{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:00.056523Z","repo":{"ref":{"host":"github.com","owner":"Arwalk","name":"goose-protobuf"},"default_branch":"main","clone_url":"https://github.com/Arwalk/goose-protobuf.git","html_url":"https://github.com/Arwalk/goose-protobuf","description":"Protobuf for the goose programming language","stars":0,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":8531,"primary_language":"Shell","license_spdx":"MIT","created_at":"2026-11-06T11:06:09Z","pushed_at":"2026-11-06T20:16:26Z","security_policy_url":"https://github.com/Arwalk/goose-protobuf/security/policy","distribution":{"owner_created_at":"2013-06-22T17:20:52Z","owner_type":"User","release_assets":[]}},"commit_sha":"a9e99bb010eb6817d374de8e93666dc955eb8a01","profile":{"lines_by_language":{"Shell":2580,"Python":1569,"C":118,"C++":67},"files_by_category":{"other":380,"docs":55,"source":53,"config":19,"test":8,"binary":2},"source_lines":3753,"test_lines":581},"pillars":{"ai_provenance":{"score":100.0,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":1.0,"suspected_share":0.0,"estimated_share":1.0,"ai_artifacts":5.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.0},"summary":"Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals."},"quality":{"score":66.9,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":85.1,"duplication":86.6,"lint":45.0,"testing":45.8,"docs":100.0,"type_safety":40.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.15, no CI test run detected; 5% of function code in complex or long functions; 2% duplicated lines. Weakest area: type safety."},"security":{"score":58.3,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":54.0,"dependencies":null,"ci_actions":6.5,"posture":40.0,"scorecard":null},"summary":"Security posture is weak: 8 high-severity SAST findings; 12 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":141.0,"attributed_commits":139.0,"attributed_commit_share":0.9858156028368794,"effective_loc":4937.0,"attributed_loc":4937.0,"attributed_loc_share":1.0,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 139 attributed commits, 4,937 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"a5326feb168032b92111adfd6bce866827e3200c","url":"https://github.com/Arwalk/goose-protobuf/commit/a5326feb168032b92111adfd6bce866827e3200c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"943bba27e66e9e17ce4e2ca659f339bbb7a6f3df","url":"https://github.com/Arwalk/goose-protobuf/commit/943bba27e66e9e17ce4e2ca659f339bbb7a6f3df","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"0523508593e607b657899d23fdfd6e2342467293","url":"https://github.com/Arwalk/goose-protobuf/commit/0523508593e607b657899d23fdfd6e2342467293","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"2807434aeca8157c4d7fb094147a9c6062efe4f1","url":"https://github.com/Arwalk/goose-protobuf/commit/2807434aeca8157c4d7fb094147a9c6062efe4f1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"adb292d2172f99391498604895df481a137dfab1","url":"https://github.com/Arwalk/goose-protobuf/commit/adb292d2172f99391498604895df481a137dfab1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1c3815509f189dc2cc002688eba8f43dd249b158","url":"https://github.com/Arwalk/goose-protobuf/commit/1c3815509f189dc2cc002688eba8f43dd249b158","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"db5a380942f870cf1e96de200f8e55cc83680258","url":"https://github.com/Arwalk/goose-protobuf/commit/db5a380942f870cf1e96de200f8e55cc83680258","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"888d3175e9696a971c4a2622b7b0ecb041edc585","url":"https://github.com/Arwalk/goose-protobuf/commit/888d3175e9696a971c4a2622b7b0ecb041edc585","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"098b478ce81020f8a1d072bde5675e67da5bc2f2","url":"https://github.com/Arwalk/goose-protobuf/commit/098b478ce81020f8a1d072bde5675e67da5bc2f2","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"37c21c1cfb9c4d0a60932441370ab36c6a5c456b","url":"https://github.com/Arwalk/goose-protobuf/commit/37c21c1cfb9c4d0a60932441370ab36c6a5c456b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"8ba324e8f22ae10257d5ec099263436f3c6c38d3","url":"https://github.com/Arwalk/goose-protobuf/commit/8ba324e8f22ae10257d5ec099263436f3c6c38d3","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"5addc107f018f5005332a1a66788833ab1dfea72","url":"https://github.com/Arwalk/goose-protobuf/commit/5addc107f018f5005332a1a66788833ab1dfea72","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"011ab88fe4d5a817ec9f33224d5d2496686e7927","url":"https://github.com/Arwalk/goose-protobuf/commit/011ab88fe4d5a817ec9f33224d5d2496686e7927","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1dc33904c808369122d15d6f56adb67facc8b091","url":"https://github.com/Arwalk/goose-protobuf/commit/1dc33904c808369122d15d6f56adb67facc8b091","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f541044a55382a0476b39b59fbc852fd00f07e38","url":"https://github.com/Arwalk/goose-protobuf/commit/f541044a55382a0476b39b59fbc852fd00f07e38","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"65827d7740f000f9ba6bba966ed1f873d4b99924","url":"https://github.com/Arwalk/goose-protobuf/commit/65827d7740f000f9ba6bba966ed1f873d4b99924","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"373e173e8e075541645ed4ffac6de147e09d8768","url":"https://github.com/Arwalk/goose-protobuf/commit/373e173e8e075541645ed4ffac6de147e09d8768","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"7657142f256826337f18f94e1390eb119f1052e9","url":"https://github.com/Arwalk/goose-protobuf/commit/7657142f256826337f18f94e1390eb119f1052e9","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"799af502bd1b1cc3eab127f6a7ca41c6d0095e8e","url":"https://github.com/Arwalk/goose-protobuf/commit/799af502bd1b1cc3eab127f6a7ca41c6d0095e8e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"9a10999762228de80fd3f5f611d11e8b18190b03","url":"https://github.com/Arwalk/goose-protobuf/commit/9a10999762228de80fd3f5f611d11e8b18190b03","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d7e5ecf1dd52f663ddd99e29bad7394a2a0b4237","url":"https://github.com/Arwalk/goose-protobuf/commit/d7e5ecf1dd52f663ddd99e29bad7394a2a0b4237","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"11a62c314c5d3b11ec21a9e4f0e3adfc4d31c374","url":"https://github.com/Arwalk/goose-protobuf/commit/11a62c314c5d3b11ec21a9e4f0e3adfc4d31c374","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"039e13e1a1004212b16956a46480c2e92af2b118","url":"https://github.com/Arwalk/goose-protobuf/commit/039e13e1a1004212b16956a46480c2e92af2b118","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"237b31d897c455928d92380535a8668a7f528b2b","url":"https://github.com/Arwalk/goose-protobuf/commit/237b31d897c455928d92380535a8668a7f528b2b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"6c409c9377d8505669627381bfc756bb70244248","url":"https://github.com/Arwalk/goose-protobuf/commit/6c409c9377d8505669627381bfc756bb70244248","weight":0.9}],"data":{"attributed_loc_by_commit":{"0844eeb9d66da393e7d79f52f5b7cfe5767a31b4":45,"da58fe94621bcff16d3e4b9b8eca4ce186461800":0,"79b3ceea77f386d1b5d14a3a6406514719ed07db":8,"e39dbc64ce49e581bc4aa92217b0c9c5db60551f":99,"d963ee08a8330cdaa25db3a1908f41e502286823":137,"2d5b6fa8146f6d45b540ed09b5a75a36cf48511d":41,"2a5786a6e8209b943deded167e4cb44892019a01":43,"2d6dfea052ada02983b7a17fd25593595e4b598e":227,"d1ec010c4c6a1b57a2f16425332168873f1f9b31":88,"2dfb5a65a80dc08e72af238f70fad8673f67f117":173,"ccbd560ad5612b9db0308d180954f22441cd8aef":86,"0f35202812c18ba043f4275d6c96bb2358eae71a":12,"620c9017ad6521d835ea5d7a3e99aaf3632d3e11":0,"21f4938a8a078d85be3f94c73fc79f0dc0dcfde8":0,"62518230fdca4b59cdf35367eb37552ca7096952":0,"b35553b01f306c38f02a48ab397b6b4d5d8e1394":0,"711b54ea5b3cea935b66796063474859741d7faa":0,"ce30a43c056613732c69d48afc7cdf17e2b39972":6,"20dbe45ee685de9eb5c1f1e6a31acfcfe1f6a326":0,"333a709e0bc30a757bcb524fe457fbb33c812005":0,"bdfdaee738b96dd0291d2725c63dad13bfe0eedd":0,"0abfe9792c41258c008dc7ec741ca98ea9a2a960":96,"d34b821b42793d68b668d428fca3b0c61bb2d43c":0,"e33a1b5f8d5b11a03db3ca6e4f5a259f9c142dde":68,"308314e478f4d86bdc2be4b230db34df9f448212":82,"e7f09a360a105e1e3440b008f8807efc48d25092":0,"87e9c27e6be6ce5e61bfa4dfcb74a760cd2e3dcc":0,"81bc4d4c0399910c9f23627c3929676aa5cd5a0f":86,"b622dd738e4db239bc22d66f6d0f6b5db2193095":0,"1f53c0863bef362d089cf83eca172ec9c0febc74":0,"0d42b37a8413cfd2745b00f21f029b43a4eac984":0,"9465d7eab434bd32087e385ed9cdb76f1c157d64":0,"2d667c8fb0ef0913d1357fe471a230df9c690b99":11,"0507bedde10b1f29da3f075b1a84e3586bcad154":0,"7d795ac0de556550e36ad84d81058abf3b6548a8":0,"82c28e2141f4aeeffe6ae30eefe1ed11e394bb96":57,"dd2524c32776b7ef8d0c9a661c907e01adf53b53":0,"2f38c125c6ed620f49a82c33131bd875263688d4":136,"844dcb69413a719fd6eff00e0d35801e2c9ffef8":0,"f12b325389cfe05356102de7342633855417b3cc":0,"16a499c8490ca2f80d043980ca6da62fecc7e353":140,"975e6736ed23fecd26949973b97c87a5e0af07d4":0,"00f76400d446d247030552f5e1bb794c61b4a77f":0,"4cfd5b4fc563fd65ef71c6b6f3c946c06e3532bb":0,"7c0a1750c831bea66f51643fa1bba7b13bcbea16":0,"af1a7c46f20fcd54677ba0005ca22c1000140b2d":4,"af12c5526156b10688e0e19c58d00f2739217869":0,"c46d4eafa193825cd2df3abf5ba06ae6b5aebf35":0,"d3c0996c1540bc51e4301ed7e3bd8f045efcd5ea":0,"8d2bbd06bd878769e46526a9a3a2cd8a1616c9d9":0,"05345b0fae8dc5ff279022c6f48d28bb20b3906d":38,"88bd4b17c5cec98d059ad6973d324d7419502783":0,"afdd3eaa87626eaf736880f53ac225390c19b3ae":0,"42f4b4aebed2dd52f68fdda5e4421683714260db":0,"34c1971860fd0745a76a8eaed5bc8c0691f55847":0,"fe9b89b3c73248906f0841767a7828bcb62957e6":0,"bc174e9992fa0a83d48dbe31fd51d08b06d7abaa":15,"401ff9a45e3d32b14749f7dfa42a8f948a1ce487":0,"11c516b4bd15a64445cf170c233c7305bcf22747":26,"f7eeb5a1b84520435e02468f7051ad2755b1104d":0,"b8df0e5d059b6eabafcfe8ca234ce88b77d1c23b":22,"ddfcc8abdecb9818b040338da6dd781681d8e466":374,"6382970274e10159514249aa6d74a5bc9fb33b2a":200,"b56d934032c9ec8d2441bb5103e9f434427156ec":0,"7b527964d9221018a44b4415cdfb71dd820e4ab6":114,"6f3fa52c1360414438db57c975a70b0852d523d3":2,"48d6ee0c9ad23a20595a978a9d70761ffee378b7":0,"dce89c30026c5b28ff1a8289d404c172f9af3080":0,"082e8069228f7c574c4144a96c7ea4015832fab8":73,"c47e1525a3076179e0116b0ba1c505554de7a506":306,"f1ef74cbaefd702e634f6ea204f03a2f1d7789ce":13,"b58ceca95d3e49ecf1286c7e9dd2be2d187ebd55":0,"e0a76fcde5802c1b1020c59579614f130fd145bc":0,"ab080b67ed31e75829feaec0a44239f598fdfc96":101,"5c216167b9fea97fcbd87e50b264d31bd4cd14c5":0,"b8fff1b0a3898b06f6cfd1642d941acbc33251a8":0,"e15c8c4fb63327719efb29b60edad8dd98a13a15":0,"3a592132804d3db663ba5d213aa82b68d5c678bd":24,"e3386285678b6cfdbb8bf916c71bf7a66337c56d":0,"bc80c81b72bd51207926bad8ba736963153256f3":128,"6f96f4d34f6fa6f516854d737272d4dbc2bb964f":0,"84de226a33f3f3e57aafa67dc355f14a19ce32e3":109,"b3423aaef0aeb499fab64e80dbd56c23539db58b":0,"d0949ed4b09b1bb111d360861c2fbda192035074":0,"5fc70deef1a36c8e782d5d430358868b23bfd12f":0,"8706b3706cf659b77fc283899604421f17b59c25":0,"8db28e5b1b243cf289d986568e995b5ce007c0e1":0,"58ff7cc114dcd0b880860801b9fa1a195e09868b":0,"9bd510c17eeb2094cc04df85c779e3daac7035c0":0,"fae2c2f021a8a5400bf50ed17cc3c1251ae75456":104,"7d0e7e61ae62f7f291642b94a21ecfb2aa3d5901":14,"8f166e9d2fbe03ddca8ce5d80da63f25130d3a17":0,"9085b6ba61afe9a7f3272f33d7a1253c9a5832f0":156,"6a4906821432f5a8eee3e02397d52cee16b01141":18,"cdb26ba3058c44b0bd6afbe1413a38abea615498":3,"24cfeac44a77ce38b7f109a809d4b721fe7d817f":3,"dc5323408e9e369d07ad9b706fb414bde185ed50":0,"518d45f2fce85951f045b9f6c0290229344e8293":0,"956671ac73b789bffaf298bce0e5b97956b1b790":0,"14212fbd05e20b4b891dee23e08fa4a940c5ea46":0,"82b111e5bdd862631aa2d7000b35d5f2c445a060":0,"7b222c22105929a8c46dcd55c5aba23575a1973d":0,"321ec413def7222ba3249f817e3449cb72c27593":0,"386f4476ce546036fe91e49fe7d8cb4f3958e7a1":0,"e79e4ba2ae876a7a274e38329febd720b2478e14":161,"a249a0f84c24d6d0a5318eac85b7d0c3f9c73977":275,"fdaa0392422ce70b5dd5b2a3b9189af29f45ffda":24,"56f5da0344a087cf0a038ca7b49747c37dc98b19":48,"2db657e6378d1681a40e024e3028f71c1ef36931":34,"01c97e100ccf23f85d90d330f0bb3c718f37e32d":1,"b2d12c99c92d23934d5cb986ff6025bd678ae0f2":26,"c6ab43b60eb43ef927648ff7bd5a7d73ee6ba73a":0,"2fc4c9ca3c64f2edb5dc817e2dd2e6250a8c24ec":121,"e91b3142eacf0855edf820b48f4074541b572b08":19,"6c409c9377d8505669627381bfc756bb70244248":171,"237b31d897c455928d92380535a8668a7f528b2b":0,"039e13e1a1004212b16956a46480c2e92af2b118":0,"11a62c314c5d3b11ec21a9e4f0e3adfc4d31c374":0,"d7e5ecf1dd52f663ddd99e29bad7394a2a0b4237":0,"9a10999762228de80fd3f5f611d11e8b18190b03":52,"799af502bd1b1cc3eab127f6a7ca41c6d0095e8e":25,"7657142f256826337f18f94e1390eb119f1052e9":68,"373e173e8e075541645ed4ffac6de147e09d8768":0,"65827d7740f000f9ba6bba966ed1f873d4b99924":0,"f541044a55382a0476b39b59fbc852fd00f07e38":25,"1dc33904c808369122d15d6f56adb67facc8b091":240,"011ab88fe4d5a817ec9f33224d5d2496686e7927":0,"5addc107f018f5005332a1a66788833ab1dfea72":0,"8ba324e8f22ae10257d5ec099263436f3c6c38d3":0,"37c21c1cfb9c4d0a60932441370ab36c6a5c456b":0,"098b478ce81020f8a1d072bde5675e67da5bc2f2":0,"888d3175e9696a971c4a2622b7b0ecb041edc585":0,"db5a380942f870cf1e96de200f8e55cc83680258":0,"1c3815509f189dc2cc002688eba8f43dd249b158":17,"adb292d2172f99391498604895df481a137dfab1":0,"2807434aeca8157c4d7fb094147a9c6062efe4f1":142,"0523508593e607b657899d23fdfd6e2342467293":0,"a5326feb168032b92111adfd6bce866827e3200c":0,"943bba27e66e9e17ce4e2ca659f339bbb7a6f3df":0},"tools":{"claude-code":{"name":"Claude Code","commits":139,"loc":4937,"first_seen":1793735763,"last_seen":1793995260}},"monthly":{"2026-11":{"loc":4937,"attributed_loc":4937}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":5.0,"workflow_agents":0.0,"tools_configured":3.0,"earliest_adoption":1793735763.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":".claude/settings.json (claude-code configuration)","ref":".claude/settings.json","url":"https://github.com/Arwalk/goose-protobuf/blob/a9e99bb010eb6817d374de8e93666dc955eb8a01/.claude/settings.json","weight":0.5},{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/Arwalk/goose-protobuf/blob/a9e99bb010eb6817d374de8e93666dc955eb8a01/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/Arwalk/goose-protobuf/blob/a9e99bb010eb6817d374de8e93666dc955eb8a01/AGENTS.md","weight":0.5},{"kind":"ai-artifact","description":".cursor/hooks.json (cursor configuration)","ref":".cursor/hooks.json","url":"https://github.com/Arwalk/goose-protobuf/blob/a9e99bb010eb6817d374de8e93666dc955eb8a01/.cursor/hooks.json","weight":0.5},{"kind":"ai-artifact","description":".cursor/rules/beads.mdc (cursor configuration)","ref":".cursor/rules/beads.mdc","url":"https://github.com/Arwalk/goose-protobuf/blob/a9e99bb010eb6817d374de8e93666dc955eb8a01/.cursor/rules/beads.mdc","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":".claude/settings.json","added_at":1793736003},{"tool":"claude-code","path":"CLAUDE.md","added_at":1793735763},{"tool":"generic-agent","path":"AGENTS.md","added_at":1793735763},{"tool":"cursor","path":".cursor/hooks.json","added_at":1793736003},{"tool":"cursor","path":".cursor/rules/beads.mdc","added_at":1793736003}],"workflows":[],"tools":["claude-code","cursor","generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":7.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":4937.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":357.7019989921048,"median_loc_per_hour":101.49942329873126,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":3753.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":9.0,"findings_high":8.0,"findings_medium":1.0,"findings_low":0.0,"weighted_findings":6.6,"scanned_lines":3753.0,"parse_errors":7.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"conformance/check_testee.py","line":87,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:conformance/check_testee.py:87"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/bench_codec.py","line":75,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/bench_codec.py:75"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/bench_generator.py","line":83,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/bench_generator.py:83"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-os-exec-audit","severity":"high","message":"Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low]","path":"scripts/bench_generator.py","line":96,"fingerprint":"python.lang.security.audit.dangerous-os-exec-audit:scripts/bench_generator.py:96"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/bench_generator.py","line":110,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/bench_generator.py:110"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/check_troubleshooting.py","line":126,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/check_troubleshooting.py:126"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/check_troubleshooting.py","line":213,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/check_troubleshooting.py:213"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/interop.py","line":52,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/interop.py:52"},{"rule_id":"opengrep/python.lang.security.audit.insecure-file-permissions","severity":"medium","message":"These permissions `0o755` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else. [confidence medium]","path":"scripts/bench_generator.py","line":81,"fingerprint":"python.lang.security.audit.insecure-file-permissions:scripts/bench_generator.py:81"}],"evidence":[],"data":{"rulesets":["bash","python","c"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":23.0,"findings_high":12.0,"findings_medium":11.0,"findings_low":0.0,"penalty":164.4},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":20,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:20"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":103,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:103"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":106,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:106"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":139,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:139"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":142,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:142"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":162,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:162"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":170,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:170"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":209,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:209"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/fuzz.yml","line":15,"fingerprint":"unpinned-uses:.github/workflows/fuzz.yml:15"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/fuzz.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/fuzz.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/fuzz.yml","line":47,"fingerprint":"unpinned-uses:.github/workflows/fuzz.yml:47"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":20,"fingerprint":"artipacked:.github/workflows/ci.yml:20"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":103,"fingerprint":"artipacked:.github/workflows/ci.yml:103"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":139,"fingerprint":"artipacked:.github/workflows/ci.yml:139"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":162,"fingerprint":"artipacked:.github/workflows/ci.yml:162"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":5,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:5"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":12,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:12"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":97,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:97"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":136,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:136"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":155,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:155"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/fuzz.yml","line":15,"fingerprint":"artipacked:.github/workflows/fuzz.yml:15"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/fuzz.yml","line":12,"fingerprint":"excessive-permissions:.github/workflows/fuzz.yml:12"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: SECURITY.md","ref":"SECURITY.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":83.0,"function_nloc":818.0,"mean_ccn":3.82,"p90_ccn":8.0,"complex_functions":1.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0538},"findings":[],"evidence":[{"kind":"complex-function","description":"check in scripts/check_reference.py: complexity 20, 44 lines","ref":"scripts/check_reference.py","url":"https://github.com/Arwalk/goose-protobuf/blob/a9e99bb010eb6817d374de8e93666dc955eb8a01/scripts/check_reference.py#L57","weight":0.3333333333333333}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":3092.0,"duplicated_lines":74.0,"duplicated_share":0.0239,"files":53.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/build_testee.sh:33 and scripts/fuzz.sh:37","ref":"scripts/build_testee.sh","url":"https://github.com/Arwalk/goose-protobuf/blob/a9e99bb010eb6817d374de8e93666dc955eb8a01/scripts/build_testee.sh#L33","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/golden.sh:28 and scripts/wkt.sh:13","ref":"scripts/golden.sh","url":"https://github.com/Arwalk/goose-protobuf/blob/a9e99bb010eb6817d374de8e93666dc955eb8a01/scripts/golden.sh#L28","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/test_buf_golden.sh:7 and scripts/test_check_generated.sh:7","ref":"scripts/test_buf_golden.sh","url":"https://github.com/Arwalk/goose-protobuf/blob/a9e99bb010eb6817d374de8e93666dc955eb8a01/scripts/test_buf_golden.sh#L7","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/test_check_generated.sh:18 and scripts/test_golden.sh:22","ref":"scripts/test_check_generated.sh","url":"https://github.com/Arwalk/goose-protobuf/blob/a9e99bb010eb6817d374de8e93666dc955eb8a01/scripts/test_check_generated.sh#L18","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":31.0,"weighted_findings":12.0,"scanned_lines":3753.0,"category:best-practice":3.0,"category:correctness":28.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"conformance/check_testee.py","line":179,"fingerprint":"python.lang.best-practice.arbitrary-sleep:conformance/check_testee.py:179"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/bench_generator.py","line":75,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/bench_generator.py:75"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/bench_generator.py","line":79,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/bench_generator.py:79"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"scripts/buf_golden.sh","line":59,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:scripts/buf_golden.sh:59"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/build_plugin.sh","line":27,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/build_plugin.sh:27"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/build_testee.sh","line":52,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/build_testee.sh:52"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/check_generated.sh","line":65,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/check_generated.sh:65"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/consumer_test.sh","line":76,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/consumer_test.sh:76"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/consumer_test.sh","line":190,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/consumer_test.sh:190"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/goose_tests.sh","line":34,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/goose_tests.sh:34"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/goose_tests.sh","line":50,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/goose_tests.sh:50"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/roundtrip.sh","line":100,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/roundtrip.sh:100"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test_buf_golden.sh","line":65,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test_buf_golden.sh:65"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test_check_docs.sh","line":25,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test_check_docs.sh:25"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test_check_generated.sh","line":46,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test_check_generated.sh:46"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test_check_links.sh","line":39,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test_check_links.sh:39"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test_check_links.sh","line":68,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test_check_links.sh:68"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test_consumer_test.sh","line":29,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test_consumer_test.sh:29"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test_fuzz.sh","line":21,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test_fuzz.sh:21"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test_golden.sh","line":70,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test_golden.sh:70"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test_goose_tests.sh","line":18,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test_goose_tests.sh:18"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test_install_plugin.sh","line":79,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test_install_plugin.sh:79"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test_interop.sh","line":21,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test_interop.sh:21"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test_interop.sh","line":25,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test_interop.sh:25"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test_interop.sh","line":33,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test_interop.sh:33"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test_interop.sh","line":40,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test_interop.sh:40"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test_protoc_versions.sh","line":40,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test_protoc_versions.sh:40"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test_roundtrip.sh","line":27,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test_roundtrip.sh:27"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test_run_conformance.sh","line":48,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test_run_conformance.sh:48"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test_selfhost_tests.sh","line":48,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test_selfhost_tests.sh:48"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/wkt.sh","line":68,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/wkt.sh:68"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.3096,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.3019,"test_lines":581.0,"source_lines":3753.0,"test_ratio":0.1548,"ci_files":2.0,"cochange_share":0.0755,"cochange_commits":53.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/fuzz.yml","ref":".github/workflows/fuzz.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":1.0,"readme_lines":78.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":3753.0,"other_lines":0.0,"files_blamed":53.0,"blame_failures":0.0,"quality:ai_findings":31.0,"quality:ai_per_kloc":8.26,"quality:other_findings":0.0,"security:ai_findings":9.0,"security:ai_per_kloc":2.398,"security:other_findings":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":["unreviewed-ai-risk"]}