{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:00.639190Z","repo":{"ref":{"host":"github.com","owner":"Himalian","name":"CLIAgents.nvim"},"default_branch":"main","clone_url":"https://github.com/Himalian/CLIAgents.nvim.git","html_url":"https://github.com/Himalian/CLIAgents.nvim","description":null,"stars":0,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":896,"primary_language":"Lua","license_spdx":"MIT","created_at":"2025-09-05T06:54:03Z","pushed_at":"2025-10-22T08:26:35Z","security_policy_url":"https://github.com/Himalian/CLIAgents.nvim/security/policy","distribution":{"owner_created_at":"2022-01-07T03:29:31Z","owner_type":"User","release_assets":[]}},"commit_sha":"fe828b28599987eb7b466177805e484927c4d4ee","profile":{"lines_by_language":{"Lua":5006,"Shell":564},"files_by_category":{"docs":18,"source":18,"config":14,"test":12,"other":7,"binary":1},"source_lines":2861,"test_lines":2709},"pillars":{"ai_provenance":{"score":51.1,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.5108,"suspected_share":0.0,"estimated_share":0.5108,"ai_artifacts":3.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":4.893},"summary":"Explicit AI attribution on 51% of first-party code added; an estimated 51% including velocity signals."},"quality":{"score":82.5,"confidence":0.9,"coverage":1.0,"label":"strong","breakdown":{"complexity":79.9,"duplication":89.5,"lint":88.2,"testing":70.0,"docs":100.0,"type_safety":null,"process":null},"summary":"Code quality is strong: test-to-source ratio 0.95, no CI test run detected; 7% of function code in complex or long functions; 2% duplicated lines. Weakest area: testing."},"security":{"score":70.2,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":100.0,"dependencies":null,"ci_actions":0.9,"posture":40.0,"scorecard":null},"summary":"Security posture is adequate: 23 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":136.0,"attributed_commits":56.0,"attributed_commit_share":0.4117647058823529,"effective_loc":8710.0,"attributed_loc":4449.0,"attributed_loc_share":0.5107921928817452,"tools_detected":2.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 55 attributed commits, 4,449 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"OpenHands: 1 attributed commits, 0 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"OpenHands: author openhands","ref":"ffdf35d8566528cb144d9812eccfecee34502edf","url":"https://github.com/Himalian/CLIAgents.nvim/commit/ffdf35d8566528cb144d9812eccfecee34502edf","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ca3c2ae414901e06de23e1a89fae5079321aed54","url":"https://github.com/Himalian/CLIAgents.nvim/commit/ca3c2ae414901e06de23e1a89fae5079321aed54","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"161bb9df609ddbf74b100908a236b8bd452e1db7","url":"https://github.com/Himalian/CLIAgents.nvim/commit/161bb9df609ddbf74b100908a236b8bd452e1db7","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"6178dbe244f1302336791eead9abb15c88c7098a","url":"https://github.com/Himalian/CLIAgents.nvim/commit/6178dbe244f1302336791eead9abb15c88c7098a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d1dbc6b7025c4f034e14cc0dda6d29d5a6a5c4e8","url":"https://github.com/Himalian/CLIAgents.nvim/commit/d1dbc6b7025c4f034e14cc0dda6d29d5a6a5c4e8","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ebd162520e17fe9a27d26d393a5b470f4e841456","url":"https://github.com/Himalian/CLIAgents.nvim/commit/ebd162520e17fe9a27d26d393a5b470f4e841456","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"47f9cdd6ad120ade7540f4c452cd9f9dce7cd71b","url":"https://github.com/Himalian/CLIAgents.nvim/commit/47f9cdd6ad120ade7540f4c452cd9f9dce7cd71b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author Claude","ref":"153a977d881e59a2a69439d7cb76f0bc5faff702","url":"https://github.com/Himalian/CLIAgents.nvim/commit/153a977d881e59a2a69439d7cb76f0bc5faff702","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author Claude","ref":"9b8f3dd9389d52b16d8c3c1d666aabb28fd8256d","url":"https://github.com/Himalian/CLIAgents.nvim/commit/9b8f3dd9389d52b16d8c3c1d666aabb28fd8256d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author Claude","ref":"80376a51c2b9cce99af28b84791c242da5579a7e","url":"https://github.com/Himalian/CLIAgents.nvim/commit/80376a51c2b9cce99af28b84791c242da5579a7e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author Claude","ref":"86ee3b3b4fdaaad3d77afd0e1fa93428a9c20bbd","url":"https://github.com/Himalian/CLIAgents.nvim/commit/86ee3b3b4fdaaad3d77afd0e1fa93428a9c20bbd","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author Claude","ref":"3bf053fdf24e42959aceb5c50843920d66372a42","url":"https://github.com/Himalian/CLIAgents.nvim/commit/3bf053fdf24e42959aceb5c50843920d66372a42","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"4275a954179581168c8532b99e178f3867d8c18b","url":"https://github.com/Himalian/CLIAgents.nvim/commit/4275a954179581168c8532b99e178f3867d8c18b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d741309db029c78682b64ca620302742fe70fb43","url":"https://github.com/Himalian/CLIAgents.nvim/commit/d741309db029c78682b64ca620302742fe70fb43","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"5708e1e89f5b461242853532160584194cf92d34","url":"https://github.com/Himalian/CLIAgents.nvim/commit/5708e1e89f5b461242853532160584194cf92d34","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"e63379c88e32ac285d11c70ca776a52fc7b785ce","url":"https://github.com/Himalian/CLIAgents.nvim/commit/e63379c88e32ac285d11c70ca776a52fc7b785ce","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"9feed06be072d7b4bac3f412ff30316ee98f4dd9","url":"https://github.com/Himalian/CLIAgents.nvim/commit/9feed06be072d7b4bac3f412ff30316ee98f4dd9","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"53d9af906827a3a6d68ac901b22218018f39fcca","url":"https://github.com/Himalian/CLIAgents.nvim/commit/53d9af906827a3a6d68ac901b22218018f39fcca","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"958b59f4b2040f5ff25c8e7a241a2abeecffa5cb","url":"https://github.com/Himalian/CLIAgents.nvim/commit/958b59f4b2040f5ff25c8e7a241a2abeecffa5cb","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"04f1aa32e8e718eeb06c02d85a75230e5631a8a0","url":"https://github.com/Himalian/CLIAgents.nvim/commit/04f1aa32e8e718eeb06c02d85a75230e5631a8a0","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"88d1ee42035ae84690d4a090b6f11811dcd77e86","url":"https://github.com/Himalian/CLIAgents.nvim/commit/88d1ee42035ae84690d4a090b6f11811dcd77e86","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"a4506d6dd1873a6e1337a4f34ee797ae5a7e64e6","url":"https://github.com/Himalian/CLIAgents.nvim/commit/a4506d6dd1873a6e1337a4f34ee797ae5a7e64e6","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"bf7b021d5f0f19121d2315acf07821107d140578","url":"https://github.com/Himalian/CLIAgents.nvim/commit/bf7b021d5f0f19121d2315acf07821107d140578","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1df754842eb1327a1543483ba837f4937d0cd8a3","url":"https://github.com/Himalian/CLIAgents.nvim/commit/1df754842eb1327a1543483ba837f4937d0cd8a3","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1b0f21a5f6aa589561f763db26a056ffd1a1e9ab","url":"https://github.com/Himalian/CLIAgents.nvim/commit/1b0f21a5f6aa589561f763db26a056ffd1a1e9ab","weight":0.9}],"data":{"attributed_loc_by_commit":{"b04c30baddbab6ef3bcde0362f3b5792150441c6":0,"14ef5b49eb0038374c6d9ba7977a5e71110b73e5":0,"e2edba902a3e0e98a4598b732b355a22ecab2e7c":33,"ee03cc56c7ba3d9d1abcc21a9f0fe9cafd6f9193":0,"5f31df9efd14c91ff5663db1a773b2d74d6e983a":361,"192ba4a66de234b1010ad42f0ef3070eab2e7374":0,"58e8c93ac6232bde67565297fb8d2b7990b2ac2e":5,"39256a00b96f7b25f1ca7e933858ba31355330d2":0,"3fa343658ac93979c55c3bb268610426e939adbe":795,"0c3e08d9cabfcde0b026ec3bb4a01d390180e146":23,"5cfdedb0ac9619c647e109351d447ed72a77b5b2":24,"9085353c5c0caee40e61afbf39027db4b46246f0":4,"b03436e671f1ff82c8a60f2ba5d24540acd6a40c":42,"937be6347a3aeefc4f48d11bea5bed50b8b8611f":252,"d0ad1d25531e145130c12c385c1a306cad7233b5":66,"de1852abf8ff25145433e7d4391238f6d6d96ce0":49,"4f7f424c993a3089920b580c61c18b030b56eb87":0,"8906b13c282d209caac7a2a9cbc6ad7b0fb829e8":0,"36b065c09bec45fd89af69fc4009d00ba3ee3da2":0,"cef868bf2c74248473488964b2015fc307ac18b2":10,"1378066f7420ae78af7fa250018dcd8d19a447fa":28,"1e1eafb7ec56ab32411e511985e2bda75b5ca172":50,"5cd25f9de9e142862fe1c3c71816937a79b53705":31,"08ede274e1326d49d194ca212a96f0e33b4d42c3":62,"a7621a0c83f31ca544299cfe3c477efb3952543b":4,"22c9d4d9a0cab9613a3c54860fdacabfad680e80":86,"3f332196dcefe674c9ee1bade8471d7f84a9df96":12,"5faa1f8f10827abacb45bfdfd7c4dbb228301a44":20,"536a0686ce1cb1dcb2cee404089c396001323422":18,"dfa3f0947fa10843a43d2806aeefe8160eb70f98":21,"0af7092ed008ab1845fdba7abc072c85ff3f0d85":79,"1b0f21a5f6aa589561f763db26a056ffd1a1e9ab":10,"1df754842eb1327a1543483ba837f4937d0cd8a3":39,"bf7b021d5f0f19121d2315acf07821107d140578":46,"a4506d6dd1873a6e1337a4f34ee797ae5a7e64e6":0,"88d1ee42035ae84690d4a090b6f11811dcd77e86":3,"04f1aa32e8e718eeb06c02d85a75230e5631a8a0":10,"958b59f4b2040f5ff25c8e7a241a2abeecffa5cb":0,"53d9af906827a3a6d68ac901b22218018f39fcca":0,"9feed06be072d7b4bac3f412ff30316ee98f4dd9":3,"e63379c88e32ac285d11c70ca776a52fc7b785ce":0,"5708e1e89f5b461242853532160584194cf92d34":0,"d741309db029c78682b64ca620302742fe70fb43":0,"4275a954179581168c8532b99e178f3867d8c18b":3,"3bf053fdf24e42959aceb5c50843920d66372a42":0,"86ee3b3b4fdaaad3d77afd0e1fa93428a9c20bbd":498,"80376a51c2b9cce99af28b84791c242da5579a7e":0,"9b8f3dd9389d52b16d8c3c1d666aabb28fd8256d":0,"153a977d881e59a2a69439d7cb76f0bc5faff702":0,"47f9cdd6ad120ade7540f4c452cd9f9dce7cd71b":64,"ebd162520e17fe9a27d26d393a5b470f4e841456":0,"d1dbc6b7025c4f034e14cc0dda6d29d5a6a5c4e8":433,"6178dbe244f1302336791eead9abb15c88c7098a":87,"161bb9df609ddbf74b100908a236b8bd452e1db7":1178,"ca3c2ae414901e06de23e1a89fae5079321aed54":0,"ffdf35d8566528cb144d9812eccfecee34502edf":0},"tools":{"claude-code":{"name":"Claude Code","commits":55,"loc":4449,"first_seen":1740487599,"last_seen":1747613619},"openhands":{"name":"OpenHands","commits":1,"loc":0,"first_seen":1747958270,"last_seen":1747958270}},"monthly":{"2025-02":{"loc":2383,"attributed_loc":1654},"2025-03":{"loc":2541,"attributed_loc":1530},"2025-05":{"loc":1797,"attributed_loc":1265},"2025-06":{"loc":742,"attributed_loc":0},"2025-08":{"loc":993,"attributed_loc":0},"2025-09":{"loc":210,"attributed_loc":0},"2025-10":{"loc":44,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":3.0,"workflow_agents":0.0,"tools_configured":3.0,"earliest_adoption":1740508748.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/Himalian/CLIAgents.nvim/blob/fe828b28599987eb7b466177805e484927c4d4ee/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/Himalian/CLIAgents.nvim/blob/fe828b28599987eb7b466177805e484927c4d4ee/AGENTS.md","weight":0.5},{"kind":"ai-artifact","description":"GEMINI.md (gemini configuration)","ref":"GEMINI.md","url":"https://github.com/Himalian/CLIAgents.nvim/blob/fe828b28599987eb7b466177805e484927c4d4ee/GEMINI.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1740508748},{"tool":"generic-agent","path":"AGENTS.md","added_at":1757054852},{"tool":"gemini","path":"GEMINI.md","added_at":1761117978}],"workflows":[],"tools":["claude-code","gemini","generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":35.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":8710.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":521.6262975778546,"median_loc_per_hour":93.0,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":2861.0,"index":4.893,"count:narrated_steps":4.0,"per_kloc:narrated_steps":1.398,"files:narrated_steps":3.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":20.0,"per_kloc:emoji_in_code":6.991,"files:emoji_in_code":3.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # First, determine the minimum heading level used in the file","ref":"scripts/markdown/fix_heading_levels.sh:25","url":"https://github.com/Himalian/CLIAgents.nvim/blob/fe828b28599987eb7b466177805e484927c4d4ee/scripts/markdown/fix_heading_levels.sh#L25","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: -- First, update the canonical version","ref":"scripts/version_bump.lua:248","url":"https://github.com/Himalian/CLIAgents.nvim/blob/fe828b28599987eb7b466177805e484927c4d4ee/scripts/version_bump.lua#L248","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: -- First, check for structured version with major.minor.patch format","ref":"scripts/version_check.lua:56","url":"https://github.com/Himalian/CLIAgents.nvim/blob/fe828b28599987eb7b466177805e484927c4d4ee/scripts/version_check.lua#L56","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: -- First, get the canonical version from version.lua","ref":"scripts/version_check.lua:113","url":"https://github.com/Himalian/CLIAgents.nvim/blob/fe828b28599987eb7b466177805e484927c4d4ee/scripts/version_check.lua#L113","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"findings_high":0.0,"findings_medium":0.0,"findings_low":0.0,"weighted_findings":0.0,"scanned_lines":564.0,"parse_errors":0.0},"findings":[],"evidence":[],"data":{"rulesets":["bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":3.0,"findings":38.0,"findings_high":23.0,"findings_medium":7.0,"findings_low":8.0,"penalty":285.6},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":19,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:19"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":22,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:22"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":33,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:33"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/dependency-updates.yml","line":13,"fingerprint":"excessive-permissions:.github/workflows/dependency-updates.yml:13"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":19,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:19"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":46,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:46"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":54,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:54"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":94,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:94"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":102,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:102"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":125,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:125"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":135,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:135"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":138,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:138"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":143,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:143"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":148,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:148"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":171,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:171"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/release.yml","line":30,"fingerprint":"template-injection:.github/workflows/release.yml:30"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/release.yml","line":37,"fingerprint":"template-injection:.github/workflows/release.yml:37"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/release.yml","line":62,"fingerprint":"template-injection:.github/workflows/release.yml:62"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/release.yml","line":113,"fingerprint":"template-injection:.github/workflows/release.yml:113"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/release.yml","line":115,"fingerprint":"template-injection:.github/workflows/release.yml:115"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/release.yml","line":121,"fingerprint":"template-injection:.github/workflows/release.yml:121"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/release.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":125,"fingerprint":"unpinned-uses:.github/workflows/release.yml:125"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":19,"fingerprint":"artipacked:.github/workflows/ci.yml:19"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":10,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:10"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/dependency-updates.yml","line":19,"fingerprint":"artipacked:.github/workflows/dependency-updates.yml:19"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/dependency-updates.yml","line":54,"fingerprint":"artipacked:.github/workflows/dependency-updates.yml:54"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/dependency-updates.yml","line":102,"fingerprint":"artipacked:.github/workflows/dependency-updates.yml:102"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/dependency-updates.yml","line":135,"fingerprint":"artipacked:.github/workflows/dependency-updates.yml:135"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":23,"fingerprint":"artipacked:.github/workflows/release.yml:23"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":45,"fingerprint":"template-injection:.github/workflows/release.yml:45"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":46,"fingerprint":"template-injection:.github/workflows/release.yml:46"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":54,"fingerprint":"template-injection:.github/workflows/release.yml:54"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":55,"fingerprint":"template-injection:.github/workflows/release.yml:55"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":64,"fingerprint":"template-injection:.github/workflows/release.yml:64"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":106,"fingerprint":"template-injection:.github/workflows/release.yml:106"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":108,"fingerprint":"template-injection:.github/workflows/release.yml:108"},{"rule_id":"zizmor/superfluous-actions","severity":"info","message":"action functionality is already included by the runner [confidence high]","path":".github/workflows/release.yml","line":125,"fingerprint":"superfluous-actions:.github/workflows/release.yml:125"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.1029,"unpinned_manifests":0.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: SECURITY.md","ref":"SECURITY.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":75.0,"function_nloc":1295.0,"mean_ccn":5.05,"p90_ccn":12.0,"complex_functions":2.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0749},"findings":[],"evidence":[{"kind":"complex-function","description":"validate_float_config in lua/claude-code/config.lua: complexity 28, 53 lines","ref":"lua/claude-code/config.lua","url":"https://github.com/Himalian/CLIAgents.nvim/blob/fe828b28599987eb7b466177805e484927c4d4ee/lua/claude-code/config.lua#L191","weight":0.4666666666666667},{"kind":"complex-function","description":"M.get_provider_config in lua/claude-code/providers.lua: complexity 16, 44 lines","ref":"lua/claude-code/providers.lua","url":"https://github.com/Himalian/CLIAgents.nvim/blob/fe828b28599987eb7b466177805e484927c4d4ee/lua/claude-code/providers.lua#L37","weight":0.26666666666666666}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":2059.0,"duplicated_lines":38.0,"duplicated_share":0.0185,"files":18.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/version_bump.lua:67 and scripts/version_check.lua:38","ref":"scripts/version_bump.lua","url":"https://github.com/Himalian/CLIAgents.nvim/blob/fe828b28599987eb7b466177805e484927c4d4ee/scripts/version_bump.lua#L67","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":2.0,"weighted_findings":0.5,"scanned_lines":564.0,"category:correctness":2.0},"findings":[{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test.sh","line":41,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test.sh:41"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test.sh","line":50,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test.sh:50"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":2709.0,"source_lines":2861.0,"test_ratio":0.9469,"ci_files":3.0,"cochange_share":0.4167,"cochange_commits":72.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/dependency-updates.yml","ref":".github/workflows/dependency-updates.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":1.0,"readme_lines":228.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":1789.0,"other_lines":1072.0,"files_blamed":18.0,"blame_failures":0.0,"quality:ai_findings":2.0,"quality:ai_per_kloc":1.118,"quality:other_findings":0.0,"quality:other_per_kloc":0.0,"security:ai_findings":0.0,"security:ai_per_kloc":0.0,"security:other_findings":0.0,"security:other_per_kloc":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}