{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-5d7d954cdd9af21c", "name": "Possibly dead Python function: set_aux_hidden_state_layers", "shortDescription": {"text": "Possibly dead Python function: set_aux_hidden_state_layers"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a779f5a596b5428", "name": "Possibly dead Python function: get_eagle3_aux_hidden_state_layers", "shortDescription": {"text": "Possibly dead Python function: get_eagle3_aux_hidden_state_layers"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ed42cbf35ba794a", "name": "Possibly dead Python function: forward", "shortDescription": {"text": "Possibly dead Python function: forward"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-13b50c347db333c8", "name": "Possibly dead Python function: compute_logits", "shortDescription": {"text": "Possibly dead Python function: compute_logits"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f83bcad24430841", "name": "Possibly dead Python function: recompute_mrope_positions", "shortDescription": {"text": "Possibly dead Python function: recompute_mrope_positions"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-04c81e7a78286648", "name": "Possibly dead Python function: update_physical_experts_metadata", "shortDescription": {"text": "Possibly dead Python function: update_physical_experts_metadata"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-603e96c6d5b6c282", "name": "Privileged port 465 in use", "shortDescription": {"text": "Privileged port 465 in use"}, "fullDescription": {"text": "Port 465 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ed23c1fe5c3e8b1b", "name": "Privileged port 256 in use", "shortDescription": {"text": "Privileged port 256 in use"}, "fullDescription": {"text": "Port 256 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fcd2a42c12b23cf8", "name": "Privileged port 866 in use", "shortDescription": {"text": "Privileged port 866 in use"}, "fullDescription": {"text": "Port 866 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f67e9f02e0e74e5c", "name": "Privileged port 17 in use", "shortDescription": {"text": "Privileged port 17 in use"}, "fullDescription": {"text": "Port 17 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf5095f4d016df4c", "name": "Insecure pattern 'weak_hash' in cluster/base/flux-system/gotk-components.yaml:4828", "shortDescription": {"text": "Insecure pattern 'weak_hash' in cluster/base/flux-system/gotk-components.yaml:4828"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8f4c232b4aa78fc9", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77166cbd46fcd8e4", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4997f3f751f47d42", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "github/super-linter/slim@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de53ac274e5b4ecf", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37716d9c0a33ad5c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 1 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-faccb9061e9b52a0", "name": "No README detected", "shortDescription": {"text": "No README detected"}, "fullDescription": {"text": "No README file was found. Generated repos without README context are hard to operate, validate, or safely hand off."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: tests, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ncluster/apps/ai/vllm/app/patches/qwen3_5.py:get_hf_config, cluster/apps/ai/vllm/app/patches/qwen3_5.py:get_hf_config\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ncluster/apps/ai/vllm/app/patches/qwen3_5.py:load_weights, cluster/apps/ai/vllm/app/patches/qwen3_5.py:load_weights, cluster/apps/ai/vllm/app/patches/qwen3_5.py:load_weights\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24138"}, "properties": {"repository": "a-mcf/k3s-gitops", "repoUrl": "https://github.com/a-mcf/k3s-gitops", "branch": "main"}, "results": [{"ruleId": "scanner-5d7d954cdd9af21c", "level": "note", "message": {"text": "Possibly dead Python function: set_aux_hidden_state_layers"}, "properties": {"repobilityId": "fa965f160767798a", "scanner": "scanner-primary", "fingerprint": "5d7d954cdd9af21c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cluster/apps/ai/vllm/app/patches/qwen3_5.py:514"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2a779f5a596b5428", "level": "note", "message": {"text": "Possibly dead Python function: get_eagle3_aux_hidden_state_layers"}, "properties": {"repobilityId": "4f4cb22410fda433", "scanner": "scanner-primary", "fingerprint": "2a779f5a596b5428", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cluster/apps/ai/vllm/app/patches/qwen3_5.py:517"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2ed42cbf35ba794a", "level": "note", "message": {"text": "Possibly dead Python function: forward"}, "properties": {"repobilityId": "ea414cce7f8e5874", "scanner": "scanner-primary", "fingerprint": "2ed42cbf35ba794a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cluster/apps/ai/vllm/app/patches/qwen3_5.py:660"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-13b50c347db333c8", "level": "note", "message": {"text": "Possibly dead Python function: compute_logits"}, "properties": {"repobilityId": "41d56da1043c49f1", "scanner": "scanner-primary", "fingerprint": "13b50c347db333c8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cluster/apps/ai/vllm/app/patches/qwen3_5.py:535"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6f83bcad24430841", "level": "note", "message": {"text": "Possibly dead Python function: recompute_mrope_positions"}, "properties": {"repobilityId": "18cb657d645e1d58", "scanner": "scanner-primary", "fingerprint": "6f83bcad24430841", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cluster/apps/ai/vllm/app/patches/qwen3_5.py:654"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-04c81e7a78286648", "level": "note", "message": {"text": "Possibly dead Python function: update_physical_experts_metadata"}, "properties": {"repobilityId": "0a9e372831399f6c", "scanner": "scanner-primary", "fingerprint": "04c81e7a78286648", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cluster/apps/ai/vllm/app/patches/qwen3_5.py:755"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-603e96c6d5b6c282", "level": "warning", "message": {"text": "Privileged port 465 in use"}, "properties": {"repobilityId": "bcd1f06b60a2b6bc", "scanner": "scanner-primary", "fingerprint": "603e96c6d5b6c282", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cluster/apps/authentik/authentik/app/helm-release.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ed23c1fe5c3e8b1b", "level": "warning", "message": {"text": "Privileged port 256 in use"}, "properties": {"repobilityId": "0ec1f2d0c9e6da94", "scanner": "scanner-primary", "fingerprint": "ed23c1fe5c3e8b1b", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cluster/apps/garage/garage-premium/app/helm-release.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fcd2a42c12b23cf8", "level": "warning", "message": {"text": "Privileged port 866 in use"}, "properties": {"repobilityId": "25c09cd1391afe3a", "scanner": "scanner-primary", "fingerprint": "fcd2a42c12b23cf8", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cluster/apps/garage/garage-premium/app/helm-release.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f67e9f02e0e74e5c", "level": "warning", "message": {"text": "Privileged port 17 in use"}, "properties": {"repobilityId": "0bf38fb8f89ec589", "scanner": "scanner-primary", "fingerprint": "f67e9f02e0e74e5c", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cluster/apps/garage/garage-premium/webui/helm-release.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf5095f4d016df4c", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in cluster/base/flux-system/gotk-components.yaml:4828"}, "properties": {"repobilityId": "f9209350ddf538bd", "scanner": "scanner-primary", "fingerprint": "cf5095f4d016df4c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cluster/base/flux-system/gotk-components.yaml"}, "region": {"startLine": 4828}}}]}, {"ruleId": "scanner-8f4c232b4aa78fc9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2aa8458f6ec87a2", "scanner": "scanner-primary", "fingerprint": "8f4c232b4aa78fc9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude-code-review.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-8f4c232b4aa78fc9", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7572d8d133564421", "scanner": "scanner-primary", "fingerprint": "8f4c232b4aa78fc9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude-code-review.yml"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-77166cbd46fcd8e4", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "50f3b563ffac10e9", "scanner": "scanner-primary", "fingerprint": "77166cbd46fcd8e4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude-code-review.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4997f3f751f47d42", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "909b9a989726cee9", "scanner": "scanner-primary", "fingerprint": "4997f3f751f47d42", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/lint.yaml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-de53ac274e5b4ecf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "69dd0abad9dba1dc", "scanner": "scanner-primary", "fingerprint": "de53ac274e5b4ecf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-de53ac274e5b4ecf", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8ead6a2c2bfe167b", "scanner": "scanner-primary", "fingerprint": "de53ac274e5b4ecf", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-37716d9c0a33ad5c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "abfb5752158cf655", "scanner": "scanner-primary", "fingerprint": "37716d9c0a33ad5c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-faccb9061e9b52a0", "level": "note", "message": {"text": "No README detected"}, "properties": {"repobilityId": "578365aa27055d14", "scanner": "scanner-primary", "fingerprint": "faccb9061e9b52a0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "dafde5301fb19a65", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "c34e876e31680f08", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "eb5d10fd34e66a22", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "4b90b112bc899c5a", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "64ac80c59d20925a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2bcb3014ee0c16ab", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}