{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-6bc52b6e98f453f5", "name": "Possibly dead Python function: decode_funct3", "shortDescription": {"text": "Possibly dead Python function: decode_funct3"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4ee2000ee5ac8bde", "name": "Possibly dead Python function: check_against_eh2_trace", "shortDescription": {"text": "Possibly dead Python function: check_against_eh2_trace"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ae82fc5211aab7cb", "name": "Possibly dead Python function: subst_dict", "shortDescription": {"text": "Possibly dead Python function: subst_dict"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27aca147e51fb3c6", "name": "Possibly dead Python function: export", "shortDescription": {"text": "Possibly dead Python function: export"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2da5f0bae113c355", "name": "Possibly dead Python function: load_recorded_sim_returncode", "shortDescription": {"text": "Possibly dead Python function: load_recorded_sim_returncode"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-33aee793cde14329", "name": "Possibly dead Python function: compute_testlist_pool", "shortDescription": {"text": "Possibly dead Python function: compute_testlist_pool"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-42649ed66d838ad6", "name": "Possibly dead Python function: repl", "shortDescription": {"text": "Possibly dead Python function: repl"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be97ca2818aae7a4", "name": "Possibly dead Python function: find_test_entry", "shortDescription": {"text": "Possibly dead Python function: find_test_entry"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e1d100dd6597452c", "name": "Possibly dead Python function: output_results_html", "shortDescription": {"text": "Possibly dead Python function: output_results_html"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-195de2720be763c2", "name": "Possibly dead Python function: output_run_results_junit_xml", "shortDescription": {"text": "Possibly dead Python function: output_run_results_junit_xml"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1ef04112de5abfe", "name": "Possibly dead Python function: output_results_dvsim_json", "shortDescription": {"text": "Possibly dead Python function: output_results_dvsim_json"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df7b344f865c7b3f", "name": "Possibly dead Python function: create_test_summary_dict", "shortDescription": {"text": "Possibly dead Python function: create_test_summary_dict"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46a31bedd6c41d2b", "name": "Possibly dead Python function: output_results_svg", "shortDescription": {"text": "Possibly dead Python function: output_results_svg"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b0f26aaf7debb999", "name": "Possibly dead Python function: output_results_text", "shortDescription": {"text": "Possibly dead Python function: output_results_text"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e5483c3a16f9c628", "name": "Possibly dead Python function: process_eh2_sim_log", "shortDescription": {"text": "Possibly dead Python function: process_eh2_sim_log"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-304cf40f0420f842", "name": "Possibly dead Python function: check_eh2_uvm_log", "shortDescription": {"text": "Possibly dead Python function: check_eh2_uvm_log"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-db1ce1d6dc5a01d5", "name": "Possibly dead Python function: setup", "shortDescription": {"text": "Possibly dead Python function: setup"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0f581de9c342432b", "name": "Privileged port 12 in use", "shortDescription": {"text": "Privileged port 12 in use"}, "fullDescription": {"text": "Port 12 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-02238efa29d94310", "name": "Privileged port 11 in use", "shortDescription": {"text": "Privileged port 11 in use"}, "fullDescription": {"text": "Port 11 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f8c7c103127232a7", "name": "Privileged port 31 in use", "shortDescription": {"text": "Privileged port 31 in use"}, "fullDescription": {"text": "Port 31 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bafe8027f24dbb7b", "name": "Privileged port 30 in use", "shortDescription": {"text": "Privileged port 30 in use"}, "fullDescription": {"text": "Port 30 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d3938e7a505afaf4", "name": "Privileged port 28 in use", "shortDescription": {"text": "Privileged port 28 in use"}, "fullDescription": {"text": "Port 28 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fea3ecaccf5ad7f4", "name": "Privileged port 10 in use", "shortDescription": {"text": "Privileged port 10 in use"}, "fullDescription": {"text": "Port 10 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a8db987af5659ead", "name": "Insecure pattern 'subprocess_shell_true' in dv/uvm/core_eh2/scripts/run_rtl.py:100", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in dv/uvm/core_eh2/scripts/run_rtl.py:100"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-97cd387fae7ff1c9", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f8c0801f98c9d930", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47b0515c3860ca68", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-266162aa2c525a31", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-92983fe6ea6c60aa", "name": "Very large file: dv/uvm/core_eh2/scripts/signoff.py (1774 lines)", "shortDescription": {"text": "Very large file: dv/uvm/core_eh2/scripts/signoff.py (1774 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a9e80171d8c1881", "name": "Very large file: dv/uvm/core_eh2/scripts/tests/test_regression_framework.py (2361 lines)", "shortDescription": {"text": "Very large file: dv/uvm/core_eh2/scripts/tests/test_regression_framework.py (2361 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 162 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b1ed97247b4615b8", "name": "Commented-code block (10 lines) in dv/uvm/core_eh2/scripts/check_logs.py:26", "shortDescription": {"text": "Commented-code block (10 lines) in dv/uvm/core_eh2/scripts/check_logs.py:26"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a845fb289277966c", "name": "Commented-code block (5 lines) in dv/uvm/core_eh2/scripts/signoff.py:398", "shortDescription": {"text": "Commented-code block (5 lines) in dv/uvm/core_eh2/scripts/signoff.py:398"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f52a84979f411b5a", "name": "Commented-code block (7 lines) in dv/uvm/core_eh2/scripts/run_regress.py:381", "shortDescription": {"text": "Commented-code block (7 lines) in dv/uvm/core_eh2/scripts/run_regress.py:381"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-24048b8f320cfed3", "name": "Commented-code block (5 lines) in dv/uvm/core_eh2/scripts/merge_cov.py:194", "shortDescription": {"text": "Commented-code block (5 lines) in dv/uvm/core_eh2/scripts/merge_cov.py:194"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e9db80853419136f", "name": "Network/subprocess call without timeout or try/except \u2014 dv/uvm/core_eh2/scripts/get_fcov.py:53", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 dv/uvm/core_eh2/scripts/get_fcov.py:53"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2127ea18303c5a82", "name": "Commented-code block (5 lines) in dv/uvm/core_eh2/scripts/tests/test_regression_framework.py:368", "shortDescription": {"text": "Commented-code block (5 lines) in dv/uvm/core_eh2/scripts/tests/test_regression_framework.py:368"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b028acf3aac2990e", "name": "Commented-code block (6 lines) in dv/uvm/core_eh2/riscv_dv_extension/eh2_log_to_trace_csv.py:210", "shortDescription": {"text": "Commented-code block (6 lines) in dv/uvm/core_eh2/riscv_dv_extension/eh2_log_to_trace_csv.py:210"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ndv/uvm/core_eh2/scripts/signoff.py:collect_cosim_exceptions, dv/uvm/core_eh2/scripts/signoff.py:collect_skip_in_signoff\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ndocs/sphinx_cn/source/_ext/eh2_tabs_fallback.py:run, docs/sphinx_cn/source/_ext/eh2_tabs_fallback.py:run, docs/sphinx_cn/source/_ext/eh2_tabs_fallback.py:run\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24779"}, "properties": {"repository": "bzambition/eh2-veri", "repoUrl": "https://github.com/bzambition/eh2-veri", "branch": "main"}, "results": [{"ruleId": "scanner-6bc52b6e98f453f5", "level": "note", "message": {"text": "Possibly dead Python function: decode_funct3"}, "properties": {"repobilityId": "7a21eb1c7f7b991a", "scanner": "scanner-primary", "fingerprint": "6bc52b6e98f453f5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/formal/spec/sail_trace_check.py:63"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4ee2000ee5ac8bde", "level": "note", "message": {"text": "Possibly dead Python function: check_against_eh2_trace"}, "properties": {"repobilityId": "658a9538a51fd3d8", "scanner": "scanner-primary", "fingerprint": "4ee2000ee5ac8bde", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/formal/spec/sail_trace_check.py:132"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ae82fc5211aab7cb", "level": "note", "message": {"text": "Possibly dead Python function: subst_dict"}, "properties": {"repobilityId": "9b64c8c18c01079f", "scanner": "scanner-primary", "fingerprint": "ae82fc5211aab7cb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/uvm/core_eh2/scripts/scripts_lib.py:101"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27aca147e51fb3c6", "level": "note", "message": {"text": "Possibly dead Python function: export"}, "properties": {"repobilityId": "eb9ca389f8cda1a9", "scanner": "scanner-primary", "fingerprint": "27aca147e51fb3c6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/uvm/core_eh2/scripts/scripts_lib.py:172"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2da5f0bae113c355", "level": "note", "message": {"text": "Possibly dead Python function: load_recorded_sim_returncode"}, "properties": {"repobilityId": "0bcb89881ed1fa60", "scanner": "scanner-primary", "fingerprint": "2da5f0bae113c355", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/uvm/core_eh2/scripts/check_logs.py:238"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-33aee793cde14329", "level": "note", "message": {"text": "Possibly dead Python function: compute_testlist_pool"}, "properties": {"repobilityId": "bcc1bc2182ce812a", "scanner": "scanner-primary", "fingerprint": "33aee793cde14329", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/uvm/core_eh2/scripts/signoff.py:1232"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-42649ed66d838ad6", "level": "note", "message": {"text": "Possibly dead Python function: repl"}, "properties": {"repobilityId": "6f5d3779bbb8be8b", "scanner": "scanner-primary", "fingerprint": "42649ed66d838ad6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/uvm/core_eh2/scripts/render_config_template.py:46"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-be97ca2818aae7a4", "level": "note", "message": {"text": "Possibly dead Python function: find_test_entry"}, "properties": {"repobilityId": "5ebe89a97155a776", "scanner": "scanner-primary", "fingerprint": "be97ca2818aae7a4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/uvm/core_eh2/scripts/run_regress.py:46"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e1d100dd6597452c", "level": "note", "message": {"text": "Possibly dead Python function: output_results_html"}, "properties": {"repobilityId": "74f9dcfc687a687e", "scanner": "scanner-primary", "fingerprint": "e1d100dd6597452c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/uvm/core_eh2/scripts/report_lib/html.py:26"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-195de2720be763c2", "level": "note", "message": {"text": "Possibly dead Python function: output_run_results_junit_xml"}, "properties": {"repobilityId": "4b84c565f75bb3da", "scanner": "scanner-primary", "fingerprint": "195de2720be763c2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/uvm/core_eh2/scripts/report_lib/junit_xml.py:69"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a1ef04112de5abfe", "level": "note", "message": {"text": "Possibly dead Python function: output_results_dvsim_json"}, "properties": {"repobilityId": "71abda429ee34b6b", "scanner": "scanner-primary", "fingerprint": "a1ef04112de5abfe", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/uvm/core_eh2/scripts/report_lib/dvsim_json.py:49"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-df7b344f865c7b3f", "level": "note", "message": {"text": "Possibly dead Python function: create_test_summary_dict"}, "properties": {"repobilityId": "ba75a21b804f1f40", "scanner": "scanner-primary", "fingerprint": "df7b344f865c7b3f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/uvm/core_eh2/scripts/report_lib/util.py:63"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46a31bedd6c41d2b", "level": "note", "message": {"text": "Possibly dead Python function: output_results_svg"}, "properties": {"repobilityId": "3994cdb29946026a", "scanner": "scanner-primary", "fingerprint": "46a31bedd6c41d2b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/uvm/core_eh2/scripts/report_lib/svg.py:88"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b0f26aaf7debb999", "level": "note", "message": {"text": "Possibly dead Python function: output_results_text"}, "properties": {"repobilityId": "f9880623b75421bf", "scanner": "scanner-primary", "fingerprint": "b0f26aaf7debb999", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/uvm/core_eh2/scripts/report_lib/text.py:31"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e5483c3a16f9c628", "level": "note", "message": {"text": "Possibly dead Python function: process_eh2_sim_log"}, "properties": {"repobilityId": "71c8a83dc43eca5d", "scanner": "scanner-primary", "fingerprint": "e5483c3a16f9c628", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/uvm/core_eh2/riscv_dv_extension/eh2_log_to_trace_csv.py:96"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-304cf40f0420f842", "level": "note", "message": {"text": "Possibly dead Python function: check_eh2_uvm_log"}, "properties": {"repobilityId": "22cfddef512d6c59", "scanner": "scanner-primary", "fingerprint": "304cf40f0420f842", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/uvm/core_eh2/riscv_dv_extension/eh2_log_to_trace_csv.py:184"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-db1ce1d6dc5a01d5", "level": "note", "message": {"text": "Possibly dead Python function: setup"}, "properties": {"repobilityId": "52737e4a6c586991", "scanner": "scanner-primary", "fingerprint": "db1ce1d6dc5a01d5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/sphinx_cn/source/_ext/eh2_tabs_fallback.py:68"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0f581de9c342432b", "level": "warning", "message": {"text": "Privileged port 12 in use"}, "properties": {"repobilityId": "65e7eefa33f2def4", "scanner": "scanner-primary", "fingerprint": "0f581de9c342432b", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/uvm/core_eh2/riscv_dv_extension/csr_description.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-02238efa29d94310", "level": "warning", "message": {"text": "Privileged port 11 in use"}, "properties": {"repobilityId": "5b3038c67fabb4c8", "scanner": "scanner-primary", "fingerprint": "02238efa29d94310", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/uvm/core_eh2/riscv_dv_extension/csr_description.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f8c7c103127232a7", "level": "warning", "message": {"text": "Privileged port 31 in use"}, "properties": {"repobilityId": "8a1049d03b927a2d", "scanner": "scanner-primary", "fingerprint": "f8c7c103127232a7", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/uvm/core_eh2/riscv_dv_extension/csr_description.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bafe8027f24dbb7b", "level": "warning", "message": {"text": "Privileged port 30 in use"}, "properties": {"repobilityId": "54f172e7d16fc662", "scanner": "scanner-primary", "fingerprint": "bafe8027f24dbb7b", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/uvm/core_eh2/riscv_dv_extension/csr_description.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d3938e7a505afaf4", "level": "warning", "message": {"text": "Privileged port 28 in use"}, "properties": {"repobilityId": "5c3f00b3e839840d", "scanner": "scanner-primary", "fingerprint": "d3938e7a505afaf4", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/uvm/core_eh2/riscv_dv_extension/csr_description.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fea3ecaccf5ad7f4", "level": "warning", "message": {"text": "Privileged port 10 in use"}, "properties": {"repobilityId": "735372d6b5594915", "scanner": "scanner-primary", "fingerprint": "fea3ecaccf5ad7f4", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/uvm/core_eh2/riscv_dv_extension/csr_description.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a8db987af5659ead", "level": "error", "message": {"text": "Insecure pattern 'subprocess_shell_true' in dv/uvm/core_eh2/scripts/run_rtl.py:100"}, "properties": {"repobilityId": "825420341e0772c5", "scanner": "scanner-primary", "fingerprint": "a8db987af5659ead", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dv/uvm/core_eh2/scripts/run_rtl.py"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-97cd387fae7ff1c9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "de91641340ba96e6", "scanner": "scanner-primary", "fingerprint": "97cd387fae7ff1c9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sim.yml"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-f8c0801f98c9d930", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1ae61d3712da69f2", "scanner": "scanner-primary", "fingerprint": "f8c0801f98c9d930", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/nightly.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-47b0515c3860ca68", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c4804932e1c2778c", "scanner": "scanner-primary", "fingerprint": "47b0515c3860ca68", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/unit-tests.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-47b0515c3860ca68", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c4804932e1c2778c", "scanner": "scanner-primary", "fingerprint": "47b0515c3860ca68", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/unit-tests.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-266162aa2c525a31", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e19d2b58876c91e", "scanner": "scanner-primary", "fingerprint": "266162aa2c525a31", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/lint.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-92983fe6ea6c60aa", "level": "note", "message": {"text": "Very large file: dv/uvm/core_eh2/scripts/signoff.py (1774 lines)"}, "properties": {"repobilityId": "992f8cdd1ba23a70", "scanner": "scanner-primary", "fingerprint": "92983fe6ea6c60aa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1a9e80171d8c1881", "level": "note", "message": {"text": "Very large file: dv/uvm/core_eh2/scripts/tests/test_regression_framework.py (2361 lines)"}, "properties": {"repobilityId": "a61624fa6fbb1e69", "scanner": "scanner-primary", "fingerprint": "1a9e80171d8c1881", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "e586c520ac084e6e", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "1e2f6dbaf2707660", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "bea4832720034e00", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b1ed97247b4615b8", "level": "none", "message": {"text": "Commented-code block (10 lines) in dv/uvm/core_eh2/scripts/check_logs.py:26"}, "properties": {"repobilityId": "9be0dac8b50adb91", "scanner": "scanner-primary", "fingerprint": "b1ed97247b4615b8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a845fb289277966c", "level": "none", "message": {"text": "Commented-code block (5 lines) in dv/uvm/core_eh2/scripts/signoff.py:398"}, "properties": {"repobilityId": "8c1d366fcaadc4da", "scanner": "scanner-primary", "fingerprint": "a845fb289277966c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f52a84979f411b5a", "level": "none", "message": {"text": "Commented-code block (7 lines) in dv/uvm/core_eh2/scripts/run_regress.py:381"}, "properties": {"repobilityId": "afe4f75458559992", "scanner": "scanner-primary", "fingerprint": "f52a84979f411b5a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-24048b8f320cfed3", "level": "none", "message": {"text": "Commented-code block (5 lines) in dv/uvm/core_eh2/scripts/merge_cov.py:194"}, "properties": {"repobilityId": "3738309e59ec8c56", "scanner": "scanner-primary", "fingerprint": "24048b8f320cfed3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e9db80853419136f", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 dv/uvm/core_eh2/scripts/get_fcov.py:53"}, "properties": {"repobilityId": "977d1b3d9c481230", "scanner": "scanner-primary", "fingerprint": "e9db80853419136f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2127ea18303c5a82", "level": "none", "message": {"text": "Commented-code block (5 lines) in dv/uvm/core_eh2/scripts/tests/test_regression_framework.py:368"}, "properties": {"repobilityId": "b9628d8422d951eb", "scanner": "scanner-primary", "fingerprint": "2127ea18303c5a82", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b028acf3aac2990e", "level": "none", "message": {"text": "Commented-code block (6 lines) in dv/uvm/core_eh2/riscv_dv_extension/eh2_log_to_trace_csv.py:210"}, "properties": {"repobilityId": "c972188a3f371ebc", "scanner": "scanner-primary", "fingerprint": "b028acf3aac2990e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "55951a8648dfe06a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4f2c5ad704384407", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "55f818be4a15cabd", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "797675f94aff6be5", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "076ec9a880fbac70", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "27d1190198d5dc09", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}