1.4

Adjusted Signal

1.4

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

25.7K

Stars

Language

1.4M

Lines of Code

7.5K

Files

1.8K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 6.3/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 1761 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.2/100 · LOW

Are imports declared and package/API names verified? 68 finding(s).

Agent Over-Engineering Ratio 0.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 10 finding(s).

PR Review Velocity Impact 6.6/100 · LOW

Which changes need focused human review? 1839 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 3MEDIUM 50LOW 1786

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1839 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block1589 hits · 1490 pts

Severity	File	Line	Snippet	Context
LOW	Documentation/check-build.sh	101	-E -n --color -w "${warnings}" -W --keep-going 2>/dev/null	COMMENT
LOW	Documentation/conf.py	1	# -- coding: utf-8 --	COMMENT
LOW	Documentation/conf.py	261	# bottom, using the given strftime format.	COMMENT
LOW	tools/cloud-dep-check/main.go	1	// SPDX-License-Identifier: Apache-2.0	COMMENT
LOW	tools/mount/main.go	21	// This program is executed by an init container so we purposely don't	COMMENT
LOW	install/kubernetes/cilium/values.yaml	1	# File generated by install/kubernetes/Makefile; DO NOT EDIT.	COMMENT
LOW	install/kubernetes/cilium/values.yaml	21	# For example: '1.7', '1.8', '1.9'	COMMENT
LOW	install/kubernetes/cilium/values.yaml	41	# - tagged	COMMENT
LOW	install/kubernetes/cilium/values.yaml	61	# @default -- `"~/.kube/config"`	COMMENT
LOW	install/kubernetes/cilium/values.yaml	81	k8sServicePort: ""	COMMENT
LOW	install/kubernetes/cilium/values.yaml	101	# -- (int) The sustained request rate in requests per second.	COMMENT
LOW	install/kubernetes/cilium/values.yaml	121	# @schema	COMMENT
LOW	install/kubernetes/cilium/values.yaml	221	# -- Install the cilium agent resources.	COMMENT
LOW	install/kubernetes/cilium/values.yaml	241	# -- List of config-map keys to ignore when computing the drift delta.	COMMENT
LOW	install/kubernetes/cilium/values.yaml	281	tolerations:	COMMENT
LOW	install/kubernetes/cilium/values.yaml	301	extraHostPathMounts: []	COMMENT
LOW	install/kubernetes/cilium/values.yaml	341	# requests:	COMMENT
LOW	install/kubernetes/cilium/values.yaml	361	capabilities:	COMMENT
LOW	install/kubernetes/cilium/values.yaml	381	# Could be an alternative for the SYS_ADMIN for the RLIMIT_NPROC	COMMENT
LOW	install/kubernetes/cilium/values.yaml	401	- SYS_ADMIN	COMMENT
LOW	install/kubernetes/cilium/values.yaml	421	- SYS_MODULE	COMMENT
LOW	install/kubernetes/cilium/values.yaml	441	# @schema	COMMENT
LOW	install/kubernetes/cilium/values.yaml	461	annotateK8sNode: false	COMMENT
LOW	install/kubernetes/cilium/values.yaml	501	enabled: false	COMMENT
LOW	install/kubernetes/cilium/values.yaml	521	create: false	COMMENT
LOW	install/kubernetes/cilium/values.yaml	541	enabled: false	COMMENT
LOW	install/kubernetes/cilium/values.yaml	561	root: /sys/fs/bpf	COMMENT
LOW	install/kubernetes/cilium/values.yaml	581	# tracking table.	COMMENT
LOW	install/kubernetes/cilium/values.yaml	601	# BPF events map. The number of messages is averaged, meaning that if no messages	COMMENT
LOW	install/kubernetes/cilium/values.yaml	621	# -- Enable policy verdict events.	COMMENT
LOW	install/kubernetes/cilium/values.yaml	641	# -- (int) Configure the maximum number of entries for the neighbor table.	COMMENT
LOW	install/kubernetes/cilium/values.yaml	661	# -- Configure the maximum number of entries in global policy stats map.	COMMENT
LOW	install/kubernetes/cilium/values.yaml	681	monitorFlags: "all"	COMMENT
LOW	install/kubernetes/cilium/values.yaml	701	# @schema	COMMENT
LOW	install/kubernetes/cilium/values.yaml	721	tproxy: ~	COMMENT
LOW	install/kubernetes/cilium/values.yaml	741	# -- (bool) Attach endpoint programs using tcx instead of legacy tc hooks on	COMMENT
LOW	install/kubernetes/cilium/values.yaml	761	# -- Wait for KUBE-PROXY-CANARY iptables rule to appear in "wait-for-kube-proxy"	COMMENT
LOW	install/kubernetes/cilium/values.yaml	781	# - generic-veth	COMMENT
LOW	install/kubernetes/cilium/values.yaml	801	# -- Skip writing of the CNI configuration. This can be used if	COMMENT
LOW	install/kubernetes/cilium/values.yaml	821	# parameter must be specified too.	COMMENT
LOW	install/kubernetes/cilium/values.yaml	841	# type: [integer, string]	COMMENT
LOW	install/kubernetes/cilium/values.yaml	861	# -- (string) Configure the maximum frequency for the garbage collection of the	COMMENT
LOW	install/kubernetes/cilium/values.yaml	881	# -- Configure a custom list of possible configuration override sources	COMMENT
LOW	install/kubernetes/cilium/values.yaml	901	# -- blockedConfigOverrides is a list of config-map keys that may not be overridden.	COMMENT
LOW	install/kubernetes/cilium/values.yaml	921	# medium: "Memory"	COMMENT
LOW	install/kubernetes/cilium/values.yaml	961	burst: 100	COMMENT
LOW	install/kubernetes/cilium/values.yaml	981	ingressController:	COMMENT
LOW	install/kubernetes/cilium/values.yaml	1001	# -- Configure whether to use the remote address of the client when determining the source IP.	COMMENT
LOW	install/kubernetes/cilium/values.yaml	1021	create: true	COMMENT
LOW	install/kubernetes/cilium/values.yaml	1041	# -- Configure whether the secure HTTPS port (443) is exposed on the shared LB service.	COMMENT
LOW	install/kubernetes/cilium/values.yaml	1061	# -- Configure a specific loadBalancerIP on the shared LB service	COMMENT
LOW	install/kubernetes/cilium/values.yaml	1081	httpPort: 0	COMMENT
LOW	install/kubernetes/cilium/values.yaml	1101	enableProxyProtocol: false	COMMENT
LOW	install/kubernetes/cilium/values.yaml	1121	# type: [boolean, string]	COMMENT
LOW	install/kubernetes/cilium/values.yaml	1141	nodes:	COMMENT
LOW	install/kubernetes/cilium/values.yaml	1161	# -- Enable encryption for pure node to node traffic.	COMMENT
LOW	install/kubernetes/cilium/values.yaml	1181	keyFile: keys	COMMENT
LOW	install/kubernetes/cilium/values.yaml	1201	# -- CA backend used by ztunnel to issue workload identities.	COMMENT
LOW	install/kubernetes/cilium/values.yaml	1261	# @schema	COMMENT
LOW	install/kubernetes/cilium/values.yaml	1281	# type: [null, string]	COMMENT
1529 more matches not shown…

Structural Annotation Overuse51 hits · 88 pts

Severity	File	Line	Snippet	Context
LOW	operator/pkg/gateway-api/gateway_reconcile.go	44	// Step 1: Retrieve the Gateway	COMMENT
LOW	operator/pkg/gateway-api/gateway_reconcile.go	62	// Step 2: Gather all required information for the ingestion model	COMMENT
LOW	operator/pkg/gateway-api/gateway_reconcile.go	205	// Step 3: Ingest loaded and validated resources into internal model	COMMENT
LOW	operator/pkg/gateway-api/gateway_reconcile.go	223	// Step 4: Translate the listeners into Cilium model	COMMENT
LOW	operator/pkg/gateway-api/gateway_reconcile.go	249	// Step 5: Update the status of the Gateway	COMMENT
LOW	operator/pkg/gateway-api/gamma_reconcile.go	45	// Step 1: Retrieve the Service	COMMENT
LOW	operator/pkg/gateway-api/gamma_reconcile.go	66	// Step 2: Gather all required information for the ingestion model	COMMENT
LOW	pkg/k8s/apis/cilium.io/v2/cnp_types.go	213	// NOTE: This method assumes that the CiliumNetworkPolicy object is validated beforehand.	COMMENT
LOW	pkg/k8s/apis/cilium.io/v2/cnp_types.go	241	// NOTE: This method assumes that the CiliumNetworkPolicy object is validated beforehand.	COMMENT
LOW	pkg/k8s/apis/cilium.io/v2/ccnp_types.go	114	// NOTE: This method assumes that the CCNP object is validated beforehand.	COMMENT
LOW	pkg/k8s/apis/cilium.io/v2/ccnp_types.go	129	// NOTE: This method assumes that the CCNP object is validated beforehand.	COMMENT
LOW⚡	pkg/fqdn/service/service_test.go	878	// Step 1: Start with empty policy map	COMMENT
LOW⚡	pkg/fqdn/service/service_test.go	885	// Step 2: Apply HTTP policy first (should not create DNS table entries)	COMMENT
LOW⚡	pkg/fqdn/service/service_test.go	892	// Step 3: Apply DNS policy for identity 1 and 2	COMMENT
LOW⚡	pkg/fqdn/service/service_test.go	900	// Step 4: Update existing DNS policy with HTTP policy for identity 2	COMMENT
LOW⚡	pkg/fqdn/service/service_test.go	907	// Step 5: Apply different DNS policy for identity 4 (should add another entry)	COMMENT
LOW⚡	pkg/fqdn/service/service_test.go	914	// Step 6: Apply same DNS policy again (should be idempotent)	COMMENT
LOW⚡	pkg/fqdn/service/service_test.go	920	// Step 7: Test nil policies (should be no-op)	COMMENT
LOW⚡	pkg/fqdn/service/service_test.go	926	// Step 8: Test deletion of DNS policies for identity 1	COMMENT
LOW	pkg/loadbalancer/reconciler/bpf_reconciler_test.go	1149	// Step 1: Create a ClusterIP with one backend. This succeeds and establishes	COMMENT
LOW	pkg/loadbalancer/reconciler/bpf_reconciler_test.go	1171	// Step 2: Switch to backend2 with an error injected. Backend state and the	COMMENT
LOW	pkg/loadbalancer/reconciler/bpf_reconciler_test.go	1189	// Step 3: Retry without the error. The reconciler recovers and proceeds normally.	COMMENT
LOW	pkg/loadbalancer/reconciler/bpf_reconciler_test.go	1210	// Step 4: Clean up.	COMMENT
LOW	pkg/loadbalancer/reconciler/bpf_reconciler_test.go	1224	// Step 1: Create a ClusterIP with one backend. This succeeds and establishes	COMMENT
LOW	pkg/loadbalancer/reconciler/bpf_reconciler_test.go	1246	// Step 2: Switch to backend2 and fail while updating its service slot. The	COMMENT
LOW	pkg/loadbalancer/reconciler/bpf_reconciler_test.go	1263	// Step 3: Delete the frontend before the failed update is retried. Pruning	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	642	// Step 2: Read each policy by endpoint ID and verify its IP addresses.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	650	// Step 3: An unknown policy name returns no resource.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	654	// Step 4: Remove endpoint 40's policy without affecting endpoint 30.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	1440	// Step 3: Wait briefly for revert to complete (revert runs asynchronously via the callback).	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	1443	// Step 4: Verify the bad listener was reverted out of the snapshot.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	1452	// Step 5: Verify we can still add new valid listeners after the revert.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	1529	// Step 1: Add a first listener so Envoy connects and we have a baseline.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	1537	// Step 2: Rapidly add multiple listeners, each producing a new snapshot version.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	1709	// Step 1: Add a valid baseline listener.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	1717	// Step 2: Rapidly add multiple listeners where the last one will cause a NACK.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	1732	// Step 3: Wait for revert to complete.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	1735	// Step 4: Verify no pending completions remain.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	1739	// Step 5: Verify the bad listener was reverted from the snapshot.	COMMENT
LOW	pkg/envoy/standalone_envoy_test.go	629	// Step 1: Upsert base Envoy resources and the separate endpoint policies.	COMMENT
LOW	pkg/envoy/standalone_envoy_test.go	666	// Step 5: Remove the remaining endpoint's policy.	COMMENT
LOW	pkg/envoy/standalone_envoy_test.go	1407	// Step 1: Add a valid listener so Envoy has a known-good baseline.	COMMENT
LOW	pkg/envoy/standalone_envoy_test.go	1419	// Step 2: Add a listener on port 22 which Envoy cannot bind (privileged port) — should NACK.	COMMENT
LOW	pkg/envoy/standalone_envoy_test.go	1552	// Step 3: Verify no pending completions remain.	COMMENT
LOW⚡	pkg/endpoint/endpoint_test.go	571	// Step 1: With namespace permission, apply annotation to disable SIP verification	COMMENT
LOW⚡	pkg/endpoint/endpoint_test.go	580	// Step 2: Remove pod annotation - should reset to global default	COMMENT
LOW⚡	pkg/endpoint/endpoint_test.go	589	// Step 3: Set to disabled, then remove namespace permission - pod annotation should be ignored	COMMENT
LOW⚡	pkg/endpoint/endpoint_test.go	599	// Step 4: With invalid pod annotation value, should reset to global default	COMMENT
LOW	pkg/policy/k8s/service.go	358	// NOTE: This method assumes that the selector is validated beforehand.	COMMENT
LOW	pkg/policy/k8s/cilium_network_policy.go	107	// NOTE: This method assumes that the provided CNP object is validated beforehand.	COMMENT
LOW	pkg/policy/api/rule_validation.go	35	// NOTE: This method is immutable and MUST not modify the Rule itself. Any edits	COMMENT

Verbosity Indicators47 hits · 82 pts

Severity	File	Line	Snippet	Context
LOW	operator/pkg/gateway-api/gateway_reconcile.go	44	// Step 1: Retrieve the Gateway	COMMENT
LOW	operator/pkg/gateway-api/gateway_reconcile.go	62	// Step 2: Gather all required information for the ingestion model	COMMENT
LOW	operator/pkg/gateway-api/gateway_reconcile.go	205	// Step 3: Ingest loaded and validated resources into internal model	COMMENT
LOW	operator/pkg/gateway-api/gateway_reconcile.go	223	// Step 4: Translate the listeners into Cilium model	COMMENT
LOW	operator/pkg/gateway-api/gateway_reconcile.go	249	// Step 5: Update the status of the Gateway	COMMENT
LOW	operator/pkg/gateway-api/gamma_reconcile.go	45	// Step 1: Retrieve the Service	COMMENT
LOW	operator/pkg/gateway-api/gamma_reconcile.go	66	// Step 2: Gather all required information for the ingestion model	COMMENT
LOW	pkg/networkdriver/dra.go	851	// So we need to check if we already have a valid ip address before	COMMENT
LOW⚡	pkg/fqdn/service/service_test.go	878	// Step 1: Start with empty policy map	COMMENT
LOW⚡	pkg/fqdn/service/service_test.go	885	// Step 2: Apply HTTP policy first (should not create DNS table entries)	COMMENT
LOW⚡	pkg/fqdn/service/service_test.go	892	// Step 3: Apply DNS policy for identity 1 and 2	COMMENT
LOW⚡	pkg/fqdn/service/service_test.go	900	// Step 4: Update existing DNS policy with HTTP policy for identity 2	COMMENT
LOW⚡	pkg/fqdn/service/service_test.go	907	// Step 5: Apply different DNS policy for identity 4 (should add another entry)	COMMENT
LOW⚡	pkg/fqdn/service/service_test.go	914	// Step 6: Apply same DNS policy again (should be idempotent)	COMMENT
LOW⚡	pkg/fqdn/service/service_test.go	920	// Step 7: Test nil policies (should be no-op)	COMMENT
LOW⚡	pkg/fqdn/service/service_test.go	926	// Step 8: Test deletion of DNS policies for identity 1	COMMENT
LOW	pkg/loadbalancer/reconciler/bpf_reconciler_test.go	1149	// Step 1: Create a ClusterIP with one backend. This succeeds and establishes	COMMENT
LOW	pkg/loadbalancer/reconciler/bpf_reconciler_test.go	1171	// Step 2: Switch to backend2 with an error injected. Backend state and the	COMMENT
LOW	pkg/loadbalancer/reconciler/bpf_reconciler_test.go	1189	// Step 3: Retry without the error. The reconciler recovers and proceeds normally.	COMMENT
LOW	pkg/loadbalancer/reconciler/bpf_reconciler_test.go	1210	// Step 4: Clean up.	COMMENT
LOW	pkg/loadbalancer/reconciler/bpf_reconciler_test.go	1224	// Step 1: Create a ClusterIP with one backend. This succeeds and establishes	COMMENT
LOW	pkg/loadbalancer/reconciler/bpf_reconciler_test.go	1246	// Step 2: Switch to backend2 and fail while updating its service slot. The	COMMENT
LOW	pkg/loadbalancer/reconciler/bpf_reconciler_test.go	1263	// Step 3: Delete the frontend before the failed update is retried. Pruning	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	642	// Step 2: Read each policy by endpoint ID and verify its IP addresses.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	650	// Step 3: An unknown policy name returns no resource.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	654	// Step 4: Remove endpoint 40's policy without affecting endpoint 30.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	1440	// Step 3: Wait briefly for revert to complete (revert runs asynchronously via the callback).	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	1443	// Step 4: Verify the bad listener was reverted out of the snapshot.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	1452	// Step 5: Verify we can still add new valid listeners after the revert.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	1529	// Step 1: Add a first listener so Envoy connects and we have a baseline.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	1537	// Step 2: Rapidly add multiple listeners, each producing a new snapshot version.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	1709	// Step 1: Add a valid baseline listener.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	1717	// Step 2: Rapidly add multiple listeners where the last one will cause a NACK.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	1732	// Step 3: Wait for revert to complete.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	1735	// Step 4: Verify no pending completions remain.	COMMENT
LOW⚡	pkg/envoy/standalone_envoy_test.go	1739	// Step 5: Verify the bad listener was reverted from the snapshot.	COMMENT
LOW	pkg/envoy/standalone_envoy_test.go	629	// Step 1: Upsert base Envoy resources and the separate endpoint policies.	COMMENT
LOW	pkg/envoy/standalone_envoy_test.go	666	// Step 5: Remove the remaining endpoint's policy.	COMMENT
LOW	pkg/envoy/standalone_envoy_test.go	1407	// Step 1: Add a valid listener so Envoy has a known-good baseline.	COMMENT
LOW	pkg/envoy/standalone_envoy_test.go	1419	// Step 2: Add a listener on port 22 which Envoy cannot bind (privileged port) — should NACK.	COMMENT
LOW	pkg/envoy/standalone_envoy_test.go	1552	// Step 3: Verify no pending completions remain.	COMMENT
LOW⚡	pkg/endpoint/endpoint_test.go	571	// Step 1: With namespace permission, apply annotation to disable SIP verification	COMMENT
LOW⚡	pkg/endpoint/endpoint_test.go	580	// Step 2: Remove pod annotation - should reset to global default	COMMENT
LOW⚡	pkg/endpoint/endpoint_test.go	589	// Step 3: Set to disabled, then remove namespace permission - pod annotation should be ignored	COMMENT
LOW⚡	pkg/endpoint/endpoint_test.go	599	// Step 4: With invalid pod annotation value, should reset to global default	COMMENT
LOW	pkg/datapath/linux/route/reconciler/reconciler.go	290	// When a desired route is deleted, we need to check if there are any other desired routes	COMMENT
LOW	pkg/datapath/linux/route/reconciler/reconciler.go	351	// If we have a set of keys from a previous run, we need to check if we still desire them.	COMMENT

Self-Referential Comments20 hits · 72 pts

Severity	File	Line	Snippet	Context
MEDIUM	Documentation/conf.py	6	# This file is execfile()d with the current directory set to its	COMMENT
MEDIUM	install/kubernetes/cilium/values.yaml	2	# This file is based on install/kubernetes/cilium/*values.yaml.tmpl.	COMMENT
MEDIUM	.github/workflows/conformance-clustermesh.yaml	607	# Create the Cilium CA secret	COMMENT
MEDIUM	.github/workflows/conformance-clustermesh.yaml	611	# Create the cert-manager issuer	COMMENT
MEDIUM⚡	.github/actions/generic-external-targets/action.sh	8	# Create a private key for the self signed CA	COMMENT
MEDIUM⚡	.github/actions/generic-external-targets/action.sh	11	# Create a self signed CA certificate	COMMENT
MEDIUM⚡	.github/actions/generic-external-targets/action.sh	17	# Create a secret with the CA certificate, will be used by L7 tests as trused CA for	COMMENT
MEDIUM⚡	.github/actions/generic-external-targets/action.sh	22	# Create a cerificate signing request and private key for external services	COMMENT
MEDIUM	.github/actions/generic-external-targets/action.sh	35	# Create a config file to tell openssl how to turn the signing request into a certificate	COMMENT
MEDIUM⚡	.github/actions/kind-external-targets/action.sh	43	# Create a private key for the self signed CA	COMMENT
MEDIUM⚡	.github/actions/kind-external-targets/action.sh	46	# Create a self signed CA certificate	COMMENT
MEDIUM⚡	.github/actions/kind-external-targets/action.sh	52	# Create a cerificate signing request and private key for external services	COMMENT
MEDIUM⚡	.github/actions/kind-external-targets/action.sh	59	# Create a config file to tell openssl how to turn the signing request into a certificate	COMMENT
MEDIUM	.github/actions/kind-external-targets/action.sh	78	# Create a nginx config file for our external services. Its very minimal, essentially just	COMMENT
MEDIUM	.github/actions/kind-external-targets/action.sh	157	# Create a secret with the CA certificate, will be used by L7 tests as trusted CA for	COMMENT
MEDIUM	.github/actions/kind-external-targets/action.sh	180	# Create a patch for the CoreDNS configmap	COMMENT
MEDIUM	.github/actions/kind-external-network/action.sh	37	# Create an external network in the similar way to the one created by kind	COMMENT
MEDIUM	.github/actions/ginkgo/main-focus.yaml	1	# This file contains the list of tests that should be included and excluded.	COMMENT
MEDIUM	.github/actions/ginkgo/main-k8s-versions.yaml	1	# This file contains which kernel versions should be run with which k8s versions	COMMENT
MEDIUM	…r/pkg/gateway-api/testdata/gateway/base/manifests.yaml	1	# This file contains the base resources that most conformance tests will rely	COMMENT

Unused Imports61 hits · 61 pts

Severity	File	Line	Context
LOW	Documentation/conf.py	21	CODE
LOW	Documentation/conf.py	22	CODE
LOW	Documentation/conf.py	27	CODE
LOW	Documentation/_exts/cilium_helm_directive.py	21	CODE
LOW	test/vtep/vxlan-responder.py	24	CODE
LOW	test/vtep/vxlan-responder.py	24	CODE
LOW	test/vtep/vxlan-responder.py	26	CODE
LOW	examples/kubernetes-grpc/cc_door_client.py	17	CODE
LOW	bpf/tools/log2scapy.py	6	CODE
LOW	bpf/tools/log2scapy.py	9	CODE
LOW	bpf/tests/scapy/wg_from_netdev_pkt_defs.py	4	CODE
LOW	bpf/tests/scapy/wg_from_netdev_pkt_defs.py	6	CODE
LOW	bpf/tests/scapy/tc_l2_announce6_pkt_defs.py	4	CODE
LOW	bpf/tests/scapy/tc_l2_announce6_pkt_defs.py	6	CODE
LOW	…/scapy/xdp_nodeport_lb4_nat_lb_tun_dynamic_pkt_defs.py	4	CODE
LOW	…/scapy/xdp_nodeport_lb4_nat_lb_tun_dynamic_pkt_defs.py	6	CODE
LOW	bpf/tests/scapy/tc_l2_announce_pkt_defs.py	4	CODE
LOW	bpf/tests/scapy/tc_l2_announce_pkt_defs.py	6	CODE
LOW	bpf/tests/scapy/selftest_pkt_defs.py	4	CODE
LOW	bpf/tests/scapy/selftest_pkt_defs.py	6	CODE
LOW	bpf/tests/scapy/lb_pkt_defs.py	4	CODE
LOW	bpf/tests/scapy/lb_pkt_defs.py	6	CODE
LOW	bpf/tests/scapy/trace_diff_pkts.py	6	CODE
LOW	bpf/tests/scapy/trace_diff_pkts.py	8	CODE
LOW	bpf/tests/scapy/trace_diff_pkts.py	11	CODE
LOW	…tests/scapy/tc_nodeport_lb6_nat_lb_dynamic_pkt_defs.py	1	CODE
LOW	…tests/scapy/tc_nodeport_lb6_nat_lb_dynamic_pkt_defs.py	2	CODE
LOW	bpf/tests/scapy/wg_from_overlay_pkt_defs.py	4	CODE
LOW	bpf/tests/scapy/wg_from_overlay_pkt_defs.py	6	CODE
LOW	bpf/tests/scapy/ipsec_from_netdev_pkt_defs.py	4	CODE
LOW	bpf/tests/scapy/ipsec_from_netdev_pkt_defs.py	6	CODE
LOW	bpf/tests/scapy/lxc_policy_reject_defs.py	4	CODE
LOW	bpf/tests/scapy/lxc_policy_reject_defs.py	6	CODE
LOW	bpf/tests/scapy/pkt_defs_common.py	4	CODE
LOW	…tests/scapy/tc_nodeport_lb4_nat_lb_dynamic_pkt_defs.py	1	CODE
LOW	…tests/scapy/tc_nodeport_lb4_nat_lb_dynamic_pkt_defs.py	2	CODE
LOW	bpf/tests/scapy/kpr_dsr_pkt_defs.py	4	CODE
LOW	bpf/tests/scapy/kpr_dsr_pkt_defs.py	5	CODE
LOW	bpf/tests/scapy/ipv6_ndp_pkt_defs.py	1	CODE
LOW	bpf/tests/scapy/ipv6_ndp_pkt_defs.py	3	CODE
LOW	bpf/tests/scapy/pkt_defs.py	4	CODE
LOW	bpf/tests/scapy/pkt_defs.py	6	CODE
LOW	bpf/tests/scapy/pkt_defs.py	9	CODE
LOW	bpf/tests/scapy/pkt_defs.py	10	CODE
LOW	bpf/tests/scapy/pkt_defs.py	11	CODE
LOW	bpf/tests/scapy/pkt_defs.py	12	CODE
LOW	bpf/tests/scapy/pkt_defs.py	13	CODE
LOW	bpf/tests/scapy/pkt_defs.py	14	CODE
LOW	bpf/tests/scapy/pkt_defs.py	15	CODE
LOW	bpf/tests/scapy/pkt_defs.py	16	CODE
LOW	bpf/tests/scapy/pkt_defs.py	17	CODE
LOW	bpf/tests/scapy/pkt_defs.py	18	CODE
LOW	bpf/tests/scapy/pkt_defs.py	19	CODE
LOW	bpf/tests/scapy/pkt_defs.py	20	CODE
LOW	bpf/tests/scapy/pkt_defs.py	21	CODE
LOW	bpf/tests/scapy/pkt_defs.py	22	CODE
LOW	bpf/tests/scapy/pkt_defs.py	23	CODE
LOW	bpf/tests/scapy/icmp_err_revnat_pkt_defs.py	6	CODE
LOW	bpf/tests/scapy/icmp_err_revnat_pkt_defs.py	9	CODE
LOW	bpf/tests/scapy/tc_redirect_pkt_defs.py	4	CODE
1 more matches not shown…

AI Slop Vocabulary22 hits · 60 pts

Severity	File	Line	Snippet	Context
MEDIUM	install/kubernetes/cilium/values.yaml	1481	# for more comprehensive documentation about Hubble metrics.	COMMENT
MEDIUM	…tall/kubernetes/cilium/templates/cilium-configmap.yaml	172	# for seamless migrations from the kvstore mode to the crd mode. Consult the	COMMENT
MEDIUM	test/k8s/manifests/netpol-cyclonus/install-cyclonus.yml	15	# harness cut it back out of the log. exit $rc keeps the container exit	COMMENT
LOW	.github/workflows/build-images-ci.yaml	108	# We first check if base_ref exist, meaning we're in pull_request_target context, and if not we just use defau	COMMENT
LOW	.github/workflows/build-images-ci-v1.18.yaml	104	# We first check if base_ref exist, meaning we're in pull_request_target context, and if not we just use defau	COMMENT
LOW	.github/workflows/build-images-ci-v1.19.yaml	104	# We first check if base_ref exist, meaning we're in pull_request_target context, and if not we just use defau	COMMENT
MEDIUM	.github/workflows/scale-test-clustermesh.yaml	357	# * We enable the ClusterMesh API server only at this point to leverage	COMMENT
LOW	.github/workflows/build-images-ci-v1.20.yaml	100	# We first check if base_ref exist, meaning we're in pull_request_target context, and if not we just use defau	COMMENT
MEDIUM	cilium-cli/connectivity/tests/encryption_v2.go	25	// to utilize encrypted overlay, where encryption occurs just prior to the	COMMENT
MEDIUM	pkg/eventqueue/eventqueue.go	27	// processed by anything which chooses to utilize an `EventQueue`.	COMMENT
MEDIUM	pkg/hubble/metrics/api/context.go	389	// that leverage the response/return flows where the source and destination are	COMMENT
MEDIUM	pkg/azure/api/api.go	497	// Uses arm.ParseResourceID from the Azure SDK for robust parsing.	COMMENT
MEDIUM	pkg/k8s/resource/filtered_resource_test.go	262	// channel. We leverage synctest to obtain a better failure, as it fails	COMMENT
MEDIUM	pkg/clustermesh/remote_cluster_test.go	532	// Make use of synctest to leverage [synctest.Wait], which allows waiting	COMMENT
MEDIUM	pkg/clustermesh/operator/remote_cluster_test.go	368	// Make use of synctest to leverage [synctest.Wait], which allows waiting	COMMENT
MEDIUM	pkg/loadbalancer/reconciler/bpf_reconciler_test.go	575	// HostPort. Essentially same as NodePort when zero address is used,	COMMENT
MEDIUM	pkg/kvstore/allocator/allocator_test.go	685	// it is better to be robust in this case as well.	COMMENT
MEDIUM	pkg/endpoint/endpoint.go	1826	// Uses strconv.ParseBool for robust boolean parsing (accepts: 1, t, T, TRUE, true, True,	COMMENT
MEDIUM	pkg/datapath/loader/tc.go	43	// Attach using tcx if available. This is seamless on interfaces with	COMMENT
MEDIUM	pkg/datapath/linux/devices_controller.go	635	// hence it has no name. Definitely not selected yet!	COMMENT
MEDIUM	pkg/cgroups/manager/provider.go	224	// generating the path of slice. Essentially, test-a-b.slice becomes	COMMENT
MEDIUM	pkg/bgp/manager/manager.go	644	// reconcileBGPConfig will utilize the current set of ConfigReconciler	COMMENT

Redundant / Tautological Comments16 hits · 26 pts

Severity	File	Line	Snippet	Context
LOW	install/kubernetes/cilium/values.yaml	1039	# Set it to false to keep cloud load balancers from creating a plain HTTP listener.	COMMENT
LOW	install/kubernetes/cilium/files/nodeinit/prestop.bash	35	# Check if we're running on GKE, identified by the	COMMENT
LOW	install/kubernetes/cilium/files/nodeinit/startup.bash	27	# Check if we're running on GKE, identified by the	COMMENT
LOW	contrib/scripts/print-downgrade-version.sh	77	# Check if the tag is already present locally.	COMMENT
LOW⚡	.github/workflows/conformance-eks.yaml	216	# Check if ipsec is requested via extra-args	COMMENT
LOW⚡	.github/workflows/conformance-eks.yaml	224	# Check if KPR is requested via extra-args	COMMENT
LOW⚡	.github/workflows/conformance-eks.yaml	232	# Check if we have a BPF Datapath mode via extra-args	COMMENT
LOW	.github/workflows/auto-approve.yaml	59	# Check if ciliumbot was requested by cilium-renovate[bot] from the events list	COMMENT
LOW	.github/workflows/lint-go.yaml	172	# Set GOBIN to ensure 'go install' binaries end up in the same directory	COMMENT
LOW	.github/workflows/conformance-aks.yaml	299	# Check if ipsec is requested via extra-args	COMMENT
LOW	.github/workflows/conformance-aks.yaml	307	# Check if KPR is requested via extra-args	COMMENT
LOW	.github/workflows/conformance-gateway-api.yaml	304	# Set this to "standard" to use the standard CRDs instead	COMMENT
LOW	.github/workflows/eks-cluster-pool-manager.yaml	164	# Check if kubeconfig exists in S3 pool before deleting	COMMENT
LOW	.github/workflows/eks-cluster-pool-manager.yaml	356	# Check if bucket exists	COMMENT
LOW	.github/workflows/conformance-ginkgo.yaml	617	# Check if file already exists and fail if it does	COMMENT
LOW	.github/actions/renovate/entrypoint.sh	9	# Check if PS1 is unset; using ${PS1:-} to avoid "unbound variable" error	COMMENT

Synthetic Comment Markers3 hits · 22 pts

Severity	File	Line	Snippet	Context
HIGH	pkg/maps/ipmasq/ipmasq.go	117	// and/or IPv6, as requested by the caller.	COMMENT
HIGH	pkg/endpoint/endpoint.go	1494	// was changed as requested	COMMENT
HIGH	pkg/ipam/multipool_manager.go	583	// operator to recover exact usage as requested - preAllocate.	COMMENT

Decorative Section Separators5 hits · 15 pts

Severity	File	Line	Snippet	Context
MEDIUM	pkg/networkdriver/sriov/sriov_test.go	346	// ── deviceManagers ────────────────────────────────────────────────	COMMENT
MEDIUM	pkg/networkdriver/sriov/sriov_test.go	392	// ── ifNames on device with no kernel interface (DPDK/vfio) ────────	COMMENT
MEDIUM	pkg/networkdriver/sriov/sriov_test.go	406	// ── PCI-specific fields ───────────────────────────────────────────	COMMENT
MEDIUM	pkg/networkdriver/sriov/sriov_test.go	456	// ── pfNames: SR-IOV Physical Function filter ──────────────────────	COMMENT
MEDIUM	pkg/networkdriver/sriov/sriov_test.go	470	// ── combinations ──────────────────────────────────────────────────	COMMENT

Modern AI Meta-Vocabulary4 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	examples/kubernetes/servicemesh/grpc-ingress.yaml	1	# GRPC ingress for GCP microservice demo application	COMMENT
MEDIUM	.github/workflows/scale-test-clustermesh.yaml	65	# renovate: datasource=git-refs depName=https://github.com/cilium/scaffolding branch=main	COMMENT
MEDIUM	.github/workflows/scale-test-egw.yaml	81	# a workflow in cilium/scaffolding.	COMMENT
MEDIUM	.github/workflows/scale-test-egw.yaml	82	# renovate: datasource=git-refs depName=https://github.com/cilium/scaffolding branch=main	COMMENT

Excessive Try-Catch Wrapping5 hits · 7 pts

Severity	File	Line	Snippet	Context
LOW	bpf/tools/log2scapy.py	42	except Exception as e:	CODE
LOW	bpf/tests/scapy/trace_diff_pkts.py	16	except Exception as e:	CODE
LOW	bpf/tests/scapy/trace_diff_pkts.py	25	except Exception as e:	CODE
MEDIUM	bpf/tests/scapy/trace_diff_pkts.py	13	def parse_asserts():	CODE
MEDIUM	bpf/tests/scapy/trace_diff_pkts.py	21	def bytes_to_scapy_pkt(first_layer, hex_str):	CODE

Fake / Example Data7 hits · 7 pts

Severity	File	Line	Snippet	Context
LOW	operator/pkg/ztunnel/spire/client_test.go	420	Id: "auto-generated-dummy-id",	CODE
LOW	operator/pkg/ztunnel/spire/client_test.go	426	Ids: []string{"auto-generated-dummy-id"},	CODE
LOW	pkg/hubble/metrics/pathtemplate/pathtemplate_test.go	23	{"placeholder", []string{"/api/v1/users/{id}"}},	CODE
LOW	pkg/loadbalancer/writer/zones_test.go	134	n.Labels["dummy-label"] = "dummy-value"	CODE
LOW	pkg/command/map_string_test.go	82	"k2": "test@test.com",	CODE
LOW	pkg/murmur3/murmur3_test.go	19	{500, 0x188f69f0abbd67de, 0x1b0eeb31b4c00cb6, "lorem ipsum dolor sit amet"},	CODE
LOW	pkg/murmur3/murmur3_test.go	19	{500, 0x188f69f0abbd67de, 0x1b0eeb31b4c00cb6, "lorem ipsum dolor sit amet"},	CODE

Example Usage Blocks4 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW	contrib/k8s/k8s-cilium-exec.sh	12	# Usage:	COMMENT
LOW	contrib/scripts/print-downgrade-version.sh	15	# Usage:	COMMENT
LOW	pkg/bpf/metrics.go	67	// Example usage:	COMMENT
LOW	pkg/bpf/ops_linux.go	38	// Example usage:	COMMENT

Slop Phrases3 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	install/kubernetes/cilium/values.yaml	3866	# Or alternatively you can use a list of clusters:	COMMENT
LOW	…tall/kubernetes/cilium/templates/cilium-configmap.yaml	134	# TLS please make sure you follow the tutorial in https://cilium.link/etcd-config	COMMENT
LOW	images/scripts/update-cilium-envoy-image.sh	51	echo "Please don't forget to execute 'make -C install/kubernetes && make -C Documentation update-helm-values'"	CODE

TODO Padding1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	…erator/pkg/gateway-api/gatewayclassconfig_reconcile.go	38	// TODO: Add validations if required for the GatewayClassConfig, especially with Cilium configuration	COMMENT

Deep Nesting1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	examples/kubernetes-grpc/cc_door_client.py	29		CODE

cilium/cilium

Open-Source Code Quality, Security and Technical Debt Review