anthropics/claude-code-action

https://github.com/anthropics/claude-code-action · commit 9fa68854da5f · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/anthropics/claude-code-action
Commit: 9fa68854da5fadef4ed3dce240325a0dfe251880
Generated: 2026-11-13T23:18:52+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	53	explicit	95%	100%
Code quality	75	adequate	90%	100%
Security	38	poor	85%	100%

AI provenance

Explicit AI attribution on 53% of first-party code added; an estimated 53% including velocity signals.

Explicitly attributed share (lower bound): 52.9%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 52.9%

AI tool	Attributed commits	Lines added
Claude Code	208	24,269
OpenAI Codex	5	452
Cursor agent	2	236

AI tooling configured in repo: claude-code

Current source lines last changed by AI-attributed commits: 8,514 of 15,229.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Quality	1.292	0.149	8.67x
Security	6.812	6.85	0.99x

Stylometry index: 0.66 per 1,000 lines (narrated steps 3, placeholders 0, assistant phrasing 0, emoji 14). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2025-12	1,708	96%
2026-01	2,649	29%
2026-02	1,686	6%
2026-03	583	0%
2026-04	453	44%
2026-05	1,295	50%
2026-06	3,472	83%
2026-07	1,217	24%
2026-08	5,076	8%
2026-09	366	93%
2026-10	131	80%
2026-11	4,862	100%

Evidence

Claude Code: trailer 'Co-authored-by: Claude' (9fa68854da5f)
Claude Code: trailer 'Co-authored-by: Claude' (4d75e5f390ee)
Claude Code: trailer 'Co-authored-by: Claude' (274a39507b06)
Claude Code: trailer 'Co-authored-by: Claude' (8a29bc6f0ae1)
Claude Code: trailer 'Co-authored-by: Claude' (e52db4509809)
Claude Code: trailer 'Co-authored-by: Claude' (75b2776d96a8)
Claude Code: trailer 'Co-authored-by: Claude' (650432d39672)
Claude Code: trailer 'Co-authored-by: Claude' (462c312141ff)
Claude Code: trailer 'Co-authored-by: Claude' (ead3158f2768)
Claude Code: trailer 'Co-authored-by: Claude' (8565ca8f1847)
Claude Code: trailer 'Co-authored-by: Claude' (3fd089526cbc)
Claude Code: trailer 'Co-authored-by: Claude' (d5f7970ae232)
Claude Code: trailer 'Co-authored-by: Claude' (98a9e39fe1e0)
Claude Code: PR branch 'claude/vigilant-cray-pileu4' (925afb53776c)
Claude Code: PR description attribution (8d70a0dd2651)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 1.46, CI runs tests; 41% of function code in complex or long functions; 6% duplicated lines. Weakest area: complexity.

Area	Score
Complexity (lizard)	29
Duplication	72
Code smells (Opengrep)	87
Tests and CI	100
Documentation	80
Type safety	91
Process (Scorecard review/maintenance)	n/a

Functions: 493; mean complexity 4.8, 90th percentile 10; 31 complex and 20 long functions
Duplicated lines: 5.5% of 10,914 compared
Tests: 22,290 test lines for 15,229 source lines (ratio 1.46); CI test commands: bun test; 28% of recent source commits also change tests
Docs missing or thin: changelog

Most complex functions:

Security

Security posture is poor: 113 known vulnerabilities in 18 dependencies; 1 high-severity SAST findings; 23 high-severity workflow issues. Weakest area: ci actions.

Area	Score
Secrets (gitleaks, tree + history)	69
Static analysis (Opengrep)	55
Vulnerable dependencies (OSV)	10
CI workflows (zizmor)	1
Posture (policy, updates, signing, lockfiles)	40
OpenSSF Scorecard	n/a

Known vulnerabilities: 113 in 18 packages (critical 2, high 32, medium 68, low 11)
Posture checks passed: security policy, lockfiles; missing: dependency updates, signed commits

Top findings

Severity	Finding	Location
critical	`osv/GHSA-jqcg-44mw-7w3h`: proxy-addr@2.0.7 (npm) is affected by GHSA-jqcg-44mw-7w3h; also in bun.lock	base-action/bun.lock
critical	`osv/GHSA-pqg4-j6r4-53mv`: shell-quote@1.8.4 (npm) is affected by GHSA-pqg4-j6r4-53mv; also in base-action/package-lock.json; also in bun.lock	base-action/bun.lock
high	`opengrep/javascript.lang.security.detect-child-process`: Detected calls to child_process from a function argument `claudeExecutable`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]	base-action/src/install-plugins.ts:144
high	`osv/GHSA-x8mw-p69m-v3mx`: @fastify/busboy@2.1.1 (npm) is affected by GHSA-x8mw-p69m-v3mx; also in base-action/package-lock.json; also in bun.lock	base-action/bun.lock
high	`osv/GHSA-22jm-h49p-29qw`: @modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-22jm-h49p-29qw	base-action/bun.lock
high	`osv/GHSA-46jr-4wx8-v453`: @modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-46jr-4wx8-v453	base-action/bun.lock
high	`osv/GHSA-6qxp-vccf-f47h`: @modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-6qxp-vccf-f47h	base-action/bun.lock
high	`osv/GHSA-f897-62hf-6gxq`: @modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-f897-62hf-6gxq	base-action/bun.lock
high	`osv/GHSA-27r3-jxmh-p828`: body-parser@2.2.2 (npm) is affected by GHSA-27r3-jxmh-p828	base-action/bun.lock
high	`osv/GHSA-4c8g-83qw-93j6`: fast-uri@3.1.0 (npm) is affected by GHSA-4c8g-83qw-93j6	base-action/bun.lock
high	`osv/GHSA-7p8r-x3mc-p8w7`: fast-uri@3.1.0 (npm) is affected by GHSA-7p8r-x3mc-p8w7	base-action/bun.lock
high	`osv/GHSA-f65p-4m7j-42xc`: fast-uri@3.1.0 (npm) is affected by GHSA-f65p-4m7j-42xc	base-action/bun.lock
high	`osv/GHSA-jqff-g426-hqxp`: fast-uri@3.1.0 (npm) is affected by GHSA-jqff-g426-hqxp	base-action/bun.lock
high	`osv/GHSA-q3j6-qgpj-74h6`: fast-uri@3.1.0 (npm) is affected by GHSA-q3j6-qgpj-74h6	base-action/bun.lock
high	`osv/GHSA-qw65-cvwx-89v3`: fast-uri@3.1.0 (npm) is affected by GHSA-qw65-cvwx-89v3	base-action/bun.lock
high	`osv/GHSA-v2hh-gcrm-f6hx`: fast-uri@3.1.0 (npm) is affected by GHSA-v2hh-gcrm-f6hx	base-action/bun.lock
high	`osv/GHSA-v39h-62p7-jpjc`: fast-uri@3.1.0 (npm) is affected by GHSA-v39h-62p7-jpjc	base-action/bun.lock
high	`osv/GHSA-88fw-hqm2-52qc`: hono@4.12.9 (npm) is affected by GHSA-88fw-hqm2-52qc	base-action/bun.lock
high	`osv/GHSA-mwp4-54f8-5fhr`: ip-address@10.1.0 (npm) is affected by GHSA-mwp4-54f8-5fhr	base-action/bun.lock
high	`osv/GHSA-395f-4hp3-45gv`: shell-quote@1.8.4 (npm) is affected by GHSA-395f-4hp3-45gv; also in base-action/package-lock.json; also in bun.lock	base-action/bun.lock
high	`osv/GHSA-2m5v-pch6-74hx`: undici@5.29.0 (npm) is affected by GHSA-2m5v-pch6-74hx; also in base-action/package-lock.json; also in bun.lock	base-action/bun.lock
high	`osv/GHSA-qrxm-fqhp-jwvm`: undici@5.29.0 (npm) is affected by GHSA-qrxm-fqhp-jwvm; also in base-action/package-lock.json; also in bun.lock	base-action/bun.lock
high	`osv/GHSA-v9p9-hfj2-hcw8`: undici@5.29.0 (npm) is affected by GHSA-v9p9-hfj2-hcw8; also in base-action/package-lock.json; also in bun.lock	base-action/bun.lock
high	`osv/GHSA-vrm6-8vpv-qv8q`: undici@5.29.0 (npm) is affected by GHSA-vrm6-8vpv-qv8q; also in base-action/package-lock.json; also in bun.lock	base-action/bun.lock
high	`osv/GHSA-vxpw-j846-p89q`: undici@5.29.0 (npm) is affected by GHSA-vxpw-j846-p89q; also in base-action/package-lock.json; also in bun.lock	base-action/bun.lock

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 15,229; test lines: 22,290

Language	Lines
TypeScript	34,769
Python	2,167
Shell	421
JavaScript	162

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/anthropics/claude-code-action/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/anthropics/claude-code-action/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/anthropics/claude-code-action/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/anthropics/claude-code-action/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/anthropics/claude-code-action/security.svg)](https://repotrust.synapticcyber.com/r/github.com/anthropics/claude-code-action/)