.0.0-20230301143203-a9d515a09cc2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2",
            "direct": false,
            "version": "v1.42.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/config",
            "direct": false,
            "version": "v1.32.24",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/credentials",
            "direct": false,
            "version": "v1.19.23",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds",
            "direct": false,
            "version": "v1.18.29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/configsources",
            "direct": false,
            "version": "v1.4.29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2",
            "direct": false,
            "version": "v2.7.29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/internal/v4a",
            "direct": false,
            "version": "v1.4.30",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding",
            "direct": false,
            "version": "v1.13.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url",
            "direct": false,
            "version": "v1.13.29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/signin",
            "direct": false,
            "version": "v1.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sso",
            "direct": false,
            "version": "v1.31.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/ssooidc",
            "direct": false,
            "version": "v1.36.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/aws-sdk-go-v2/service/sts",
            "direct": false,
            "version": "v1.43.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aws/smithy-go",
            "direct": false,
            "version": "v1.27.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/azure/go-ansiterm",
            "direct": false,
            "version": "v0.0.0-20250102033503-faa5f7b0171c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/beorn7/perks",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/blang/semver",
            "direct": false,
            "version": "v3.5.1+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cenkalti/backoff/v5",
            "direct": false,
            "version": "v5.0.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cespare/xxhash/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/displaywidth",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/uax29/v2",
            "direct": false,
            "version": "v2.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cloudflare/circl",
            "direct": false,
            "version": "v1.6.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/console",
            "direct": false,
            "version": "v1.0.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/containerd/api",
            "direct": false,
            "version": "v1.11.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/continuity",
            "direct": false,
            "version": "v0.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/errdefs",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/errdefs/pkg",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/log",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/platforms",
            "direct": false,
            "version": "v1.0.0-rc.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/ttrpc",
            "direct": false,
            "version": "v1.2.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/containerd/typeurl/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cpuguy83/go-md2man/v2",
            "direct": false,
            "version": "v2.0.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyberphone/json-canonicalization",
            "direct": false,
            "version": "v0.0.0-20241213102144-19d51d7fe467",
            "ecosystem": "go"
          },
          {
            "name": "github.com/decred/dcrd/dcrec/secp256k1/v4",
            "direct": false,
            "version": "v4.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/digitorus/pkcs7",
            "direct": false,
            "version": "v0.0.0-20250730155240-ffadbf3f398c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/digitorus/timestamp",
            "direct": false,
            "version": "v0.0.0-20250524132541-c45532741eea",
            "ecosystem": "go"
          },
          {
            "name": "github.com/distribution/distribution",
            "direct": false,
            "version": "v2.8.3+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/distribution",
            "direct": false,
            "version": "v2.8.3+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/docker",
            "direct": false,
            "version": "v28.5.2+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/docker-credential-helpers",
            "direct": false,
            "version": "v0.9.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-connections",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-metrics",
            "direct": false,
            "version": "v0.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/docker/go-units",
            "direct": false,
            "version": "v0.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/emicklei/go-restful/v3",
            "direct": false,
            "version": "v3.13.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fatih/color",
            "direct": false,
            "version": "v1.19.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/felixge/httpsnoop",
            "direct": false,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fsnotify/fsnotify",
            "direct": false,
            "version": "v1.9.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fvbommel/sortorder",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fxamacker/cbor/v2",
            "direct": false,
            "version": "v2.9.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/logr",
            "direct": false,
            "version": "v1.4.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/stdr",
            "direct": false,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/analysis",
            "direct": false,
            "version": "v0.25.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/errors",
            "direct": false,
            "version": "v0.22.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/jsonpointer",
            "direct": false,
            "version": "v0.23.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/jsonreference",
            "direct": false,
            "version": "v0.21.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/loads",
            "direct": false,
            "version": "v0.23.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/runtime",
            "direct": false,
            "version": "v0.32.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/runtime/server-middleware",
            "direct": false,
            "version": "v0.30.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/spec",
            "direct": false,
            "version": "v0.22.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/strfmt",
            "direct": false,
            "version": "v0.26.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/cmdutils",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/conv",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/fileutils",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/jsonname",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/jsonutils",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/loading",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/mangling",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/netutils",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/stringutils",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/typeutils",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/yamlutils",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/validate",
            "direct": false,
            "version": "v0.25.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-viper/mapstructure/v2",
            "direct": false,
            "version": "v2.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gobwas/glob",
            "direct": false,
            "version": "v0.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/goccy/go-json",
            "direct": false,
            "version": "v0.10.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/goccy/go-yaml",
            "direct": false,
            "version": "v1.19.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gofrs/flock",
            "direct": false,
            "version": "v0.13.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/protobuf",
            "direct": false,
            "version": "v1.5.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/snappy",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/certificate-transparency-go",
            "direct": false,
            "version": "v1.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/gnostic-models",
            "direct": false,
            "version": "v0.7.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/jsonschema-go",
            "direct": false,
            "version": "v0.4.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/shlex",
            "direct": false,
            "version": "v0.0.0-20191202100458-e7afc7fbc510",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gorilla/mux",
            "direct": false,
            "version": "v1.8.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/grpc-ecosystem/grpc-gateway/v2",
            "direct": false,
            "version": "v2.29.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/errwrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-cleanhttp",
            "direct": false,
            "version": "v0.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/yamux",
            "direct": false,
            "version": "v0.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hiddeco/sshsig",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/imfing/hextra",
            "direct": false,
            "version": "v0.7.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/in-toto/attestation",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/in-toto/in-toto-golang",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/inconshreveable/mousetrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/json-iterator/go",
            "direct": false,
            "version": "v1.1.12",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kballard/go-shellquote",
            "direct": false,
            "version": "v0.0.0-20180428030007-95032a82bc51",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/compress",
            "direct": false,
            "version": "v1.18.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kr/pty",
            "direct": false,
            "version": "v1.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/blackmagic",
            "direct": false,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/dsig",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/dsig-secp256k1",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/httpcc",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/httprc/v3",
            "direct": false,
            "version": "v3.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/jwx/v3",
            "direct": false,
            "version": "v3.0.13",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/option/v2",
            "direct": false,
            "version": "v2.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/masterminds/semver",
            "direct": false,
            "version": "v1.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-runewidth",
            "direct": false,
            "version": "v0.0.23",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mgutz/ansi",
            "direct": false,
            "version": "v0.0.0-20200706080929-d51e80ef957d",
            "ecosystem": "go"
          },
          {
            "name": "github.com/microsoft/go-winio",
            "direct": false,
            "version": "v0.6.3-0.20251027160822-ad3df93bed29",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/copystructure",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/go-testing-interface",
            "direct": false,
            "version": "v1.14.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/hashstructure/v2",
            "direct": false,
            "version": "v2.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/reflectwalk",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mmcdole/goxpp/v2",
            "direct": false,
            "version": "v2.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/docker-image-spec",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/go-archive",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/locker",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/patternmatcher",
            "direct": false,
            "version": "v0.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/policy-helpers",
            "direct": false,
            "version": "v0.0.0-20260612073044-d5411a945cfc",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/atomicwriter",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/mountinfo",
            "direct": false,
            "version": "v0.7.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/sequential",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/signal",
            "direct": false,
            "version": "v0.7.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/user",
            "direct": false,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/moby/sys/userns",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/concurrent",
            "direct": false,
            "version": "v0.0.0-20180306012644-bacd9c7ef1dd",
            "ecosystem": "go"
          },
          {
            "name": "github.com/modern-go/reflect2",
            "direct": false,
            "version": "v1.0.3-0.20250322232337-35a7c28c31ee",
            "ecosystem": "go"
          },
          {
            "name": "github.com/montanaflynn/stats",
            "direct": false,
            "version": "v0.8.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/morikuni/aec",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/munnerz/goautoneg",
            "direct": false,
            "version": "v0.0.0-20191010083416-a7dc8b61c822",
            "ecosystem": "go"
          },
          {
            "name": "github.com/oklog/run",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/oklog/ulid",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/oklog/ulid/v2",
            "direct": false,
            "version": "v2.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/cat",
            "direct": false,
            "version": "v0.0.0-20250911104152-50322a0618f6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/errors",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/ll",
            "direct": false,
            "version": "v0.1.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/open-policy-agent/opa",
            "direct": false,
            "version": "v1.14.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/osteele/tuesday",
            "direct": false,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/package-url/packageurl-go",
            "direct": false,
            "version": "v0.1.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/paesslerag/gval",
            "direct": false,
            "version": "v1.2.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml/v2",
            "direct": false,
            "version": "v2.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/errors",
            "direct": false,
            "version": "v0.9.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/planetscale/vtprotobuf",
            "direct": false,
            "version": "v0.6.1-0.20240319094008-0393e58bdf10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.1-0.20181226105442-5d4384ee4fb2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/client_model",
            "direct": false,
            "version": "v0.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/common",
            "direct": false,
            "version": "v0.67.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/procfs",
            "direct": false,
            "version": "v0.20.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/protonmail/go-crypto",
            "direct": false,
            "version": "v1.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/qri-io/jsonpointer",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/qri-io/jsonschema",
            "direct": false,
            "version": "v0.2.2-0.20210831022256-780655b2ba0e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rcrowley/go-metrics",
            "direct": false,
            "version": "v0.0.0-20250401214520-65e299d6c5c9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/russross/blackfriday/v2",
            "direct": false,
            "version": "v2.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sagikazarmark/locafero",
            "direct": false,
            "version": "v0.12.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/secure-systems-lab/go-securesystemslib",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/segmentio/asm",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/segmentio/encoding",
            "direct": false,
            "version": "v0.5.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/shibumi/go-pathspec",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/shopspring/decimal",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/protobuf-specs",
            "direct": false,
            "version": "v0.5.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/rekor",
            "direct": false,
            "version": "v1.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/rekor-tiles/v2",
            "direct": false,
            "version": "v2.2.2-0.20260601073857-5d098a2b6443",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/sigstore",
            "direct": false,
            "version": "v1.10.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/sigstore-go",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/timestamp-authority/v2",
            "direct": false,
            "version": "v2.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sirupsen/logrus",
            "direct": false,
            "version": "v1.9.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cast",
            "direct": false,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/subosito/gotenv",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tchap/go-patricia/v2",
            "direct": false,
            "version": "v2.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/theupdateframework/go-tuf/v2",
            "direct": false,
            "version": "v2.4.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/match",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/pretty",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tonistiigi/dchapes-mode",
            "direct": false,
            "version": "v0.0.0-20250318174251-73d941a28323",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tonistiigi/fsutil",
            "direct": false,
            "version": "v0.0.0-20260716115106-30cd4fc5d911",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tonistiigi/go-csvvalue",
            "direct": false,
            "version": "v0.0.0-20240814133006-030d3b2625d0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tonistiigi/units",
            "direct": false,
            "version": "v0.0.0-20180711220420-6950e57a87ea",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tonistiigi/vt100",
            "direct": false,
            "version": "v0.0.0-20240514184818-90bafcd6abab",
            "ecosystem": "go"
          },
          {
            "name": "github.com/transparency-dev/formats",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/transparency-dev/merkle",
            "direct": false,
            "version": "v0.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/valyala/fastjson",
            "direct": false,
            "version": "v1.6.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vektah/gqlparser/v2",
            "direct": false,
            "version": "v2.5.32",
            "ecosystem": "go"
          },
          {
            "name": "github.com/x448/float16",
            "direct": false,
            "version": "v0.8.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xdg-go/pbkdf2",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xdg-go/scram",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xdg-go/stringprep",
            "direct": false,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonpointer",
            "direct": false,
            "version": "v0.0.0-20190905194746-02993c407bfb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonreference",
            "direct": false,
            "version": "v0.0.0-20180127040603-bd5ef7bd5415",
            "ecosystem": "go"
          },
          {
            "name": "github.com/yashtewari/glob-intersection",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/yosida95/uritemplate/v3",
            "direct": false,
            "version": "v3.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/youmark/pkcs8",
            "direct": false,
            "version": "v0.0.0-20240726163527-a2c0da244d78",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zclconf/go-cty",
            "direct": false,
            "version": "v1.18.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/auto/sdk",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace",
            "direct": false,
            "version": "v0.69.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
            "direct": false,
            "version": "v0.69.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/metric",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk/metric",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/proto/otlp",
            "direct": false,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "go.uber.org/multierr",
            "direct": false,
            "version": "v1.11.0",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v2",
            "direct": false,
            "version": "v2.4.4",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v3",
            "direct": false,
            "version": "v3.0.4",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.53.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/mod",
            "direct": false,
            "version": "v0.37.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.56.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/oauth2",
            "direct": false,
            "version": "v0.36.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.46.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/term",
            "direct": false,
            "version": "v0.44.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.38.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/time",
            "direct": false,
            "version": "v0.15.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/tools",
            "direct": false,
            "version": "v0.46.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/api",
            "direct": false,
            "version": "v0.0.0-20260526163538-3dc84a4a5aaa",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/rpc",
            "direct": false,
            "version": "v0.0.0-20260526163538-3dc84a4a5aaa",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/evanphx/json-patch.v4",
            "direct": false,
            "version": "v4.13.0",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/inf.v0",
            "direct": false,
            "version": "v0.9.1",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v2",
            "direct": false,
            "version": "v2.4.0",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/api",
            "direct": false,
            "version": "v0.36.2",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/apimachinery",
            "direct": false,
            "version": "v0.36.2",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/client-go",
            "direct": false,
            "version": "v0.36.2",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/klog/v2",
            "direct": false,
            "version": "v2.140.0",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/kube-openapi",
            "direct": false,
            "version": "v0.0.0-20260319004828-5883c5ee87b9",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/json",
            "direct": false,
            "version": "v0.0.0-20250730193827-2d320260d730",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/randfill",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/structured-merge-diff/v6",
            "direct": false,
            "version": "v6.3.2",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/yaml",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 293,
        "direct_count": 67,
        "indirect_count": 226
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 6,
        "merged_prs": 1967,
        "open_issues": 123,
        "closed_ratio": 0.901,
        "closed_issues": 1116,
        "closed_unmerged_prs": 305
      },
      "bus_factor": 2,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "carolynvs",
          "commits": 1363,
          "avatar_url": "https://avatars.githubusercontent.com/u/1368985?v=4"
        },
        {
          "type": "User",
          "login": "carolynvs-msft",
          "commits": 974,
          "avatar_url": "https://avatars.githubusercontent.com/u/100001070?v=4"
        },
        {
          "type": "User",
          "login": "kichristensen",
          "commits": 220,
          "avatar_url": "https://avatars.githubusercontent.com/u/2461567?v=4"
        },
        {
          "type": "User",
          "login": "vdice",
          "commits": 214,
          "avatar_url": "https://avatars.githubusercontent.com/u/9322017?v=4"
        },
        {
          "type": "User",
          "login": "dgannon991",
          "commits": 159,
          "avatar_url": "https://avatars.githubusercontent.com/u/19214156?v=4"
        },
        {
          "type": "User",
          "login": "jeremyrickard",
          "commits": 83,
          "avatar_url": "https://avatars.githubusercontent.com/u/33884483?v=4"
        },
        {
          "type": "User",
          "login": "schristoff",
          "commits": 72,
          "avatar_url": "https://avatars.githubusercontent.com/u/28318173?v=4"
        },
        {
          "type": "User",
          "login": "VinozzZ",
          "commits": 48,
          "avatar_url": "https://avatars.githubusercontent.com/u/22300958?v=4"
        },
        {
          "type": "User",
          "login": "Arhell",
          "commits": 32,
          "avatar_url": "https://avatars.githubusercontent.com/u/26163841?v=4"
        },
        {
          "type": "User",
          "login": "dev-drprasad",
          "commits": 29,
          "avatar_url": "https://avatars.githubusercontent.com/u/22687681?v=4"
        }
      ],
      "contributors_sampled": 99,
      "top_contributor_share": 0.392
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "build_pipelinesrelease_template.yml",
        "check-licenses.yaml",
        "codeql.yaml",
        "integ-reuseable-workflow.yml",
        "porter-canary.yml",
        "porter-install-check.yml",
        "porter-integration-pr.yml",
        "porter-integration-release.yml",
        "porter-release.yml",
        "porter.yml",
        "trivy.yaml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        ".golangci.yml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": null,
            "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 8,
            "reason": "26 out of 29 merged PRs checked by a CI test -- score normalized to 8",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 5,
            "reason": "badge detected: Passing",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 1/19 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 70 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 9,
            "reason": "SAST tool detected but not run on all commits",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "11 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "cd545ed2901976b77590f03b695dc63df2acc3f2",
        "ran_at": "2026-07-23T00:45:40Z",
        "aggregate_score": 5.4,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": true,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-22T12:33:13Z",
      "oldest_open_prs": [
        {
          "number": 2099,
          "created_at": "2022-05-25T04:14:12Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 2216,
          "created_at": "2022-06-30T23:30:13Z",
          "last_comment_at": "2022-06-30T23:38:14Z",
          "last_comment_author": "carolynvs"
        },
        {
          "number": 2218,
          "created_at": "2022-07-04T16:08:41Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 3542,
          "created_at": "2026-01-22T23:11:10Z",
          "last_comment_at": "2026-04-05T21:27:22Z",
          "last_comment_author": "dgannon991"
        },
        {
          "number": 3637,
          "created_at": "2026-07-20T13:49:16Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 3638,
          "created_at": "2026-07-21T13:29:00Z",
          "last_comment_at": "2026-07-21T13:29:12Z",
          "last_comment_author": "kichristensen"
        }
      ],
      "last_merged_pr_at": "2026-07-22T12:31:53Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 70,
          "created_at": "2018-12-03T15:49:24Z",
          "last_comment_at": "2021-05-22T19:31:19Z",
          "last_comment_author": "carolynvs"
        },
        {
          "number": 143,
          "created_at": "2019-02-06T00:17:29Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 202,
          "created_at": "2019-03-04T15:12:19Z",
          "last_comment_at": "2019-09-23T21:59:41Z",
          "last_comment_author": "carolynvs"
        },
        {
          "number": 256,
          "created_at": "2019-04-08T19:10:59Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 326,
          "created_at": "2019-05-08T20:50:32Z",
          "last_comment_at": "2022-09-29T15:45:40Z",
          "last_comment_author": "carolynvs"
        },
        {
          "number": 496,
          "created_at": "2019-08-05T15:25:44Z",
          "last_comment_at": "2020-03-11T13:43:06Z",
          "last_comment_author": "ferantivero"
        },
        {
          "number": 531,
          "created_at": "2019-08-19T22:36:18Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 532,
          "created_at": "2019-08-20T14:39:31Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 584,
          "created_at": "2019-09-06T21:03:25Z",
          "last_comment_at": "2019-12-31T19:39:15Z",
          "last_comment_author": "squillace"
        },
        {
          "number": 676,
          "created_at": "2019-10-01T18:03:11Z",
          "last_comment_at": "2019-10-01T19:44:47Z",
          "last_comment_author": "carolynvs"
        },
        {
          "number": 679,
          "created_at": "2019-10-02T20:12:17Z",
          "last_comment_at": "2022-03-11T18:44:06Z",
          "last_comment_author": "carolynvs"
        },
        {
          "number": 855,
          "created_at": "2020-01-14T15:12:43Z",
          "last_comment_at": "2022-07-26T16:18:10Z",
          "last_comment_author": "VinozzZ"
        },
        {
          "number": 897,
          "created_at": "2020-02-11T16:41:01Z",
          "last_comment_at": "2020-02-11T16:48:01Z",
          "last_comment_author": "carolynvs"
        },
        {
          "number": 939,
          "created_at": "2020-03-05T18:37:17Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 964,
          "created_at": "2020-04-01T12:45:04Z",
          "last_comment_at": "2020-05-08T12:09:29Z",
          "last_comment_author": "dev-drprasad"
        },
        {
          "number": 1002,
          "created_at": "2020-04-20T21:33:37Z",
          "last_comment_at": "2020-06-23T18:49:59Z",
          "last_comment_author": "vdice"
        },
        {
          "number": 1019,
          "created_at": "2020-04-30T16:22:38Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 1082,
          "created_at": "2020-06-11T15:34:18Z",
          "last_comment_at": "2023-09-22T23:52:49Z",
          "last_comment_author": "schristoff"
        },
        {
          "number": 1089,
          "created_at": "2020-06-16T14:30:25Z",
          "last_comment_at": "2020-06-16T14:43:47Z",
          "last_comment_author": "carolynvs"
        },
        {
          "number": 1220,
          "created_at": "2020-08-20T17:02:23Z",
          "last_comment_at": "2022-02-28T22:09:06Z",
          "last_comment_author": "carolynvs"
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/getporter/porter",
    "host": "github.com",
    "name": "porter",
    "owner": "getporter"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "good",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 78,
      "inputs": {
        "security": 63,
        "vitality": 80,
        "community": 85,
        "governance": 74,
        "engineering": 84
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 80,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "excellent",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 97,
            "inputs": {
              "commits_last_year": 265,
              "human_commit_share": 0.68,
              "days_since_last_push": 0,
              "active_weeks_last_year": 48
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "48/52 weeks with commits",
                "points": 33.2,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 48
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "265 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 265
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "moderate",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 54,
            "inputs": {
              "releases_count": 100,
              "latest_release_tag": "canary",
              "releases_from_tags": false,
              "days_since_latest_release": 1933,
              "mean_days_between_releases": -141.3
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "100 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 100
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 1933 days ago",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 1933
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~-141.3 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": -141.3
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "maintained",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 0,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "last human commit 0 days ago",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_maintained",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "excellent",
        "name": "Community & Adoption",
        "value": 85,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "good",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 78,
            "inputs": {
              "forks": 222,
              "stars": 1422,
              "watchers": 24,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "1,422 stars",
                "points": 51.1,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 1422
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "222 forks",
                "points": 19.5,
                "status": "partial",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 222
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "24 watchers",
                "points": 7.6,
                "status": "partial",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 24
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "excellent",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 92,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "has_pull_request_template": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 6.3,
                "status": "met",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "good",
        "name": "Sustainability & Governance",
        "value": 74,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "moderate",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 62,
            "inputs": {
              "bus_factor": 2,
              "contributors_sampled": 99,
              "top_contributor_share": 0.392
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "2 contributor(s) cover half of all commits",
                "points": 25.2,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 39% of commits",
                "points": 13.7,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 39
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "99 contributors",
                "points": 13.5,
                "status": "met",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 99
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 70 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "good",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 75,
            "inputs": {
              "merged_prs": 1967,
              "open_issues": 123,
              "closed_issues": 1116,
              "issue_closed_ratio": 0.901,
              "closed_unmerged_prs": 305
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "90% of issues closed",
                "points": 42.1,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 90
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "1967/2272 decided PRs merged",
                "points": 33.1,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 1967,
                      "decided": 2272
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 1/19 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 66,
            "inputs": {
              "followers": 48,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "getporter",
              "public_repos": 48,
              "account_age_days": 2457
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "48 followers of getporter",
                "points": 12.2,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 48,
                      "login": "getporter"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "48 public repos, account ~6 yr old",
                "points": 24.3,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 48
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 6
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "get.porter.sh/porter"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 5
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 5 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "136 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 136
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 84,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 80,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "11 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 11
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "26 out of 29 merged PRs checked by a CI test -- score normalized to 8",
                "points": 16,
                "status": "partial",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "topics": [
                "porter",
                "cnab",
                "cncf"
              ],
              "has_wiki": false,
              "homepage": "https://porter.sh",
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://porter.sh",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "3 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 63,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Branch-Protection, Packaging. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "branch_protection",
                    "packaging"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 54,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 5.4
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "26 out of 29 merged PRs checked by a CI test -- score normalized to 8",
                "points": 2,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "badge detected: Passing",
                "points": 1.2,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 1/19 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 70 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool detected but not run on all commits",
                "points": 4.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "11 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 293 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories",
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 293
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 18,
              "affected_packages": 4,
              "assessed_packages": 293,
              "unassessed_packages": 0,
              "affected_by_severity": "high 2, unknown 2",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 293,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 11
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "excellent",
        "name": "AI Readiness",
        "value": 86,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.853,
              "agent_instruction_files": [
                "docs/content/docs/references/docker-images/agent.md"
              ],
              "agent_instruction_max_bytes": 4506
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "docs/content/docs/references/docker-images/agent.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "docs/content/docs/references/docker-images/agent.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "58 of 68 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 58,
                      "sampled": 68
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 77,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0.01,
              "toolchain_manifests": [
                "docs/go.mod",
                "go.mod"
              ],
              "dependency_bot_commit_share": 0.32
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "docs/go.mod, go.mod (toolchain convention, no task runner)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "toolchain_convention",
                    "params": {
                      "files": "docs/go.mod, go.mod"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "1 of the last 100 commits agent-authored or agent-credited",
                "points": 2,
                "status": "partial",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 1,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "32 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 32,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 55257,
              "source_files_sampled": 584,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/584 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 584,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "excellent",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": true,
              "api_schema_files": [
                "pkg/secrets/plugins/proto/secrets_protocol.proto",
                "pkg/signing/plugins/proto/signing_protocol.proto",
                "pkg/storage/plugins/proto/storage_protocol.proto",
                "proto/porterapis/installation/v1alpha1/installation.proto",
                "proto/porterapis/porter/v1alpha1/porter.proto"
              ]
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": "pkg/secrets/plugins/proto/secrets_protocol.proto, pkg/signing/plugins/proto/signing_protocol.proto, pkg/storage/plugins/proto/storage_protocol.proto, proto/porterapis/installation/v1alpha1/installation.proto, proto/porterapis/porter/v1alpha1/porter.proto",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "pkg/secrets/plugins/proto/secrets_protocol.proto, pkg/signing/plugins/proto/signing_protocol.proto, pkg/storage/plugins/proto/storage_protocol.proto, proto/porterapis/installation/v1alpha1/installation.proto, proto/porterapis/porter/v1alpha1/porter.proto"
                    }
                  }
                ],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-23T00:46:07.976484Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/g/getporter/porter.svg",
  "full_name": "getporter/porter",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}