{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:43:13.055014Z","repo":{"ref":{"host":"github.com","owner":"greggh","name":"claude-code.nvim"},"default_branch":"main","clone_url":"https://github.com/greggh/claude-code.nvim.git","html_url":"https://github.com/greggh/claude-code.nvim","description":"Seamless integration between Claude Code AI assistant and Neovim","stars":2107,"forks":73,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":839,"primary_language":"Lua","license_spdx":"MIT","created_at":"2025-02-24T21:33:05Z","pushed_at":"2026-02-04T14:44:51Z","security_policy_url":"https://github.com/greggh/claude-code.nvim/security/policy","distribution":{"owner_created_at":"2009-05-30T23:41:51Z","owner_type":"User","release_assets":[]}},"commit_sha":"55c0cb59828fbc3bec744288286a46f5d5750b83","profile":{"lines_by_language":{"Lua":4176,"Shell":564},"files_by_category":{"source":17,"docs":16,"config":14,"test":11,"other":5,"binary":1},"source_lines":2539,"test_lines":2201},"pillars":{"ai_provenance":{"score":70.2,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.7015,"suspected_share":0.0,"estimated_share":0.7015,"ai_artifacts":1.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"Explicit AI attribution on 70% of first-party code added; an estimated 70% including velocity signals."},"quality":{"score":83.9,"confidence":0.9,"coverage":1.0,"label":"strong","breakdown":{"complexity":86.7,"duplication":88.3,"lint":88.2,"testing":70.0,"docs":100.0,"type_safety":null,"process":null},"summary":"Code quality is strong: test-to-source ratio 0.87, no CI test run detected; 5% of function code in complex or long functions; 2% duplicated lines. Weakest area: testing."},"security":{"score":70.2,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":100.0,"dependencies":null,"ci_actions":0.9,"posture":40.0,"scorecard":null},"summary":"Security posture is adequate: 23 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":125.0,"attributed_commits":74.0,"attributed_commit_share":0.592,"effective_loc":7491.0,"attributed_loc":5255.0,"attributed_loc_share":0.7015084768388733,"tools_detected":2.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 73 attributed commits, 5,255 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"OpenHands: 1 attributed commits, 0 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: on merged branch (c9a31e5106)","ref":"1952ba2586150ef0b789d024ff78f8d90dadba13","url":"https://github.com/greggh/claude-code.nvim/commit/1952ba2586150ef0b789d024ff78f8d90dadba13","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (c9a31e5106)","ref":"1617a92b12241c38b0d867b3ad1c708f3ca5bf38","url":"https://github.com/greggh/claude-code.nvim/commit/1617a92b12241c38b0d867b3ad1c708f3ca5bf38","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (c9a31e5106)","ref":"ed9c728a381b8fee32e0336121faf745386c968b","url":"https://github.com/greggh/claude-code.nvim/commit/ed9c728a381b8fee32e0336121faf745386c968b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (c9a31e5106)","ref":"3f8839dcea76d1f1fd4ebf3ad07567ae7b626209","url":"https://github.com/greggh/claude-code.nvim/commit/3f8839dcea76d1f1fd4ebf3ad07567ae7b626209","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (c9a31e5106)","ref":"c2af084756c1c297bb8f87c038518b78006d9d84","url":"https://github.com/greggh/claude-code.nvim/commit/c2af084756c1c297bb8f87c038518b78006d9d84","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (c9a31e5106)","ref":"d1601c64cd61b955e102243fbd285f9f441f5a34","url":"https://github.com/greggh/claude-code.nvim/commit/d1601c64cd61b955e102243fbd285f9f441f5a34","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (c9a31e5106)","ref":"12fa63f15e071618ac9fec48abfae443223fa368","url":"https://github.com/greggh/claude-code.nvim/commit/12fa63f15e071618ac9fec48abfae443223fa368","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (c9a31e5106)","ref":"780ca1b489fdafad34fce0c7bf5b79c9966e6a87","url":"https://github.com/greggh/claude-code.nvim/commit/780ca1b489fdafad34fce0c7bf5b79c9966e6a87","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (c9a31e5106)","ref":"22dcdffa60d2e60e06f827c1526fd27bb9c1a0d6","url":"https://github.com/greggh/claude-code.nvim/commit/22dcdffa60d2e60e06f827c1526fd27bb9c1a0d6","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (275c47615f)","ref":"da466772cb44e6360f663aca964f9e0707653631","url":"https://github.com/greggh/claude-code.nvim/commit/da466772cb44e6360f663aca964f9e0707653631","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (275c47615f)","ref":"d3693c1210bafb521fdc78ffc4417eb42df7e50c","url":"https://github.com/greggh/claude-code.nvim/commit/d3693c1210bafb521fdc78ffc4417eb42df7e50c","weight":0.9},{"kind":"attributed-commit","description":"OpenHands: author openhands","ref":"ffdf35d8566528cb144d9812eccfecee34502edf","url":"https://github.com/greggh/claude-code.nvim/commit/ffdf35d8566528cb144d9812eccfecee34502edf","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (c9a31e5106)","ref":"891e47370a46d0edaa5c7eace22f20efd8e5e7f7","url":"https://github.com/greggh/claude-code.nvim/commit/891e47370a46d0edaa5c7eace22f20efd8e5e7f7","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (c9a31e5106)","ref":"e60039fd2f4e59c90de093f61e1b18f35bebb184","url":"https://github.com/greggh/claude-code.nvim/commit/e60039fd2f4e59c90de093f61e1b18f35bebb184","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (c9a31e5106)","ref":"69eeaaf46f197f6bf70f3031d3259cb5c7e935a4","url":"https://github.com/greggh/claude-code.nvim/commit/69eeaaf46f197f6bf70f3031d3259cb5c7e935a4","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (c9a31e5106)","ref":"c2603ce8d1f812b5bc0d50c4ab3b704be516571c","url":"https://github.com/greggh/claude-code.nvim/commit/c2603ce8d1f812b5bc0d50c4ab3b704be516571c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (c9a31e5106)","ref":"a3fb884099dbee232c52a9831bdcd28e5121cda4","url":"https://github.com/greggh/claude-code.nvim/commit/a3fb884099dbee232c52a9831bdcd28e5121cda4","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (c9a31e5106)","ref":"abc2aa57c719c7495905e2312ab1d8be22914dd7","url":"https://github.com/greggh/claude-code.nvim/commit/abc2aa57c719c7495905e2312ab1d8be22914dd7","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (c9a31e5106)","ref":"27ec4c0f855bb611159ae4491838baff2d7af8e1","url":"https://github.com/greggh/claude-code.nvim/commit/27ec4c0f855bb611159ae4491838baff2d7af8e1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ca3c2ae414901e06de23e1a89fae5079321aed54","url":"https://github.com/greggh/claude-code.nvim/commit/ca3c2ae414901e06de23e1a89fae5079321aed54","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"161bb9df609ddbf74b100908a236b8bd452e1db7","url":"https://github.com/greggh/claude-code.nvim/commit/161bb9df609ddbf74b100908a236b8bd452e1db7","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"6178dbe244f1302336791eead9abb15c88c7098a","url":"https://github.com/greggh/claude-code.nvim/commit/6178dbe244f1302336791eead9abb15c88c7098a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d1dbc6b7025c4f034e14cc0dda6d29d5a6a5c4e8","url":"https://github.com/greggh/claude-code.nvim/commit/d1dbc6b7025c4f034e14cc0dda6d29d5a6a5c4e8","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ebd162520e17fe9a27d26d393a5b470f4e841456","url":"https://github.com/greggh/claude-code.nvim/commit/ebd162520e17fe9a27d26d393a5b470f4e841456","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"47f9cdd6ad120ade7540f4c452cd9f9dce7cd71b","url":"https://github.com/greggh/claude-code.nvim/commit/47f9cdd6ad120ade7540f4c452cd9f9dce7cd71b","weight":0.9}],"data":{"attributed_loc_by_commit":{"b04c30baddbab6ef3bcde0362f3b5792150441c6":0,"14ef5b49eb0038374c6d9ba7977a5e71110b73e5":0,"e2edba902a3e0e98a4598b732b355a22ecab2e7c":33,"ee03cc56c7ba3d9d1abcc21a9f0fe9cafd6f9193":0,"5f31df9efd14c91ff5663db1a773b2d74d6e983a":361,"192ba4a66de234b1010ad42f0ef3070eab2e7374":0,"58e8c93ac6232bde67565297fb8d2b7990b2ac2e":5,"39256a00b96f7b25f1ca7e933858ba31355330d2":0,"3fa343658ac93979c55c3bb268610426e939adbe":795,"0c3e08d9cabfcde0b026ec3bb4a01d390180e146":23,"5cfdedb0ac9619c647e109351d447ed72a77b5b2":24,"9085353c5c0caee40e61afbf39027db4b46246f0":4,"b03436e671f1ff82c8a60f2ba5d24540acd6a40c":42,"937be6347a3aeefc4f48d11bea5bed50b8b8611f":252,"d0ad1d25531e145130c12c385c1a306cad7233b5":66,"de1852abf8ff25145433e7d4391238f6d6d96ce0":49,"4f7f424c993a3089920b580c61c18b030b56eb87":0,"8906b13c282d209caac7a2a9cbc6ad7b0fb829e8":0,"36b065c09bec45fd89af69fc4009d00ba3ee3da2":0,"cef868bf2c74248473488964b2015fc307ac18b2":10,"1378066f7420ae78af7fa250018dcd8d19a447fa":28,"1e1eafb7ec56ab32411e511985e2bda75b5ca172":50,"5cd25f9de9e142862fe1c3c71816937a79b53705":31,"08ede274e1326d49d194ca212a96f0e33b4d42c3":62,"a7621a0c83f31ca544299cfe3c477efb3952543b":4,"22c9d4d9a0cab9613a3c54860fdacabfad680e80":86,"3f332196dcefe674c9ee1bade8471d7f84a9df96":12,"5faa1f8f10827abacb45bfdfd7c4dbb228301a44":20,"536a0686ce1cb1dcb2cee404089c396001323422":18,"dfa3f0947fa10843a43d2806aeefe8160eb70f98":21,"0af7092ed008ab1845fdba7abc072c85ff3f0d85":79,"1b0f21a5f6aa589561f763db26a056ffd1a1e9ab":10,"1df754842eb1327a1543483ba837f4937d0cd8a3":39,"bf7b021d5f0f19121d2315acf07821107d140578":46,"a4506d6dd1873a6e1337a4f34ee797ae5a7e64e6":0,"88d1ee42035ae84690d4a090b6f11811dcd77e86":3,"04f1aa32e8e718eeb06c02d85a75230e5631a8a0":10,"958b59f4b2040f5ff25c8e7a241a2abeecffa5cb":0,"53d9af906827a3a6d68ac901b22218018f39fcca":0,"9feed06be072d7b4bac3f412ff30316ee98f4dd9":3,"e63379c88e32ac285d11c70ca776a52fc7b785ce":0,"5708e1e89f5b461242853532160584194cf92d34":0,"d741309db029c78682b64ca620302742fe70fb43":0,"4275a954179581168c8532b99e178f3867d8c18b":3,"3bf053fdf24e42959aceb5c50843920d66372a42":0,"86ee3b3b4fdaaad3d77afd0e1fa93428a9c20bbd":498,"80376a51c2b9cce99af28b84791c242da5579a7e":0,"9b8f3dd9389d52b16d8c3c1d666aabb28fd8256d":0,"153a977d881e59a2a69439d7cb76f0bc5faff702":0,"47f9cdd6ad120ade7540f4c452cd9f9dce7cd71b":64,"ebd162520e17fe9a27d26d393a5b470f4e841456":0,"d1dbc6b7025c4f034e14cc0dda6d29d5a6a5c4e8":433,"6178dbe244f1302336791eead9abb15c88c7098a":87,"161bb9df609ddbf74b100908a236b8bd452e1db7":1178,"ca3c2ae414901e06de23e1a89fae5079321aed54":0,"27ec4c0f855bb611159ae4491838baff2d7af8e1":3,"abc2aa57c719c7495905e2312ab1d8be22914dd7":30,"a3fb884099dbee232c52a9831bdcd28e5121cda4":24,"c2603ce8d1f812b5bc0d50c4ab3b704be516571c":10,"69eeaaf46f197f6bf70f3031d3259cb5c7e935a4":4,"e60039fd2f4e59c90de093f61e1b18f35bebb184":23,"891e47370a46d0edaa5c7eace22f20efd8e5e7f7":35,"ffdf35d8566528cb144d9812eccfecee34502edf":0,"d3693c1210bafb521fdc78ffc4417eb42df7e50c":68,"da466772cb44e6360f663aca964f9e0707653631":15,"22dcdffa60d2e60e06f827c1526fd27bb9c1a0d6":79,"780ca1b489fdafad34fce0c7bf5b79c9966e6a87":18,"12fa63f15e071618ac9fec48abfae443223fa368":372,"d1601c64cd61b955e102243fbd285f9f441f5a34":14,"c2af084756c1c297bb8f87c038518b78006d9d84":27,"3f8839dcea76d1f1fd4ebf3ad07567ae7b626209":15,"ed9c728a381b8fee32e0336121faf745386c968b":12,"1617a92b12241c38b0d867b3ad1c708f3ca5bf38":38,"1952ba2586150ef0b789d024ff78f8d90dadba13":19},"tools":{"claude-code":{"name":"Claude Code","commits":73,"loc":5255,"first_seen":1740487599,"last_seen":1751322337},"openhands":{"name":"OpenHands","commits":1,"loc":0,"first_seen":1747958270,"last_seen":1747958270}},"monthly":{"2025-02":{"loc":2383,"attributed_loc":1654},"2025-03":{"loc":2541,"attributed_loc":1530},"2025-05":{"loc":1797,"attributed_loc":1394},"2025-06":{"loc":742,"attributed_loc":677},"2026-02":{"loc":28,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":1.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1740508748.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/greggh/claude-code.nvim/blob/55c0cb59828fbc3bec744288286a46f5d5750b83/CLAUDE.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1740508748}],"workflows":[],"tools":["claude-code"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":29.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":7491.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":294.5,"median_loc_per_hour":95.90693430656934,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":2.0,"flagged_releases":0.0,"max_loc_per_day":57.2},"findings":[],"evidence":[],"data":{"releases":[{"from":"v0.4.1","to":"v0.4.2","loc":3,"days":0.44,"loc_per_day":6.7,"flagged":false},{"from":"v0.4.2","to":"v0.4.3","loc":1006,"days":17.6,"loc_per_day":57.2,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":2539.0,"index":5.514,"count:narrated_steps":4.0,"per_kloc:narrated_steps":1.575,"files:narrated_steps":3.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":20.0,"per_kloc:emoji_in_code":7.877,"files:emoji_in_code":3.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # First, determine the minimum heading level used in the file","ref":"scripts/markdown/fix_heading_levels.sh:25","url":"https://github.com/greggh/claude-code.nvim/blob/55c0cb59828fbc3bec744288286a46f5d5750b83/scripts/markdown/fix_heading_levels.sh#L25","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: -- First, update the canonical version","ref":"scripts/version_bump.lua:248","url":"https://github.com/greggh/claude-code.nvim/blob/55c0cb59828fbc3bec744288286a46f5d5750b83/scripts/version_bump.lua#L248","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: -- First, check for structured version with major.minor.patch format","ref":"scripts/version_check.lua:56","url":"https://github.com/greggh/claude-code.nvim/blob/55c0cb59828fbc3bec744288286a46f5d5750b83/scripts/version_check.lua#L56","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: -- First, get the canonical version from version.lua","ref":"scripts/version_check.lua:113","url":"https://github.com/greggh/claude-code.nvim/blob/55c0cb59828fbc3bec744288286a46f5d5750b83/scripts/version_check.lua#L113","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"findings_high":0.0,"findings_medium":0.0,"findings_low":0.0,"weighted_findings":0.0,"scanned_lines":564.0,"parse_errors":0.0},"findings":[],"evidence":[],"data":{"rulesets":["bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":3.0,"findings":38.0,"findings_high":23.0,"findings_medium":7.0,"findings_low":8.0,"penalty":285.6},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":19,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:19"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":22,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:22"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":33,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:33"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/dependency-updates.yml","line":13,"fingerprint":"excessive-permissions:.github/workflows/dependency-updates.yml:13"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":19,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:19"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":46,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:46"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":54,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:54"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":94,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:94"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":102,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:102"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":125,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:125"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":135,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:135"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":138,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:138"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":143,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:143"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":148,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:148"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/dependency-updates.yml","line":171,"fingerprint":"unpinned-uses:.github/workflows/dependency-updates.yml:171"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/release.yml","line":30,"fingerprint":"template-injection:.github/workflows/release.yml:30"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/release.yml","line":37,"fingerprint":"template-injection:.github/workflows/release.yml:37"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/release.yml","line":62,"fingerprint":"template-injection:.github/workflows/release.yml:62"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/release.yml","line":113,"fingerprint":"template-injection:.github/workflows/release.yml:113"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/release.yml","line":115,"fingerprint":"template-injection:.github/workflows/release.yml:115"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/release.yml","line":121,"fingerprint":"template-injection:.github/workflows/release.yml:121"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/release.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":125,"fingerprint":"unpinned-uses:.github/workflows/release.yml:125"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":19,"fingerprint":"artipacked:.github/workflows/ci.yml:19"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":10,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:10"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/dependency-updates.yml","line":19,"fingerprint":"artipacked:.github/workflows/dependency-updates.yml:19"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/dependency-updates.yml","line":54,"fingerprint":"artipacked:.github/workflows/dependency-updates.yml:54"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/dependency-updates.yml","line":102,"fingerprint":"artipacked:.github/workflows/dependency-updates.yml:102"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/dependency-updates.yml","line":135,"fingerprint":"artipacked:.github/workflows/dependency-updates.yml:135"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":23,"fingerprint":"artipacked:.github/workflows/release.yml:23"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":45,"fingerprint":"template-injection:.github/workflows/release.yml:45"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":46,"fingerprint":"template-injection:.github/workflows/release.yml:46"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":54,"fingerprint":"template-injection:.github/workflows/release.yml:54"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":55,"fingerprint":"template-injection:.github/workflows/release.yml:55"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":64,"fingerprint":"template-injection:.github/workflows/release.yml:64"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":106,"fingerprint":"template-injection:.github/workflows/release.yml:106"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":108,"fingerprint":"template-injection:.github/workflows/release.yml:108"},{"rule_id":"zizmor/superfluous-actions","severity":"info","message":"action functionality is already included by the runner [confidence high]","path":".github/workflows/release.yml","line":125,"fingerprint":"superfluous-actions:.github/workflows/release.yml:125"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.12,"unpinned_manifests":0.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: SECURITY.md","ref":"SECURITY.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":65.0,"function_nloc":1117.0,"mean_ccn":4.77,"p90_ccn":11.0,"complex_functions":1.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0474},"findings":[],"evidence":[{"kind":"complex-function","description":"validate_float_config in lua/claude-code/config.lua: complexity 28, 53 lines","ref":"lua/claude-code/config.lua","url":"https://github.com/greggh/claude-code.nvim/blob/55c0cb59828fbc3bec744288286a46f5d5750b83/lua/claude-code/config.lua#L180","weight":0.4666666666666667}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":1831.0,"duplicated_lines":38.0,"duplicated_share":0.0208,"files":17.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/version_bump.lua:67 and scripts/version_check.lua:38","ref":"scripts/version_bump.lua","url":"https://github.com/greggh/claude-code.nvim/blob/55c0cb59828fbc3bec744288286a46f5d5750b83/scripts/version_bump.lua#L67","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":2.0,"weighted_findings":0.5,"scanned_lines":564.0,"category:correctness":2.0},"findings":[{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test.sh","line":41,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test.sh:41"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/test.sh","line":50,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/test.sh:50"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":2201.0,"source_lines":2539.0,"test_ratio":0.8669,"ci_files":3.0,"cochange_share":0.3939,"cochange_commits":66.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/dependency-updates.yml","ref":".github/workflows/dependency-updates.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":1.0,"readme_lines":230.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":2242.0,"other_lines":297.0,"files_blamed":17.0,"blame_failures":0.0,"quality:ai_findings":2.0,"quality:ai_per_kloc":0.892,"quality:other_findings":0.0,"quality:other_per_kloc":0.0,"security:ai_findings":0.0,"security:ai_per_kloc":0.0,"security:other_findings":0.0,"security:other_per_kloc":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}