anthropics/claude-code-action

• Repository: https://github.com/anthropics/claude-code-action
• Commit: 9fa68854da5fadef4ed3dce240325a0dfe251880
• Generated: 2026-11-13T23:18:52+00:00
• Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

AI provenance

Explicit AI attribution on 53% of first-party code added; an estimated 53% including velocity signals.

• Explicitly attributed share (lower bound): 52.9%
• Unattributed share in AI-consistent velocity bursts: 0.0%
• Estimated AI-generated share: 52.9%

• AI tooling configured in repo: claude-code

Current source lines last changed by AI-attributed commits: 8,514 of 15,229.

• Stylometry index: 0.66 per 1,000 lines (narrated steps 3, placeholders 0, assistant phrasing 0, emoji 14). Reported as a signal, not scored.

Evidence

• Claude Code: trailer 'Co-authored-by: Claude' (9fa68854da5f)
• Claude Code: trailer 'Co-authored-by: Claude' (4d75e5f390ee)
• Claude Code: trailer 'Co-authored-by: Claude' (274a39507b06)
• Claude Code: trailer 'Co-authored-by: Claude' (8a29bc6f0ae1)
• Claude Code: trailer 'Co-authored-by: Claude' (e52db4509809)
• Claude Code: trailer 'Co-authored-by: Claude' (75b2776d96a8)
• Claude Code: trailer 'Co-authored-by: Claude' (650432d39672)
• Claude Code: trailer 'Co-authored-by: Claude' (462c312141ff)
• Claude Code: trailer 'Co-authored-by: Claude' (ead3158f2768)
• Claude Code: trailer 'Co-authored-by: Claude' (8565ca8f1847)
• Claude Code: trailer 'Co-authored-by: Claude' (3fd089526cbc)
• Claude Code: trailer 'Co-authored-by: Claude' (d5f7970ae232)
• Claude Code: trailer 'Co-authored-by: Claude' (98a9e39fe1e0)
• Claude Code: PR branch 'claude/vigilant-cray-pileu4' (925afb53776c)
• Claude Code: PR description attribution (8d70a0dd2651)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 1.46, CI runs tests; 41% of function code in complex or long functions; 6% duplicated lines. Weakest area: complexity.

• Functions: 493; mean complexity 4.8, 90th percentile 10; 31 complex and 20 long functions
• Duplicated lines: 5.5% of 10,914 compared
• Tests: 22,290 test lines for 15,229 source lines (ratio 1.46); CI test commands: bun test; 28% of recent source commits also change tests
• Docs missing or thin: changelog

Most complex functions:

• fetch_pr_data in agent-approval-check/agent_approval_check.py: complexity 63, 149 lines
• prepareContext in src/create-prompt/index.ts: complexity 55, 215 lines
• generateDefaultPrompt in src/create-prompt/index.ts: complexity 52, 250 lines
• run in src/entrypoints/run.ts: complexity 43, 214 lines
• checkContainsTrigger in src/github/validation/trigger.ts: complexity 39, 126 lines

Security

Security posture is poor: 113 known vulnerabilities in 18 dependencies; 1 high-severity SAST findings; 23 high-severity workflow issues. Weakest area: ci actions.

• Known vulnerabilities: 113 in 18 packages (critical 2, high 32, medium 68, low 11)

• Posture checks passed: security policy, lockfiles; missing: dependency updates, signed commits

Top findings

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

• Source lines: 15,229; test lines: 22,290

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/anthropics/claude-code-action/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/anthropics/claude-code-action/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/anthropics/claude-code-action/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/anthropics/claude-code-action/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/anthropics/claude-code-action/security.svg)](https://repotrust.synapticcyber.com/r/github.com/anthropics/claude-code-action/)