{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:07.088189Z","repo":{"ref":{"host":"github.com","owner":"rcrowley","name":"goagain"},"default_branch":"master","clone_url":"https://github.com/rcrowley/goagain.git","html_url":"https://github.com/rcrowley/goagain","description":"Zero-downtime restarts in Go","stars":2091,"forks":137,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":300,"primary_language":"Go","license_spdx":"NOASSERTION","created_at":"2011-08-27T16:55:16Z","pushed_at":"2019-02-13T23:18:41Z","security_policy_url":null,"distribution":{"owner_created_at":"2008-05-22T06:35:04Z","owner_type":"User","release_assets":[]}},"commit_sha":"f2f192b5d1a96e21dd4026ce67cda85e49659a48","profile":{"lines_by_language":{"Go":571,"Shell":54},"files_by_category":{"source":6,"config":5,"docs":2},"source_lines":625,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.54,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":46.7,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":100.0,"duplication":35.3,"lint":93.9,"testing":0.0,"docs":45.0,"type_safety":null,"process":5.0},"summary":"Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 0% of function code in complex or long functions; 17% duplicated lines. Weakest area: testing."},"security":{"score":66.0,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":76.9,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":25.0},"summary":"Security posture is weak: 1 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"ok","tool_version":"scorecard v5.6.0","metrics":{"aggregate":2.1,"check:Code-Review":1.0,"check:Binary-Artifacts":10.0,"check:Maintained":0.0,"check:CII-Best-Practices":0.0,"check:Security-Policy":0.0,"check:Fuzzing":0.0,"check:License":9.0,"check:Branch-Protection":0.0,"check:SAST":0.0},"findings":[],"evidence":[{"kind":"scorecard-check","description":"Scorecard Code-Review: 1/10 (Found 3/28 approved changesets -- score normalized to 1)","ref":"Code-Review","url":"https://scorecard.dev/viewer/?uri=github.com/rcrowley/goagain","weight":0.9},{"kind":"scorecard-check","description":"Scorecard Binary-Artifacts: 10/10 (no binaries found in the repo)","ref":"Binary-Artifacts","url":"https://scorecard.dev/viewer/?uri=github.com/rcrowley/goagain","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Maintained: 0/10 (0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0)","ref":"Maintained","url":"https://scorecard.dev/viewer/?uri=github.com/rcrowley/goagain","weight":1.0},{"kind":"scorecard-check","description":"Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)","ref":"CII-Best-Practices","url":"https://scorecard.dev/viewer/?uri=github.com/rcrowley/goagain","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Security-Policy: 0/10 (security policy file not detected)","ref":"Security-Policy","url":"https://scorecard.dev/viewer/?uri=github.com/rcrowley/goagain","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Fuzzing: 0/10 (project is not fuzzed)","ref":"Fuzzing","url":"https://scorecard.dev/viewer/?uri=github.com/rcrowley/goagain","weight":1.0},{"kind":"scorecard-check","description":"Scorecard License: 9/10 (license file detected)","ref":"License","url":"https://scorecard.dev/viewer/?uri=github.com/rcrowley/goagain","weight":0.1},{"kind":"scorecard-check","description":"Scorecard Branch-Protection: 0/10 (branch protection not enabled on development/release branches)","ref":"Branch-Protection","url":"https://scorecard.dev/viewer/?uri=github.com/rcrowley/goagain","weight":1.0},{"kind":"scorecard-check","description":"Scorecard SAST: 0/10 (SAST tool is not run on all commits -- score normalized to 0)","ref":"SAST","url":"https://scorecard.dev/viewer/?uri=github.com/rcrowley/goagain","weight":1.0}],"data":{"date":"2026-10-19","commit":"f2f192b5d1a96e21dd4026ce67cda85e49659a48","matches_head":true},"error":null},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":57.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":1126.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2011-08":{"loc":163,"attributed_loc":0},"2011-09":{"loc":9,"attributed_loc":0},"2011-11":{"loc":59,"attributed_loc":0},"2012-02":{"loc":33,"attributed_loc":0},"2013-03":{"loc":119,"attributed_loc":0},"2013-06":{"loc":9,"attributed_loc":0},"2013-08":{"loc":45,"attributed_loc":0},"2013-09":{"loc":21,"attributed_loc":0},"2013-11":{"loc":656,"attributed_loc":0},"2014-01":{"loc":8,"attributed_loc":0},"2014-04":{"loc":4,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":26.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":1126.0,"pre_ai_era_burst_loc":0.0,"measured_loc":1126.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":59.0,"median_loc_per_hour":41.696902114139064,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":625.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":1.0,"findings_high":1.0,"findings_medium":0.0,"findings_low":0.0,"weighted_findings":0.75,"scanned_lines":625.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/go.lang.security.audit.dangerous-syscall-exec","severity":"high","message":"Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"goagain.go","line":73,"fingerprint":"go.lang.security.audit.dangerous-syscall-exec:goagain.go:73"}],"evidence":[],"data":{"rulesets":["go","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0351,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":20.0,"function_nloc":357.0,"mean_ccn":4.45,"p90_ccn":10.0,"complex_functions":0.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":432.0,"duplicated_lines":75.0,"duplicated_share":0.1736,"files":6.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: example/double/main.go:25 and example/single/main.go:20","ref":"example/double/main.go","url":"https://github.com/rcrowley/goagain/blob/f2f192b5d1a96e21dd4026ce67cda85e49659a48/example/double/main.go#L25","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: example/double/main.go:26 and example/legacy/main.go:22","ref":"example/double/main.go","url":"https://github.com/rcrowley/goagain/blob/f2f192b5d1a96e21dd4026ce67cda85e49659a48/example/double/main.go#L26","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: example/legacy/main.go:6 and example/single/main.go:6","ref":"example/legacy/main.go","url":"https://github.com/rcrowley/goagain/blob/f2f192b5d1a96e21dd4026ce67cda85e49659a48/example/legacy/main.go#L6","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":1.0,"weighted_findings":0.25,"scanned_lines":625.0,"category:correctness":1.0},"findings":[{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"test.sh","line":16,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:test.sh:16"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":625.0,"test_ratio":0.0,"ci_files":0.0,"cochange_share":0.0,"cochange_commits":48.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":0.5,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":14.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}