公开记录存在风险
软件健康报告模式 0.27.0 · 指标 1.13.0 · 2026-07-26 19:16 UTC
wdconinc / spack
A flexible package manager that supports multiple versions, configurations, platforms, and compilers.
wdconinc/spack 的健康指数为 100 分中的 49 分，处于「存在风险」区间。 其得分最高的类别是AI Readiness（70/100），最低的是Community & Adoption（12/100）。 最近一次更新在 27 天前。 近期的大部分工作由 10 位贡献者完成。
49
总分 / 100软件健康指数
指标归入加权类别，统一采用 1–100 量表。总体分先取类别加权平均；当公开证据触发高风险司法辖区政策时，评级会按政策调整，并设置 49（有风险）的上限。AI 就绪度不计入总体分。
49
优秀85-100堪称典范；基本满足所有检验标准
良好70-84健康；仅有轻微不足
中等50-69可接受，但存在明显不足；建议进行审查
存在风险30-49存在重大薄弱环节；采用时应保持审慎
危急1-29问题严重（项目被弃置、仅有单一维护者、缺乏基本工程规范）
评分画像
每条轴代表一个类别。形状比平均值更重要——健康的对象会填满整个图形，而“一峰一谷”式画像意味着某一维度的优势正掩盖另一维度的风险。
所有权
Wouter Deconinck个人账户
46 关注者226 个公开仓库始于 2013年6月University of Manitoba
该仓库由个人账户拥有。相较于组织支持的项目，单一所有者项目的延续性风险更高。
按类别列示的指标
活力
项目是否仍有生命——是否仍在编写代码，是否仍在发布版本？
59
开发活跃度
72良好
评分方式
| 28.8/36 | 推送新近度 — 最近一次推送于 27 天前 |
| 25.6/36 | 提交节奏 — 52 周中有 37 周有提交 |
| 18/18 | 提交量 — 最近一年 662 次提交 |
| 0/10 | OpenSSF Scorecard：Maintained — 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 |
所用输入
| commits_last_year | 662 |
| human_commit_share | 0.96 |
| days_since_last_push | 27 |
| active_weeks_last_year | 37 |
发布纪律
40存在风险
评分方式
| 16.2/27 | 有发布版本 — 21 个版本标签（无 GitHub 发布版本） |
| 0/36 | 发布时效 — 最近一次发布版本于 2,292 天前 |
| 19.8/27 | 发布节奏 — 约每 57.7 天发布一次 |
| 0/10 | OpenSSF Scorecard：Signed-Releases — 无数据 |
所用输入
| releases_count | 21 |
| latest_release_tag | v0.14.2 |
| releases_from_tags | 是 |
| days_since_latest_release | 2,292 |
| mean_days_between_releases | 57.7 |
已排除计分（无数据或不适用）：OpenSSF Scorecard：Signed-Releases。 其余权重已重新归一化。
社区与采用
项目是否拥有用户、下载量与关注度，并具备欢迎贡献者参与的配置？
12
流行度与采用
1危急
评分方式
| 0/60 | 星标 — 0 个星标 |
| 0/25 | 复刻 — 0 个复刻 |
| 0/15 | 关注者 — 0 位关注者 |
所用输入
| forks | 0 |
| stars | 0 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
社区健康
25危急
评分方式
| 0/22.5 | README |
| 22.5/22.5 | 许可证 — 可识别的许可证（Apache-2.0） |
| 0/18 | CONTRIBUTING 指南 |
| 0/13.5 | 行为准则 |
| 0/7.2 | 议题模板 |
| 0/6.3 | PR 模板 |
所用输入
| has_readme | 否 |
| has_license | 否 |
| has_contributing | 否 |
| has_issue_template | 否 |
| has_code_of_conduct | 否 |
| has_pull_request_template | 否 |
可持续性与治理
项目能否在其成员之外延续——巴士系数、响应能力、由谁支持，以及软件包的维护状况？
55
维护者韧性（巴士系数）
98优秀
评分方式
| 54/54 | 巴士系数 — 10 位贡献者贡献了半数提交 |
| 20.1/22.5 | 提交分布 — 头号贡献者编写了 11% 的提交 |
| 13.5/13.5 | 贡献者广度 — 99 位贡献者 |
| 10/10 | OpenSSF Scorecard：Contributors — project has 91 contributing companies or organizations |
所用输入
| bus_factor | 10 |
| contributors_sampled | 99 |
| top_contributor_share | 0.107 |
议题与 PR 响应能力
1危急
评分方式
| 0/46.8 | 议题解决 — 没有议题或无数据 |
| 0.4/38.3 | PR 接受 — 已裁定的 PR 中 1/87 已合并 |
| 0/15 | OpenSSF Scorecard：Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
所用输入
| merged_prs | 1 |
| open_issues | 0 |
| closed_issues | 0 |
| issue_closed_ratio | — |
| closed_unmerged_prs | 86 |
已排除计分（无数据或不适用）：议题解决。 其余权重已重新归一化。
所有权与托管责任
59中等
评分方式
| 10/30 | 所有权背书 — 个人（用户）账户 |
| 0/20 | 已验证域名 — 不适用于个人账户 |
| 12/25 | 所有者影响力 — wdconinc 有 46 位关注者 |
| 25/25 | 既往记录 — 226 个公开仓库，账户约 13 年 |
所用输入
| followers | 46 |
| owner_type | User |
| is_verified | — |
| owner_login | wdconinc |
| public_repos | 226 |
| account_age_days | 4,794 |
已排除计分（无数据或不适用）：已验证域名。 其余权重已重新归一化。
工程质量
基础的工程与文档实践是否到位？
58
工程实践
80良好
评分方式
| 24/24 | CI 工作流 — 9 个工作流 |
| 24/24 | 存在测试 |
| 16/16 | Linter 配置 — .flake8 |
| 0/9.6 | Pre-commit 钩子 |
| 0/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard：CI-Tests — 无数据 |
所用输入
| has_ci | 是 |
| has_tests | 是 |
| has_editorconfig | 否 |
| has_linter_config | 是 |
| has_precommit_config | 否 |
已排除计分（无数据或不适用）：OpenSSF Scorecard：CI-Tests。 其余权重已重新归一化。
文档
25危急
评分方式
| 0/30 | README |
| 0/25 | 文档目录 |
| 15/15 | 文档 / 主页站点 — https://spack.io |
| 0/10 | 仓库描述 |
| 0/10 | 主题标签 |
| 10/10 | Wiki |
所用输入
| topics | — |
| has_wiki | 是 |
| homepage | https://spack.io |
| has_readme | 否 |
| has_docs_dir | 否 |
| has_description | 否 |
安全
可见的安全与供应链实践是否稳固，且不存在未解决的高风险司法辖区暴露？
58
安全态势
48存在风险
评分方式
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 0/2.5 | CI-Tests — 无数据 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
| 2.5/2.5 | Contributors — project has 91 contributing companies or organizations |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 7.5/7.5 | Dependency-Update-Tool — update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | 许可证 — license file detected |
| 0/7.5 | Maintained — 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 |
| 0/5 | Packaging — 无数据 |
| 0/5 | Pinned-Dependencies — 无数据 |
| 0/5 | SAST — no SAST tool detected |
| 5/5 | Security-Policy — security policy file detected |
| 0/7.5 | Signed-Releases — 无数据 |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 6/7.5 | Vulnerabilities — 2 existing vulnerabilities detected |
所用输入
| source | openssf_scorecard |
| checks_evaluated | 14 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 4 |
| scorecard_aggregate | 4.8 |
已排除计分（无数据或不适用）：ci_tests, packaging, pinned_dependencies, signed_releases。 其余权重已重新归一化。
依赖安全公告
100优秀
评分方式
| 35/35 | 直接依赖不含已知公告 — 没有直接依赖携带已知公告 |
| 0/25 | 间接依赖不含已知公告 — 在此范围内，传递依赖集合无法与开发和测试依赖区分 |
| 0/40 | 没有长期未处理的公告 — 没有公告带有发布日期 |
所用输入
| source | osv |
| advisories | 3 |
| affected_packages | 1 |
| assessed_packages | 20 |
| unassessed_packages | 1 |
| affected_by_severity | critical 1 |
| direct_affected_packages | 0 |
已排除计分（无数据或不适用）：间接依赖不含已知公告, 没有长期未处理的公告。 其余权重已重新归一化。 已将 20 个已解析依赖与 OSV 比对。 有 1 项无法评估——没有已解析的版本、生态系统不受支持，或超出所报告的软件包清单。 该仓库未发布任何索引可解析的软件包，因此改为评估仓库依赖图。该图将开发与测试版本固定同交付的依赖混在一起，因此仅对声明的运行时依赖计分；传递性发现仅作为背景信息列出，不计入评分。 未对可达性进行分析。
AI 就绪度
该仓库在多大程度上具备与 AI 编码代理协同开发与维护的条件？这是一枚独立的实验性徽章——权重为 0.0，因此单独呈现，不影响总体健康评分。
70
AI 代理上下文与指引
40存在风险
评分方式
| 0/45 | 代理指令 — 没有 CLAUDE.md / AGENTS.md / 编辑器规则 |
| 0/15 | 机器可读文档（llms.txt） |
| 40/40 | 可读的提交历史 — 96 次人类提交中有 94 次说明了意图（结构化标题或解释性正文） |
所用输入
| has_llms_txt | 否 |
| legible_history_share | 0.979 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
评分方式
| 18/18 | 一条命令的引导启动 — lib/spack/docs/Makefile, lib/spack/spack/test/data/make/affirmative/capital_makefile/Makefile, lib/spack/spack/test/data/make/affirmative/check_test/Makefile, lib/spack/spack/test/data/make/affirmative/expansion/Makefile, lib/spack/spack/test/data/make/affirmative/gnu_makefile/GNUmakefile, lib/spack/spack/test/data/make/affirmative/include/Makefile, lib/spack/spack/test/data/make/affirmative/lowercase_makefile/makefile, lib/spack/spack/test/data/make/affirmative/prerequisites/Makefile, lib/spack/spack/test/data/make/affirmative/spaces/Makefile, lib/spack/spack/test/data/make/affirmative/test_check/Makefile, lib/spack/spack/test/data/make/affirmative/three_targets/Makefile, lib/spack/spack/test/data/make/negative/partial_match/Makefile, lib/spack/spack/test/data/make/negative/variable/Makefile, share/spack/templates/depfile/Makefile |
| 22/22 | 自动化测试 |
| 11/11 | Lint / 格式化配置 — .flake8 |
| 11/11 | 静态类型检查 — lib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed |
| 10/10 | 可复现环境 — devcontainer, Dockerfile |
| 0/10 | 已体现的代理实践 — 最近 100 次提交中没有代理编写的提交 |
| 8/8 | 自动化维护 — 最近 100 次提交中有 4 次为自动依赖更新 |
| 0/10 | OpenSSF Scorecard：Pinned-Dependencies — 无数据 |
所用输入
| has_nix | 否 |
| has_tests | 是 |
| lockfiles | — |
| has_dockerfile | 是 |
| typed_language | 否 |
| bootstrap_files | lib/spack/docs/Makefile, lib/spack/spack/test/data/make/affirmative/capital_makefile/Makefile, lib/spack/spack/test/data/make/affirmative/check_test/Makefile, lib/spack/spack/test/data/make/affirmative/expansion/Makefile, lib/spack/spack/test/data/make/affirmative/gnu_makefile/GNUmakefile, lib/spack/spack/test/data/make/affirmative/include/Makefile, lib/spack/spack/test/data/make/affirmative/lowercase_makefile/makefile, lib/spack/spack/test/data/make/affirmative/prerequisites/Makefile, lib/spack/spack/test/data/make/affirmative/spaces/Makefile, lib/spack/spack/test/data/make/affirmative/test_check/Makefile, lib/spack/spack/test/data/make/affirmative/three_targets/Makefile, lib/spack/spack/test/data/make/negative/partial_match/Makefile, lib/spack/spack/test/data/make/negative/variable/Makefile, share/spack/templates/depfile/Makefile |
| has_devcontainer | 是 |
| has_linter_config | 是 |
| typecheck_configs | lib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed |
| agent_commit_share | 0 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0.04 |
已排除计分（无数据或不适用）：OpenSSF Scorecard：Pinned-Dependencies。 其余权重已重新归一化。
面向模型的代码可读性
81良好
评分方式
| 27/45 | 可类型检查的代码 — Python，已配置类型检查（lib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed） |
| 53.9/55 | 可控的文件大小 — 采样的 1,009 个源文件中有 21 个超过 60KB |
所用输入
| primary_language | Python |
| largest_source_bytes | 231,926 |
| source_files_sampled | 1,009 |
| oversized_source_files | 21 |
关键数据
0GitHub 星标
99贡献者
662最近 12 个月提交数
27距最近推送天数
21发布版本数
10巴士系数（bus factor）
0开放议题
PyPI软件包生态系统数
数据采集警告
- Community profile unavailable
- Could not fetch pypi package 'spack' from its registry
更多细节
OpenSSF Scorecard 4.8 / 10
4.8综合
来自开源项目 OpenSSF Scorecard 的独立、工具无关的安全评估。每项检查奖励的是安全实践本身，而非特定供应商的工具。Scorecard 无法判定的检查项标记为 不适用，并从安全评分中剔除（绝不按零分计）。
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| 不适用 | CI-Tests | no pull request found |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/30 approved changesets -- score normalized to 0 |
| 10 | Contributors | project has 91 contributing companies or organizations |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 10 | Dependency-Update-Tool | update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 0 | Maintained | 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 |
| 不适用 | Packaging | packaging workflow not detected |
| 不适用 | Pinned-Dependencies | internal error: internal error: invalid Dockerfile |
| 0 | SAST | no SAST tool detected |
| 10 | Security-Policy | security policy file detected |
| 不适用 | Signed-Releases | no releases found |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 8 | Vulnerabilities | 2 existing vulnerabilities detected |
直接依赖 1
| 注册表 | 软件包 | 版本约束 | 清单文件 |
|---|---|---|---|
| PyPI | clingo | — | pyproject.toml |
全部依赖 21
来自 GitHub 依赖图的完整解析依赖集合：2 个直接依赖与 19 个间接（传递）软件包。仓库提交锁文件时，传递闭包才是完整的。
| 注册表 | 软件包 | 版本 | 关系 |
|---|---|---|---|
| PyPI | clingo | — | 直接 |
| PyPI | clingo | 5.8.0 | 直接 |
| PyPI | black | 25.12.0 | 间接 |
| PyPI | coverage | 7.11.0 | 间接 |
| PyPI | docutils | 0.22.4 | 间接 |
| PyPI | flake8 | 7.3.0 | 间接 |
| PyPI | furo | 2025.12.19 | 间接 |
| PyPI | isort | 7.0.0 | 间接 |
| PyPI | mypy | 1.20.0 | 间接 |
| PyPI | pygments | 2.20.0 | 间接 |
| PyPI | pylint | 4.0.5 | 间接 |
| PyPI | ruamel-yaml | 0.19.1 | 间接 |
| PyPI | slotscheck | 0.19.1 | 间接 |
| PyPI | sphinx | 9.1.0 | 间接 |
| PyPI | sphinx-copybutton | 0.5.2 | 间接 |
| PyPI | sphinx-last-updated-by-git | 0.3.8 | 间接 |
| PyPI | sphinx-sitemap | 2.9.0 | 间接 |
| PyPI | sphinxcontrib-programoutput | 0.18 | 间接 |
| PyPI | sphinxcontrib-svg2pdfconverter | 2.1.0 | 间接 |
| PyPI | types-six | 1.17.0.20251009 | 间接 |
| PyPI | vermin | 1.8.0 | 间接 |
依赖安全公告 1
该仓库未发布可被索引解析的包，因此评估的是其自身的依赖图——共 20 个包，其中也包含从不交付的开发与测试版本固定：1 个存在已知公告，0 个为直接依赖。 有 1 个无法评估——没有已解析的版本、生态系统不受支持，或不在所列包清单之内。
| 软件包 | 版本 | 关系 | 严重程度 | 公告数 | 修复版本 |
|---|---|---|---|---|---|
| black | 25.12.0 | 间接 | 严重 | 3 | 26.3.1 |
公告表示依赖图中记录的版本落入某条公告的受影响范围。可达性未经分析，且依赖图包含开发与测试的版本固定——某项发现可能只涉及工具链而非交付的软件。
原始 JSON 报告 机器可读
{
"data": {
"repo": {
"topics": [],
"is_fork": true,
"size_kb": 224386,
"has_wiki": true,
"homepage": "https://spack.io",
"languages": {
"C": 38431,
"Lua": 3080,
"Tcl": 2427,
"HTML": 2418,
"CMake": 4652,
"Shell": 523231,
"Python": 7952523,
"Lambdapi": 120493,
"Makefile": 9844,
"Batchfile": 12052,
"Dockerfile": 11727,
"PowerShell": 7940,
"Standard ML": 22142,
"Answer Set Programming": 14133
},
"pushed_at": "2026-06-29T18:28:52Z",
"created_at": "2020-06-18T19:12:42Z",
"owner_type": "User",
"updated_at": "2026-04-05T17:24:00Z",
"description": "A flexible package manager that supports multiple versions, configurations, platforms, and compilers.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "develop",
"license_spdx_raw": "Apache-2.0",
"primary_language": "Python",
"significant_languages": [
"Python"
]
},
"owner": {
"blog": null,
"name": "Wouter Deconinck",
"type": "User",
"login": "wdconinc",
"company": "University of Manitoba",
"location": "Winnipeg, MB, Canada",
"followers": 46,
"avatar_url": "https://avatars.githubusercontent.com/u/4656391?v=4",
"created_at": "2013-06-09T21:42:01Z",
"is_verified": null,
"public_repos": 226,
"account_age_days": 4794
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": false
},
"activity": {
"releases": [
{
"tag": "v0.14.2",
"kind": "patch",
"published_at": "2020-04-15T21:32:01Z"
},
{
"tag": "v0.14.1",
"kind": "patch",
"published_at": "2020-03-20T19:29:44Z"
},
{
"tag": "v0.14.0",
"kind": "minor",
"published_at": "2020-02-24T01:08:15Z"
},
{
"tag": "v0.13.4",
"kind": "patch",
"published_at": "2020-02-07T22:52:07Z"
},
{
"tag": "v0.13.3",
"kind": "patch",
"published_at": "2019-12-24T07:48:11Z"
},
{
"tag": "v0.13.2",
"kind": "patch",
"published_at": "2019-12-05T06:02:41Z"
},
{
"tag": "v0.13.1",
"kind": "patch",
"published_at": "2019-11-05T09:49:17Z"
},
{
"tag": "v0.13.0",
"kind": "minor",
"published_at": "2019-10-26T06:19:36Z"
},
{
"tag": "v0.12.1",
"kind": "patch",
"published_at": "2019-01-13T22:29:07Z"
},
{
"tag": "v0.12.0",
"kind": "minor",
"published_at": "2018-11-13T17:05:17Z"
},
{
"tag": "v0.11.2",
"kind": "patch",
"published_at": "2018-02-07T16:45:29Z"
},
{
"tag": "v0.11.1",
"kind": "patch",
"published_at": "2018-01-19T21:28:26Z"
},
{
"tag": "v0.11.0",
"kind": "minor",
"published_at": "2018-01-17T22:14:45Z"
},
{
"tag": "v0.10.0",
"kind": "minor",
"published_at": "2017-01-17T09:36:03Z"
},
{
"tag": "v0.9.1",
"kind": "patch",
"published_at": "2016-05-18T15:30:13Z"
},
{
"tag": "v0.8.17",
"kind": "patch",
"published_at": "2015-03-24T17:17:18Z"
},
{
"tag": "v0.8.16",
"kind": "patch",
"published_at": "2015-03-14T03:41:59Z"
},
{
"tag": "v0.8.15",
"kind": "patch",
"published_at": "2015-02-24T18:42:58Z"
},
{
"tag": "v0.8.11",
"kind": "patch",
"published_at": "2014-11-06T21:22:15Z"
},
{
"tag": "v0.8.10",
"kind": "patch",
"published_at": "2014-10-28T06:04:47Z"
},
{
"tag": "v0.8.5",
"kind": "patch",
"published_at": "2014-09-19T16:56:00Z"
}
],
"recent_commits": [
{
"oid": "188f78ac7a902faa98b875809537f9e31fe0b179",
"body": null,
"is_bot": false,
"headline": "Merge branch 'spack:develop' into develop",
"author_name": "Wouter Deconinck",
"author_login": "wdconinc",
"committed_at": "2026-04-05T17:22:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "af1edd44f13ed3fb53c7f647c7e25280f8bc817e",
"body": "In build subprocesses, create a new process group instead of a new session.\nThe benefit is that tools like pstree neatly show the spack install process\nwith all its concurrent builds as a tree, making it easier to verify whether\nthe jobserver is working correctly: -j N <--> N leaf nodes.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: new process group instead of session (#52192)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-04-02T11:12:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "41351d3df9634b3f96d37682310510e55a6d995b",
"body": "Bumps [mypy](https://github.com/python/mypy) from 1.19.1 to 1.20.0.\n- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/python/mypy/compare/v1.19.1...v1.20.0)\n\n---\nupdated-dependencies:\n- dependency-name: mypy\n dependency-version: 1.20.0\n dependenc\n[…]\nirect:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "build(deps): bump mypy in /.github/workflows/requirements/style (#52178)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-01T12:10:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "61627c0ceba84e6b7c1689047de1723b9f0143ed",
"body": "Signed-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "main.py: cache spack commit (#52185)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-04-01T11:50:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "10f6348e9385f448729cf61d21bece8b32d9e4f3",
"body": "With recent changes there is no need anymore to communicate the package\nto mtime dictionary to build subprocesses. Remove this to reduce\nsubprocess startup latency by ~15ms per process.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: remove pkg->mtime dict ipc (#52183)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-04-01T11:48:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e1d7af8f259bc7e1440d761335f49d3d083562e8",
"body": "The logic to exclude packages tagged \"runtime\" from views triggers cache\nvalidation, resulting in 8k stat calls.\n\nAvoid this by querying the package classes.\n\nThis is needed to make `spack install` not trigger many stat calls on\npackage.py files for a concrete environment.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "environment.py: use tag from pkg for view regen (#52182)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-04-01T11:40:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ed06dcee94d912a9713815b1371740e45bf19fd2",
"body": "Signed-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "tags.py: fix integration test (#52184)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-04-01T09:43:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3451e95a445ea3a5a7ca5396184c8c1f0587bd26",
"body": "The goal is to avoid consulting the virtual provider lookup during `Spec.satisfies`, in particular in the common case of concrete lhs.\n\nThis is accomplished as follows:\n\n1. The left-hand side provides edge attributes to which the right-hand side nodes can be matched.\n2. If the right hand side is a k\n[…]\n on `fortran`.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>\nCo-authored-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
"is_bot": false,
"headline": "spec.py: avoid cache validation in satisfies (#52176)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-04-01T08:19:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fd7e3d64498650448a497c2fcf1760c69986641c",
"body": "This commit avoids hitting the 8k stat call penalty when looking up\npatch files in most cases.\n\nPreviously the strategy was:\n\n* check cache validity (8k stat calls)\n* lookup the patch by shasum in cache\n\nWith this commit we add an initial \"optimistic\" lookup in possibly stale\ncache. It's expected th\n[…]\n with the installer in the forkserver and spawn during staging\nof patches, which can now be done without validating freshness of the\npatch index.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "repo: improve patch lookup speed (#52157)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-04-01T08:15:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b1f8182ceec046a32bb21e3f38a7f262a062e82f",
"body": null,
"is_bot": false,
"headline": "docs: minor modification on the example (#52180)",
"author_name": "Massimiliano Culpo",
"author_login": "alalazo",
"committed_at": "2026-04-01T06:40:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "abd879b45ae0d2f1bf08b9009b244d881c4adbe4",
"body": "Argparse color adds of color control characters in Python >= 3.14,\nwhich breaks \"spack commands --update-completion\". Add logic to\ncheck whether output is a terminal and turn off color when it is not.\n\n---------\n\nSigned-off-by: John Parent <john.parent@kitware.com>",
"is_bot": false,
"headline": "Update Completion: turn off argparse color for 3.14 and newer (#52174)",
"author_name": "John W. Parent",
"author_login": "johnwparent",
"committed_at": "2026-04-01T00:56:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "91849fe2c9a98519e48241f16785b415d461f449",
"body": "Signed-off-by: Gregory Becker <becker33@llnl.gov>",
"is_bot": false,
"headline": "ci: print spec in each rebuild job (#49021)",
"author_name": "Greg Becker",
"author_login": "becker33",
"committed_at": "2026-03-31T20:24:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a1dbb85ab9167c533c0c624ed374204aaf6b3f9c",
"body": "Signed-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: docs (#52164)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-31T19:16:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c974ccb46fd0460253e10b7c5b56fd0cd11b0dbd",
"body": "`\\033[<n>A` (Cursor Up) and `\\033[<n>B` (Cursor Down) have been part of\nthe original VT100 spec since 1978, so every terminal emulator should\nsupport them, including JuiceSSH.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: fix cursor movement compatibility (#52173)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-30T21:13:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e2e28b8a8b661073f45e459f7e08f5fbe0937a43",
"body": null,
"is_bot": true,
"headline": "docs: pygments v2.20.0 (#52171)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-30T20:06:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "60bdc99558ec7d91d0407f311a5df2f9fdc0f007",
"body": "* new_installer.py: print full line on finish\n\nIf a build finishes, we can print the full status line instead of\ntruncating it so it fits the terminal width.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>\n\n* new_installer.py: duration\n\nPrint\n\n```\n[+] gzo2zcw pkgconf@2.5.1 /tmp/x/darwin-m4/pk\n[…]\n@8.18.0 /tmp/x/darwin-m4/curl-8.18.0-lkzwnfgfvjff6ve6lpfc2w6laff42zjm (49s)\n```\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>\n\n---------\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: elapsed time (#52163)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-30T18:54:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "87dd2ba313d1d85238749068ee2b321719c9b90f",
"body": "Signed-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "conf.py: do not document re-export of spack.package classes (#52169)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-30T18:28:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6901e4add84e926b0f37eaff77ef3e3e55a101fd",
"body": "* new_installer.py: Ctrl+Z, bg, and fg\n\nWhen the user presses Ctrl+Z, the parent process was stopped by SIGTSTP\nbut its build subprocesses kept running, consuming CPU and filling log\npipes until they blocked on write.\n\nFix this by broadcasting SIGSTOP to every child process group just before\nthe par\n[…]\n<me@harmenstoppels.nl>\n\n* fix for zsh: output stdout = suspend, so do not print\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>\n\n---------\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: suspend, background, foreground (#52101)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-30T15:23:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2e0cf4de3459216053b41620606d8e689f24cc4a",
"body": "…#52022)\n\n* Document version range practice\n\nSigned-off-by: Seth R Johnson <johnsonsr@ornl.gov>\n\n* Tweak verbiage and examples\n\nSigned-off-by: Seth R Johnson <johnsonsr@ornl.gov>\n\n* Fix typo\n\nSigned-off-by: Seth R Johnson <johnsonsr@ornl.gov>\n\n* Incorporate feedback\n\nSigned-off-by: Seth R Johnson <johnsonsr@ornl.gov>\n\n* Incorporate comments\n\nSigned-off-by: Seth R Johnson <johnsonsr@ornl.gov>\n\n---------\n\nSigned-off-by: Seth R Johnson <johnsonsr@ornl.gov>",
"is_bot": false,
"headline": "Document correct practices for specifying dependency version ranges (…",
"author_name": "Seth R. Johnson",
"author_login": "sethrj",
"committed_at": "2026-03-30T14:37:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a5b4056c9019d27d7d38885d37f3be4446b48dd8",
"body": "Signed-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "languages: add hip-lang, cuda-lang (#52145)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-27T09:27:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bf1637a793b507a76bdc06e1169a373c83a5e535",
"body": "…l) path or tempdir (from #50207) (#51896)\n\n* remote include path: cache under enclosing scope\n\nCache remote include paths under the enclosing scope's path. If it\nhas no path, the file will be cached in tmpdir\n\n* Update include yaml docs\n\n* cleanup and add unit tests for include's destination directory\n\n* config: add extra subdirectory to support multiple remote includes\n\nsubdir naming order: name, git repo name, or hash\n\n---------\n\nSigned-off-by: tldahlgren <dahlgren1@llnl.gov>",
"is_bot": false,
"headline": "remote include path: cache under enclosing scope ({spack|include}.yam…",
"author_name": "Tamara Dahlgren",
"author_login": "tldahlgren",
"committed_at": "2026-03-26T21:08:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "625e9f5dc210d6cc2ea453fc082b88fd140ae4b7",
"body": "Signed-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: support --until (#52123)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-26T17:33:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0517e97284dff7ddf604cd3715c4e5c8cd50f954",
"body": "Use the new installer by default on Linux and Darwin.\n\nDispatch to old installer when using unsupported features (splicing, --until).\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "config.yaml: default to `installer: new` (#52149)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-26T14:18:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "86fccfaa243b0d6f514ff265549715e24767f2ce",
"body": "…yle (#52068)\" (#52147)\n\nThis reverts commit 0875e9be639bc4c8cfafeb74bfe6d7e678d1bbef.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "Revert \"build(deps): bump black in /.github/workflows/requirements/st…",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-26T12:57:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0875e9be639bc4c8cfafeb74bfe6d7e678d1bbef",
"body": "…068)\n\nBumps [black](https://github.com/psf/black) from 25.12.0 to 26.3.1.\n- [Release notes](https://github.com/psf/black/releases)\n- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)\n- [Commits](https://github.com/psf/black/compare/25.12.0...26.3.1)\n\n---\nupdated-dependencies:\n- depende\n[…]\nndency-version: 26.3.1\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "build(deps): bump black in /.github/workflows/requirements/style (#52…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-26T06:08:20Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1b010c58b6ebf7f43972f34d7feae68671c942c6",
"body": "Placeholder (or stub) packages for externals do not have a url or vcs to fetch from. They should not error out for `spack mirror -a`\n\n* Skip placeholder packages\n\nSigned-off-by: Angelica Loshak <loshak@lanl.gov>\n\n* unit tests skipping placeholder pkgs\n\nSigned-off-by: Angelica Loshak <loshak@lanl.gov>\n\n* Placeholder mock pkg\n\nSigned-off-by: Angelica Loshak <loshak@lanl.gov>\n\n---------\n\nSigned-off-by: Angelica Loshak <loshak@lanl.gov>",
"is_bot": false,
"headline": "Mirror all skip placeholder packages (#51991)",
"author_name": "Angelica",
"author_login": "alstar555",
"committed_at": "2026-03-26T01:29:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "30883e60a31e41f5783d832fac79045b0d8bc22c",
"body": "…#52140)\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
"is_bot": false,
"headline": "solver: switch version_constraints from set of tuples to dictionary (…",
"author_name": "Massimiliano Culpo",
"author_login": "alalazo",
"committed_at": "2026-03-25T11:11:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "33d863b55e0572c0934d8e1661fd432c68464820",
"body": "…(#52120)\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer: mark explicit if already installed but implicit in db …",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-25T10:37:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9ff2ef8e76a31ac2c78c5987dc2b2c02e64c5ae4",
"body": "Importing pdb is problematic cause it pulls in readline, which makes\nit impossible to run `spack install &` in the background on macOS, as\nit queries stdin and gets immediately suspended as a result.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "debug.py: avoid pdb import, simplify (#52139)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-25T08:40:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "84721f049ecc24f3c029d05dcfad65624874fee2",
"body": "Signed-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
"is_bot": false,
"headline": "solver: remove unused `asp` attribute from `Result` (#52136)",
"author_name": "Massimiliano Culpo",
"author_login": "alalazo",
"committed_at": "2026-03-24T17:06:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f66589c1e844e919ee12d2d085f3131c39b4cfdc",
"body": "* In the forkserver case, preload a few modules needed in the installer\n* Avoid the 8k stat calls in all build processes\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "installer: improve spawn/forkserver (#52127)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-23T16:14:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "618dd722b496be0bdec12016f44c5509681aa7d5",
"body": "…ake 2) (#52109)\n\nBefore this commit there were cases where a default compiler was not selected \nbecause it had penalty on variants. Instead, the second-best provider was selected.\n\nHere we tweak priorities to ensure that the compiler choice is above variant penalty.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
"is_bot": false,
"headline": "solver: prefer best compiler above one with no penalty on variants (t…",
"author_name": "Massimiliano Culpo",
"author_login": "alalazo",
"committed_at": "2026-03-23T16:10:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3b6064d31bf343f5a9d790c05d1a440e85712949",
"body": "The previous implementation of SIGTERM was somewhat brittle. The\nassumption was that if we're stuck in `Executable(\"make\")(...)` and\nreceive SIGTERM, we can just forward the signal and then return to\nwaiting for `make` to exit with nonzero exite code, which would trigger\nan exception and ultimately \n[…]\nicit\n`waitpid` until all children have exited, and then raise\n`KeyboardInterrupt`. This ensures we hit an exception in all cases\nmentioned above.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: improve SIGTERM handler of build (#52102)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-23T15:17:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0714f2f90645d167742f6401e534b06c3f559ae0",
"body": "Add `Lock.try_acquire_write()` and `Lock.try_acquire_read()` to simplify\nthe code in the new installer which only uses non-blocking lock calls in\nthe event loop.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "lock.py: add non-blocking api (#52126)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-23T10:39:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cd9f9d3d396f9413467afe48630e748f511557f4",
"body": "Makes the number of build jobs (-j) dynamic with `+` and `-` keyboard input,\r\nprovided that we are the owner of the jobserver.\r\n\r\n* On `+`: write a byte to `jobserver.w`\r\n* On `-`: eventually read a byte from `jobserver.r`\r\n\r\nSo, `+` applies immediately, while `-` happens at some point in the event \n[…]\n build finishes: do not write back the Spack-acquired token\r\n2. The `jobserver.r` becomes readable: read at most `num_jobs - target_jobs` bytes.\r\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: dynamic --jobs (#51997)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-22T19:09:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b742ce993763d5dc68b26a04d55217b9c2178983",
"body": null,
"is_bot": false,
"headline": "new_installer.py: support --source (#52122)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-22T19:05:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c11fda331bf0e42c07f9fe94c09a3ebe3ce4224a",
"body": "Claude, Gemini, and Codex all leave a hidden top-level directory in the project\nfor their own saved state. Ignore these for now.\n\nIf there are helpful things in here that make sense to check in, we can modify\nthis to allow them. For now, just prevent people from inadvertently checking\nthese directories in.\n\nSigned-off-by: Todd Gamblin <tgamblin@llnl.gov>",
"is_bot": false,
"headline": "`.gitignore`: ignore coding agents state directories (#52125)",
"author_name": "Todd Gamblin",
"author_login": "tgamblin",
"committed_at": "2026-03-21T19:39:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "041eeb25c3e7e5860db18dadd3a7bd854a2bd7c9",
"body": "* The use of TextIO in Executable.__call__ was a bug, only BinaryIO was allowed.\n\n* input= doesn't support str or str.split values.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "executable.py: refactor to improve static type analysis (#52111)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-20T18:24:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7a17cfcb7affbff3dd84620ee57ead9a0510ff16",
"body": "Comparing JSON specs in tests is not useful unless `pytest` can show us a diff.\n\n- [x] Introduce a `pretty=True` option to Spack JSON dumps that prints\n with newlines and indentation.\n- [x] Modify tests to show a detailed diff using the new json output.\n\nSigned-off-by: Todd Gamblin <tgamblin@llnl.gov>",
"is_bot": false,
"headline": "`spack_json`: add `pretty` option to `to_json()` (#52118)",
"author_name": "Todd Gamblin",
"author_login": "tgamblin",
"committed_at": "2026-03-20T17:01:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "436c22ba75c2b323f54ea82fedbb715d2c597e23",
"body": "`NodeArgument` is used as an argument when reconstructing specs,\nbut I think it's clearer to call it a `NodeId`, since its real\nfunction is to disambiguate \"dupes\", which is what we call different\nconfigurations of the same package.\n\n- [x] Rename `NodeArgument` to `NodeId` in `core.py` and `asp.py`\n- [x] Call `NodeID` `ID` in `concretize.lp` for consistency with `asp.py`\n\nSigned-off-by: Todd Gamblin <tgamblin@llnl.gov>",
"is_bot": false,
"headline": "solver: rename `NodeArgument` to `NodeId`. (#52116)",
"author_name": "Todd Gamblin",
"author_login": "tgamblin",
"committed_at": "2026-03-20T15:46:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "edfe62a371e837f6a619be30725f92c42d97592e",
"body": "* Use single retry-on-transient-error mechanism throughout.\n* Add exponential back-off also to `url_exists` in case of transient errors\n* Widen retry mechanism exception `OSError -> Exception`, because botocore/urllib3 exceptions do not subtype `OSError` but `Exception` directly",
"is_bot": false,
"headline": "urlopen: improved retry on transient error (#52088)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-20T15:42:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e88dce167277519bd696fd74b48a5929e5cc8ef5",
"body": "Variant and dependency propagation shouldn't be used in package.py files. This PR adds checks to catch such uses and block them in CI.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
"is_bot": false,
"headline": "audit: catch propagation in directives (#52113)",
"author_name": "Massimiliano Culpo",
"author_login": "alalazo",
"committed_at": "2026-03-20T13:57:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8153569addca9e562adf2bb45069b391148aa59c",
"body": "Signed-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
"is_bot": false,
"headline": "Add Changelog to Package API section (#52110)",
"author_name": "Massimiliano Culpo",
"author_login": "alalazo",
"committed_at": "2026-03-20T09:16:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7b378635fa834135e58fec1c313e712945ea212b",
"body": "…iants (#…\" (#52108)\n\nThis reverts commit 1dd8c8167ae7af42b4400dc5220358cba8f9f392.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "Revert \"solver: prefer best provider above one with no penalty on var…",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-19T21:17:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f1cb12f2f1dfe3917676eb6b045f1bd3f28610b8",
"body": "Signed-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
"is_bot": false,
"headline": "requirements.py: fix toolchain expansion for preferences (#52106)",
"author_name": "Massimiliano Culpo",
"author_login": "alalazo",
"committed_at": "2026-03-19T20:52:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1dd8c8167ae7af42b4400dc5220358cba8f9f392",
"body": "…52070)\n\nBefore this commit there were cases where a default compiler was not selected \nbecause it had penalty on variants. Instead, the second-best provider was selected.\n\nHere we tweak priorities to ensure that the compiler choice is above variant penalty.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
"is_bot": false,
"headline": "solver: prefer best provider above one with no penalty on variants (#…",
"author_name": "Massimiliano Culpo",
"author_login": "alalazo",
"committed_at": "2026-03-19T18:36:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3cae9d190144795686a1ad5e418c7516f67b39ed",
"body": "When the same spec (e.g. gcc@8.4.0) is discovered at\ntwo different prefixes, only the first entry is kept.\n\nA warning is printed to users for any successive\nduplicate found in other prefixes.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
"is_bot": false,
"headline": "detection: deduplicate specs at different prefixes (#52100)",
"author_name": "Massimiliano Culpo",
"author_login": "alalazo",
"committed_at": "2026-03-19T18:34:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c052a3265717dca0e8c68be0d1be73d9422af9f2",
"body": "* test/cmd/install.py: enable new installer more\n\n* fix case of forking under pytest\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "test/cmd/install.py: enable new installer more (#52097)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-19T15:53:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e958367e3f7c0a6424234bfcd4daaf1f13c94ded",
"body": "Very minor: on ^C the status line \"Progress: ...\" is sometimes cleared\nand sometimes not, depending on what moment ^C was pressed.\n\nIf right after a spinner tick it would be removed, else it would not\nbecause then the UI was not \"dirty\".\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: clear progress line on ^C (#52103)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-19T15:50:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "248e95e798f453a69a2e2af2ac6e9c9a2f88c042",
"body": "Our full clone test is failing to pull specific commits on ubuntu containers.\nThis is because the git version on the container supports `--filter=blob:none` \nbut does not turn it on by default.\n\nThis change ensures that filter is configured before fetching when it will be \nused in the option list. N\n[…]\nmail.com>\n\n* Clarify code per review\n\nSigned-off-by: psakievich <psakievich@gmail.com>\n\n---------\n\nSigned-off-by: psakievich <psakievich@gmail.com>\nSigned-off-by: Phil Sakievich <psakievich@gmail.com>",
"is_bot": false,
"headline": "git: ensure git server configured for tests (#51989)",
"author_name": "Phil Sakievich",
"author_login": "psakievich",
"committed_at": "2026-03-18T13:22:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b18ad342d4472361f65b5b2618c7db592d242e7f",
"body": "The two packages are not very well maintained, and vendor-specific.\n\nSo it may be surprising to see `amdblis` selected when `openblas` is\nnot possible. Let Spack users decide the defaults instead.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
"is_bot": false,
"headline": "Remove amdblis and amdlibflame as defaults (#52099)",
"author_name": "Massimiliano Culpo",
"author_login": "alalazo",
"committed_at": "2026-03-18T10:47:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e90f050a0e732e4ae00773873b5d86dafd55469e",
"body": "Signed-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: no status line at the end (#52098)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-18T09:11:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "453adc9c42940134fc326c1dcca33916c2c2d4d4",
"body": "1. Unlink the log file from the stage dir if successful and not\n --keep-stage.\n2. Drop second call to install test logs.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: two log fixes (#52096)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-17T17:41:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3878e80946c70b64c73c18377877f6eb37dcb0a3",
"body": "* Parse logs on error to get a log summary\n* Allow users to navigate through logs with `n`/`p`\n* Print the full log path in overview mode: `[x] ... failed: <log path>`\n* Print the full log path in log mode after the log summary.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: build failure ui improvements (#52093)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-17T16:11:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "721add3a6bc32ba19b6932f9ea0390f29a41d6cb",
"body": "When a spack.yaml is created from a lockfile, the groups are\nnow preserved. `needs` dependencies are not preserved yet.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
"is_bot": false,
"headline": "environment: reconstruct groups from lockfiles (#52095)",
"author_name": "Massimiliano Culpo",
"author_login": "alalazo",
"committed_at": "2026-03-17T15:51:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "585e25c9d2347062a8b6df3d79e3ee029c15658a",
"body": "Add read_text() and read_json() helpers to spack.util.web that\nencapsulate the fetch-decode-close cycle, and use them to replace\nrepeated read_from_url + TextIOWrapper boilerplate.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "urlopen: clean up resources (#52091)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-17T15:45:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0a126d610686a069d8e56d5332d715156dfcee78",
"body": "Signed-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "install_test.py: break circular import (#52092)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-17T15:43:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "96cae55e9b09e12cf82326541b020a06f372deb4",
"body": "It turns out Gitlab CI was failing with parallel downloads not \nbecause of concurrent requests that need retry, but due to \nfork-safety issues of SSL context objects.\n\nThe likely explanation is that shared resources are mutated \nby forked process A that invalidate them for concurrent \nforked process B.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: fork safety of ssl/boto3/urllib3 (#52089)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-17T07:00:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b80b32c4a23d8a56be25cc517debb03461ffeddf",
"body": "When using the new installer in CI, it's not particularly pretty to do\n`--verbose` when installing dependencies. Only apply --verbose to the\nroot package to see build logs.\n\nAlso drop --backtrace. In the new installer the child process always\nprints the full backtrace to the build log on failure. Th\n[…]\na backtrace to the installer event loop on\ninstall failure, that suggests the problem is with Spack instead of\nwith the build, causing confusion.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "ci: only use --verbose for root install, not deps (#52090)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-17T06:50:06Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e2c49f2b3a7aabc324a2d54f6c8319b854191bd4",
"body": "Malformed data from a crashing child causes an uncaught exception that\ncrashes the event loop. Catch JSONDecodeError and skip the malformed\nline instead. In practice this should never happen, but it does not hurt\nto be a bit more defensive.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: catch JSONDecodeError (#52084)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-16T21:05:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "95a4aabfda6aee34ad2ec2540a173eb1b8191bc8",
"body": "If a log line does not end with a newline, the UI should add one when\nswitching to overview mode or the new log. If a log line did end with a\nnewline, we shouldn't add double newlines.\n\nThis prevents things like:\n\n```\nchecking for foo.h header... ==> following log of xyz\n...\n```\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: ensure newlines between logs (#52087)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-16T20:39:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7344031b9bc19116e47dc1ec3696d8244dceacba",
"body": null,
"is_bot": false,
"headline": "new_installer.py: fix non-blocking I/O (#52086)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-16T20:35:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bf896946a56ea1ad8c10bcef0e61d96b2d961ac5",
"body": null,
"is_bot": false,
"headline": "new_installer.py: use longer timeout for non-TTY (#52085)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-16T20:33:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f65b58cd129d4bad4dfb89a7032d8408609447c5",
"body": "When a child exits, if the sentinel fires before the state pipe EOF,\nstate_buffers retains a partial JSON fragment. If the OS reuses that fd\nnumber for a new child's state pipe, the stale data is prepended,\ncorrupting the JSON stream. Pop the buffer before cleanup closes the fd.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: clean up state_buffers on exit (#52083)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-16T20:31:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2f1ef9ab3f919fe3a889a5861e7eea0d505813e4",
"body": "If a grandchild process ignores SIGTERM, the cleanup path hangs forever,\nleaving locks, jobserver, and terminal unreleased. Add a 30-second\ntimeout and escalate to SIGKILL.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: join timeout in finally block (#52082)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-16T20:25:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "58f0e6a27217f9dec747230acf6f35874f61d1ee",
"body": "…52069)\n\nThe test ensures that `spack.lock` entries\ninside git-based includes are correctly resolved\nusing the clone destination as the base directory,\nrather than the manifest directory.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
"is_bot": false,
"headline": "Add test for resolving git-based relative includes in environments (#…",
"author_name": "Massimiliano Culpo",
"author_login": "alalazo",
"committed_at": "2026-03-16T17:21:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e0997bb279d5cc1e1a243dcd91e55ac63089ff29",
"body": "Toolchain references are now parsed as regular dependencies and expanded \nin a separate post-parse step via `expand_toolchains`.\n\nToolchain expansion now happens in these entry points:\n\n* SpecList/SpecListParser for environment YAML\n* RequirementParser for packages.yaml requirements\n* spack.cmd.parse_specs for CLI\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
"is_bot": false,
"headline": "spec_parser.py: extract toolchain expansion from SpecParser (#52076)",
"author_name": "Massimiliano Culpo",
"author_login": "alalazo",
"committed_at": "2026-03-16T16:14:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "428b2ab2de4846bc791f5cdd64352ed0be65bb3e",
"body": "In CI, transient fetch errors (S3 rate limits, server errors, mid-stream\ndisconnects) cause spurious failures. To handle this uniformly:\n\n- Add `web_util.is_transient_error(e)` covering HTTP 5xx/429, socket\n timeouts, and botocore ResponseStreamingError.\n- Rewrite `_fetch_urllib` to retry up to `_F\n[…]\no a `.part` file\n for atomicity (consistent with `_fetch_curl`).\n- Simplify `oci/opener.py`'s retry logic to delegate to\n `is_transient_error`.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "fetch: retry urllib downloads with back-off (#52081)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-16T10:24:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "08dac53c99ad9a865331c4f5ae5bbe7d86b3b396",
"body": "…x) (#52072)\n\n* In non-TTY mode use colors when forced (`spack --color=always` or\r\n `SPACK_COLOR=always`)\r\n* In TTY mode do not use colors when explicitly disabled with the flag\r\n `spack --color=never` or `SPACK_COLOR=never`.\r\n* Use single code path for status line whether TTY or non-TTY.\r\n* While at it: apply path filtering of the install prefix also in the status line to `[+] ... /path/to/__spack_path_placeholder__/...`.\r\n\r\n\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: better color support (and a small path filtering fi…",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-15T19:55:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9a0390d3457bafa7e7ccae4fb3f712d407edec46",
"body": null,
"is_bot": false,
"headline": "new_installer.py: always try build cache (#52073)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-14T16:32:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dfead316f4c6e8d6774289adbcce8ab94df654bf",
"body": null,
"is_bot": false,
"headline": "new_installer.py: drain logs pipe before close (#52080)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-14T16:31:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2e154c5f1c1fe594223428938280689db6305660",
"body": "Do log filtering in `BuildStatus`, which is a class that handles the UI of the\nnew installer. The Tee class in the build process still duplexes build output\nverbatim to the log file and to the parent process; this is just a UI\nenhancement, and therefore part of the parent process.\n\n* Support both `s\n[…]\n* Use bytes based log filtering in `new_installer.py` (it treats stdout/stderr as raw bytes)\n* Parametrize existing tests over `str` and `bytes`.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: log filtering of path padding (#52071)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-13T17:50:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "54135ed30a7eb50f3b6bbf070981a4cdd8ee61a6",
"body": "Update \"tcl\" modulefile template to ease its readability and readability\nof generated modulefiles:\n\n* always use \"depends-on\" command to auto load dependencies and define\n this command if it is not found (when Environment Modules <5.1 is\n used)\n* always specify a path delimiter when using append-path, prepend-path\n and remove-path\n\nSigned-off-by: Xavier Delaruelle <xavier.delaruelle@cea.fr>",
"is_bot": false,
"headline": "modules: ease tcl template & modulefile readability (#52046)",
"author_name": "Xavier Delaruelle",
"author_login": "xdelaruelle",
"committed_at": "2026-03-13T08:39:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5a8a79390c5a8dad8015897f9dc4d6d0b0921293",
"body": "The `include_concrete` key in spack.yaml is deprecated. Concrete\nenvironments (lock files) should now be listed under the standard\n`include` key with an explicit `spack.lock` path:\n\n# Old (deprecated)\ninclude_concrete:\n- /path/to/env\n\n# New\ninclude:\n- /path/to/env/spack.lock\n\nUsing `include_concrete\n[…]\n format.\n\nSigned-off-by: tldahlgren <dahlgren1@llnl.gov>\nSigned-off-by: Tamara Dahlgren <35777542+tldahlgren@users.noreply.github.com>\nCo-authored-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
"is_bot": false,
"headline": "Deprecate `include_concrete:` in favor of `include:`",
"author_name": "Tamara Dahlgren",
"author_login": "tldahlgren",
"committed_at": "2026-03-13T08:10:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ad8b41095421b7ffe794556874674c48727032a5",
"body": "…ps (#52029)\n\nWhen a compiler is reused as a pure build dependency, its run-reachable\ntransitive deps are unified in the build environment (they appear in\nPATH etc.), but their pure link-type dependencies are local to the\ncompiler's toolchain and must not be forced onto the package being\nbuilt.\n\nPre\n[…]\n\navailable for the new rules. When a compiler is used as a library, or\nfor a fresh (--fresh) concretization, the existing behavior is\nunchanged.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "concretize.lp: avoid imposing transitive link deps of compiler run de…",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-12T21:35:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6b91d635ad3d29c549edd067d32c20009a62c553",
"body": "* Set debug=1 for the tty during phase execution\n* Force line buffering for sys.stdout and sys.error to ensure correctly ordered output\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: enable debug like old installer (#52059)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-12T21:06:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bbeff4b9a99ac93ece65b4488fbb0aa717660f6a",
"body": "Signed-off-by: Gregory Becker <becker33@llnl.gov>",
"is_bot": false,
"headline": "installer.py: pass debug=True to logger for clarity (#52067)",
"author_name": "Greg Becker",
"author_login": "becker33",
"committed_at": "2026-03-12T19:56:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9922e0216ec599a16fe4a7a0b4a6d69edf93a92c",
"body": "* new_installer.py: reporters\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>\n\n* communicate install from build cache\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>\n\n* debug message on report failure\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>\n\n* exitcode\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>\n\n---------\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: reporters (#52058)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-12T16:28:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cfccf3061d81bcdd0bd10a342f6f32ba1f5edf50",
"body": "This adds support for `spack install --verbose` in non-TTY mode.\n\nIt balances readability and troubleshootability:\n\n* Follow logs of one build and one build only\n* Always follow a build from start to finish, never half-way the process\n* For concurrent builds: only print install phase state changes a\n[…]\n of `spack install --verbose -p1` this choice results in the\nsame output as people were used to from the old installer before package\nparallelism\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: --verbose in non-TTY mode (#52048)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-12T09:36:14Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a8fb9ef2478ffac5f2e015d511fd481c78e4fe05",
"body": "Signed-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: add --test support (#52047)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-11T22:35:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d5c1d9ed5169eb8274a48930dd2a79602fb7898f",
"body": "This function exists for the purpose of unit tests; it looks a lot like\na hook to be used in spack-packages, which is rather unfortunate.\n\nMake it private.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "package_base.py: unit_test_check is not public API (#52060)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-11T20:41:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "22f600d3293b906f26ab0fc71dc56eeabef64ccd",
"body": "This reverts commit 341772bbab8673059dfc10913bd3ad5092050c8f.",
"is_bot": false,
"headline": "Revert \"variant.py: Sequence -> Iterable (#51859)\" (#52056)",
"author_name": "Massimiliano Culpo",
"author_login": "alalazo",
"committed_at": "2026-03-11T14:13:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fee5e77ba2db555f6e7a84ce5a30c44a60b4f094",
"body": "* new_installer.py: integration testing\n\n* Mimic GlobalStateMarshaller, but (a) drop unnecessary package related\n serialization bits and (b) do not serialize the active env\n* Add support for `--fake` used in tests.\n* Enable some unit tests for the new installer by parametrizing the\n installer conf\n[…]\n<me@harmenstoppels.nl>\n\n* GlobalState: dynamic instead of at a class definition\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>\n\n---------\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: integration testing (#52049)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-11T11:00:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a7bfaf7ebd45e7c93ec176602f57f6ced410fda7",
"body": "…051)\n\nWhen verbose, displays a summary of where the time was spent\nat the end of the execution.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
"is_bot": false,
"headline": "spack buildcache update-index: add timing when verbose is active (#52…",
"author_name": "Massimiliano Culpo",
"author_login": "alalazo",
"committed_at": "2026-03-11T09:55:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f6ae52c35b516e1f75b0b76d4bd6397ab1affb41",
"body": "Signed-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: no log file for externals (#52055)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-11T08:42:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c8dc13e8531d74e2e2d2c74d2488389bc850832e",
"body": "Previously the build subprocess would close stdout/stderr, which in turn\nwould unblock the Tee thread so it could be `.join`ed and then exit the\nbuild process.\n\nThat does not work in certain hard to troubleshoot edge cases witnessed\non macOS + pytest-xdist + coverage, where presumably stdout/stderr \n[…]\n-op), the approach taken here is to dup the\nfile descriptor and restore it afterwards to not break possible atexit\nhandlers or cpython internals.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: reset stdout/stderr on Tee exit (#52053)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-11T08:04:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "638120ff90a464a0bd24deaa304604868dcf4af3",
"body": "* lock.py: re-affirm lock to support forking\n\nWhen doing acquire_write, fork, acquire_write, the forked process\ncurrently does not error, because the `_writes` counter is `1` after the\nfork. But forking does not inherit locks, because it's a different pid.\n\nWith this change, on a nested lock, we always do the lock syscall, which\nis a no-op for the process that acquired the lock, but an error for the\nforked process.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "lock.py: re-affirm POSIX lock to support forking (#52004)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-10T20:02:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7ab5c181a2605467217614288e411301f51d8a53",
"body": "Signed-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "mailmap: add Harmen Stoppels (#52035)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-10T17:23:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d6df756508ad3294c7234b8c3ce227cbacfd1499",
"body": "Archive spack-build-out.txt.gz, spack-build-env.txt,\nspack-configure-args.txt, install-time-test-log.txt, repos/, and\narchived-files/ into the .spack metadata directory after a successful\nbuild, matching what the old installer writes.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: archive build provenance metadata (#51999)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-10T07:35:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ec3367bb060951135990a43afd75895986e96387",
"body": "Signed-off-by: Xavier Delaruelle <xavier.delaruelle@cea.fr>",
"is_bot": false,
"headline": "Fix some typos found with codespell (#52038)",
"author_name": "Xavier Delaruelle",
"author_login": "xdelaruelle",
"committed_at": "2026-03-09T17:41:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b47619603d05fa41a20278af0ac190b2fd7b2540",
"body": "Signed-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "ci: try new installer in bootstrap.yml (#51784)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-09T11:52:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f0731aed9aef1e683707eef2f582cc385d7cf0b0",
"body": "If two concurrent install processes do an overwrite install of the same\nspec, the second one now realizes that the first one has overwritten the\ninstall by comparing against the timestamp at which the installer was\nstarted.\n\nMimics the older installer.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: concurrent overwrite installs (#52013)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-09T11:00:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "66cec545482fe46267e400060e6db073a27debd1",
"body": "Signed-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "config.py: atomic writes to prevent parallel test races (#52041)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-09T10:58:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7842cb42412b07df1a2fd9d0751b712be0b0635d",
"body": "After writing an installed spec to the DB, downgrade the prefix write lock to a \nread lock instead of releasing it outright. This prevents another process from \n[…]\n \nLocks and resources are released best-effort under a single `finally` block\nafter the event loop finishes.",
"is_bot": false,
"headline": "new_installer.py: read locks on installed deps (#52012)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-07T08:15:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "580bc2d8f3fb51e22ab936ecced002a27bfe8791",
"body": "Move @@ -> @ replacement into match_to_ansi's text branch so it applies\ninside `{...}` blocks; top-level `@@` is already handled by the regex.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "color.py: fix @@ unescaping (#52034)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-06T17:00:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "50271c20b71fccc3a84c9d6d735f419dedd07562",
"body": "Signed-off-by: Brian Vanderwende <vanderwb@ucar.edu>",
"is_bot": false,
"headline": "Support cxx and fortran for Lmod compiler hierarchy (#52018)",
"author_name": "Brian Vanderwende",
"author_login": "vanderwb",
"committed_at": "2026-03-06T12:23:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c9e77cd2dff815adc6eaa3624655c7d12b571ff9",
"body": "Currently we do an ioctl syscall on every redraw to get the terminal\nsize. Instead use the self-pipe trick to handle `SIGWINCH` in the event\nloop, so we only query the terminal size if changed. This is only\nenabled in TTY mode.\n\nSigned-off-by: Harmen Stoppels <me@harmenstoppels.nl>",
"is_bot": false,
"headline": "new_installer.py: event-driven terminal resize (#52011)",
"author_name": "Harmen Stoppels",
"author_login": "haampie",
"committed_at": "2026-03-06T10:43:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6e8e2417068cfddd9358cf41fea0c6a4948d1dca",
"body": "Signed-off-by: Peter Scheibel <scheibel1@llnl.gov>",
"is_bot": false,
"headline": "tests: print autocompletion diff when it needs updating (#52032)",
"author_name": "Peter Scheibel",
"author_login": "scheibelp",
"committed_at": "2026-03-06T10:35:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0257aeb7925e67691f7cb1d8c806f36f5b0292ee",
"body": "…#52031)\n\nBumps [sphinxcontrib-svg2pdfconverter](https://github.com/missinglinkelectronics/sphinxcontrib-svg2pdfconverter) from 2.0.0 to 2.1.0.\n- [Commits](https://github.com/missinglinkelectronics/sphinxcontrib-svg2pdfconverter/compare/v2.0.0...v2.1.0)\n\n---\nupdated-dependencies:\n- dependency-name: \n[…]\nirect:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "build(deps): bump sphinxcontrib-svg2pdfconverter in /lib/spack/docs (…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-06T09:32:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3d24559ee20d51ee8b5af920213a4d2618b1af8c",
"body": "This option works only if an environment is active\nand accounts for group overrides when displaying\nthe configuration.\n\nSigned-off-by: Massimiliano Culpo <massimiliano.culpo@gmail.com>",
"is_bot": false,
"headline": "spack config: add --group option (#52025)",
"author_name": "Massimiliano Culpo",
"author_login": "alalazo",
"committed_at": "2026-03-06T07:14:13Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 21,
"commits_last_year": 662,
"latest_release_at": "2020-04-15T21:32:01Z",
"latest_release_tag": "v0.14.2",
"releases_from_tags": true,
"days_since_last_push": 27,
"active_weeks_last_year": 37,
"days_since_latest_release": 2292,
"mean_days_between_releases": 57.7
},
"community": {
"has_readme": false,
"has_license": false,
"has_description": false,
"has_contributing": false,
"health_percentage": null,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": []
},
"popularity": {
"forks": 0,
"stars": 0,
"watchers": 0,
"fork_history": {
"days": [],
"complete": true,
"collected": 0,
"total_forks": 0
},
"star_history": {
"days": [],
"complete": true,
"collected": 0,
"total_stars": 0,
"collected_at": null
},
"open_issues_and_prs": 14
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": false,
"bootstrap_files": [
"lib/spack/docs/Makefile",
"lib/spack/spack/test/data/make/affirmative/capital_makefile/Makefile",
"lib/spack/spack/test/data/make/affirmative/check_test/Makefile",
"lib/spack/spack/test/data/make/affirmative/expansion/Makefile",
"lib/spack/spack/test/data/make/affirmative/gnu_makefile/GNUmakefile",
"lib/spack/spack/test/data/make/affirmative/include/Makefile",
"lib/spack/spack/test/data/make/affirmative/lowercase_makefile/makefile",
"lib/spack/spack/test/data/make/affirmative/prerequisites/Makefile",
"lib/spack/spack/test/data/make/affirmative/spaces/Makefile",
"lib/spack/spack/test/data/make/affirmative/test_check/Makefile",
"lib/spack/spack/test/data/make/affirmative/three_targets/Makefile",
"lib/spack/spack/test/data/make/negative/partial_match/Makefile",
"lib/spack/spack/test/data/make/negative/variable/Makefile",
"share/spack/templates/depfile/Makefile"
],
"api_schema_files": [],
"has_devcontainer": true,
"typecheck_configs": [
"lib/spack/spack/vendor/attr/py.typed",
"lib/spack/spack/vendor/attrs/py.typed",
"lib/spack/spack/vendor/distro/py.typed",
"lib/spack/spack/vendor/jinja2/py.typed",
"lib/spack/spack/vendor/markupsafe/py.typed",
"lib/spack/spack/vendor/pyrsistent/py.typed",
"lib/spack/spack/vendor/ruamel/yaml/py.typed"
],
"toolchain_manifests": [],
"largest_source_bytes": 231926,
"source_files_sampled": 1009,
"oversized_source_files": 21,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"pyproject.toml"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [
{
"name": "black",
"direct": false,
"version": "25.12.0",
"severity": "critical",
"ecosystem": "pypi",
"cvss_score": 9.8,
"advisory_ids": [
"GHSA-3936-cmfr-pm3m",
"PYSEC-2026-2120",
"PYSEC-2026-2121"
],
"fixed_version": "26.3.1",
"advisory_count": 3,
"oldest_advisory_days": 136
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"critical": 1
},
"advisory_count": 3,
"affected_count": 1,
"assessed_count": 20,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 1,
"direct_affected_count": 0
},
"ecosystems": [
"pypi"
],
"dependencies": [
{
"name": "clingo",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": null
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "clingo",
"direct": true,
"version": null,
"ecosystem": "pypi"
},
{
"name": "clingo",
"direct": true,
"version": "5.8.0",
"ecosystem": "pypi"
},
{
"name": "black",
"direct": false,
"version": "25.12.0",
"ecosystem": "pypi"
},
{
"name": "coverage",
"direct": false,
"version": "7.11.0",
"ecosystem": "pypi"
},
{
"name": "docutils",
"direct": false,
"version": "0.22.4",
"ecosystem": "pypi"
},
{
"name": "flake8",
"direct": false,
"version": "7.3.0",
"ecosystem": "pypi"
},
{
"name": "furo",
"direct": false,
"version": "2025.12.19",
"ecosystem": "pypi"
},
{
"name": "isort",
"direct": false,
"version": "7.0.0",
"ecosystem": "pypi"
},
{
"name": "mypy",
"direct": false,
"version": "1.20.0",
"ecosystem": "pypi"
},
{
"name": "pygments",
"direct": false,
"version": "2.20.0",
"ecosystem": "pypi"
},
{
"name": "pylint",
"direct": false,
"version": "4.0.5",
"ecosystem": "pypi"
},
{
"name": "ruamel-yaml",
"direct": false,
"version": "0.19.1",
"ecosystem": "pypi"
},
{
"name": "slotscheck",
"direct": false,
"version": "0.19.1",
"ecosystem": "pypi"
},
{
"name": "sphinx",
"direct": false,
"version": "9.1.0",
"ecosystem": "pypi"
},
{
"name": "sphinx-copybutton",
"direct": false,
"version": "0.5.2",
"ecosystem": "pypi"
},
{
"name": "sphinx-last-updated-by-git",
"direct": false,
"version": "0.3.8",
"ecosystem": "pypi"
},
{
"name": "sphinx-sitemap",
"direct": false,
"version": "2.9.0",
"ecosystem": "pypi"
},
{
"name": "sphinxcontrib-programoutput",
"direct": false,
"version": "0.18",
"ecosystem": "pypi"
},
{
"name": "sphinxcontrib-svg2pdfconverter",
"direct": false,
"version": "2.1.0",
"ecosystem": "pypi"
},
{
"name": "types-six",
"direct": false,
"version": "1.17.0.20251009",
"ecosystem": "pypi"
},
{
"name": "vermin",
"direct": false,
"version": "1.8.0",
"ecosystem": "pypi"
}
],
"collected": true,
"truncated": false,
"total_count": 21,
"direct_count": 2,
"indirect_count": 19
}
},
"maintainership": {
"issues": {
"open_prs": 14,
"merged_prs": 1,
"open_issues": 0,
"closed_ratio": null,
"closed_issues": 0,
"closed_unmerged_prs": 86
},
"bus_factor": 10,
"bot_contributors": 1,
"top_contributors": [
{
"type": "User",
"login": "adamjstewart",
"commits": 3237,
"avatar_url": "https://avatars.githubusercontent.com/u/12021217?v=4"
},
{
"type": "User",
"login": "tgamblin",
"commits": 2946,
"avatar_url": "https://avatars.githubusercontent.com/u/299842?v=4"
},
{
"type": "User",
"login": "alalazo",
"commits": 2230,
"avatar_url": "https://avatars.githubusercontent.com/u/4199709?v=4"
},
{
"type": "User",
"login": "haampie",
"commits": 2115,
"avatar_url": "https://avatars.githubusercontent.com/u/194764?v=4"
},
{
"type": "User",
"login": "alecbcs",
"commits": 957,
"avatar_url": "https://avatars.githubusercontent.com/u/19558067?v=4"
},
{
"type": "User",
"login": "wdconinc",
"commits": 902,
"avatar_url": "https://avatars.githubusercontent.com/u/4656391?v=4"
},
{
"type": "User",
"login": "glennpj",
"commits": 811,
"avatar_url": "https://avatars.githubusercontent.com/u/16138574?v=4"
},
{
"type": "User",
"login": "becker33",
"commits": 724,
"avatar_url": "https://avatars.githubusercontent.com/u/13971568?v=4"
},
{
"type": "User",
"login": "manuelakuhn",
"commits": 707,
"avatar_url": "https://avatars.githubusercontent.com/u/36827019?v=4"
},
{
"type": "User",
"login": "michaelkuhn",
"commits": 691,
"avatar_url": "https://avatars.githubusercontent.com/u/4062614?v=4"
}
],
"contributors_sampled": 99,
"top_contributor_share": 0.107
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"bootstrap.yml",
"build-containers.yml",
"ci.yaml",
"coverage.yml",
"import-check.yaml",
"prechecks.yml",
"stale.yaml",
"triage.yml",
"unit_tests.yaml"
],
"has_docs_dir": false,
"linter_configs": [
".flake8"
],
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": null,
"reason": "no pull request found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 91 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": null,
"reason": "internal error: internal error: invalid Dockerfile",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "no SAST tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 10,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 8,
"reason": "2 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "188f78ac7a902faa98b875809537f9e31fe0b179",
"ran_at": "2026-07-26T19:15:45Z",
"aggregate_score": 4.8,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": true,
"has_dependabot_config": true
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-06-13T03:26:41Z",
"oldest_open_prs": [
{
"number": 28,
"created_at": "2023-08-11T03:25:08Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 47,
"created_at": "2023-09-14T08:15:50Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 59,
"created_at": "2024-01-05T08:58:20Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 74,
"created_at": "2024-02-06T08:26:03Z",
"last_comment_at": "2026-04-05T17:23:50Z",
"last_comment_author": "dependabot"
},
{
"number": 86,
"created_at": "2024-03-10T00:36:55Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 91,
"created_at": "2024-03-13T08:27:50Z",
"last_comment_at": "2026-04-05T17:23:21Z",
"last_comment_author": "dependabot"
},
{
"number": 92,
"created_at": "2024-03-14T08:39:56Z",
"last_comment_at": "2026-04-05T17:23:35Z",
"last_comment_author": "dependabot"
},
{
"number": 93,
"created_at": "2024-03-14T08:40:03Z",
"last_comment_at": "2026-04-05T17:23:57Z",
"last_comment_author": "dependabot"
},
{
"number": 96,
"created_at": "2026-04-05T17:23:22Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 97,
"created_at": "2026-04-05T17:23:27Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 98,
"created_at": "2026-04-05T17:23:33Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 99,
"created_at": "2026-04-05T17:23:42Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 100,
"created_at": "2026-04-08T08:23:52Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 101,
"created_at": "2026-04-13T08:39:13Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": "2020-06-20T16:09:38Z",
"ci_last_conclusion": "SKIPPED",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/wdconinc/spack",
"host": "github.com",
"name": "spack",
"owner": "wdconinc"
},
"metrics": {
"overall": {
"key": "overall",
"band": "at_risk",
"name": "Overall health",
"note": null,
"notes": [],
"value": 49,
"inputs": {
"security": 58,
"vitality": 59,
"community": 12,
"governance": 55,
"engineering": 58
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "moderate",
"name": "Vitality",
"value": 59,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "good",
"name": "Development activity",
"note": null,
"notes": [],
"value": 72,
"inputs": {
"commits_last_year": 662,
"human_commit_share": 0.96,
"days_since_last_push": 27,
"active_weeks_last_year": 37
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 27 days ago",
"points": 28.8,
"status": "partial",
"details": [
{
"code": "push_recency",
"params": {
"days": 27
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "37/52 weeks with commits",
"points": 25.6,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 37
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "662 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 662
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "at_risk",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 40,
"inputs": {
"releases_count": 21,
"latest_release_tag": "v0.14.2",
"releases_from_tags": true,
"days_since_latest_release": 2292,
"mean_days_between_releases": 57.7
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "21 version tags (no GitHub releases)",
"points": 16.2,
"status": "partial",
"details": [
{
"code": "version_tags_no_releases",
"params": {
"count": 21
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 2292 days ago",
"points": 0,
"status": "missed",
"details": [
{
"code": "release_recency",
"params": {
"days": 2292
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~57.7 days",
"points": 19.8,
"status": "partial",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 57.7
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 112,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 112 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 112
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "critical",
"name": "Community & Adoption",
"value": 12,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"forks": 0,
"stars": 0,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "0 stars",
"points": 0,
"status": "missed",
"details": [
{
"code": "stars",
"params": {
"count": 0
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "0 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 0
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "critical",
"name": "Community health",
"note": null,
"notes": [],
"value": 25,
"inputs": {
"has_readme": false,
"has_license": false,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 55,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "excellent",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 98,
"inputs": {
"bus_factor": 10,
"contributors_sampled": 99,
"top_contributor_share": 0.107
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "10 contributor(s) cover half of all commits",
"points": 54,
"status": "met",
"details": [
{
"code": "bus_factor",
"params": {
"count": 10
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 11% of commits",
"points": 20.1,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 11
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "99 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 99
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 91 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "critical",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"issue_resolution"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 1,
"inputs": {
"merged_prs": 1,
"open_issues": 0,
"closed_issues": 0,
"issue_closed_ratio": null,
"closed_unmerged_prs": 86
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "no issues or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_issues_or_data",
"params": {}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "1/87 decided PRs merged",
"points": 0.4,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 1,
"decided": 87
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 59,
"inputs": {
"followers": 46,
"owner_type": "User",
"is_verified": null,
"owner_login": "wdconinc",
"public_repos": 226,
"account_age_days": 4794
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "46 followers of wdconinc",
"points": 12,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 46,
"login": "wdconinc"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "226 public repos, account ~13 yr old",
"points": 25,
"status": "met",
"details": [
{
"code": "public_repos",
"params": {
"count": 226
}
},
{
"code": "account_age_years",
"params": {
"years": 13
}
}
],
"max_points": 25
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 58,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_ci_tests"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 80,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "9 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 9
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": ".flake8",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".flake8"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "critical",
"name": "Documentation",
"note": null,
"notes": [],
"value": 25,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": "https://spack.io",
"has_readme": false,
"has_docs_dir": false,
"has_description": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://spack.io",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 58,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): CI-Tests, Packaging, Pinned-Dependencies, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"ci_tests",
"packaging",
"pinned_dependencies",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 48,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 14,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 4,
"scorecard_aggregate": 4.8
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 91 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "internal error: internal error: invalid Dockerfile",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "no SAST tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "2 existing vulnerabilities detected",
"points": 6,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 20 resolved dependencies against OSV; 1 could not be assessed (no resolved version, an unsupported ecosystem, or beyond the reported package list). This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories",
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 20
}
},
{
"code": "advisories_unassessed",
"params": {
"count": 1
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 3,
"affected_packages": 1,
"assessed_packages": 20,
"unassessed_packages": 1,
"affected_by_severity": "critical 1",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 20,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 15
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "good",
"name": "AI Readiness",
"value": 70,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.979,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "94 of 96 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 94,
"sampled": 96
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "excellent",
"name": "Verify loop (build / test / typecheck)",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Pinned-Dependencies. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_pinned_dependencies"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 89,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [],
"has_dockerfile": true,
"typed_language": false,
"bootstrap_files": [
"lib/spack/docs/Makefile",
"lib/spack/spack/test/data/make/affirmative/capital_makefile/Makefile",
"lib/spack/spack/test/data/make/affirmative/check_test/Makefile",
"lib/spack/spack/test/data/make/affirmative/expansion/Makefile",
"lib/spack/spack/test/data/make/affirmative/gnu_makefile/GNUmakefile",
"lib/spack/spack/test/data/make/affirmative/include/Makefile",
"lib/spack/spack/test/data/make/affirmative/lowercase_makefile/makefile",
"lib/spack/spack/test/data/make/affirmative/prerequisites/Makefile",
"lib/spack/spack/test/data/make/affirmative/spaces/Makefile",
"lib/spack/spack/test/data/make/affirmative/test_check/Makefile",
"lib/spack/spack/test/data/make/affirmative/three_targets/Makefile",
"lib/spack/spack/test/data/make/negative/partial_match/Makefile",
"lib/spack/spack/test/data/make/negative/variable/Makefile",
"share/spack/templates/depfile/Makefile"
],
"has_devcontainer": true,
"has_linter_config": true,
"typecheck_configs": [
"lib/spack/spack/vendor/attr/py.typed",
"lib/spack/spack/vendor/attrs/py.typed",
"lib/spack/spack/vendor/distro/py.typed",
"lib/spack/spack/vendor/jinja2/py.typed",
"lib/spack/spack/vendor/markupsafe/py.typed",
"lib/spack/spack/vendor/pyrsistent/py.typed",
"lib/spack/spack/vendor/ruamel/yaml/py.typed"
],
"agent_commit_share": 0,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0.04
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "lib/spack/docs/Makefile, lib/spack/spack/test/data/make/affirmative/capital_makefile/Makefile, lib/spack/spack/test/data/make/affirmative/check_test/Makefile, lib/spack/spack/test/data/make/affirmative/expansion/Makefile, lib/spack/spack/test/data/make/affirmative/gnu_makefile/GNUmakefile, lib/spack/spack/test/data/make/affirmative/include/Makefile, lib/spack/spack/test/data/make/affirmative/lowercase_makefile/makefile, lib/spack/spack/test/data/make/affirmative/prerequisites/Makefile, lib/spack/spack/test/data/make/affirmative/spaces/Makefile, lib/spack/spack/test/data/make/affirmative/test_check/Makefile, lib/spack/spack/test/data/make/affirmative/three_targets/Makefile, lib/spack/spack/test/data/make/negative/partial_match/Makefile, lib/spack/spack/test/data/make/negative/variable/Makefile, share/spack/templates/depfile/Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lib/spack/docs/Makefile, lib/spack/spack/test/data/make/affirmative/capital_makefile/Makefile, lib/spack/spack/test/data/make/affirmative/check_test/Makefile, lib/spack/spack/test/data/make/affirmative/expansion/Makefile, lib/spack/spack/test/data/make/affirmative/gnu_makefile/GNUmakefile, lib/spack/spack/test/data/make/affirmative/include/Makefile, lib/spack/spack/test/data/make/affirmative/lowercase_makefile/makefile, lib/spack/spack/test/data/make/affirmative/prerequisites/Makefile, lib/spack/spack/test/data/make/affirmative/spaces/Makefile, lib/spack/spack/test/data/make/affirmative/test_check/Makefile, lib/spack/spack/test/data/make/affirmative/three_targets/Makefile, lib/spack/spack/test/data/make/negative/partial_match/Makefile, lib/spack/spack/test/data/make/negative/variable/Makefile, share/spack/templates/depfile/Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": ".flake8",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".flake8"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "lib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "devcontainer, Dockerfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "devcontainer, Dockerfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "4 of the last 100 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 4,
"sampled": 100
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "internal error: internal error: invalid Dockerfile",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "good",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 81,
"inputs": {
"primary_language": "Python",
"largest_source_bytes": 231926,
"source_files_sampled": 1009,
"oversized_source_files": 21
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Python with type-check config (lib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed)",
"points": 27,
"status": "partial",
"details": [
{
"code": "typecheck_config_language",
"params": {
"files": "lib/spack/spack/vendor/attr/py.typed, lib/spack/spack/vendor/attrs/py.typed, lib/spack/spack/vendor/distro/py.typed, lib/spack/spack/vendor/jinja2/py.typed, lib/spack/spack/vendor/markupsafe/py.typed, lib/spack/spack/vendor/pyrsistent/py.typed, lib/spack/spack/vendor/ruamel/yaml/py.typed",
"language": "Python"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "21/1009 source files over 60KB",
"points": 53.9,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 1009,
"oversized": 21
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Community profile unavailable",
"Could not fetch pypi package 'spack' from its registry"
],
"report_type": "repository",
"generated_at": "2026-07-26T19:16:03.772661Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/w/wdconinc/spack.svg",
"full_name": "wdconinc/spack",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}