{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:53:45.496851Z","repo":{"ref":{"host":"github.com","owner":"duguyue100","name":"midnight-captain"},"default_branch":"main","clone_url":"https://github.com/duguyue100/midnight-captain.git","html_url":"https://github.com/duguyue100/midnight-captain","description":"Inspired by Midnight Commander, tailored to my taste.","stars":56,"forks":3,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":10005,"primary_language":"Go","license_spdx":"MIT","created_at":"2026-04-09T15:14:26Z","pushed_at":"2026-04-22T21:09:50Z","security_policy_url":null,"distribution":{"owner_created_at":"2011-07-26T12:40:42Z","owner_type":"User","release_assets":[{"name":"checksums.txt","size":326,"download_count":1,"release_tag":"v0.1.7","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.7/checksums.txt"},{"name":"mc-darwin-amd64","size":7189264,"download_count":9,"release_tag":"v0.1.7","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.7/mc-darwin-amd64"},{"name":"mc-darwin-arm64","size":6791378,"download_count":17,"release_tag":"v0.1.7","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.7/mc-darwin-arm64"},{"name":"mc-linux-amd64","size":7073954,"download_count":18,"release_tag":"v0.1.7","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.7/mc-linux-amd64"},{"name":"mc-linux-arm64","size":6684834,"download_count":8,"release_tag":"v0.1.7","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.7/mc-linux-arm64"},{"name":"checksums.txt","size":326,"download_count":0,"release_tag":"v0.1.6","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.6/checksums.txt"},{"name":"mc-darwin-amd64","size":7180928,"download_count":3,"release_tag":"v0.1.6","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.6/mc-darwin-amd64"},{"name":"mc-darwin-arm64","size":6791234,"download_count":5,"release_tag":"v0.1.6","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.6/mc-darwin-arm64"},{"name":"mc-linux-amd64","size":7065762,"download_count":21,"release_tag":"v0.1.6","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.6/mc-linux-amd64"},{"name":"mc-linux-arm64","size":6684834,"download_count":5,"release_tag":"v0.1.6","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.6/mc-linux-arm64"},{"name":"checksums.txt","size":326,"download_count":0,"release_tag":"v0.1.5","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.5/checksums.txt"},{"name":"mc-darwin-amd64","size":7176704,"download_count":2,"release_tag":"v0.1.5","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.5/mc-darwin-amd64"},{"name":"mc-darwin-arm64","size":6774610,"download_count":7,"release_tag":"v0.1.5","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.5/mc-darwin-arm64"},{"name":"mc-linux-amd64","size":7057570,"download_count":7,"release_tag":"v0.1.5","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.5/mc-linux-amd64"},{"name":"mc-linux-arm64","size":6684834,"download_count":3,"release_tag":"v0.1.5","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.5/mc-linux-arm64"},{"name":"checksums.txt","size":326,"download_count":1,"release_tag":"v0.1.4","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.4/checksums.txt"},{"name":"mc-darwin-amd64","size":7147808,"download_count":6,"release_tag":"v0.1.4","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.4/mc-darwin-amd64"},{"name":"mc-darwin-arm64","size":6757858,"download_count":7,"release_tag":"v0.1.4","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.4/mc-darwin-arm64"},{"name":"mc-linux-amd64","size":7037090,"download_count":9,"release_tag":"v0.1.4","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.4/mc-linux-amd64"},{"name":"mc-linux-arm64","size":6619298,"download_count":6,"release_tag":"v0.1.4","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.4/mc-linux-arm64"},{"name":"checksums.txt","size":326,"download_count":1,"release_tag":"v0.1.3","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.3/checksums.txt"},{"name":"mc-darwin-amd64","size":7147808,"download_count":5,"release_tag":"v0.1.3","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.3/mc-darwin-amd64"},{"name":"mc-darwin-arm64","size":6757874,"download_count":5,"release_tag":"v0.1.3","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.3/mc-darwin-arm64"},{"name":"mc-linux-amd64","size":7032994,"download_count":4,"release_tag":"v0.1.3","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.3/mc-linux-amd64"},{"name":"mc-linux-arm64","size":6619298,"download_count":4,"release_tag":"v0.1.3","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.3/mc-linux-arm64"},{"name":"checksums.txt","size":326,"download_count":1,"release_tag":"v0.1.2","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.2/checksums.txt"},{"name":"mc-darwin-amd64","size":7122848,"download_count":6,"release_tag":"v0.1.2","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.2/mc-darwin-amd64"},{"name":"mc-darwin-arm64","size":6740930,"download_count":14,"release_tag":"v0.1.2","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.2/mc-darwin-arm64"},{"name":"mc-linux-amd64","size":7012514,"download_count":15,"release_tag":"v0.1.2","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.2/mc-linux-amd64"},{"name":"mc-linux-arm64","size":6619298,"download_count":6,"release_tag":"v0.1.2","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.2/mc-linux-arm64"},{"name":"checksums.txt","size":326,"download_count":2,"release_tag":"v0.1.1","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.1/checksums.txt"},{"name":"mc-darwin-amd64","size":7114432,"download_count":9,"release_tag":"v0.1.1","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.1/mc-darwin-amd64"},{"name":"mc-darwin-arm64","size":6724194,"download_count":23,"release_tag":"v0.1.1","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.1/mc-darwin-arm64"},{"name":"mc-linux-amd64","size":7000226,"download_count":19,"release_tag":"v0.1.1","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.1/mc-linux-amd64"},{"name":"mc-linux-arm64","size":6619298,"download_count":7,"release_tag":"v0.1.1","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.1/mc-linux-arm64"},{"name":"checksums.txt","size":326,"download_count":1,"release_tag":"v0.1.0","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.0/checksums.txt"},{"name":"mc-darwin-amd64","size":7118576,"download_count":5,"release_tag":"v0.1.0","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.0/mc-darwin-amd64"},{"name":"mc-darwin-arm64","size":6740754,"download_count":5,"release_tag":"v0.1.0","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.0/mc-darwin-arm64"},{"name":"mc-linux-amd64","size":7004322,"download_count":7,"release_tag":"v0.1.0","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.0/mc-linux-amd64"},{"name":"mc-linux-arm64","size":6619298,"download_count":5,"release_tag":"v0.1.0","url":"https://github.com/duguyue100/midnight-captain/releases/download/v0.1.0/mc-linux-arm64"}]}},"commit_sha":"400875060ada16cce0545160da1b0532fc66dbb3","profile":{"lines_by_language":{"Go":7469,"Shell":153},"files_by_category":{"source":42,"test":12,"config":3,"docs":3,"other":3,"generated":1},"source_lines":5378,"test_lines":2244},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.49,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":1.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"Weak signals consistent with AI-assisted development."},"quality":{"score":77.8,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":55.6,"duplication":85.1,"lint":100.0,"testing":83.1,"docs":65.0,"type_safety":null,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.42, CI runs tests; 20% of function code in complex or long functions; 3% duplicated lines. Weakest area: complexity."},"security":{"score":66.7,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":90.7,"dependencies":74.1,"ci_actions":14.1,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 18 known vulnerabilities in 2 dependencies; 2 high-severity SAST findings; 10 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":38.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":8440.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2026-04":{"loc":8440,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":1.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1775935159.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/duguyue100/midnight-captain/blob/400875060ada16cce0545160da1b0532fc66dbb3/AGENTS.md","weight":0.5}],"data":{"artifacts":[{"tool":"generic-agent","path":"AGENTS.md","added_at":1775935159}],"workflows":[],"tools":["generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":7.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":5090.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":474.25022182786165,"median_loc_per_hour":228.28435722114932,"pr_timed_units":0.0,"excluded_import_loc":3350.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["9591f96ea4b2f6c177a28c909a7fddb28e666bd9"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":7.0,"flagged_releases":0.0,"max_loc_per_day":4199.8},"findings":[],"evidence":[],"data":{"releases":[{"from":"v0.1.0","to":"v0.1.1","loc":1,"days":0.04,"loc_per_day":24.0,"flagged":false},{"from":"v0.1.1","to":"v0.1.2","loc":2227,"days":0.53,"loc_per_day":4199.8,"flagged":false},{"from":"v0.1.2","to":"v0.1.3","loc":433,"days":0.92,"loc_per_day":470.1,"flagged":false},{"from":"v0.1.3","to":"v0.1.4","loc":26,"days":0.04,"loc_per_day":624.0,"flagged":false},{"from":"v0.1.4","to":"v0.1.5","loc":257,"days":0.09,"loc_per_day":2929.0,"flagged":false},{"from":"v0.1.5","to":"v0.1.6","loc":172,"days":0.05,"loc_per_day":3564.6,"flagged":false},{"from":"v0.1.6","to":"v0.1.7","loc":145,"days":9.31,"loc_per_day":15.6,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":5378.0,"index":0.093,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":1.0,"per_kloc:emoji_in_code":0.186,"files:emoji_in_code":1.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":2.0,"findings_high":2.0,"findings_medium":0.0,"findings_low":0.0,"weighted_findings":1.5,"scanned_lines":5378.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"internal/app/update.go","line":628,"fingerprint":"go.lang.security.audit.dangerous-exec-command:internal/app/update.go:628"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"internal/app/update.go","line":672,"fingerprint":"go.lang.security.audit.dangerous-exec-command:internal/app/update.go:672"}],"evidence":[],"data":{"rulesets":["go","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":2.0,"vulnerabilities":18.0,"vulns_critical":7.0,"vulns_high":2.0,"vulns_medium":4.0,"vulns_low":0.0,"vulns_unknown":5.0,"penalty":18.0},"findings":[{"rule_id":"osv/GHSA-jppx-rxg9-jmrx","severity":"critical","message":"golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5005, GHSA-jppx-rxg9-jmrx","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.50.0 (Go):GHSA-jppx-rxg9-jmrx"},{"rule_id":"osv/GHSA-f5wc-c3c7-36mc","severity":"critical","message":"golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5006, GHSA-f5wc-c3c7-36mc","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.50.0 (Go):GHSA-f5wc-c3c7-36mc"},{"rule_id":"osv/GHSA-vgwf-h737-ff37","severity":"critical","message":"golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5017, GHSA-vgwf-h737-ff37","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.50.0 (Go):GHSA-vgwf-h737-ff37"},{"rule_id":"osv/GHSA-89gr-r52h-f8rx","severity":"critical","message":"golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5019, GHSA-89gr-r52h-f8rx","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.50.0 (Go):GHSA-89gr-r52h-f8rx"},{"rule_id":"osv/GHSA-rm3j-f69w-wqmq","severity":"critical","message":"golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5020, GHSA-rm3j-f69w-wqmq","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.50.0 (Go):GHSA-rm3j-f69w-wqmq"},{"rule_id":"osv/GHSA-5cgq-3rg8-m6cv","severity":"critical","message":"golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5021, GHSA-5cgq-3rg8-m6cv","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.50.0 (Go):GHSA-5cgq-3rg8-m6cv"},{"rule_id":"osv/GHSA-x527-x647-q7gg","severity":"critical","message":"golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5023, GHSA-x527-x647-q7gg","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.50.0 (Go):GHSA-x527-x647-q7gg"},{"rule_id":"osv/GHSA-q4h4-gmj2-qvw2","severity":"high","message":"golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5013, GHSA-q4h4-gmj2-qvw2","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.50.0 (Go):GHSA-q4h4-gmj2-qvw2"},{"rule_id":"osv/GHSA-w879-237q-wc7r","severity":"high","message":"golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5018, GHSA-w879-237q-wc7r","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.50.0 (Go):GHSA-w879-237q-wc7r"},{"rule_id":"osv/GHSA-45gg-vh54-h5m9","severity":"medium","message":"golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5014, GHSA-45gg-vh54-h5m9","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.50.0 (Go):GHSA-45gg-vh54-h5m9"},{"rule_id":"osv/GHSA-78mq-xcr3-xm33","severity":"medium","message":"golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5015, GHSA-78mq-xcr3-xm33","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.50.0 (Go):GHSA-78mq-xcr3-xm33"},{"rule_id":"osv/GHSA-qpw4-5x99-6vjp","severity":"medium","message":"golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5016, GHSA-qpw4-5x99-6vjp","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.50.0 (Go):GHSA-qpw4-5x99-6vjp"},{"rule_id":"osv/GHSA-9m57-25v3-79x9","severity":"medium","message":"golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5033, GHSA-9m57-25v3-79x9","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.50.0 (Go):GHSA-9m57-25v3-79x9"},{"rule_id":"osv/GO-2026-5932","severity":"medium","message":"golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5932","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.50.0 (Go):GO-2026-5932"},{"rule_id":"osv/GO-2026-6303","severity":"medium","message":"golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-6303","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.50.0 (Go):GO-2026-6303"},{"rule_id":"osv/GO-2026-6354","severity":"medium","message":"golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-6354","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.50.0 (Go):GO-2026-6354"},{"rule_id":"osv/GO-2026-6355","severity":"medium","message":"golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-6355","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.50.0 (Go):GO-2026-6355"},{"rule_id":"osv/GO-2026-5024","severity":"medium","message":"golang.org/x/sys@0.43.0 (Go) is affected by GO-2026-5024","path":"go.mod","line":null,"fingerprint":"golang.org/x/sys@0.43.0 (Go):GO-2026-5024"}],"evidence":[],"data":{"ecosystems":["Go"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":14.0,"findings_high":10.0,"findings_medium":4.0,"findings_low":0.0,"penalty":117.6},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build.yml","line":16,"fingerprint":"unpinned-uses:.github/workflows/build.yml:16"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build.yml","line":19,"fingerprint":"unpinned-uses:.github/workflows/build.yml:19"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/release.yml","line":9,"fingerprint":"excessive-permissions:.github/workflows/release.yml:9"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/release.yml","line":82,"fingerprint":"template-injection:.github/workflows/release.yml:82"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":29,"fingerprint":"unpinned-uses:.github/workflows/release.yml:29"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":32,"fingerprint":"unpinned-uses:.github/workflows/release.yml:32"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":50,"fingerprint":"unpinned-uses:.github/workflows/release.yml:50"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":63,"fingerprint":"unpinned-uses:.github/workflows/release.yml:63"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":66,"fingerprint":"unpinned-uses:.github/workflows/release.yml:66"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/release.yml","line":32,"fingerprint":"cache-poisoning:.github/workflows/release.yml:32"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/build.yml","line":15,"fingerprint":"artipacked:.github/workflows/build.yml:15"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/build.yml","line":10,"fingerprint":"excessive-permissions:.github/workflows/build.yml:10"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":28,"fingerprint":"artipacked:.github/workflows/release.yml:28"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":62,"fingerprint":"artipacked:.github/workflows/release.yml:62"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0526,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":233.0,"function_nloc":3366.0,"mean_ccn":3.94,"p90_ccn":9.0,"complex_functions":7.0,"long_functions":2.0,"many_param_functions":1.0,"risky_nloc_share":0.1958},"findings":[],"evidence":[{"kind":"complex-function","description":"Update in internal/app/update.go: complexity 48, 174 lines","ref":"internal/app/update.go","url":"https://github.com/duguyue100/midnight-captain/blob/400875060ada16cce0545160da1b0532fc66dbb3/internal/app/update.go#L34","weight":0.8},{"kind":"complex-function","description":"nerdIcon in internal/ui/pane/view.go: complexity 41, 90 lines","ref":"internal/ui/pane/view.go","url":"https://github.com/duguyue100/midnight-captain/blob/400875060ada16cce0545160da1b0532fc66dbb3/internal/ui/pane/view.go#L266","weight":0.6833333333333333},{"kind":"complex-function","description":"formatKind in internal/ui/pane/view.go: complexity 36, 80 lines","ref":"internal/ui/pane/view.go","url":"https://github.com/duguyue100/midnight-captain/blob/400875060ada16cce0545160da1b0532fc66dbb3/internal/ui/pane/view.go#L396","weight":0.6},{"kind":"complex-function","description":"handleGlobalKey in internal/app/update.go: complexity 29, 129 lines","ref":"internal/app/update.go","url":"https://github.com/duguyue100/midnight-captain/blob/400875060ada16cce0545160da1b0532fc66dbb3/internal/app/update.go#L285","weight":0.48333333333333334},{"kind":"complex-function","description":"handleKey in internal/ui/pane/update.go: complexity 25, 73 lines","ref":"internal/ui/pane/update.go","url":"https://github.com/duguyue100/midnight-captain/blob/400875060ada16cce0545160da1b0532fc66dbb3/internal/ui/pane/update.go#L25","weight":0.4166666666666667},{"kind":"complex-function","description":"resolveSSHConfig in internal/ssh/config.go: complexity 23, 55 lines","ref":"internal/ssh/config.go","url":"https://github.com/duguyue100/midnight-captain/blob/400875060ada16cce0545160da1b0532fc66dbb3/internal/ssh/config.go#L23","weight":0.38333333333333336},{"kind":"complex-function","description":"handleCommand in internal/app/update.go: complexity 18, 58 lines","ref":"internal/app/update.go","url":"https://github.com/duguyue100/midnight-captain/blob/400875060ada16cce0545160da1b0532fc66dbb3/internal/app/update.go#L546","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":3799.0,"duplicated_lines":102.0,"duplicated_share":0.0268,"files":42.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: internal/fs/local.go:50 and internal/fs/remote.go:100","ref":"internal/fs/local.go","url":"https://github.com/duguyue100/midnight-captain/blob/400875060ada16cce0545160da1b0532fc66dbb3/internal/fs/local.go#L50","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: internal/ops/copy.go:18 and internal/ops/move.go:48","ref":"internal/ops/copy.go","url":"https://github.com/duguyue100/midnight-captain/blob/400875060ada16cce0545160da1b0532fc66dbb3/internal/ops/copy.go#L18","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: internal/ops/rename.go:28 and internal/ui/pane/update.go:200","ref":"internal/ops/rename.go","url":"https://github.com/duguyue100/midnight-captain/blob/400875060ada16cce0545160da1b0532fc66dbb3/internal/ops/rename.go#L28","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: internal/ui/cmdpalette/update.go:10 and internal/ui/goto/model.go:86","ref":"internal/ui/cmdpalette/update.go","url":"https://github.com/duguyue100/midnight-captain/blob/400875060ada16cce0545160da1b0532fc66dbb3/internal/ui/cmdpalette/update.go#L10","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: internal/ui/pane/update.go:115 and internal/ui/pane/update.go:132","ref":"internal/ui/pane/update.go","url":"https://github.com/duguyue100/midnight-captain/blob/400875060ada16cce0545160da1b0532fc66dbb3/internal/ui/pane/update.go#L115","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"weighted_findings":0.0,"scanned_lines":5378.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.8345,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.7273,"test_lines":2244.0,"source_lines":5378.0,"test_ratio":0.4173,"ci_files":2.0,"cochange_share":0.1818,"cochange_commits":22.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/build.yml","ref":".github/workflows/build.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (go test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["go test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":104.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}