{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-1cd919510eb87c66", "name": "Possibly dead Python function: async_unload_entry", "shortDescription": {"text": "Possibly dead Python function: async_unload_entry"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ea24d021ec30d18", "name": "Possibly dead Python function: async_step_user", "shortDescription": {"text": "Possibly dead Python function: async_step_user"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a6d1cdeacea1ec0", "name": "Possibly dead Python function: async_step_init", "shortDescription": {"text": "Possibly dead Python function: async_step_init"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1877625a6c5750a7", "name": "Possibly dead Python function: async_step_add_schedule", "shortDescription": {"text": "Possibly dead Python function: async_step_add_schedule"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81ad708177c73e9b", "name": "Possibly dead Python function: async_step_edit_schedule", "shortDescription": {"text": "Possibly dead Python function: async_step_edit_schedule"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c66e76ad9e8fd944", "name": "Possibly dead Python function: async_step_remove_schedule", "shortDescription": {"text": "Possibly dead Python function: async_step_remove_schedule"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e96c89aff1a40ef", "name": "Possibly dead Python function: async_step_remove_schedule_confirm", "shortDescription": {"text": "Possibly dead Python function: async_step_remove_schedule_confirm"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9517258ece359f88", "name": "Possibly dead Python function: async_step_default_configuration", "shortDescription": {"text": "Possibly dead Python function: async_step_default_configuration"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c6f920cd5baf1f02", "name": "Possibly dead Python function: async_step_import_holidays", "shortDescription": {"text": "Possibly dead Python function: async_step_import_holidays"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-65aa740cba4a4a73", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7efbda965f283c17", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-266162aa2c525a31", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6655e70293c3c6ec", "name": "Very large file: tests/test_config_flow.py (2493 lines)", "shortDescription": {"text": "Very large file: tests/test_config_flow.py (2493 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf2039382e593946", "name": "Very large file: tests/test_holiday_import_comprehensive.py (1333 lines)", "shortDescription": {"text": "Very large file: tests/test_holiday_import_comprehensive.py (1333 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6d58d1f12b1147d", "name": "Very large file: custom_components/ha_scheduler/config_flow.py (1619 lines)", "shortDescription": {"text": "Very large file: custom_components/ha_scheduler/config_flow.py (1619 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cbb5857940ba0dc2", "name": "Agent instruction/config may expose a secret: AGENTS.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: AGENTS.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-48bb108fff8e8dbe", "name": "Agent instruction/config may expose a secret: .github/copilot-instructions.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .github/copilot-instructions.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-49b085b9b10c393e", "name": "Legacy-named symbol `async_migrate_v1_to_v2` in custom_components/ha_scheduler/migrations.py:32", "shortDescription": {"text": "Legacy-named symbol `async_migrate_v1_to_v2` in custom_components/ha_scheduler/migrations.py:32"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a8f6c1e56841365a", "name": "Commented-code block (5 lines) in custom_components/ha_scheduler/schedule_generator.py:117", "shortDescription": {"text": "Commented-code block (5 lines) in custom_components/ha_scheduler/schedule_generator.py:117"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ncustom_components/ha_scheduler/config_flow.py:async_step_configure_holiday_country, custom_components/ha_scheduler/config_flow.py:async_step_configure_holiday\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19886"}, "properties": {"repository": "Smiley73/ha-scheduler", "repoUrl": "https://github.com/Smiley73/ha-scheduler", "branch": "main"}, "results": [{"ruleId": "scanner-1cd919510eb87c66", "level": "note", "message": {"text": "Possibly dead Python function: async_unload_entry"}, "properties": {"repobilityId": "30a9c97872d972d2", "scanner": "scanner-primary", "fingerprint": "1cd919510eb87c66", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "custom_components/ha_scheduler/__init__.py:25"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2ea24d021ec30d18", "level": "note", "message": {"text": "Possibly dead Python function: async_step_user"}, "properties": {"repobilityId": "3e711d68888368f0", "scanner": "scanner-primary", "fingerprint": "2ea24d021ec30d18", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "custom_components/ha_scheduler/config_flow.py:141"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6a6d1cdeacea1ec0", "level": "note", "message": {"text": "Possibly dead Python function: async_step_init"}, "properties": {"repobilityId": "a2d8666a207dd7f1", "scanner": "scanner-primary", "fingerprint": "6a6d1cdeacea1ec0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "custom_components/ha_scheduler/config_flow.py:366"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1877625a6c5750a7", "level": "note", "message": {"text": "Possibly dead Python function: async_step_add_schedule"}, "properties": {"repobilityId": "fd9eb3342f922ad2", "scanner": "scanner-primary", "fingerprint": "1877625a6c5750a7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "custom_components/ha_scheduler/config_flow.py:381"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-81ad708177c73e9b", "level": "note", "message": {"text": "Possibly dead Python function: async_step_edit_schedule"}, "properties": {"repobilityId": "ef57721c4f3b5633", "scanner": "scanner-primary", "fingerprint": "81ad708177c73e9b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "custom_components/ha_scheduler/config_flow.py:1042"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c66e76ad9e8fd944", "level": "note", "message": {"text": "Possibly dead Python function: async_step_remove_schedule"}, "properties": {"repobilityId": "b35de03ac611352d", "scanner": "scanner-primary", "fingerprint": "c66e76ad9e8fd944", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "custom_components/ha_scheduler/config_flow.py:1094"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1e96c89aff1a40ef", "level": "note", "message": {"text": "Possibly dead Python function: async_step_remove_schedule_confirm"}, "properties": {"repobilityId": "e62eed8a4cc9a711", "scanner": "scanner-primary", "fingerprint": "1e96c89aff1a40ef", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "custom_components/ha_scheduler/config_flow.py:1142"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9517258ece359f88", "level": "note", "message": {"text": "Possibly dead Python function: async_step_default_configuration"}, "properties": {"repobilityId": "a14411b60b233054", "scanner": "scanner-primary", "fingerprint": "9517258ece359f88", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "custom_components/ha_scheduler/config_flow.py:1162"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c6f920cd5baf1f02", "level": "note", "message": {"text": "Possibly dead Python function: async_step_import_holidays"}, "properties": {"repobilityId": "f6d2d549cfcd1ce5", "scanner": "scanner-primary", "fingerprint": "c6f920cd5baf1f02", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "custom_components/ha_scheduler/config_flow.py:1265"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f72e4b498f09201b", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7640466c92034bac", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3130c0a2c5ea460e", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "925b528a63157ee6", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d8f8ba9161e1a9f4", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-266162aa2c525a31", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fe33aafb64ea7991", "scanner": "scanner-primary", "fingerprint": "266162aa2c525a31", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/lint.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-6655e70293c3c6ec", "level": "note", "message": {"text": "Very large file: tests/test_config_flow.py (2493 lines)"}, "properties": {"repobilityId": "c671354e044e1f99", "scanner": "scanner-primary", "fingerprint": "6655e70293c3c6ec", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bf2039382e593946", "level": "note", "message": {"text": "Very large file: tests/test_holiday_import_comprehensive.py (1333 lines)"}, "properties": {"repobilityId": "550a7ea84964d52e", "scanner": "scanner-primary", "fingerprint": "bf2039382e593946", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b6d58d1f12b1147d", "level": "note", "message": {"text": "Very large file: custom_components/ha_scheduler/config_flow.py (1619 lines)"}, "properties": {"repobilityId": "c712cecb2b40ca46", "scanner": "scanner-primary", "fingerprint": "b6d58d1f12b1147d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "3a64260112a424cc", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "6ff3cc33d79e9be0", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-cbb5857940ba0dc2", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: AGENTS.md"}, "properties": {"repobilityId": "e12c7213d5eadf3e", "scanner": "scanner-primary", "fingerprint": "cbb5857940ba0dc2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 687}}}]}, {"ruleId": "scanner-48bb108fff8e8dbe", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .github/copilot-instructions.md"}, "properties": {"repobilityId": "4ecf14e8fecc6b34", "scanner": "scanner-primary", "fingerprint": "48bb108fff8e8dbe", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "agent_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/copilot-instructions.md"}, "region": {"startLine": 687}}}]}, {"ruleId": "scanner-49b085b9b10c393e", "level": "note", "message": {"text": "Legacy-named symbol `async_migrate_v1_to_v2` in custom_components/ha_scheduler/migrations.py:32"}, "properties": {"repobilityId": "6b53d36d2d99dfbc", "scanner": "scanner-primary", "fingerprint": "49b085b9b10c393e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a8f6c1e56841365a", "level": "none", "message": {"text": "Commented-code block (5 lines) in custom_components/ha_scheduler/schedule_generator.py:117"}, "properties": {"repobilityId": "f73ebccc07fe0744", "scanner": "scanner-primary", "fingerprint": "a8f6c1e56841365a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4bf1d8c9a90b0859", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}