RepoTrust

nizos/tdd-guard

Automated TDD enforcement for Claude Code

https://github.com/nizos/tdd-guard · commit ffb7026c8f7e · scored 2026-11-14 · scoring prov-4+qual-2+sec-2

RepoTrust ai badge RepoTrust quality badge RepoTrust security badge

Dispute this score or request a re-score Full report JSON

Scores

Pillar Score Signal Confidence Coverage
AI provenance (estimated AI-generated share) 63 explicit 95% 100%
Code quality 92 strong 90% 100%
Security 69 weak 85% 100%

AI provenance

Explicit AI attribution on 63% of first-party code added; an estimated 63% including velocity signals.

AI tool Attributed commits Lines added
Claude Code 573 30,622

Current source lines last changed by AI-attributed commits: 4,747 of 10,556.

Findings per 1,000 lines AI-attributed Other Ratio
Quality 1.053 0.172 6.12x
Security 1.264 0.172 7.35x
Month Lines added Attributed to AI
2025-07 21,279 87%
2025-08 11,616 65%
2025-09 1,568 98%
2025-10 24 100%
2025-11 948 2%
2026-01 6 50%
2026-03 1,332 40%
2026-04 5,740 25%
2026-05 2,387 4%
2026-06 941 100%
2026-07 2,613 0%
2026-08 14 100%

Evidence

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is strong: test-to-source ratio 2.26, CI runs tests; 2% of function code in complex or long functions; 3% duplicated lines. Weakest area: docs.

Area Score
Complexity (lizard) 94
Duplication 82
Code smells (Opengrep) 93
Tests and CI 100
Documentation 80
Type safety 98
Process (Scorecard review/maintenance) n/a

Most complex functions:

Security

Security posture is weak: 7 known vulnerabilities in 3 dependencies; 27 high-severity workflow issues. Weakest area: ci actions.

Area Score
Secrets (gitleaks, tree + history) 100
Static analysis (Opengrep) 90
Vulnerable dependencies (OSV) 86
CI workflows (zizmor) 0
Posture (policy, updates, signing, lockfiles) 20
OpenSSF Scorecard n/a

Top findings

Severity Finding Location
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:19
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:22
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:28
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:52
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:55
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:61
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:85
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:88
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:104
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:107
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:113
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:123
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:144
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:147
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:153
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:159
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:164
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:169
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:174
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:208
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:214
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/security.yml:27
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/security.yml:30
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/security.yml:36
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/security.yml:39

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Language Lines
TypeScript 18,757
Ruby 3,143
Go 3,035
Java 2,856
C# 2,102
Rust 1,448
PHP 1,327
Python 1,006
Shell 313
JavaScript 272

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/nizos/tdd-guard/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/nizos/tdd-guard/)
[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/nizos/tdd-guard/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/nizos/tdd-guard/)
[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/nizos/tdd-guard/security.svg)](https://repotrust.synapticcyber.com/r/github.com/nizos/tdd-guard/)