privateerproj / privateer

每颗 star 和每个 fork 的添加时间，来自 GitHub 并按天汇总。累计增长位于其构成来源——每日新增——的正上方，二者可相互对照：稳定的自然增长与短暂的突增形态截然不同。当这一差别可被衡量时，它会作为增长真实性予以报告。

每个点涵盖 3 天。

来自 GitHub 依赖图的完整解析依赖集合：5 个直接依赖与 120 个间接（传递）软件包。仓库提交锁文件时，传递闭包才是完整的。

该仓库未发布可被索引解析的包，因此评估的是其自身的依赖图——共 125 个包，其中也包含从不交付的开发与测试版本固定：1 个存在已知公告，0 个为直接依赖。

公告表示依赖图中记录的版本落入某条公告的受影响范围。可达性未经分析，且依赖图包含开发与测试的版本固定——某项发现可能只涉及工具链而非交付的软件。

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 13358,
      "has_wiki": false,
      "homepage": null,
      "languages": {
        "Go": 18668,
        "Shell": 18975,
        "Makefile": 2552,
        "Dockerfile": 377
      },
      "pushed_at": "2026-07-27T17:13:46Z",
      "created_at": "2022-10-26T12:14:52Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-27T17:14:33Z",
      "description": "Privateer is a plugin-based framework for security & compliance evaluations.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Shell",
      "significant_languages": [
        "Shell",
        "Go"
      ]
    },
    "owner": {
      "blog": null,
      "name": "Privateer Project",
      "type": "Organization",
      "login": "privateerproj",
      "company": null,
      "location": null,
      "followers": 9,
      "avatar_url": "https://avatars.githubusercontent.com/u/116728460?v=4",
      "created_at": "2022-10-26T12:10:18Z",
      "is_verified": null,
      "public_repos": 7,
      "account_age_days": 1374
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.22.0",
          "kind": "minor",
          "published_at": "2026-07-20T14:10:11Z"
        },
        {
          "tag": "v0.21.2",
          "kind": "patch",
          "published_at": "2026-05-18T22:57:37Z"
        },
        {
          "tag": "v0.21.1",
          "kind": "patch",
          "published_at": "2026-05-12T13:41:40Z"
        },
        {
          "tag": "v0.21.0",
          "kind": "minor",
          "published_at": "2026-05-01T04:53:14Z"
        },
        {
          "tag": "v0.20.3",
          "kind": "patch",
          "published_at": "2026-04-26T21:26:14Z"
        },
        {
          "tag": "v0.20.2",
          "kind": "patch",
          "published_at": "2026-04-12T23:15:45Z"
        },
        {
          "tag": "v0.20.1",
          "kind": "patch",
          "published_at": "2026-04-12T21:39:55Z"
        },
        {
          "tag": "v0.20.0",
          "kind": "minor",
          "published_at": "2026-04-12T03:33:41Z"
        },
        {
          "tag": "v0.19.0",
          "kind": "minor",
          "published_at": "2026-04-07T20:04:56Z"
        },
        {
          "tag": "v0.18.1",
          "kind": "patch",
          "published_at": "2026-03-31T13:35:41Z"
        },
        {
          "tag": "v0.18.0",
          "kind": "minor",
          "published_at": "2026-03-16T06:54:32Z"
        },
        {
          "tag": "v0.17.0",
          "kind": "minor",
          "published_at": "2026-03-16T01:38:04Z"
        },
        {
          "tag": "v0.16.1",
          "kind": "patch",
          "published_at": "2026-03-14T21:44:41Z"
        },
        {
          "tag": "v0.16.0",
          "kind": "minor",
          "published_at": "2026-03-14T15:44:55Z"
        },
        {
          "tag": "v0.15.1",
          "kind": "patch",
          "published_at": "2026-03-13T06:54:32Z"
        },
        {
          "tag": "v0.15.0",
          "kind": "minor",
          "published_at": "2026-02-15T17:14:18Z"
        },
        {
          "tag": "v0.14.3",
          "kind": "patch",
          "published_at": "2026-02-15T15:15:30Z"
        },
        {
          "tag": "v0.14.2",
          "kind": "patch",
          "published_at": "2026-02-15T07:26:29Z"
        },
        {
          "tag": "v0.14.1",
          "kind": "patch",
          "published_at": "2026-02-15T07:12:17Z"
        },
        {
          "tag": "v0.14.0",
          "kind": "minor",
          "published_at": "2026-02-15T06:46:51Z"
        },
        {
          "tag": "v0.13.2",
          "kind": "patch",
          "published_at": "2026-02-15T00:12:08Z"
        },
        {
          "tag": "v0.13.1",
          "kind": "patch",
          "published_at": "2026-02-14T16:40:40Z"
        },
        {
          "tag": "v0.13.0",
          "kind": "minor",
          "published_at": "2025-11-06T23:37:47Z"
        },
        {
          "tag": "v0.12.0",
          "kind": "minor",
          "published_at": "2025-11-04T19:45:06Z"
        },
        {
          "tag": "v0.11.0",
          "kind": "minor",
          "published_at": "2025-11-03T02:57:40Z"
        },
        {
          "tag": "v0.10.0",
          "kind": "minor",
          "published_at": "2025-10-10T15:05:42Z"
        },
        {
          "tag": "v0.9.1",
          "kind": "patch",
          "published_at": "2025-09-27T16:03:22Z"
        },
        {
          "tag": "v0.9.0",
          "kind": "minor",
          "published_at": "2025-09-25T18:50:37Z"
        },
        {
          "tag": "v0.8.0",
          "kind": "minor",
          "published_at": "2025-03-30T12:03:15Z"
        },
        {
          "tag": "v0.7.0",
          "kind": "minor",
          "published_at": "2025-03-06T00:57:49Z"
        },
        {
          "tag": "v0.6.0",
          "kind": "minor",
          "published_at": "2025-02-23T23:49:52Z"
        },
        {
          "tag": "v0.5.0",
          "kind": "minor",
          "published_at": "2025-01-28T20:05:52Z"
        },
        {
          "tag": "v0.4.1",
          "kind": "patch",
          "published_at": "2025-01-27T22:02:35Z"
        },
        {
          "tag": "v0.4.0",
          "kind": "minor",
          "published_at": "2025-01-20T22:00:39Z"
        },
        {
          "tag": "v0.3.1",
          "kind": "patch",
          "published_at": "2025-01-19T15:52:00Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2025-01-15T23:37:34Z"
        },
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2025-01-14T11:58:22Z"
        },
        {
          "tag": "v0.1.0",
          "kind": "minor",
          "published_at": "2025-01-07T08:02:43Z"
        },
        {
          "tag": "v0.0.4",
          "kind": "patch",
          "published_at": "2025-01-03T20:09:00Z"
        },
        {
          "tag": "v0.0.3",
          "kind": "patch",
          "published_at": "2024-12-23T01:55:34Z"
        },
        {
          "tag": "v0.0.3-rc",
          "kind": "prerelease",
          "published_at": "2024-12-02T11:03:14Z"
        },
        {
          "tag": "v0.0.2",
          "kind": "patch",
          "published_at": "2024-09-27T20:00:42Z"
        },
        {
          "tag": "v0.0.1",
          "kind": "patch",
          "published_at": "2023-09-01T16:14:29Z"
        },
        {
          "tag": "v0.0.0",
          "kind": "major",
          "published_at": "2023-02-27T16:28:34Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "76500f5556acfac22f0009e8ca3bab1bae324ce4",
          "body": "## What/Why\nBump the transitive google.golang.org/grpc dependency to v1.82.1 to\nresolve high-severity advisory GHSA-hrxh-6v49-42gf (xDS RBAC auth\nbypass, HTTP/2 Rapid Reset DoS, and RBAC engine panic).\n\n## Proof it works\n`make test` passes (go vet + go test ok), `golangci-lint run` reports\n0 issues,\n[…]\ned by Claude Opus 4.8.\n\n## Review focus\nConfirm no other module needs a matching bump and that the indirect\nconstraint holds after downstream go mod tidy.\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 (#292)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-07-27T17:13:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "73d087e5a2fda2ea18b9396dbd65de73890c9de7",
          "body": "GoReleaser derives ProjectName from the repo/module name when it is not set,\nso every release archive shipped as privateer_* even though the binary, the\nCLI and the formula are all named pvtr. Set project_name explicitly.\n\nThe homebrew job is updated in step: it fetches the renamed archives, and the\n[…]\ns that\nno longer resolve.\n\nVerified with a snapshot build: archives are pvtr_Darwin_all.tar.gz,\npvtr_Linux_{x86_64,arm64,i386}.tar.gz and pvtr_Windows_*.zip, each still\ncontaining a binary named pvtr.",
          "is_bot": false,
          "headline": "chore: name release archives pvtr_* instead of privateer_* (#290)",
          "author_name": "Eddie Knight",
          "author_login": "eddie-knight",
          "committed_at": "2026-07-23T21:19:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3d841a925c2af4ea518aa42c450f479138d69a7f",
          "body": "Bumps the dependencies group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action).\n\n\nUpdates `actions/checkout` from 7.0.0 to 7.0.1\n- [Release notes](https://github.com/actions/checko\n[…]\nersion-update:semver-minor\n  dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the dependencies group with 2 updates (#291)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-23T21:06:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "babef723cb379d0eefeb397966ec66d5336ced21",
          "body": "Signed-off-by: Eddie Knight <knight@linux.com>",
          "is_bot": false,
          "headline": "feat: added benchmark command (#289)",
          "author_name": "Eddie Knight",
          "author_login": "eddie-knight",
          "committed_at": "2026-07-20T13:35:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3a9214b9e0757780272f9164bed9de8c0c68aab6",
          "body": null,
          "is_bot": true,
          "headline": "chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 (#288)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-16T21:05:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1450a1a1ac449b4abb23d9956c543fa40b030490",
          "body": "Signed-off-by: Eddie Knight <knight@linux.com>",
          "is_bot": false,
          "headline": "chore: upgrade privateer-sdk to v1.31.3 (#287)",
          "author_name": "Eddie Knight",
          "author_login": "eddie-knight",
          "committed_at": "2026-07-16T04:17:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "161c680cf2b25e83291bf70f9bfc627d76aff522",
          "body": "…285)",
          "is_bot": false,
          "headline": "chore(deps): bump privateer-sdk to v1.31.2 and go-gemara to v0.8.0 (#…",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-07-12T04:29:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "255a3988e772a47bd3897a23aa88b797059770e0",
          "body": "…(#284)",
          "is_bot": false,
          "headline": "ci: harden GitHub Actions workflows and resolve code-scanning alerts …",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-07-12T04:28:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "52ac984ef2e6d7b3294bfdc5f0437dab23a97fb3",
          "body": "Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.52.0 to 0.54.0.\n- [Commits](https://github.com/golang/crypto/compare/v0.52.0...v0.54.0)\n\n---\nupdated-dependencies:\n- dependency-name: golang.org/x/crypto\n  dependency-version: 0.54.0\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.54.0 (#283)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-11T02:16:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e27f3182cf3ab5c71ec7f9a6aa9cf9e7d3302d8d",
          "body": "Bumps the dependencies group with 4 updates: [github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml](https://github.com/github-community-projects/ospo-reusable-workflows), [github-community-projects/ospo-reusable-workflows/.github/workflows/pr-title.yaml](https://gith\n[…]\nersion-update:semver-minor\n  dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the dependencies group with 4 updates (#280)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-10T18:59:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6e55ec0d12dccc5828ba315cfcf9f68bff32d8f9",
          "body": "Bumps [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action) from 23.2.0 to 24.0.0.\n- [Release notes](https://github.com/davidanson/markdownlint-cli2-action/releases)\n- [Commits](https://github.com/davidanson/markdownlint-cli2-action/compare/ded1f9488f68a970bc6\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump DavidAnson/markdownlint-cli2-action (#281)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-10T18:59:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c9736a91054a16f27c8437c29047b22f2bb43030",
          "body": "Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.51.0 to 0.52.0.\n- [Commits](https://github.com/golang/crypto/compare/v0.51.0...v0.52.0)\n\n---\nupdated-dependencies:\n- dependency-name: golang.org/x/crypto\n  dependency-version: 0.52.0\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#282)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-10T18:59:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c79ccb2ea8c3f19cca03a10675f103d8e3927f5f",
          "body": "Bumps [golang.org/x/net](https://github.com/golang/net) from 0.53.0 to 0.55.0.\n- [Commits](https://github.com/golang/net/compare/v0.53.0...v0.55.0)\n\n---\nupdated-dependencies:\n- dependency-name: golang.org/x/net\n  dependency-version: 0.55.0\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump golang.org/x/net from 0.53.0 to 0.55.0 (#279)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-04T00:20:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "34430423ac68b9074f1867e6b146ac81b3ac9718",
          "body": "Bumps the dependencies group with 1 update: [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action).\n\n\nUpdates `golangci/golangci-lint-action` from 9.2.1 to 9.3.0\n- [Release notes](https://github.com/golangci/golangci-lint-action/releases)\n- [Commits](https://github.com/gol\n[…]\nersion-update:semver-minor\n  dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump golangci/golangci-lint-action (#278)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-03T17:21:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e5439ed75fb21d59cdc81767b936055c824be098",
          "body": "- Only run homebrew update when a release occurred\n- Only release when release label is used",
          "is_bot": false,
          "headline": "fix: Update release.yml (#277)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-06-26T14:35:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4c4fe36d6c9dea0e07deaf2518b8cb1cdbfdeb0b",
          "body": "Bumps the dependencies group with 4 updates: [github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml](https://github.com/github-community-projects/ospo-reusable-workflows), [actions/setup-go](https://github.com/actions/setup-go), [github-community-projects/ospo-reusabl\n[…]\nersion-update:semver-minor\n  dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the dependencies group with 4 updates (#276)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-26T03:18:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9d0fd9cf89c1cd1a37db5f942bd2c8c05853b711",
          "body": "Bumps alpine from `a2d49ea` to `28bd5fe`.\n\n---\nupdated-dependencies:\n- dependency-name: alpine\n  dependency-version: '3.24'\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump alpine from `a2d49ea` to `28bd5fe` (#275)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-20T08:22:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2ff9715533923a371de69d87eabfbda3f9dce810",
          "body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b43\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#274)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-20T08:21:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "776bb3f1c5357512eaf639c88bc4684e16c64731",
          "body": "Bumps alpine from 3.23 to 3.24.\n\n---\nupdated-dependencies:\n- dependency-name: alpine\n  dependency-version: '3.24'\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump alpine from 3.23 to 3.24 (#273)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-12T05:03:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2a94c7febfd3e722250bd3a1aae25523ecc85f01",
          "body": "…(#270)\n\n* chore(deps): bump golang from 1.26.3-alpine3.22 to 1.26.4-alpine3.22\n\nBumps golang from 1.26.3-alpine3.22 to 1.26.4-alpine3.22.\n\n---\nupdated-dependencies:\n- dependency-name: golang\n  dependency-version: 1.26.4-alpine3.22\n  dependency-type: direct:production\n  update-type: version-update:s\n[…]\n[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\nCo-authored-by: Jason Meridth <jmeridth@gmail.com>",
          "is_bot": true,
          "headline": "chore(deps): bump golang from 1.26.3-alpine3.22 to 1.26.4-alpine3.22 …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-05T18:48:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bfa3a7d3f1e7a63252f65a0a87733779d57a4b00",
          "body": "Bumps the dependencies group with 1 update: [actions/checkout](https://github.com/actions/checkout).\n\n\nUpdates `actions/checkout` from 6.0.2 to 6.0.3\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](\n[…]\nersion-update:semver-patch\n  dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/checkout in the dependencies group (#269)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-04T21:16:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e739edca322cd49ec9fbcf7ec3fa32e142f79778",
          "body": "Bumps the dependencies group with 1 update: [github.com/privateerproj/privateer-sdk](https://github.com/privateerproj/privateer-sdk).\n\n\nUpdates `github.com/privateerproj/privateer-sdk` from 1.24.1 to 1.25.0\n- [Release notes](https://github.com/privateerproj/privateer-sdk/releases)\n- [Commits](https:\n[…]\nersion-update:semver-minor\n  dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/privateerproj/privateer-sdk (#268)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-04T21:16:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "782385d60c935d842c7a773faeb6ce78b51696ca",
          "body": "Bumps the dependencies group with 6 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml](https://github.com/github-community-projects/ospo-reusable-workflows) | `1.0.1` | `1.1.0` |\n| [golangci/golangci-lint-ac\n[…]\nersion-update:semver-minor\n  dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the dependencies group with 6 updates (#266)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-28T23:26:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "982c3b2fa6b5d1b85d89ca7950cb7c482b696977",
          "body": "* fix: enforce LF on shell scripts to fix make build on Windows\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* add new line\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* add new line\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* add newline\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n---------\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>",
          "is_bot": false,
          "headline": "fix: enforce LF on shell scripts to fix make build on Windows (#265)",
          "author_name": "Satarupa Deb",
          "author_login": "Satarupa22-SD",
          "committed_at": "2026-05-28T23:26:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ded766dc2804172485af8dd3e2d41c29e1fb8538",
          "body": "Signed-off-by: Satarupa22-SD <satarupa2212@gmail.com>",
          "is_bot": false,
          "headline": "drop viper dependency (#264)",
          "author_name": "Satarupa Deb",
          "author_login": "Satarupa22-SD",
          "committed_at": "2026-05-27T04:09:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fd98bf16ead2f150439fd4cd18e0708c09ba6247",
          "body": "…up (#263)",
          "is_bot": true,
          "headline": "chore(deps): bump step-security/harden-runner in the dependencies gro…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-23T20:58:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7d5e157fc3a9c93bf15f56410aa53e005f656bb4",
          "body": "…(#254)",
          "is_bot": true,
          "headline": "chore(deps): bump golang from 1.26.2-alpine3.22 to 1.26.3-alpine3.22 …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-23T12:52:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5097a97949d50a35134ed7675bd329d0d4863eee",
          "body": "…#262)\n\nBumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.19.0 to 5.19.1.\n- [Release notes](https://github.com/go-git/go-git/releases)\n- [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md)\n- [Commits](https://github.com/go-git/go-git/compare/v5.19.0...v5.19.\n[…]\nv5\n  dependency-version: 5.19.1\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-19T18:39:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9589b4500a119312b7eff8d51649723e8db281f7",
          "body": "contents:write, which is the minimum needed for the RubbaBoy/BYOB\naction to push badge data to the shields branch.\n\nSigned-off-by: Vinaya Damle <vinayada@mac.lan>\nCo-authored-by: Vinaya Damle <vinayada@mac.lan>",
          "is_bot": false,
          "headline": "Add a top-level permissions block restricting the GITHUB_TOKEN to (#245)",
          "author_name": "vinayada1",
          "author_login": "vinayada1",
          "committed_at": "2026-05-18T23:20:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7b623b9a509b26a7a3a66114715f64262712664c",
          "body": "Bumps the dependencies group with 1 update: [github.com/privateerproj/privateer-sdk](https://github.com/privateerproj/privateer-sdk).\n\n\nUpdates `github.com/privateerproj/privateer-sdk` from 1.24.0 to 1.24.1\n- [Release notes](https://github.com/privateerproj/privateer-sdk/releases)\n- [Commits](https:\n[…]\nersion-update:semver-patch\n  dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/privateerproj/privateer-sdk (#258)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-18T22:54:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7f76ab950168f9f9af5bf7b01f8f7bd784258ed8",
          "body": "…github/workflows/pr-title.yaml (#260)\n\nBumps [github-community-projects/ospo-reusable-workflows/.github/workflows/pr-title.yaml](https://github.com/github-community-projects/ospo-reusable-workflows) from 0.6.0 to 1.0.1.\n- [Release notes](https://github.com/github-community-projects/ospo-reusable-wo\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github-community-projects/ospo-reusable-workflows/.…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-18T22:53:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "81719b61060006ed8812b7334d219e04ddf26429",
          "body": "…github/workflows/auto-labeler.yaml (#261)\n\nBumps [github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml](https://github.com/github-community-projects/ospo-reusable-workflows) from 0.6.0 to 1.0.1.\n- [Release notes](https://github.com/github-community-projects/ospo-reu\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github-community-projects/ospo-reusable-workflows/.…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-18T22:53:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7d460680e3b1af269a2ca81bccd5da092fb50748",
          "body": "…239)\n\n* update logger\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* fix: initialize writer and logger in NewCLI\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* update cli tests\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* guard writer init in persistentPreRun(fixe\n[…]\nby: Satarupa22-SD <satarupa2212@gmail.com>\n\n* test: regression test for run cmd\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n---------\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>",
          "is_bot": false,
          "headline": "fix: initialize logger to null logger to prevent nil pointer panic (#…",
          "author_name": "Satarupa Deb",
          "author_login": "Satarupa22-SD",
          "committed_at": "2026-05-18T22:53:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "be3ed48dd725b6aa557e5ddc9e67c79b18c42786",
          "body": "…up (#259)\n\nBumps the dependencies group with 1 update: [step-security/harden-runner](https://github.com/step-security/harden-runner).\n\n\nUpdates `step-security/harden-runner` from 2.16.1 to 2.19.2\n- [Release notes](https://github.com/step-security/harden-runner/releases)\n- [Commits](https://github.c\n[…]\nersion-update:semver-minor\n  dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump step-security/harden-runner in the dependencies gro…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-18T16:18:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3d2130a9b553c79334c969fe9a38dfeb4d0f253a",
          "body": null,
          "is_bot": false,
          "headline": "ci: Update catalog version in security assessment workflow (#257)",
          "author_name": "Eddie Knight",
          "author_login": "eddie-knight",
          "committed_at": "2026-05-12T14:55:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d63cd550cbddb7c0ead7708692535c6fc5557697",
          "body": null,
          "is_bot": false,
          "headline": "ci: adopt consolidated ospo-reusable-workflows release.yaml (#255)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-05-12T13:36:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cecdb19db58c0498d46640b01ef5a5120aff46c9",
          "body": "…#256)",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-12T13:28:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c024ee800a072dd8fe94c89b4b70027d83d15e05",
          "body": "Bumps the dependencies group with 1 update: [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action).\n\n\nUpdates `DavidAnson/markdownlint-cli2-action` from 23.1.0 to 23.2.0\n- [Release notes](https://github.com/davidanson/markdownlint-cli2-action/releases)\n- [Commi\n[…]\nersion-update:semver-minor\n  dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump DavidAnson/markdownlint-cli2-action (#253)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-08T18:39:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2f742993544870b95ccefdd8c9f9f59a2e5caadb",
          "body": "…dates (#251)\n\nBumps the dependencies group with 2 updates in the / directory: [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action) and [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action).\n\n\nUpdates `DavidAnson/markdownlint-cli2-ac\n[…]\nersion-update:semver-minor\n  dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the dependencies group across 1 directory with 2 up…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-01T20:44:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fb9aada448bcd2ad2d34371025689b58eb5e107a",
          "body": "Bumps the dependencies group with 1 update in the / directory: [github.com/hashicorp/go-plugin](https://github.com/hashicorp/go-plugin).\n\n\nUpdates `github.com/hashicorp/go-plugin` from 1.7.0 to 1.8.0\n- [Release notes](https://github.com/hashicorp/go-plugin/releases)\n- [Changelog](https://github.com/\n[…]\nersion-update:semver-minor\n  dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/hashicorp/go-plugin (#252)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-01T20:43:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "15222a0b252a7cd3a19d3e334e674df09c31c98f",
          "body": "* chore: upgrade sdk to v1.24.0; accept 0 or 1 as successful exit codes\n\nSigned-off-by: Eddie Knight <knight@linux.com>",
          "is_bot": false,
          "headline": "chore: upgrade sdk (#249)",
          "author_name": "Eddie Knight",
          "author_login": "eddie-knight",
          "committed_at": "2026-05-01T04:52:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e4cb71d947ce01ec5bc1e43eb02d519e16bd8ad2",
          "body": "* fix: update to use the latest patch from privateer-sdk for exit code handling\n\nSigned-off-by: Eddie Knight <knight@linux.com>",
          "is_bot": false,
          "headline": "chore: Update generator to use SDK fix for exit codes (#248)",
          "author_name": "Eddie Knight",
          "author_login": "eddie-knight",
          "committed_at": "2026-04-26T21:03:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2657f8fe2a825ca335d18ce7a3977aa32727b905",
          "body": null,
          "is_bot": true,
          "headline": "chore(deps): bump golang from `c259ff7` to `7ef9411` (#247)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-23T23:11:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7f50ea0cfb0cbd817c1c67a91e70f5387a58ad45",
          "body": "…oup (#246)",
          "is_bot": true,
          "headline": "chore(deps): bump goreleaser/goreleaser-action in the dependencies gr…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-23T23:11:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b8495b940293070f2b461c3622229895d10028d3",
          "body": "…#242)",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/go-git/go-git/v5 from 5.17.2 to 5.18.0 (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-18T11:22:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b3fcab9833ccc6c8a293fac41e175ee151c6b239",
          "body": "Bumps alpine from `2510918` to `5b10f43`.\n\n---\nupdated-dependencies:\n- dependency-name: alpine\n  dependency-version: '3.23'\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump alpine from `2510918` to `5b10f43` (#241)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-16T22:25:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "10cd3acbababcb419196736c9280025b3e72c985",
          "body": "…#240)\n\nBumps the dependencies group with 1 update: [actions/upload-artifact](https://github.com/actions/upload-artifact).\n\n\nUpdates `actions/upload-artifact` from 7.0.0 to 7.0.1\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-arti\n[…]\nersion-update:semver-patch\n  dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/upload-artifact in the dependencies group (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-16T22:24:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4dedfc05e93e049df14ef2388745155df71ebd4c",
          "body": "* update version test\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* update go.mod\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n---------\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>",
          "is_bot": false,
          "headline": "fix: test --verbose flag via SetArgs instead of viper.Set (#238)",
          "author_name": "Satarupa Deb",
          "author_login": "Satarupa22-SD",
          "committed_at": "2026-04-16T22:24:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "09a57e5b7cea5ac2cfde4c10cec46983c0ed51b4",
          "body": "Signed-off-by: Eddie Knight <knight@linux.com>",
          "is_bot": false,
          "headline": "chore: update SDK dependency (#237)",
          "author_name": "Eddie Knight",
          "author_login": "eddie-knight",
          "committed_at": "2026-04-15T16:59:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d24b6b2d2e0d3c04be1e5b6ad5b9b749f91b2a68",
          "body": "* chore: upgrade sdk\n\n- silence downloads in install test\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n* fix: capture install output in success tests for debuggability\n\n## What\n\nReplace `> /dev/null` with output capture in the two success test cases\n(`test_installs_when_checksum_matches` and `test\n[…]\nhe failure test cases in the\nsame file.\n\n## Notes\n\n- Addresses Copilot review comments on PR #236\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "chore: upgrade sdk (#236)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-04-12T23:15:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7b74f17612a506857f47df97e06297d411732de6",
          "body": "Bumps the dependencies group with 1 update: [github.com/privateerproj/privateer-sdk](https://github.com/privateerproj/privateer-sdk).\n\n\nUpdates `github.com/privateerproj/privateer-sdk` from 1.23.0 to 1.23.1\n- [Release notes](https://github.com/privateerproj/privateer-sdk/releases)\n- [Commits](https:\n[…]\nersion-update:semver-patch\n  dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/privateerproj/privateer-sdk (#235)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-12T21:39:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "afb24075cf8a8bc4a59fce55214562cc33301657",
          "body": null,
          "is_bot": false,
          "headline": "feat: Add install command (#204)",
          "author_name": "Eddie Knight",
          "author_login": "eddie-knight",
          "committed_at": "2026-04-12T03:33:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "20306d0cf8f62a5d61ca5ddbac381ba3b498a801",
          "body": "* fix: add mandatory checksum verification to install.sh\n\nThe installer previously piped the downloaded archive directly into tar\nwithout any integrity check, allowing a compromised release asset or\nMITM to silently deliver a tampered binary.\n\nChanges:\n- Download the release archive to a temp file b\n[…]\nigned-off-by: Vinaya Damle <vinayada@mac.lan>\n\n---------\n\nSigned-off-by: Vinaya Damle <vinayada@mac.lan>\nCo-authored-by: Vinaya Damle <vinayada@mac.lan>\nCo-authored-by: Eddie Knight <knight@linux.com>",
          "is_bot": false,
          "headline": "fix: add mandatory SHA-256 checksum verification to install.sh (#226)",
          "author_name": "vinayada1",
          "author_login": "vinayada1",
          "committed_at": "2026-04-11T15:02:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1709ffeb6dd6b6b4fc80c37c0644739861f72694",
          "body": "Signed-off-by: Satarupa22-SD <satarupa2212@gmail.com>",
          "is_bot": false,
          "headline": "fix: filter .exe binaries from plugin list (#234)",
          "author_name": "Satarupa Deb",
          "author_login": "Satarupa22-SD",
          "committed_at": "2026-04-10T19:33:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7b249ae1d59b159354982a3a92e03a36ca9de77d",
          "body": "* chore: upgrade go to 1.26.2\n\n## What\n\nUpgrade Go from 1.26.1 to 1.26.2 in go.mod and the Dockerfile base image.\n\n## Why\n\ngo1.26.2 fixes 4 vulnerabilities in the standard library:\n\n- GO-2026-4947: unexpected work during chain building (crypto/x509)\n- GO-2026-4946: inefficient policy validation (cry\n[…]\n>\n\n* Revert \"fix(ci): add dependency-graph read permission to integration tests\"\n\nThis reverts commit c89483144ababdde6fda911ec873b74006e50a09.\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "chore: upgrade go to 1.26.2 (#233)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-04-09T15:49:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "838059da7ba95da56f1aa15519835b71b3894da9",
          "body": "The integration test script enables shell tracing globally and writes\nGITHUB_TOKEN into a temporary config file via heredoc. With tracing\nleft on, the expanded token value can appear in CI logs.\n\nDisable tracing only around the config-generation block so secret\nvalues are not echoed while preserving the rest of the script's\ntrace output.\n\nCo-authored-by: Vinaya Damle <vinayada@mac.lan>\nCo-authored-by: Jason Meridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "fix: disable shell tracing around token config generation (#227)",
          "author_name": "vinayada1",
          "author_login": "vinayada1",
          "committed_at": "2026-04-08T23:13:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e48c4d2d2b02cd7c8d9608fc742bb30519d79182",
          "body": "## What\n\nExtracted the integration test job from ci.yml into a dedicated\nintegration.yml workflow and replaced octo-sts OIDC token exchange with\nthe default GITHUB_TOKEN in both integration.yml and\nosps-security-assessment.yml. Deleted the STS policy file.\n\n## Why\n\nBoth workflows only perform read-o\n[…]\n\n- Removed id-token:write from both workflows, reducing privilege scope\n- Added explicit permissions: contents: read to the changes job in integration.yml\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "ci: remove octo-sts from repo, use default GITHUB_TOKEN (#232)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-04-08T23:10:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "38b125a0045ef7be590e6466eca276db751a3549",
          "body": "…(#229)\n\n* chore(deps): bump golang from 1.25.1-alpine3.22 to 1.26.1-alpine3.22\n\nBumps golang from 1.25.1-alpine3.22 to 1.26.1-alpine3.22.\n\n---\nupdated-dependencies:\n- dependency-name: golang\n  dependency-version: 1.26.1-alpine3.22\n  dependency-type: direct:production\n  update-type: version-update:s\n[…]\nbot] <support@github.com>\nSigned-off-by: jmeridth <jmeridth@gmail.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>\nCo-authored-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": true,
          "headline": "chore(deps): bump golang from 1.25.1-alpine3.22 to 1.26.1-alpine3.22 …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-07T20:04:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1a090f35c591287ec2f5a66ad0591a2996929537",
          "body": "Bumps the dependencies group with 1 update: [github.com/privateerproj/privateer-sdk](https://github.com/privateerproj/privateer-sdk).\n\n\nUpdates `github.com/privateerproj/privateer-sdk` from 1.22.0 to 1.22.1\n- [Release notes](https://github.com/privateerproj/privateer-sdk/releases)\n- [Commits](https:\n[…]\nersion-update:semver-patch\n  dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/privateerproj/privateer-sdk (#230)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-07T19:10:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c7d33693c705679a21a5b81c862ab488673bdc90",
          "body": "Bumps alpine from 3.22 to 3.23.\n\n---\nupdated-dependencies:\n- dependency-name: alpine\n  dependency-version: '3.23'\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump alpine from 3.22 to 3.23 (#231)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-04-07T19:00:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cbdaff6b7cc299528806c386969de045842461d0",
          "body": "Co-authored-by: Vinaya Damle <vinayada@mac.lan>",
          "is_bot": false,
          "headline": "chore(deps): pin docker images for privateer (#228)",
          "author_name": "vinayada1",
          "author_login": "vinayada1",
          "committed_at": "2026-04-07T18:51:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fb6262ed9427c2a290e0444f9257a6882fd393de",
          "body": "…jection (#219)\n\n* refactor: replace package-level globals with CLI struct dependency injection\n\n## What\n\nIntroduce a CLI struct that holds logger, writer, build info, and\nrootCmd. Convert all command files from init() with package-level vars\nto methods on CLI. Delete execute.go and replace with cli\n[…]\ne buffer and that verbose-only fields (Commit:) are absent, rather than asserting an empty buffer\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "refactor: replace package-level globals with CLI struct dependency in…",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-03-31T13:35:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "01a2188061860fca260c3add552ba9d0bb30b01c",
          "body": "## What\n\nAdd `fetch-depth: 0` to the integration test job's checkout step so\nthat git tags are available during the build.\n\n## Why\n\nThe Makefile uses `git describe --tags` to inject the version at build\ntime via ldflags. Without full git history in a shallow clone, this\nfails with:\n\n    fatal: No na\n[…]\nd — the CI job doesn't need tags since it doesn't build the binary via ldflags\n- The \"Detect Changes\" job already uses `fetch-depth: 0` for its diff logic\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "fix(ci): add fetch-depth 0 to integration test checkout (#218)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-03-31T01:31:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "88191d60b51d777df7894a827c35596edab1a28f",
          "body": "…a flag types (#217)\n\n* refactor: clean up dead tests, fix verbose flag, and use correct Cobra flag types\n\n## What\n\nRemove dead commented-out test in main_test.go, register the missing\n--verbose/-v flag on the version command, switch generate-plugin from\nPersistentFlags to Flags since it has no subc\n[…]\ns to stdout via fmt.Println rather than the tabwriter, so the test asserts the buffer stays empty\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "refactor: clean up dead tests, fix verbose flag, and use correct Cobr…",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-03-31T01:11:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6cf09e5fd82e2e3e8f4b3c98ebcd389d980b2e4b",
          "body": "* refactor: improve Go idioms in run, env, and execute commands\n\n## What\n\nUse cobra.NoArgs for declarative argument validation in the run command,\nhandle previously swallowed errors from hcplugin.Discover and\nos.UserHomeDir, and switch from path.Join to filepath.Join for OS-aware\nfilesystem paths.\n\n\n[…]\n behavior added in the previous commit.\n\n## Notes\n\n- Addresses Copilot review feedback on PR #216\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "refactor: improve Go idioms in run, env, and execute commands (#216)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-03-31T00:36:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "883a247ee9f0c34816a6565f551ceaf2abfaea5d",
          "body": "Bumps the dependencies group with 1 update: [github.com/privateerproj/privateer-sdk](https://github.com/privateerproj/privateer-sdk).\n\n\nUpdates `github.com/privateerproj/privateer-sdk` from 1.21.0 to 1.22.0\n- [Release notes](https://github.com/privateerproj/privateer-sdk/releases)\n- [Commits](https:\n[…]\nersion-update:semver-minor\n  dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/privateerproj/privateer-sdk (#215)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-30T21:56:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "aaf1907f7a26503f5fe868736d2cb94383cf82f6",
          "body": "…#213)\n\nBumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.17.0 to 5.17.1.\n- [Release notes](https://github.com/go-git/go-git/releases)\n- [Commits](https://github.com/go-git/go-git/compare/v5.17.0...v5.17.1)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/go-git/go\n[…]\nv5\n  dependency-version: 5.17.1\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/go-git/go-git/v5 from 5.17.0 to 5.17.1 (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-30T21:27:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fb8c919c0474490e5fa57d2238f60e9d02b0191c",
          "body": "* chore(deps): pin GitHub Actions to latest release SHAs\n\n## What\n\nPin all GitHub Actions references to full commit SHAs of their latest\nreleases, replacing bare version tags (v6, v7) and updating stale SHAs.\n\n## Why\n\nBare version tags are mutable and can be force-pushed, which is a supply\nchain ris\n[…]\nfuture catalog version bumps\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\nCo-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>",
          "is_bot": false,
          "headline": "chore(deps): pin GitHub Actions to latest release SHAs (#214)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-03-30T21:20:51Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1993290288c08404a121ea5c60610afe3aa19259",
          "body": "* docs: add contributing.md\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* update links\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* docs: add contributing.md\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\n\n* docs: add contributing.md\n\nSigned-off-by: Satarupa22-SD <sa\n[…]\n linting errors\n\nUpdated formatting for tables and notes in the contributing guide.\n\n---------\n\nSigned-off-by: Satarupa22-SD <satarupa2212@gmail.com>\nCo-authored-by: Jason Meridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "docs: add contributing.md file to pvtr (#211)",
          "author_name": "Satarupa Deb",
          "author_login": "Satarupa22-SD",
          "committed_at": "2026-03-21T04:01:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5fc9f80de6312ffb7ab033357f02298028c05ba6",
          "body": "Bumps the dependencies group with 3 updates: [github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml](https://github.com/github-community-projects/ospo-reusable-workflows), [github-community-projects/ospo-reusable-workflows/.github/workflows/pr-title.yaml](https://gith\n[…]\nersion-update:semver-minor\n  dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the dependencies group with 3 updates (#212)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-20T20:24:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a1f2fbaec520f1704e763431fa8afed891d77792",
          "body": "Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.71.0 to 1.79.3.\n- [Release notes](https://github.com/grpc/grpc-go/releases)\n- [Commits](https://github.com/grpc/grpc-go/compare/v1.71.0...v1.79.3)\n\n---\nupdated-dependencies:\n- dependency-name: google.golang.org/grpc\n  dependency-version: 1.79.3\n  dependency-type: indirect\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump google.golang.org/grpc from 1.71.0 to 1.79.3 (#209)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-19T02:26:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3abeb94c9824591e8b9789c17bd41546ce3af389",
          "body": "Bumps the dependencies group with 3 updates: [github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml](https://github.com/github-community-projects/ospo-reusable-workflows), [github-community-projects/ospo-reusable-workflows/.github/workflows/pr-title.yaml](https://gith\n[…]\nersion-update:semver-patch\n  dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump the dependencies group with 3 updates (#208)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-17T03:49:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9dd1e795b5500646bdd2fb011661ea91d3185b55",
          "body": null,
          "is_bot": true,
          "headline": "chore(deps): bump the dependencies group with 3 updates (#207)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-16T21:22:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "df3bda3224b29d73a915205df90de566e7332cdc",
          "body": "* feat: add --organization flag and adapt to SDK PluginConfig\n\n## What\n\nAdded the --organization / -g flag to the generate-plugin command and updated\nthe generatePlugin function to use the SDK's new PluginConfig struct return\nfrom SetupTemplatingEnvironment.\n\n## Why\n\nThe SDK now returns a PluginConf\n[…]\n changes. Also updated the generatePlugin function\ncomment to reflect the current implementation.\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "feat: add --organization flag and adapt to SDK PluginConfig (#206)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-03-16T06:54:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "afa4f98ad505ecd7113d5906cab8b5a5f39aa091",
          "body": "…#205)\n\n* feat: replace goreleaser brews with custom homebrew update workflow\n\n## What\n\nRemove the brews section from .goreleaser.yaml and add a new update-homebrew job to the release workflow that updates the homebrew-tap formula by patching URLs and SHA256 checksums directly.\n\n## Why\n\nGoReleaser's\n[…]\n3.0 (4b73464bb391d4059bd26b0524d20df3927bd417)\n- Version comments retained inline for readability\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "feat: replace goreleaser brews with custom homebrew update workflow (…",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-03-16T01:37:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "013a03b098ac11dd19ea55fb4f85295e83d38054",
          "body": "…(#203)\n\n## What\n\nSet the name_template field on universal_binaries in .goreleaser.yaml to \"pvtr\" so the macOS universal binary matches the configured build binary name.\n\n## Why\n\nThe universal_binaries name_template defaults to {{ .ProjectName }}, which resolves to the repo name \"privateer\". With re\n[…]\n- The archive filenames will still use \"privateer\" (e.g., privateer_Darwin_all.tar.gz) since ProjectName is unchanged — only the binary inside is affected\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "fix: set universal_binaries name_template to match build binary name …",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-03-14T21:44:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d6147b78d90d5a8458a7113ba5708bad44a39c1b",
          "body": "* feat: rename binary from privateer to pvtr\n\n## What\n\nRenamed the CLI binary and all build artifacts from privateer to pvtr.\nThe cobra root command, GoReleaser config, Makefile, Dockerfile, install\nscript, and integration tests all reference the new binary name. A\nbackward-compatible symlink (priva\n[…]\nr\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n* fix: rename build output executables to 'privateer' to match articts generated by goreleaser\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "feat: rename binary from privateer to pvtr (#202)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-03-14T15:44:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b5f4bb600d39047c19d6175ff8bd854d433d0f5f",
          "body": "* chore: upgrade dependencies\n\nSigned-off-by: Eddie Knight <knight@linux.com>\n\n* replace\n\nSigned-off-by: Eddie Knight <knight@linux.com>\n\n* sdk v1.20.0\n\nSigned-off-by: Eddie Knight <knight@linux.com>\n\n---------\n\nSigned-off-by: Eddie Knight <knight@linux.com>",
          "is_bot": false,
          "headline": "chore: upgrade dependencies (#201)",
          "author_name": "Eddie Knight",
          "author_login": "eddie-knight",
          "committed_at": "2026-03-13T06:54:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "84ebc5c5a3c1f8aca773167d2a612470885c19f7",
          "body": "Signed-off-by: Eddie Knight <knight@linux.com>",
          "is_bot": false,
          "headline": "docs: initial threats for Privateer CLI (#200)",
          "author_name": "Eddie Knight",
          "author_login": "eddie-knight",
          "committed_at": "2026-03-11T13:33:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "40f0a6f10898433e520ca01ff56f17e81dffd9a3",
          "body": "…(#199)\n\n## What\n\nUpdated the organization path for ospo-reusable-workflows from `github` to\n`github-community-projects` across auto-labeler, pr-title, and release workflows.\n\n## Why\n\nThe ospo-reusable-workflows repository has been transferred to the\ngithub-community-projects organization, making th\n[…]\nsolves correctly under the new org\n- All three workflows (auto-labeler, pr-title, release) are affected; if any were missed, CI will break on next trigger\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "fix: update ospo-reusable-workflows org to github-community-projects …",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-03-10T06:47:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e1de9b5958543cff04b96ed9a67def3bacd18ddb",
          "body": null,
          "is_bot": true,
          "headline": "chore(deps): bump actions/upload-artifact from 6 to 7 (#198)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-03-02T23:32:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2844396e5c373f5dc22de9a2806df4041832d5c8",
          "body": null,
          "is_bot": true,
          "headline": "chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 (#197)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-25T19:38:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0bc10a33e70fc70c57324b2ab55a5d94d12f7d14",
          "body": "Signed-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "chore: upgrade osps github action to latest release SHA (#196)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-02-24T20:27:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "388838e78de435ff7861d30f5303e6f1b2d21eeb",
          "body": null,
          "is_bot": false,
          "headline": "chore: Update OSPS baseline action version in workflow (#195)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-02-24T17:30:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "15918ae2bf27666c1730cd8352530738c0922ba9",
          "body": null,
          "is_bot": false,
          "headline": "chore: Add workflow_dispatch trigger to security insights (#194)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-02-24T16:09:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "755b4a333d18fec9418b6e76f1ce2f13bb3495f2",
          "body": "Bumps the dependencies group with 1 update: [github.com/privateerproj/privateer-sdk](https://github.com/privateerproj/privateer-sdk).\n\n\nUpdates `github.com/privateerproj/privateer-sdk` from 1.18.0 to 1.19.0\n- [Release notes](https://github.com/privateerproj/privateer-sdk/releases)\n- [Commits](https:\n[…]\nersion-update:semver-minor\n  dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/privateerproj/privateer-sdk (#192)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-24T02:15:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b47a0dca2ea92c95225e427f5ee92d4007c99afb",
          "body": "…193)",
          "is_bot": true,
          "headline": "chore(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 (#…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-23T23:05:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "15643b4ea7b9d34ea27259d02cd689b03178de8c",
          "body": "… v1.2.0 (#191)\n\n## What\n\nAdded a new workflow to validate the security-insights.yml file on pushes and PRs\nto main, and bumped the osps-baseline-action from v1.0.0 to v1.2.0.\n\n## Why\n\nThe security insights validation ensures the security-insights.yml file stays\nwell-formed as it's updated. The acti\n[…]\nd to a full commit SHA rather than a\nsemver tag — this is intentional for supply chain safety but means future\nupdates require manually updating the hash.\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "ci: add security insights validation and bump osps-baseline-action to…",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-02-21T17:54:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3013672eff6b12bd06e41e9d1f4c22f25544e285",
          "body": "… (#190)\n\n* ci: replace stored secret with octo-sts for security assessment token\n\n## What\n\nSwitch the OSPS security assessment workflow from using a stored\n`PRIVATEER_GITHUB_TOKEN` secret to dynamically generated tokens via\nocto-sts/action, and add `.claude/` to `.gitignore`.\n\n## Why\n\nOcto-sts prov\n[…]\ned-off-by: jmeridth <jmeridth@gmail.com>\n\n* fix: don't persist credentials when checking out code\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "ci: replace stored secret with octo-sts for security assessment token…",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-02-21T05:42:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e3c8c521673dd5d9295b06533b141438eeebca0e",
          "body": "* ci: skip CI on markdown-only PRs and add markdown linting\n\n## What\n\nReplaced `paths-ignore` with a change-detection job that gates CI and\nintegration jobs so they skip but still satisfy required checks on\nmarkdown-only PRs. Added a markdown lint job using markdownlint-cli2 to\nthe lint workflow, wi\n[…]\n.yml\n\nCo-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\nCo-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: skip CI on markdown-only PRs and add markdown linting (#189)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-02-19T19:02:07Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "98090aeabc2c1726295890747aaa01a00c62bebe",
          "body": "## What:\n\nAdded Homebrew as the first installation option via the\nprivateerproj/tap tap, and promoted installation options from bold text\nto h4 headings for consistency (markdown linting)\n\n## Why:\n\nHomebrew is the most ergonomic installation method for macOS and Linux\nusers, and should be discoverable as the primary option.\n\n## Notes:\n\nNone\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "docs: add Homebrew tap installation method to README (#188)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-02-19T18:31:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "70f7268fb372e04cd08e8b2df60a6b79d253d359",
          "body": "* fix: update acceptance test to use correct test data filename\n\n## What\n\nUpdate the generate-plugin source path in the acceptance test from\nCCC.VPC_2025.01.yaml to OSPS_Baseline_AC_2025_02.yaml.\n\n## Why\n\nThe test data file was renamed but the acceptance test was not updated,\ncausing the generate-pl\n[…]\nolder and is a reference template, not used directly by CI.\n- This will be handled in a future PR\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>\n\n---------\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "fix: propagate generate-plugin errors to exit code  (#187)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-02-17T02:30:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ccadcab717965212b00e7f15ffab62c4c7791340",
          "body": "- update to run on push to main, just to double check everything after it\n  integrates with default/main branch\n- update octo-sts permissions to include read permissions to run plugin\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "fix: ci (#186)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-02-16T03:27:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "48f67b66a0432b575c697a6fc273c422e43c3b56",
          "body": "## What\n\nAdd an integration test that downloads the latest pvtr-github-repo plugin\nrelease and runs it against the privateer repository using the OSPS\nbaseline catalog at Maturity Level 1.\n\n## Why\n\nValidates that privateer can discover, load, and execute a real plugin\nend-to-end in CI, catching inte\n[…]\n verification step greps for the summary line pattern rather than\n  asserting specific pass/fail counts, so it won't break as the plugin\n  or repo evolves\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "feat: add pvtr-github-repo plugin integration test (#185)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-02-16T03:11:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8781dad6bd9439da02facb869356b49d700a3a9a",
          "body": "Closes https://github.com/privateerproj/privateer/issues/181\n\n## What\n\nAdd a new `env` command (aliased as `info`) that displays the binary\npath, config location, plugins directory, discovered plugins, version,\ncommit, build time, Go version, and OS/arch.\n\n## Why\n\nThere was no way to quickly see whi\n[…]\nbinaries, matching\n  existing behavior in the SDK\n- Config path comes from viper's \"config\" key which defaults to\n  {cwd}/config.yml via the SDK's SetBase\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "feat: add env command to display runtime environment info (#182)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-02-15T17:14:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e5692bd2fa64670b3adf9b9bd3a1c07eb0b52356",
          "body": "Bumps the dependencies group with 1 update: [github.com/privateerproj/privateer-sdk](https://github.com/privateerproj/privateer-sdk).\n\n\nUpdates `github.com/privateerproj/privateer-sdk` from 1.17.2 to 1.18.0\n- [Release notes](https://github.com/privateerproj/privateer-sdk/releases)\n- [Commits](https:\n[…]\nersion-update:semver-minor\n  dependency-group: dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/privateerproj/privateer-sdk (#184)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-02-15T17:12:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4ae5557c6f18739380757d1bcea21610582f295f",
          "body": "* chore: refactored entrypoint logic\n\nSigned-off-by: Eddie Knight <knight@linux.com>\n\n* linting\n\nSigned-off-by: Eddie Knight <knight@linux.com>\n\n---------\n\nSigned-off-by: Eddie Knight <knight@linux.com>",
          "is_bot": false,
          "headline": "chore: refactored entrypoint logic (#183)",
          "author_name": "Eddie Knight",
          "author_login": "eddie-knight",
          "committed_at": "2026-02-15T17:07:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "53226ed7521a60edf71d55a80923bea00b1443b2",
          "body": "## What\n\nAdd ldflags to the goreleaser build config to set Version,\nVersionPostfix, GitCommitHash, and BuiltAt at build time.\n\n## Why\n\nReleased binaries report \"0.0.0-dev\" because the default values in\nmain.go are never overridden during the goreleaser build. Without\nldflags, the Go linker has no in\n[…]\nreducing binary size\n  but making stack traces less detailed if users report panics\n- Existing releases are unaffected; only future tags will pick this up\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "fix: inject version info into binaries via goreleaser ldflags (#180)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-02-15T15:15:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b64b4d5fbc86d13bb26d2a3d6b43a365faba58f0",
          "body": "## What\n\nReplace verbose if/then blocks with idiomatic shell || operator for\ntracking command failures in the acceptance test script.\n\n## Why\n\nThe repeated $? check pattern is unnecessarily verbose. The || idiom\nis the standard shell approach for \"run but record failure\" and\nreduces the script from \n[…]\ndentical behavior.\n\n## Notes\n\n- No behavioral change — all commands still run regardless of\n  earlier failures, and the aggregate exit status is preserved\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "refactor: simplify acceptance test error handling (#178)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-02-15T07:26:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c1925cd3ec03f47db2d138b38d73c65185f0ef46",
          "body": "## What\n\nUpdate the security-insights.yml file to conform to the OSSF Security\nInsights 2.2.0 schema specification, correct stale metadata, and\nupdate the core team roster.\n\n## Why\n\nThe file was using schema version 2.0.0 with outdated dates, a\nplaceholder release license block, and a stale contribu\n[…]\n\n  when release license differs from repo license)\n- Rudra Gupta was removed from core-team; Jason Meridth affiliation\n  updated from GitHub to Chainguard\n\nSigned-off-by: jmeridth <jmeridth@gmail.com>",
          "is_bot": false,
          "headline": "chore: update security-insights.yml to 2.2.0 schema (#177)",
          "author_name": "Jason Meridth",
          "author_login": "jmeridth",
          "committed_at": "2026-02-15T07:12:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 44,
      "commits_last_year": 151,
      "latest_release_at": "2026-07-20T14:10:11Z",
      "latest_release_tag": "v0.22.0",
      "releases_from_tags": false,
      "days_since_last_push": 4,
      "active_weeks_last_year": 37,
      "days_since_latest_release": 11,
      "mean_days_between_releases": 12.3
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 75,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/privateerproj/privateer",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/privateerproj/privateer",
          "is_deprecated": false,
          "latest_version": "v0.22.0",
          "repository_url": "https://github.com/privateerproj/privateer",
          "versions_count": 46,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-20T13:35:45Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 11
        }
      ]
    },
    "popularity": {
      "forks": 9,
      "stars": 23,
      "watchers": 3,
      "fork_history": {
        "days": [
          {
            "date": "2023-10-08",
            "count": 1
          },
          {
            "date": "2024-09-10",
            "count": 1
          },
          {
            "date": "2025-03-16",
            "count": 1
          },
          {
            "date": "2025-04-09",
            "count": 1
          },
          {
            "date": "2025-09-25",
            "count": 1
          },
          {
            "date": "2025-11-26",
            "count": 1
          },
          {
            "date": "2026-03-11",
            "count": 1
          },
          {
            "date": "2026-04-03",
            "count": 1
          },
          {
            "date": "2026-07-21",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 9,
        "total_forks": 9
      },
      "star_history": null,
      "open_issues_and_prs": 11
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 4427,
      "source_files_sampled": 12,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.54.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5932"
            ],
            "fixed_version": null,
            "advisory_count": 1,
            "oldest_advisory_days": 24
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "unknown": 1
        },
        "advisory_count": 1,
        "affected_count": 1,
        "assessed_count": 125,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/hashicorp/go-hclog",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.3"
        },
        {
          "name": "github.com/hashicorp/go-plugin",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.0"
        },
        {
          "name": "github.com/privateerproj/privateer-sdk",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.32.0"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.2"
        },
        {
          "name": "github.com/spf13/viper",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.21.0"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "github.com/hashicorp/go-hclog",
            "direct": true,
            "version": "v1.6.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-plugin",
            "direct": true,
            "version": "v1.8.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/privateerproj/privateer-sdk",
            "direct": true,
            "version": "v1.32.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cobra",
            "direct": true,
            "version": "v1.10.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/viper",
            "direct": true,
            "version": "v1.21.0",
            "ecosystem": "go"
          },
          {
            "name": "dario.cat/mergo",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/asaskevich/govalidator",
            "direct": false,
            "version": "v0.0.0-20230301143203-a9d515a09cc2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/blang/semver",
            "direct": false,
            "version": "v3.5.1+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cenkalti/backoff/v5",
            "direct": false,
            "version": "v5.0.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cespare/xxhash/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cloudflare/circl",
            "direct": false,
            "version": "v1.6.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/coreos/go-oidc/v3",
            "direct": false,
            "version": "v3.17.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyberphone/json-canonicalization",
            "direct": false,
            "version": "v0.0.0-20241213102144-19d51d7fe467",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cyphar/filepath-securejoin",
            "direct": false,
            "version": "v0.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/defenseunicorns/go-oscal",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/digitorus/pkcs7",
            "direct": false,
            "version": "v0.0.0-20230818184609-3a137a874352",
            "ecosystem": "go"
          },
          {
            "name": "github.com/digitorus/timestamp",
            "direct": false,
            "version": "v0.0.0-20231217203849-220c5c2851b7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/emirpasic/gods",
            "direct": false,
            "version": "v1.18.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fatih/color",
            "direct": false,
            "version": "v1.18.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fsnotify/fsnotify",
            "direct": false,
            "version": "v1.9.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gemaraproj/go-gemara",
            "direct": false,
            "version": "v0.8.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/gcfg",
            "direct": false,
            "version": "v1.5.1-0.20230307220236-3a3c6141e376",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/go-billy/v5",
            "direct": false,
            "version": "v5.9.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-git/go-git/v5",
            "direct": false,
            "version": "v5.19.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-jose/go-jose/v4",
            "direct": false,
            "version": "v4.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/logr",
            "direct": false,
            "version": "v1.4.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/stdr",
            "direct": false,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/analysis",
            "direct": false,
            "version": "v0.25.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/errors",
            "direct": false,
            "version": "v0.22.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/jsonpointer",
            "direct": false,
            "version": "v0.23.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/jsonreference",
            "direct": false,
            "version": "v0.21.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/loads",
            "direct": false,
            "version": "v0.24.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/runtime",
            "direct": false,
            "version": "v0.32.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/runtime/server-middleware",
            "direct": false,
            "version": "v0.30.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/spec",
            "direct": false,
            "version": "v0.22.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/strfmt",
            "direct": false,
            "version": "v0.26.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag",
            "direct": false,
            "version": "v0.26.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/cmdutils",
            "direct": false,
            "version": "v0.26.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/conv",
            "direct": false,
            "version": "v0.27.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/fileutils",
            "direct": false,
            "version": "v0.26.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/jsonname",
            "direct": false,
            "version": "v0.26.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/jsonutils",
            "direct": false,
            "version": "v0.26.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/loading",
            "direct": false,
            "version": "v0.26.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/mangling",
            "direct": false,
            "version": "v0.26.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/netutils",
            "direct": false,
            "version": "v0.26.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/stringutils",
            "direct": false,
            "version": "v0.26.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/typeutils",
            "direct": false,
            "version": "v0.27.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/yamlutils",
            "direct": false,
            "version": "v0.26.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/validate",
            "direct": false,
            "version": "v0.26.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-viper/mapstructure/v2",
            "direct": false,
            "version": "v2.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/goccy/go-yaml",
            "direct": false,
            "version": "v1.19.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/groupcache",
            "direct": false,
            "version": "v0.0.0-20241129210726-2c02b8208cf8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/golang/protobuf",
            "direct": false,
            "version": "v1.5.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/certificate-transparency-go",
            "direct": false,
            "version": "v1.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/go-containerregistry",
            "direct": false,
            "version": "v0.21.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/uuid",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/grpc-ecosystem/grpc-gateway/v2",
            "direct": false,
            "version": "v2.29.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-cleanhttp",
            "direct": false,
            "version": "v0.5.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/go-retryablehttp",
            "direct": false,
            "version": "v0.7.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/yamux",
            "direct": false,
            "version": "v0.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/in-toto/attestation",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/in-toto/in-toto-golang",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/inconshreveable/mousetrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jbenet/go-context",
            "direct": false,
            "version": "v0.0.0-20150711004518-d14ea06fba99",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jedisct1/go-minisign",
            "direct": false,
            "version": "v0.0.0-20211028175153-1c139d1cc84b",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kevinburke/ssh_config",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/cpuid/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-colorable",
            "direct": false,
            "version": "v0.1.14",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-isatty",
            "direct": false,
            "version": "v0.0.20",
            "ecosystem": "go"
          },
          {
            "name": "github.com/microsoft/go-winio",
            "direct": false,
            "version": "v0.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/oklog/run",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/oklog/ulid/v2",
            "direct": false,
            "version": "v2.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/go-digest",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/image-spec",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pelletier/go-toml/v2",
            "direct": false,
            "version": "v2.2.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pjbgf/sha1cd",
            "direct": false,
            "version": "v0.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/browser",
            "direct": false,
            "version": "v0.0.0-20240102092130-5ac0b6a4141c",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pkg/errors",
            "direct": false,
            "version": "v0.9.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/protonmail/go-crypto",
            "direct": false,
            "version": "v1.1.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/revanite-io/grc-store-protocol",
            "direct": false,
            "version": "v0.5.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sagikazarmark/locafero",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/santhosh-tekuri/jsonschema/v6",
            "direct": false,
            "version": "v6.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sassoftware/relic",
            "direct": false,
            "version": "v7.2.1+incompatible",
            "ecosystem": "go"
          },
          {
            "name": "github.com/secure-systems-lab/go-securesystemslib",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sergi/go-diff",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/shibumi/go-pathspec",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/protobuf-specs",
            "direct": false,
            "version": "v0.5.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/rekor",
            "direct": false,
            "version": "v1.5.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/rekor-tiles/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/sigstore",
            "direct": false,
            "version": "v1.10.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/sigstore-go",
            "direct": false,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sigstore/timestamp-authority/v2",
            "direct": false,
            "version": "v2.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/skeema/knownhosts",
            "direct": false,
            "version": "v1.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sourcegraph/conc",
            "direct": false,
            "version": "v0.3.1-0.20240121214520-5f936abd7ae8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/afero",
            "direct": false,
            "version": "v1.15.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cast",
            "direct": false,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": false,
            "version": "v1.0.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/subosito/gotenv",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/theupdateframework/go-tuf",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/theupdateframework/go-tuf/v2",
            "direct": false,
            "version": "v2.4.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/transparency-dev/formats",
            "direct": false,
            "version": "v0.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/transparency-dev/merkle",
            "direct": false,
            "version": "v0.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xanzy/ssh-agent",
            "direct": false,
            "version": "v0.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/youmark/pkcs8",
            "direct": false,
            "version": "v0.0.0-20240726163527-a2c0da244d78",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/auto/sdk",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/metric",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/trace",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v3",
            "direct": false,
            "version": "v3.0.4",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.54.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/mod",
            "direct": false,
            "version": "v0.38.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.56.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/oauth2",
            "direct": false,
            "version": "v0.36.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sync",
            "direct": false,
            "version": "v0.22.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.47.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/term",
            "direct": false,
            "version": "v0.45.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.40.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/api",
            "direct": false,
            "version": "v0.0.0-20260526163538-3dc84a4a5aaa",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/rpc",
            "direct": false,
            "version": "v0.0.0-20260523011958-0a33c5d7ca68",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/grpc",
            "direct": false,
            "version": "v1.82.1",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/protobuf",
            "direct": false,
            "version": "v1.36.11",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/warnings.v0",
            "direct": false,
            "version": "v0.1.2",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": false,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "k8s.io/klog/v2",
            "direct": false,
            "version": "v2.140.0",
            "ecosystem": "go"
          },
          {
            "name": "oras.land/oras-go/v2",
            "direct": false,
            "version": "v2.6.2",
            "ecosystem": "go"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 125,
        "direct_count": 5,
        "indirect_count": 120
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 1,
        "merged_prs": 238,
        "open_issues": 10,
        "closed_ratio": 0.677,
        "closed_issues": 21,
        "closed_unmerged_prs": 23
      },
      "bus_factor": 2,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "eddie-knight",
          "commits": 95,
          "avatar_url": "https://avatars.githubusercontent.com/u/21176439?v=4"
        },
        {
          "type": "User",
          "login": "jmeridth",
          "commits": 68,
          "avatar_url": "https://avatars.githubusercontent.com/u/35014?v=4"
        },
        {
          "type": "User",
          "login": "lluuiissoo",
          "commits": 16,
          "avatar_url": "https://avatars.githubusercontent.com/u/13456333?v=4"
        },
        {
          "type": "User",
          "login": "zohayb23",
          "commits": 11,
          "avatar_url": "https://avatars.githubusercontent.com/u/97380019?v=4"
        },
        {
          "type": "User",
          "login": "grudra7714",
          "commits": 6,
          "avatar_url": "https://avatars.githubusercontent.com/u/12394597?v=4"
        },
        {
          "type": "User",
          "login": "Satarupa22-SD",
          "commits": 6,
          "avatar_url": "https://avatars.githubusercontent.com/u/84276219?v=4"
        },
        {
          "type": "User",
          "login": "pascalstockert",
          "commits": 4,
          "avatar_url": "https://avatars.githubusercontent.com/u/29748149?v=4"
        },
        {
          "type": "User",
          "login": "vinayada1",
          "commits": 4,
          "avatar_url": "https://avatars.githubusercontent.com/u/28875764?v=4"
        },
        {
          "type": "User",
          "login": "trumant",
          "commits": 3,
          "avatar_url": "https://avatars.githubusercontent.com/u/599706?v=4"
        },
        {
          "type": "User",
          "login": "speas038",
          "commits": 2,
          "avatar_url": "https://avatars.githubusercontent.com/u/3419863?v=4"
        }
      ],
      "contributors_sampled": 13,
      "top_contributor_share": 0.434
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "auto-labeler.yaml",
        "ci.yaml",
        "integration.yaml",
        "lint.yaml",
        "osps-security-assessment.yaml",
        "post-merge.yaml",
        "pr-title.yaml",
        "release.yaml",
        "security-insights.yaml",
        "sync-go-version.yaml"
      ],
      "has_docs_dir": false,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 4,
            "reason": "branch protection is not maximal on development and all release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 2,
            "reason": "badge detected: InProgress",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 8,
            "reason": "Found 8/10 approved changesets -- score normalized to 8",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 20 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 9,
            "reason": "dependency not pinned by hash detected -- score normalized to 9",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 8,
            "reason": "SAST tool is not run on all commits -- score normalized to 8",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 10,
            "reason": "GitHub workflow tokens follow principle of least privilege",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 9,
            "reason": "1 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "76500f5556acfac22f0009e8ca3bab1bae324ce4",
        "ran_at": "2026-08-01T03:04:52Z",
        "aggregate_score": 7.7,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-30T21:04:23Z",
      "oldest_open_prs": [
        {
          "number": 293,
          "created_at": "2026-07-28T05:33:15Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ],
      "last_merged_pr_at": "2026-07-27T17:13:07Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 2,
          "created_at": "2023-02-27T17:31:10Z",
          "last_comment_at": "2026-02-25T20:15:02Z",
          "last_comment_author": "jmeridth"
        },
        {
          "number": 67,
          "created_at": "2025-01-09T04:42:45Z",
          "last_comment_at": "2025-01-20T03:39:10Z",
          "last_comment_author": "jmeridth"
        },
        {
          "number": 103,
          "created_at": "2025-03-17T13:39:41Z",
          "last_comment_at": "2026-06-01T19:42:44Z",
          "last_comment_author": "Satarupa22-SD"
        },
        {
          "number": 118,
          "created_at": "2025-08-30T11:32:25Z",
          "last_comment_at": "2026-02-06T12:13:19Z",
          "last_comment_author": "eddie-knight"
        },
        {
          "number": 179,
          "created_at": "2026-02-15T07:29:11Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 243,
          "created_at": "2026-04-20T15:19:26Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 244,
          "created_at": "2026-04-20T15:21:33Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 267,
          "created_at": "2026-06-01T20:05:28Z",
          "last_comment_at": "2026-06-07T15:34:40Z",
          "last_comment_author": "jmeridth"
        },
        {
          "number": 271,
          "created_at": "2026-06-08T19:36:20Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 286,
          "created_at": "2026-07-12T00:58:05Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/privateerproj/privateer",
    "host": "github.com",
    "name": "privateer",
    "owner": "privateerproj"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "excellent",
      "name": "Overall health",
      "note": "The weighted overall 71 is calibrated to 84 on the published index scale (record calibration 2026-08-02).",
      "notes": [
        {
          "code": "overall_calibration",
          "params": {
            "raw": 71,
            "calibrated": 84,
            "calibration": "2026-08-02"
          }
        }
      ],
      "value": 84,
      "inputs": {
        "security": 82,
        "vitality": 90,
        "community": 56,
        "governance": 71,
        "calibration": "2026-08-02",
        "engineering": 57,
        "ai_readiness": 57,
        "weighted_overall_raw": 71
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "excellent",
        "name": "Vitality",
        "value": 90,
        "weight": 0.21,
        "metrics": [
          {
            "key": "development_activity",
            "band": "excellent",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "commits_last_year": 151,
              "human_commit_share": 0.53,
              "days_since_last_push": 4,
              "active_weeks_last_year": 37
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 4 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 4
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "37/52 weeks with commits",
                "points": 25.6,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 37
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "151 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 151
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "releases_count": 44,
              "latest_release_tag": "v0.22.0",
              "releases_from_tags": false,
              "days_since_latest_release": 11,
              "mean_days_between_releases": 12.3
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "44 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 44
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 11 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 11
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~12.3 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 12.3
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "exceptional",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "maintained",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 6,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "last human commit 6 days ago",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_maintained",
                    "params": {
                      "days": 6
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "moderate",
        "name": "Community & Adoption",
        "value": 56,
        "weight": 0.17,
        "metrics": [
          {
            "key": "popularity",
            "band": "at_risk",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 31,
            "inputs": {
              "forks": 9,
              "stars": 23,
              "watchers": 3,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "23 stars",
                "points": 21.8,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 23
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "9 forks",
                "points": 7.5,
                "status": "partial",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 9
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "3 watchers",
                "points": 1.7,
                "status": "partial",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "excellent",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "readme_badges": null,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "readme_badge_services": [],
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "good",
        "name": "Sustainability & Governance",
        "value": 71,
        "weight": 0.23,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "moderate",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 61,
            "inputs": {
              "bus_factor": 2,
              "contributors_sampled": 13,
              "top_contributor_share": 0.434
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "2 contributor(s) cover half of all commits",
                "points": 25.2,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 43% of commits",
                "points": 12.7,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 43
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "13 contributors",
                "points": 13.5,
                "status": "met",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 13
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 20 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "good",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Newcomer PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "newcomer_pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 78,
            "inputs": {
              "merged_prs": 238,
              "open_issues": 10,
              "closed_issues": 21,
              "prs_merged_7d": null,
              "prs_decided_7d": null,
              "prs_merged_30d": null,
              "prs_decided_30d": null,
              "issue_closed_ratio": 0.677,
              "closed_unmerged_prs": 23,
              "first_time_authors_30d": null,
              "first_time_prs_merged_30d": null,
              "first_time_prs_decided_30d": null
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "68% of issues closed",
                "points": 28.4,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 68
                    }
                  }
                ],
                "max_points": 42
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "238/261 decided PRs merged",
                "points": 27.4,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 238,
                      "decided": 261
                    }
                  }
                ],
                "max_points": 30
              },
              {
                "key": "newcomer_pr_acceptance",
                "name": "Newcomer PR acceptance",
                "detail": "no first-time contributor's PR decided in 30d",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_newcomer_prs",
                    "params": {
                      "days": 30
                    }
                  }
                ],
                "max_points": 13
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 8/10 approved changesets -- score normalized to 8",
                "points": 12,
                "status": "partial",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 51,
            "inputs": {
              "followers": 9,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "privateerproj",
              "public_repos": 7,
              "account_age_days": 1374
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "9 followers of privateerproj",
                "points": 7.2,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 9,
                      "login": "privateerproj"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "7 public repos, account ~3 yr old",
                "points": 14.1,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 7
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 3
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "exceptional",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/privateerproj/privateer"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 11
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 11 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 11
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "46 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 46
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 57,
        "weight": 0.19,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 68,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "10 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 10
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "weak",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "topics": [],
              "has_wiki": false,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": false,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "excellent",
        "name": "Security",
        "value": 82,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "good",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Packaging. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "packaging"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 77,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 17,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 1,
              "scorecard_aggregate": 7.7
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection is not maximal on development and all release branches",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "badge detected: InProgress",
                "points": 0.5,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 8/10 approved changesets -- score normalized to 8",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 20 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 9",
                "points": 4.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 8",
                "points": 4,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "GitHub workflow tokens follow principle of least privilege",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "1 existing vulnerabilities detected",
                "points": 6.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "exceptional",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 125 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories",
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 125
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 1,
              "affected_packages": 1,
              "assessed_packages": 125,
              "unassessed_packages": 0,
              "affected_by_severity": "unknown 1",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "exceptional",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 125,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "exceptional",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "commit_weight_rule": {
                "min_commits": 50,
                "min_commit_share": 0.1
              },
              "review_only_matches": 0,
              "below_threshold_exposures": [],
              "assessed_self_published_locations": 17
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 57,
        "weight": 0.04,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "weak",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "53 of 53 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 53,
                      "sampled": 53
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 71,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": true,
              "typed_language": false,
              "bootstrap_files": [
                "Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [],
              "agent_commit_share": 0.02,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0.47
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "2 of the last 100 commits agent-authored or agent-credited",
                "points": 4,
                "status": "partial",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 2,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "47 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 47,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 9",
                "points": 9,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "moderate",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 55,
            "inputs": {
              "primary_language": "Shell",
              "largest_source_bytes": 4427,
              "source_files_sampled": 12,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Shell without a type-check config",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_typecheck_config_language",
                    "params": {
                      "language": "Shell"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/12 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 12,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight: agent tooling is a real maintenance signal, but its absence must never gate the top of the scale (calibration saturates at raw 91, so 100/100 remains reachable with AI Readiness at zero)."
      }
    ],
    "classification": {
      "labels": [
        "library",
        "cli"
      ],
      "scores": {
        "cli": 4,
        "plugin": 2,
        "library": 6,
        "framework": 2
      },
      "primary": "library",
      "evidence": [
        {
          "tier": "distribution",
          "label": "library",
          "source": "registry:go",
          "weight": 6
        },
        {
          "tier": "dependencies",
          "label": "cli",
          "source": "dep:github.com/spf13/cobra",
          "weight": 4
        },
        {
          "tier": "description",
          "label": "framework",
          "source": "description:framework",
          "weight": 2
        },
        {
          "tier": "description",
          "label": "plugin",
          "source": "description:plugin",
          "weight": 2
        }
      ],
      "artifacts": [],
      "confidence": "medium",
      "host_extension": false,
      "runs_as_process": true,
      "consumed_by_code": true
    },
    "metrics_version": "2.3.1"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-08-01T03:05:21.696716Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/p/privateerproj/privateer.svg",
  "full_name": "privateerproj/privateer",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}