The most popular Kubernetes Operator for PostgreSQL.
This report summarizes scanner evidence for cloudnative-pg/cloudnative-pg, a Go project with 9,519 GitHub stars. SynthScan examined 572,248 lines of code across 1421 source files, recording 476 pattern matches distributed across 16 syntactic categories. The legacy adjusted pattern signal is 1.4 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 439 finding(s).
Are imports declared and package/API names verified? 10 finding(s).
Are wrappers, guards, and repeated structures necessary? 33 finding(s).
Which changes need focused human review? 476 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 476 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-bake.hcl | 1 | # | COMMENT |
| LOW | .gitvote.yml | 1 | # GitVote configuration for cloudnative-pg/cloudnative-pg. | COMMENT |
| LOW | config/crd/kustomization.yaml | 21 | # patches here are for enabling the conversion webhook for each CRD | COMMENT |
| LOW | config/crd/kustomization.yaml | 41 | # patches here are for enabling the CA injection for each CRD | COMMENT |
| LOW | config/crd/kustomization.yaml | 61 | # name: databases.postgresql.cnpg.io | COMMENT |
| LOW | config/default/kustomization.yaml | 41 | version: v1 | COMMENT |
| LOW | config/default/kustomization.yaml | 61 | # group: cert-manager.io | COMMENT |
| LOW | config/default/kustomization.yaml | 81 | # kind: Service | COMMENT |
| LOW | tests/config/config.go | 41 | // specify one. | COMMENT |
| LOW | tests/internal/asserts/doc.go | 21 | // Ginkgo specs in tests/e2e. Each topic lives in its own subpackage | COMMENT |
| LOW | tests/utils/namespaces/namespace.go | 101 | } | COMMENT |
| LOW | tests/utils/forwardconnection/forwardconnection.go | 41 | ) | COMMENT |
| LOW | tests/e2e/eviction_test.go | 41 | COMMENT | |
| LOW | tests/e2e/upgrade_plugin_barman_cloud_test.go | 541 | // Upgrading to the new release will trigger a | COMMENT |
| LOW | tests/e2e/initdb_test.go | 201 | } | COMMENT |
| LOW | tests/e2e/disk_space_test.go | 181 | }) | COMMENT |
| LOW | tests/e2e/certificates_test.go | 41 | COMMENT | |
| LOW | tests/e2e/failure_domain_test.go | 41 | COMMENT | |
| LOW | internal/webhook/v1/pooler_webhook.go | 261 | // Without a user-supplied clientTLSSecret the metrics server falls back to | COMMENT |
| LOW | internal/cmd/plugin/status/status.go | 881 | status.AddLine(columns...) | COMMENT |
| LOW | internal/cmd/plugin/report/operator_report.go | 121 | // operator implements the "report operator" subcommand | COMMENT |
| LOW | internal/cmd/manager/walrestore/cmd.go | 141 | if err != nil { | COMMENT |
| LOW | internal/cmd/manager/walrestore/cmd.go | 341 | // so it is not derivable from the cluster spec here) and caches it for us. | COMMENT |
| LOW | internal/cmd/manager/controller/controller.go | 141 | // Helm stores each release revision as a Secret containing the full | COMMENT |
| LOW | internal/cmd/manager/controller/controller.go | 401 | return err | COMMENT |
| LOW | internal/cmd/manager/instance/run/osdb.go | 21 | COMMENT | |
| LOW | internal/cmd/manager/instance/run/lifecycle/run.go | 41 | contextLogger := log.FromContext(ctx) | COMMENT |
| LOW | internal/cmd/manager/instance/run/lifecycle/run.go | 61 | // permissions and user maps to start it. | COMMENT |
| LOW | internal/cmd/manager/instance/run/lifecycle/reaper.go | 41 | // the following reasons: | COMMENT |
| LOW | …ternal/cmd/manager/instance/run/lifecycle/lifecycle.go | 81 | // will contain any error returned by the process. | COMMENT |
| LOW | internal/cmd/manager/instance/run/lease/stepdown.go | 61 | // Update implements resourcelock.Interface. | COMMENT |
| LOW | internal/cmd/manager/instance/run/lease/stepdown.go | 81 | // otherwise delay the step-down by the size of the step. The replicas time | COMMENT |
| LOW | internal/cmd/manager/instance/run/lease/stepdown.go | 101 | // preAcquire takes over the retries. | COMMENT |
| LOW | internal/cmd/manager/instance/run/lease/stepdown.go | 181 | COMMENT | |
| LOW | internal/cmd/manager/instance/run/lease/runnable.go | 41 | const ( | COMMENT |
| LOW | internal/cmd/manager/instance/run/lease/runnable.go | 61 | defaultReleasedLeaseDuration = 1 * time.Second | COMMENT |
| LOW | internal/cmd/manager/instance/run/lease/runnable.go | 141 | // detect a holder that has stopped renewing without comparing against the | COMMENT |
| LOW | internal/cmd/manager/instance/run/lease/runnable.go | 281 | r.cancelElector() | COMMENT |
| LOW | internal/cmd/manager/instance/run/lease/runnable.go | 301 | // lease held instead; the Identity is the pod name, which the replacement | COMMENT |
| LOW | internal/cmd/manager/instance/run/lease/runnable.go | 381 | // leaseUnverifiable means the lease could not be read (e.g. the API server is | COMMENT |
| LOW | internal/cmd/manager/instance/run/lease/runnable.go | 421 | // released lease (empty holder) is taken immediately. A lease still naming | COMMENT |
| LOW | internal/cmd/manager/instance/run/lease/runnable.go | 601 | timer.Reset(r.config.RetryPeriod) | COMMENT |
| LOW | internal/cmd/manager/instance/run/lease/runnable.go | 621 | // other pod has promoted. We detect this by reading the lease after le.Run | COMMENT |
| LOW | internal/cmd/manager/instance/run/lease/runnable.go | 641 | // either: the operator deliberately skips switchover while the current primary | COMMENT |
| LOW | internal/configuration/configuration.go | 81 | COMMENT | |
| LOW | internal/configuration/configuration.go | 141 | // This is the lifetime of the generated certificates | COMMENT |
| LOW | internal/configuration/configuration.go | 161 | // of instances in the same PostgreSQL cluster. | COMMENT |
| LOW | internal/management/controller/instance_startup.go | 61 | switch { | COMMENT |
| LOW | internal/management/controller/instance_token.go | 41 | // have prevented this to happen. If we're here, two things | COMMENT |
| LOW | internal/management/controller/instance_controller.go | 381 | COMMENT | |
| LOW | internal/management/controller/instance_controller.go | 1261 | clusterstatus.SetPhase(phase, phaseReason), | COMMENT |
| LOW | internal/management/controller/instance_controller.go | 1641 | // adjusting the necessary signal files and configuration, and then | COMMENT |
| LOW | internal/controller/cluster_controller.go | 141 | // +kubebuilder:rbac:groups=admissionregistration.k8s.io,resources=validatingwebhookconfigurations,verbs=get;patch | COMMENT |
| LOW | internal/controller/cluster_controller.go | 601 | // register PhaseHealthy as the LAST status mutation. See #8582. | COMMENT |
| LOW | internal/controller/cluster_controller.go | 621 | // the expected steady state rather than a stale probe to wait out. | COMMENT |
| LOW | internal/controller/cluster_controller.go | 1161 | // | COMMENT |
| LOW | internal/controller/cluster_controller.go | 1381 | &apiv1.DatabaseRole{}, | COMMENT |
| LOW | internal/controller/cluster_create.go | 1141 | ) (ctrl.Result, error) { | COMMENT |
| LOW | internal/controller/cluster_create.go | 1201 | return ctrl.Result{RequeueAfter: time.Second}, ErrNextLoop | COMMENT |
| LOW | internal/controller/cluster_create.go | 1521 | return ctrl.Result{}, err | COMMENT |
| 256 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | releases/cnpg-1.22.0.yaml | 0 | type: string resourcefieldref: description: 'selects a resource of the container: only resources limits and requests (li | STRING |
| HIGH | releases/cnpg-1.22.1.yaml | 0 | type: string resourcefieldref: description: 'selects a resource of the container: only resources limits and requests (li | STRING |
| HIGH | releases/cnpg-1.20.1.yaml | 0 | type: string resourcefieldref: description: 'selects a resource of the container: only resources limits and requests (li | STRING |
| HIGH | releases/cnpg-1.20.0.yaml | 0 | type: string resourcefieldref: description: 'selects a resource of the container: only resources limits and requests (li | STRING |
| HIGH | releases/cnpg-1.23.2.yaml | 0 | type: string resourcefieldref: description: 'selects a resource of the container: only resources limits and requests (li | STRING |
| HIGH | releases/cnpg-1.23.3.yaml | 0 | type: string resourcefieldref: description: 'selects a resource of the container: only resources limits and requests (li | STRING |
| HIGH | releases/cnpg-1.19.0.yaml | 0 | type: string resourcefieldref: description: 'selects a resource of the container: only resources limits and requests (li | STRING |
| HIGH | releases/cnpg-1.23.0.yaml | 0 | type: string resourcefieldref: description: 'selects a resource of the container: only resources limits and requests (li | STRING |
| HIGH | releases/cnpg-1.23.1.yaml | 0 | type: string resourcefieldref: description: 'selects a resource of the container: only resources limits and requests (li | STRING |
| HIGH | releases/cnpg-1.19.1.yaml | 0 | type: string resourcefieldref: description: 'selects a resource of the container: only resources limits and requests (li | STRING |
| HIGH | releases/cnpg-1.21.0.yaml | 0 | type: string resourcefieldref: description: 'selects a resource of the container: only resources limits and requests (li | STRING |
| HIGH | releases/cnpg-1.22.2.yaml | 0 | type: string resourcefieldref: description: 'selects a resource of the container: only resources limits and requests (li | STRING |
| HIGH | releases/cnpg-1.20.2.yaml | 0 | type: string resourcefieldref: description: 'selects a resource of the container: only resources limits and requests (li | STRING |
| HIGH | releases/cnpg-1.18.0.yaml | 0 | type: string resourcefieldref: description: 'selects a resource of the container: only resources limits and requests (li | STRING |
| HIGH | releases/cnpg-1.18.1.yaml | 0 | type: string resourcefieldref: description: 'selects a resource of the container: only resources limits and requests (li | STRING |
| HIGH | releases/cnpg-1.17.1.yaml | 0 | type: string resourcefieldref: description: 'selects a resource of the container: only resources limits and requests (li | STRING |
| HIGH | releases/cnpg-1.17.0.yaml | 0 | type: string resourcefieldref: description: 'selects a resource of the container: only resources limits and requests (li | STRING |
| HIGH | releases/cnpg-1.16.0.yaml | 0 | type: string resourcefieldref: description: 'selects a resource of the container: only resources limits and requests (li | STRING |
| HIGH | releases/cnpg-1.15.1.yaml | 0 | type: string resourcefieldref: description: 'selects a resource of the container: only resources limits and requests (li | STRING |
| HIGH | releases/cnpg-1.15.0.yaml | 0 | type: string resourcefieldref: description: 'selects a resource of the container: only resources limits and requests (li | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | config/crd/kustomizeconfig.yaml | 1 | # This file is for teaching kustomize how to substitute name and namespace reference in CRD | COMMENT |
| MEDIUM | internal/cmd/plugin/fio/fio.go | 55 | # Create a fio job with default values. | COMMENT |
| MEDIUM | internal/cmd/plugin/fio/fio.go | 61 | # Create a job with given values and clusterName "cluster-example" | COMMENT |
| MEDIUM | internal/cmd/plugin/pgadmin/cmd.go | 40 | # Create a pgadmin job with default values. | COMMENT |
| MEDIUM⚡ | internal/cmd/plugin/pgbench/pgbench.go | 57 | # Create a pgbench job with default values and [cluster] "cluster-example" | COMMENT |
| MEDIUM⚡ | internal/cmd/plugin/pgbench/pgbench.go | 64 | # Create a job with given values and [cluster] "cluster-example" | COMMENT |
| MEDIUM⚡ | internal/cmd/plugin/pgbench/pgbench.go | 68 | # Create a job with given values on [cluster] "cluster-example". The job will be cleaned after 10 minutes. | COMMENT |
| MEDIUM | hack/release.sh | 127 | # Create a new branch for the release that originates the PR | COMMENT |
| MEDIUM | hack/e2e/generate-e2e-config.sh | 22 | # This file is meant to be sourced. It defines generate_e2e_config, which | COMMENT |
| MEDIUM | hack/testing-tools/k8s-engines/kind/setup.sh | 81 | # Create the apiserver audit log directory beforehand, otherwise it will be | COMMENT |
| MEDIUM | hack/testing-tools/k8s-engines/kind/setup.sh | 144 | # Create the cluster | COMMENT |
| MEDIUM | hack/testing-tools/common/10-config.sh | 21 | # This file defines global, configurable constants and dependency versions. | COMMENT |
| MEDIUM | hack/testing-tools/common/10-config.sh | 54 | # Define the operator source and deployment method. | COMMENT |
| MEDIUM | hack/testing-tools/common/10-config.sh | 83 | # Define the full array of helper images used by load-helper-images | COMMENT |
| MEDIUM | hack/testing-tools/common/40-utils-registry.sh | 21 | # This file contains functions for managing the local Docker registry and builder. | COMMENT |
| MEDIUM | hack/testing-tools/common/50-utils-images-load.sh | 21 | # This file contains the generic logic for loading images into the local cluster. | COMMENT |
| MEDIUM | hack/testing-tools/common/20-utils-k8s.sh | 21 | # This file contains functions for interacting with the Kubernetes API using $K8S_CLI. | COMMENT |
| MEDIUM | hack/testing-tools/common/20-utils-k8s.sh | 400 | ## Create a temporary file for the modified plugin deployment. This updates the image tag. | COMMENT |
| MEDIUM | .github/workflows/continuous-delivery.yml | 817 | # Create an individual artifact for each E2E test, which will be used to | COMMENT |
| MEDIUM | .github/workflows/continuous-delivery.yml | 1019 | - # Create an individual artifact for each E2E test | CODE |
| MEDIUM | .github/workflows/continuous-delivery.yml | 1363 | # Create an individual artifact for each E2E test, which will be used to | COMMENT |
| MEDIUM | .github/workflows/continuous-delivery.yml | 1739 | # Create an individual artifact for each E2E test, which will be used to | COMMENT |
| MEDIUM | .github/workflows/continuous-delivery.yml | 2096 | # Create an individual artifact for each E2E test, which will be used to | COMMENT |
| MEDIUM | .github/workflows/continuous-delivery.yml | 2462 | # Create an individual artifact for each E2E test, which will be used to | COMMENT |
| MEDIUM | .github/workflows/release-pr.yml | 1 | # Create a PR for a release when a commit is pushed on a release/v* branch | COMMENT |
| MEDIUM | .github/workflows/release-tag.yml | 1 | # Create a tag when a PR on a release/v* branch is merged | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | tests/internal/asserts/pgbouncer/pgbouncer.go | 93 | g.Expect(deployment.Spec.Strategy.RollingUpdate.MaxSurge.String()).To(BeEquivalentTo(expectedMaxSurge)) | CODE |
| CRITICAL | tests/internal/asserts/pgbouncer/pgbouncer.go | 94 | g.Expect(deployment.Spec.Strategy.RollingUpdate.MaxUnavailable.String()).To(BeEquivalentTo(expectedMaxUnavailable)) | CODE |
| CRITICAL | internal/cmd/plugin/status/status.go | 730 | fullStatus.Cluster.Spec.ReplicationSlots.HighAvailability.GetEnabled() | CODE |
| CRITICAL | api/v1/cluster_funcs.go | 952 | return cluster.Spec.Bootstrap.InitDB.PostInitApplicationSQLRefs.HasElements() | CODE |
| CRITICAL | api/v1/cluster_funcs.go | 967 | return cluster.Spec.Bootstrap.InitDB.PostInitTemplateSQLRefs.HasElements() | CODE |
| CRITICAL | api/v1/cluster_funcs.go | 982 | return cluster.Spec.Bootstrap.InitDB.PostInitSQLRefs.HasElements() | CODE |
| CRITICAL | pkg/management/postgres/restore.go | 641 | cluster.Spec.Bootstrap.Recovery.RecoveryTarget.BuildPostgresOptions()) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | releases/cnpg-1.22.0.yaml | 3392 | type: string resourceFieldRef: | STRING |
| HIGH | releases/cnpg-1.20.1.yaml | 3006 | type: string resourceFieldRef: | STRING |
| HIGH | releases/cnpg-1.20.0.yaml | 2942 | type: string resourceFieldRef: | STRING |
| HIGH | releases/cnpg-1.22.1.yaml | 3646 | type: string resourceFieldRef: | STRING |
| HIGH | releases/cnpg-1.23.2.yaml | 4246 | type: string resourceFieldRef: | STRING |
| HIGH | releases/cnpg-1.23.3.yaml | 4246 | type: string resourceFieldRef: | STRING |
| HIGH | releases/cnpg-1.19.0.yaml | 2825 | type: string resourceFieldRef: | STRING |
| HIGH | releases/cnpg-1.23.0.yaml | 4148 | type: string resourceFieldRef: | STRING |
| HIGH | releases/cnpg-1.23.1.yaml | 4148 | type: string resourceFieldRef: | STRING |
| HIGH | releases/cnpg-1.19.1.yaml | 2836 | type: string resourceFieldRef: | STRING |
| HIGH | releases/cnpg-1.21.0.yaml | 3109 | type: string resourceFieldRef: | STRING |
| HIGH | releases/cnpg-1.22.2.yaml | 3982 | type: string resourceFieldRef: | STRING |
| HIGH | releases/cnpg-1.20.2.yaml | 3013 | type: string resourceFieldRef: | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/e2e/rolling_update_test.go | 89 | // We need to check if a pod is ready, otherwise we | COMMENT |
| LOW | internal/cmd/plugin/install/generate.go | 249 | The document is a YAML file that contains a single Kubernetes resource. We need to check if that resource is | CODE |
| LOW | internal/cmd/manager/walrestore/cmd.go | 178 | // Step 1: check if this WAL file is not already in the spool | COMMENT |
| LOW | internal/cmd/manager/walrestore/cmd.go | 191 | // Step 2: return error if the end-of-wal-stream flag is set. | COMMENT |
| LOW | internal/cmd/manager/walrestore/cmd.go | 204 | // Step 3: gather the WAL files names to restore. If the required file isn't a regular WAL, we download it directly. | COMMENT |
| LOW | internal/cmd/manager/walrestore/cmd.go | 216 | // Step 4: download the WAL files into the required place | COMMENT |
| LOW | internal/cmd/manager/walrestore/cmd.go | 227 | // Step 5: set end-of-wal-stream flag if any regular WAL download job returned file-not-found | COMMENT |
| LOW | internal/cmd/manager/instance/restoresnapshot/cmd.go | 68 | // Step 1: build the manager | COMMENT |
| LOW | internal/cmd/manager/instance/restoresnapshot/cmd.go | 89 | // Step 2: add the restore process to the manager | COMMENT |
| LOW | internal/cmd/manager/instance/restoresnapshot/cmd.go | 120 | // Step 3: start everything | COMMENT |
| LOW | internal/cmd/manager/instance/restore/cmd.go | 64 | // Step 1: build the manager | COMMENT |
| LOW | internal/cmd/manager/instance/restore/cmd.go | 85 | // Step 2: add the restore process to the manager | COMMENT |
| LOW | internal/cmd/manager/instance/restore/cmd.go | 99 | // Step 3: start everything | COMMENT |
| LOW | internal/controller/replicas_quorum.go | 75 | // Step 1: coherence check of the synchrouous replication information | COMMENT |
| LOW⚡ | internal/controller/replicas_quorum.go | 88 | // Step 2: detect promotable replicas | COMMENT |
| LOW⚡ | internal/controller/replicas_quorum.go | 96 | // Step 3: evaluate quorum check algorithm | COMMENT |
| LOW | internal/controller/backup_controller.go | 904 | // Step 1: Elect the target pod based on backup target policy | COMMENT |
| LOW⚡ | pkg/specs/pods.go | 116 | // Step 1: detect changes in the envFrom section | COMMENT |
| LOW⚡ | pkg/specs/pods.go | 123 | // Step 2: detect changes in the env section | COMMENT |
| LOW | pkg/management/postgres/pidfile.go | 121 | // The PID file is existing. We need to check if it is stale | COMMENT |
| LOW⚡ | pkg/management/postgres/archiver/archiver.go | 206 | // Step 1: Check if the archive location is safe to perform archiving | COMMENT |
| LOW⚡ | pkg/management/postgres/archiver/archiver.go | 213 | // Step 2: check if this WAL file has not been already archived | COMMENT |
| LOW | pkg/management/postgres/archiver/archiver.go | 227 | // Step 3: gather the WAL files names to archive | COMMENT |
| LOW | pkg/management/postgres/archiver/archiver.go | 248 | // Step 5: archive the WAL files in parallel | COMMENT |
| LOW⚡ | pkg/reconciler/backup/volumesnapshot/reconciler.go | 211 | // Step 1: backup preparation. | COMMENT |
| LOW⚡ | pkg/reconciler/backup/volumesnapshot/reconciler.go | 219 | // Step 2: create snapshot | COMMENT |
| LOW⚡ | pkg/reconciler/backup/volumesnapshot/reconciler.go | 232 | // Step 3: wait for snapshots to be provisioned | COMMENT |
| LOW⚡ | pkg/reconciler/backup/volumesnapshot/reconciler.go | 237 | // Step 4: backup finalization. | COMMENT |
| LOW⚡ | pkg/reconciler/backup/volumesnapshot/reconciler.go | 249 | // Step 5: wait for snapshots to be ready to use | COMMENT |
| LOW⚡ | pkg/reconciler/backup/volumesnapshot/reconciler.go | 254 | // Step 6: set backup as completed, adds remaining metadata | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | internal/cmd/manager/walrestore/cmd.go | 178 | // Step 1: check if this WAL file is not already in the spool | COMMENT |
| LOW | internal/cmd/manager/walrestore/cmd.go | 191 | // Step 2: return error if the end-of-wal-stream flag is set. | COMMENT |
| LOW | internal/cmd/manager/walrestore/cmd.go | 204 | // Step 3: gather the WAL files names to restore. If the required file isn't a regular WAL, we download it directly. | COMMENT |
| LOW | internal/cmd/manager/walrestore/cmd.go | 216 | // Step 4: download the WAL files into the required place | COMMENT |
| LOW | internal/cmd/manager/walrestore/cmd.go | 227 | // Step 5: set end-of-wal-stream flag if any regular WAL download job returned file-not-found | COMMENT |
| LOW | internal/cmd/manager/instance/restoresnapshot/cmd.go | 68 | // Step 1: build the manager | COMMENT |
| LOW | internal/cmd/manager/instance/restoresnapshot/cmd.go | 89 | // Step 2: add the restore process to the manager | COMMENT |
| LOW | internal/cmd/manager/instance/restoresnapshot/cmd.go | 120 | // Step 3: start everything | COMMENT |
| LOW | internal/cmd/manager/instance/restore/cmd.go | 64 | // Step 1: build the manager | COMMENT |
| LOW | internal/cmd/manager/instance/restore/cmd.go | 85 | // Step 2: add the restore process to the manager | COMMENT |
| LOW | internal/cmd/manager/instance/restore/cmd.go | 99 | // Step 3: start everything | COMMENT |
| LOW | internal/controller/replicas_quorum.go | 75 | // Step 1: coherence check of the synchrouous replication information | COMMENT |
| LOW⚡ | internal/controller/replicas_quorum.go | 88 | // Step 2: detect promotable replicas | COMMENT |
| LOW⚡ | internal/controller/replicas_quorum.go | 96 | // Step 3: evaluate quorum check algorithm | COMMENT |
| LOW | internal/controller/backup_controller.go | 904 | // Step 1: Elect the target pod based on backup target policy | COMMENT |
| LOW | docs/src/logical_replication.md | 400 | ### Step 1: Setting Up the Publisher (`freddie`) | COMMENT |
| LOW | docs/src/logical_replication.md | 455 | ### Step 2: Setting Up the Subscriber (`king`) | COMMENT |
| LOW⚡ | pkg/specs/pods.go | 116 | // Step 1: detect changes in the envFrom section | COMMENT |
| LOW⚡ | pkg/specs/pods.go | 123 | // Step 2: detect changes in the env section | COMMENT |
| LOW⚡ | pkg/management/postgres/archiver/archiver.go | 206 | // Step 1: Check if the archive location is safe to perform archiving | COMMENT |
| LOW⚡ | pkg/management/postgres/archiver/archiver.go | 213 | // Step 2: check if this WAL file has not been already archived | COMMENT |
| LOW | pkg/management/postgres/archiver/archiver.go | 227 | // Step 3: gather the WAL files names to archive | COMMENT |
| LOW | pkg/management/postgres/archiver/archiver.go | 248 | // Step 5: archive the WAL files in parallel | COMMENT |
| LOW⚡ | pkg/reconciler/backup/volumesnapshot/reconciler.go | 211 | // Step 1: backup preparation. | COMMENT |
| LOW⚡ | pkg/reconciler/backup/volumesnapshot/reconciler.go | 219 | // Step 2: create snapshot | COMMENT |
| LOW⚡ | pkg/reconciler/backup/volumesnapshot/reconciler.go | 232 | // Step 3: wait for snapshots to be provisioned | COMMENT |
| LOW⚡ | pkg/reconciler/backup/volumesnapshot/reconciler.go | 237 | // Step 4: backup finalization. | COMMENT |
| LOW⚡ | pkg/reconciler/backup/volumesnapshot/reconciler.go | 249 | // Step 5: wait for snapshots to be ready to use | COMMENT |
| LOW⚡ | pkg/reconciler/backup/volumesnapshot/reconciler.go | 254 | // Step 6: set backup as completed, adds remaining metadata | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | config/olm-scorecard/kustomization.yaml | 16 | #+kubebuilder:scaffold:patchesJson6902 | COMMENT |
| MEDIUM | config/crd/kustomization.yaml | 18 | # +kubebuilder:scaffold:crdkustomizeresource | COMMENT |
| MEDIUM | config/crd/kustomization.yaml | 38 | # +kubebuilder:scaffold:crdkustomizewebhookpatch | COMMENT |
| MEDIUM | config/crd/kustomization.yaml | 70 | # +kubebuilder:scaffold:crdkustomizecainjectionpatch | COMMENT |
| MEDIUM | tests/e2e/suite_test.go | 42 | // +kubebuilder:scaffold:imports | COMMENT |
| MEDIUM | internal/scheme/scheme.go | 92 | // +kubebuilder:scaffold:scheme | COMMENT |
| MEDIUM | internal/cmd/plugin/suite_test.go | 78 | // +kubebuilder:scaffold:scheme | COMMENT |
| MEDIUM | internal/cmd/manager/controller/controller.go | 133 | // In the default scaffold provided, the program ends immediately after | COMMENT |
| MEDIUM | internal/cmd/manager/controller/controller.go | 294 | // +kubebuilder:scaffold:builder | COMMENT |
| MEDIUM | internal/controller/suite_test.go | 43 | // +kubebuilder:scaffold:imports | COMMENT |
| MEDIUM | docs/src/cloudnative-pg.v1.md | 1450 | | `type` _[SnapshotType](#snapshottype)_ | The import type. Can be `microservice` or `monolith`. | True | | Enum: [micr | CODE |
| MEDIUM | docs/src/database_import.md | 78 | ## The `microservice` type | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | hack/testing-tools/k8s-engines/k3d/setup.sh | 43 | # -------------------------------------------------------- | COMMENT |
| MEDIUM | hack/testing-tools/k8s-engines/k3d/setup.sh | 101 | # --------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | hack/testing-tools/k8s-engines/kind/setup.sh | 43 | # -------------------------------------------------------- | COMMENT |
| MEDIUM | hack/testing-tools/k8s-engines/kind/setup.sh | 184 | # --------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | hack/testing-tools/common/00-paths.sh | 70 | # ----------------------------------------------- | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/e2e-matrix-generator.py | 221 | def build_pull_request_include_kind(): | CODE |
| LOW⚡ | .github/e2e-matrix-generator.py | 255 | def build_schedule_include_kind(): | CODE |
| LOW⚡ | .github/e2e-matrix-generator.py | 261 | def build_push_include_default(engine_version_list): | CODE |
| LOW⚡ | .github/e2e-matrix-generator.py | 265 | def build_pull_request_include_default(engine_version_list): | CODE |
| LOW⚡ | .github/e2e-matrix-generator.py | 271 | def build_main_include_default(engine_version_list): | CODE |
| LOW⚡ | .github/e2e-matrix-generator.py | 277 | def build_schedule_include_default(engine_version_list): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | hack/testing-tools/k8s-engines/manage.sh | 41 | # Usage: | COMMENT |
| LOW | pkg/specs/services.go | 165 | // Example usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | hack/testing-tools/common/00-paths.sh | 64 | # Check if stdout is a terminal; if not, clear the codes to prevent output pollution. | COMMENT |
| LOW | .github/workflows/require-labels.yml | 1 | # Verify if a pull request contains the labels required to enable the merge button. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/postgres-versions-update.py | 21 | CODE | |
| LOW | .github/postgres-versions-update.py | 22 | CODE | |
| LOW | .github/generate-test-artifacts.py | 25 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/postgres-versions-update.py | 59 | CODE | |
| LOW | .github/vpc_destroy.py | 92 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/generate-test-artifacts.py | 177 | print(f"Error: {e}") | STRING |
| LOW | .github/generate-test-artifacts.py | 294 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/postgres-versions-update.py | 101 | # make sure to update between two different names of the most recent version (it might be a release) | COMMENT |