spawnia/sailor

A typesafe GraphQL client for PHP

https://github.com/spawnia/sailor · commit a6d17438bc5c · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/spawnia/sailor
Commit: a6d17438bc5c9dfd20bba1623190ce97f35195c1
Generated: 2026-11-13T23:19:39+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	21	explicit	95%	100%
Code quality	81	strong	90%	100%
Security	65	weak	85%	100%

AI provenance

Explicit AI attribution on 21% of first-party code added; an estimated 21% including velocity signals.

Explicitly attributed share (lower bound): 21.1%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 21.1%

AI tool	Attributed commits	Lines added
Claude Code	21	5,862
GitHub Copilot coding agent	1	120

AI tooling configured in repo: claude-code

Current source lines last changed by AI-attributed commits: 5,885 of 17,646.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Quality	0.0	0.0	n/a
Security	0.0	0.0	n/a

Month	Lines added	Attributed to AI
2024-08	266	0%
2024-10	277	0%
2024-11	55	0%
2025-02	762	0%
2025-03	190	0%
2025-04	81	0%
2025-05	2	0%
2025-06	101	0%
2026-01	563	2%
2026-02	120	100%
2026-09	1	0%
2026-10	5,853	100%

Evidence

Claude Code: message 'Generated with Claude Code' (a6d17438bc5c)
Claude Code: message 'Generated with Claude Code' (ab9cf26ecb29)
Claude Code: message 'Generated with Claude Code' (beaa80eced19)
Claude Code: message 'Generated with Claude Code' (3ea59dbe4063)
Claude Code: message 'Generated with Claude Code' (654fe64855e5)
Claude Code: message 'Generated with Claude Code' (e43672814888)
Claude Code: message 'Generated with Claude Code' (0134ef2056cc)
Claude Code: message 'Generated with Claude Code' (eccf176baf5b)
Claude Code: message 'Generated with Claude Code' (54cf2a6b117c)
Claude Code: message 'Generated with Claude Code' (d1d863d5dfd3)
Claude Code: message 'Generated with Claude Code' (e3872bfbe303)
Claude Code: message 'Generated with Claude Code' (6a89d12a3157)
Claude Code: message 'Generated with Claude Code' (8ae23a6df9e6)
Claude Code: message 'Generated with Claude Code' (9b8204595fa1)
Claude Code: message 'Generated with Claude Code' (ad3c5ec1b52b)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is strong: test-to-source ratio 0.18, CI runs tests; 0% of function code in complex or long functions; 29% duplicated lines. Weakest area: duplication.

Area	Score
Complexity (lizard)	100
Duplication	18
Code smells (Opengrep)	100
Tests and CI	84
Documentation	100
Type safety	n/a
Process (Scorecard review/maintenance)	n/a

Functions: 1,509; mean complexity 1.3, 90th percentile 2; 0 complex and 0 long functions
Duplicated lines: 29.0% of 8,704 compared
Tests: 3,111 test lines for 17,646 source lines (ratio 0.18); CI test commands: phpunit; 54% of recent source commits also change tests
Docs missing or thin: none

Security

Security posture is weak: 32 known vulnerabilities in 8 dependencies; 25 high-severity workflow issues. Weakest area: ci actions.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	100
Vulnerable dependencies (OSV)	48
CI workflows (zizmor)	0
Posture (policy, updates, signing, lockfiles)	40
OpenSSF Scorecard	n/a

Known vulnerabilities: 32 in 8 packages (critical 0, high 13, medium 18, low 1)
Posture checks passed: security policy; missing: dependency updates, signed commits, lockfiles

Top findings

Severity	Finding	Location
high	`osv/GHSA-6j4f-fj2g-mc7p`: brace-expansion@5.0.9 (npm) is affected by GHSA-6j4f-fj2g-mc7p	package-lock.json
high	`osv/GHSA-qhr7-859c-m2p7`: brace-expansion@5.0.9 (npm) is affected by GHSA-qhr7-859c-m2p7	package-lock.json
high	`osv/GHSA-2m5v-pch6-74hx`: undici@6.28.0 (npm) is affected by GHSA-2m5v-pch6-74hx	package-lock.json
high	`osv/GHSA-qrxm-fqhp-jwvm`: undici@6.28.0 (npm) is affected by GHSA-qrxm-fqhp-jwvm	package-lock.json
high	`osv/GHSA-rfgv-xxqx-mfg5`: undici@6.28.0 (npm) is affected by GHSA-rfgv-xxqx-mfg5	package-lock.json
high	`osv/GHSA-xjj6-f33q-929c`: undici@6.28.0 (npm) is affected by GHSA-xjj6-f33q-929c	package-lock.json
high	`osv/GHSA-2m5v-pch6-74hx`: undici@6.29.0 (npm) is affected by GHSA-2m5v-pch6-74hx	package-lock.json
high	`osv/GHSA-qrxm-fqhp-jwvm`: undici@6.29.0 (npm) is affected by GHSA-qrxm-fqhp-jwvm	package-lock.json
high	`osv/GHSA-xjj6-f33q-929c`: undici@6.29.0 (npm) is affected by GHSA-xjj6-f33q-929c	package-lock.json
high	`osv/GHSA-2m5v-pch6-74hx`: undici@7.30.0 (npm) is affected by GHSA-2m5v-pch6-74hx	package-lock.json
high	`osv/GHSA-4w7w-5xrc-9h26`: undici@7.30.0 (npm) is affected by GHSA-4w7w-5xrc-9h26	package-lock.json
high	`osv/GHSA-qrxm-fqhp-jwvm`: undici@7.30.0 (npm) is affected by GHSA-qrxm-fqhp-jwvm	package-lock.json
high	`osv/GHSA-xjj6-f33q-929c`: undici@7.30.0 (npm) is affected by GHSA-xjj6-f33q-929c	package-lock.json
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/format.yml:12
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/format.yml:16
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/format.yml:22
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/format.yml:28
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/format.yml:35
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/format.yml:39
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/format.yml:45
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/format.yml:51
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/pr-title.yml:15
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:15
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:19
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/validate.yml:14

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 17,646; test lines: 3,111

Language	Lines
PHP	20,650
Shell	107

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/spawnia/sailor/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/spawnia/sailor/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/spawnia/sailor/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/spawnia/sailor/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/spawnia/sailor/security.svg)](https://repotrust.synapticcyber.com/r/github.com/spawnia/sailor/)