3.2

Adjusted Signal

3.2

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

5.5K

Stars

Language

2.7M

Lines of Code

9.1K

Files

6.6K

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 12.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 5763 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.0/100 · LOW

Are imports declared and package/API names verified? 593 finding(s).

Agent Over-Engineering Ratio 2.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 679 finding(s).

PR Review Velocity Impact 15.2/100 · LOW

Which changes need focused human review? 6601 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 68MEDIUM 1007LOW 5526

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 6601 distinct pattern matches across 22 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block3558 hits · 2972 pts

Severity	File	Line	Snippet	Context
LOW	install-gh-aw.sh	1	#!/bin/bash	COMMENT
LOW	.grype.yaml	1	# Grype configuration used by `gh aw compile --grype`.	COMMENT
LOW	.grant.yaml	21	# runs this image as an MCP server and never links or redistributes any of its	COMMENT
LOW	cmd/linters/main.go	1	// Command linters runs the gh-aw custom analysis linters.	COMMENT
LOW	eslint-factory/src/rules/core-aliases.ts	1	// Known `@actions/core` binding names used across lint rules.	COMMENT
LOW	…lint-factory/src/rules/no-core-error-then-setfailed.ts	221		COMMENT
LOW	…src/rules/require-getexecoutput-exitcode-check.test.ts	21	`async function f() { const { stdout, exitCode } = await exec.getExecOutput("git", ["status"], { ignoreReturnCod	COMMENT
LOW	…src/rules/require-getexecoutput-exitcode-check.test.ts	41	`async function f(other) { const options = other; const { stdout } = await exec.getExecOutput("git", ["status"],	COMMENT
LOW	eslint-factory/src/rules/prefer-core-logging.ts	1	import { AST_NODE_TYPES, ESLintUtils, TSESLint, TSESTree } from "@typescript-eslint/utils";	COMMENT
LOW	.serena/project.yml	1		COMMENT
LOW	.serena/project.yml	21	# whether the project is in read-only mode	COMMENT
LOW	.serena/project.yml	41		COMMENT
LOW	.serena/project.yml	61	# This cannot be combined with non-empty excluded_tools or included_optional_tools.	COMMENT
LOW	.serena/project.yml	81	added_modes:	COMMENT
LOW	.serena/project.yml	101	# Maps the language key to the options.	COMMENT
LOW	.serena/project.yml	121	# symbols and references across package boundaries, but these folders are not indexed by Serena,	COMMENT
LOW	.serena/project.yml	141		COMMENT
LOW	.serena/project.yml	161	# For some languages, there are several alternative language servers, e.g. csharp_omnisharp, ruby_solargraph.)	COMMENT
LOW	scratchpad/validation-refactoring.md	61	# List functions with line numbers	COMMENT
LOW	scratchpad/validation-refactoring.md	101	// # {Domain} Validation	COMMENT
LOW	scratchpad/repo-memory.md	221		COMMENT
LOW	scratchpad/repo-memory.md	241	# }	COMMENT
LOW	scratchpad/gastown.md	321	# Human: Create work campaign	COMMENT
LOW	docs/public/editor/hover-tooltips.js	1	// ================================================================	COMMENT
LOW	docs/src/content.config.ts	41	// owner: 'githubnext', // GitHub org/user	COMMENT
LOW	…src/content/docs/specs/fuzzy-schedule-specification.md	1141	## Appendices	COMMENT
LOW	…src/content/docs/specs/fuzzy-schedule-specification.md	1161	# Might generate: 37 12 * * * (12:37 PM, within 9 AM-5 PM)	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	21	# Workflow name that appears in the GitHub Actions interface. If not specified,	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	41	# (optional)	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	61	# Optional tracker identifier to tag all created assets (issues, discussions,	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	81	# Optional array of labels to categorize and organize workflows. Labels can be	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	101	# custom agent spec. Key names are limited to 64 characters, and values are	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	121	# ('.github/agents/my-agent.md'), and cross-repo paths ('owner/repo/path@ref').	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	141	resources: []	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	161	# /commands (required)	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	181	slash_command: null	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	201		COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	221	events: []	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	241	# Format 2: Command name as a string (shorthand format, e.g., 'customname' for	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	261	# 'cmd.remove'] for '/cmd.add' and '/cmd.remove' triggers). Each command name must	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	281		COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	301	# Accepted formats:	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	321		COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	341	# Label command trigger compilation strategy. 'inline' (default) compiles direct	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	361	# Paths to filter on	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	381	# Array of strings	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	401	# (optional)	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	421	# is 1 (only the latest/top pull request in the stack). Set to -1 to disable stack	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	441	forks: "example-value"	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	461	# Format 1: Single label name to filter labeled/unlabeled events (e.g., 'bug')	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	481	# Accepted formats:	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	501	types: []	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	521	discussion_comment:	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	561	# Workflow run trigger	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	581	branches-ignore: []	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	601	types: []	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	621	# Check run event trigger that runs when a check run is created, rerequested,	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	681	# for one state or an array for multiple states.	COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	721		COMMENT
LOW	docs/src/content/docs/reference/frontmatter-full.md	761	{}	COMMENT
3498 more matches not shown…

Modern AI Meta-Vocabulary703 hits · 1872 pts

Severity	File	Line	Snippet	Context
MEDIUM	CHANGELOG.md	252	#### Document the two-file agentic workflow structure (separate `.github/agentics/<id>.md` prompt file and `.github/work	COMMENT
MEDIUM	CHANGELOG.md	317	#### Removed the stray `workdir` field from generated MCP server configurations for agentic workflows so the output matc	COMMENT
MEDIUM	CHANGELOG.md	356	#### Document the new two-file agentic workflow structure (separating `.github/agentics/` prompts from `.github/workflow	COMMENT
MEDIUM	CHANGELOG.md	368	#### Updated the embedded agentic tooling stack:	COMMENT
MEDIUM	CHANGELOG.md	882	#### Add importable tools: `agentic-workflows`, `serena`, and `playwright`.	COMMENT
MEDIUM	CHANGELOG.md	1766	#### Added new shared agentic workflow: Another one	COMMENT
MEDIUM	CHANGELOG.md	2252	#### Improve create-agentic-workflow prompt with writing style guidelines and user engagement tips	COMMENT
MEDIUM	CHANGELOG.md	2297	#### Add firewall agentic workflow demonstrating network permission enforcement	COMMENT
MEDIUM	CHANGELOG.md	2338	#### Fixed silent failure when agentic workflow hits max-turns limit - now raises clear error message	COMMENT
MEDIUM	CHANGELOG.md	2421	#### Add commit-changes-analyzer agentic workflow	COMMENT
MEDIUM	CHANGELOG.md	2423	#### Add agentic workflow for enhancing Go files with debug logging	COMMENT
MEDIUM	CHANGELOG.md	2621	#### Add generic timeout field for tools configuration. Allows configuring operation timeouts (in seconds) for tool/MCP	COMMENT
MEDIUM	CHANGELOG.md	2651	#### Update add command to resolve agentic workflow file from .github/workflows folder	COMMENT
MEDIUM	CHANGELOG.md	2675	#### Add builtin "agentic-workflows" tool for workflow introspection and analysis	COMMENT
MEDIUM	CHANGELOG.md	2696	#### Add secret validation steps to agentic engines (Claude, Copilot, Codex)	COMMENT
MEDIUM	CHANGELOG.md	2709	#### Add shared agentic workflow for Microsoft Fabric RTI MCP server	COMMENT
MEDIUM	CHANGELOG.md	2837	#### Add SST OpenCode shared agentic workflow and smoke test	COMMENT
MEDIUM	CHANGELOG.md	2913	#### Add temporary folder usage instructions to agentic workflow prompts	COMMENT
MEDIUM	CHANGELOG.md	3022	#### Remove push trigger from repo-tree-map agentic workflow	COMMENT
MEDIUM	CHANGELOG.md	3054	#### Update agentic CLI versions	COMMENT
MEDIUM	DEVGUIDE.md	832	command_name_orchestrator.go # Main orchestration	CODE
MEDIUM	README.md	12	- Reference: https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/github-agentic-workflows.md	CODE
MEDIUM	README.md	26	- [How Agentic Workflows work](#how-github-agentic-workflows-works)	CODE
MEDIUM	README.md	488	> Ready to learn GitHub Agentic Workflows hands-on? The [Factory Tour Workshop](https://github.com/githubnext/gh	CODE
MEDIUM	SKILL.md	20	Load https://github.com/github/gh-aw/blob/main/.github/skills/agentic-workflows/SKILL.md to learn how to create/update/d	CODE
MEDIUM	cmd/gh-aw/capitalization_test.go	14	// - Use lowercase "agentic workflows" when referring generically to workflow files/functionality	COMMENT
MEDIUM	cmd/gh-aw/capitalization_test.go	30	// Define commands that should use lowercase "agentic workflows" (generic usage)	COMMENT
MEDIUM	cmd/gh-aw/capitalization_test.go	57	// MCP command Long description should use lowercase "agentic workflows"	COMMENT
MEDIUM	specs/security-architecture-spec.md	1697	# ... agentic execution (read-only) ...	COMMENT
MEDIUM	scratchpad/validation-refactoring.md	99	// Package workflow provides {domain} validation for agentic workflows.	COMMENT
MEDIUM	scratchpad/dev.md	2938	- [File Inlining and Runtime Imports](./file-inlining.md) - `{{#runtime-import}}` macro: file/URL content inclusion in w	CODE
MEDIUM	scratchpad/dev.md	2999	- v9.13 (2026-05-21): Maintenance tone scan — fixed 8 tone issues across 6 spec files: `serena-tools-analysis.md` (2 fix	CODE
MEDIUM	scratchpad/adding-new-engines.md	211	// MyEngine represents the My AI agentic engine	COMMENT
MEDIUM	scratchpad/string-sanitization-normalization.md	86	// Returns: "github-agentic-workflow" (default)	COMMENT
MEDIUM	…59747-report-blocked-compiler-version-at-activation.md	27	#### Alternative 3: Add a separate non-agentic watchdog workflow	COMMENT
MEDIUM	…/66270-local-first-workflow-debugging-compile-modes.md	25	#### Alternative 2: Build a local runner/emulator for agentic workflows (act-style)	COMMENT
MEDIUM	…dr/34008-manifest-scoped-source-tracking-and-update.md	65	### Update orchestration	COMMENT
MEDIUM	…eplace-pkg-cli-test-seams-with-dependency-injection.md	1	# ADR-34224: Replace mutable pkg/cli test seams with per-flow dependency injection	COMMENT
MEDIUM	…adr/68819-fail-closed-on-copilot-model-substitution.md	13	[Issue #66894](https://github.com/github/gh-aw/issues/66894) documents an upstream access boundary: a model enabled by o	CODE
MEDIUM	…adr/68819-fail-closed-on-copilot-model-substitution.md	13	[Issue #66894](https://github.com/github/gh-aw/issues/66894) documents an upstream access boundary: a model enabled by o	CODE
MEDIUM	…ackage-raw-action-workflow-yml-files-in-aw-manifest.md	21	#### Alternative 1: Treat `.yml` as another input to the agentic compilation pipeline	COMMENT
MEDIUM	…23-cancel-sibling-log-targets-on-shared-count-limit.md	11	The `gh aw logs` command already supports downloading multiple workflow targets concurrently under one invocation. PR #6	CODE
MEDIUM	docs/tests/copy-button.spec.ts	8	// Navigate to the agentic authoring page	COMMENT
MEDIUM	docs/tests/copy-button.spec.ts	54	// Navigate to the agentic authoring page	COMMENT
MEDIUM	docs/tests/copy-button.spec.ts	106	// Navigate to the agentic authoring page	COMMENT
MEDIUM	docs/tests/slideshow.spec.ts	294	await expect(deck.locator("#cost-guardrails .aw-points")).toBeVisible();	CODE
MEDIUM	docs/slides/index.md	94	add-comment: # guardrails for write operations	CODE
MEDIUM	docs/src/content/docs/about.md	11	GitHub Agentic Workflows (`gh-aw`) is an open-source [GitHub CLI](https://cli.github.com/) extension from [GitHub](h	CODE
MEDIUM	docs/src/content/docs/patterns/deterministic-ops.md	9	GitHub Agentic Workflows can combine deterministic computation ([`steps:`](/gh-aw/reference/steps-jobs/#custom-steps-ste	CODE
MEDIUM	docs/src/content/docs/patterns/deterministic-ops.md	87	Deterministic steps can also be used for [Custom Trigger Filtering](/gh-aw/reference/triggers/#filtering-by-custom-steps	CODE
MEDIUM	docs/src/content/docs/patterns/monitor-ops.md	10	The [agentic-ops repository](https://github.com/githubnext/agentic-ops) provides the reference implementation for this a	CODE
MEDIUM	…ocs/specs/repository-package-manifest-specification.md	328	- workflows/review.md # agentic workflow — compiled on install	CODE
MEDIUM	docs/src/content/docs/specs/work-queue-specification.md	252	### 1.1 Simplicity, debuggability, and agentic-dispatch review	COMMENT
MEDIUM	docs/src/content/docs/specs/forecast-specification.md	223	# Forecast all agentic workflows in the current repository for the next month	COMMENT
MEDIUM	docs/src/content/docs/gallery/maintaining-repos.md	8	Repository maintenance is continuous work: triaging issues, reviewing pull requests, keeping tests and dependencies heal	CODE
MEDIUM⚡	docs/src/content/docs/setup/cli.md	14	\| [`gh aw init`](#init) \| Set up your repository for agentic workflows \| First time configuring a repo — creates skills,	CODE
MEDIUM⚡	docs/src/content/docs/setup/cli.md	23	\| [`gh aw logs`](#logs) \| Download and analyze agentic workflow logs and artifacts \| Debugging a past run by inspecting	CODE
MEDIUM⚡	docs/src/content/docs/setup/cli.md	33	\| [`gh aw skill`](#skill) \| Print the bundled agentic-workflows skill \| Loading instructions into an agent without addin	CODE
MEDIUM	docs/src/content/docs/troubleshooting/debug-ghe.md	11	and [shared debugging strategy](https://github.com/github/gh-aw/blob/main/.github/aw/debug-agentic-workflow.md),	CODE
MEDIUM⚡	docs/src/content/docs/troubleshooting/debug-ghe.md	79	Follow the shared [branch-testing path](https://github.com/github/gh-aw/blob/main/.github/aw/debug-agentic-workflow.md#t	CODE
643 more matches not shown…

Structural Annotation Overuse675 hits · 1151 pts

Severity	File	Line	Snippet	Context
LOW	install.md	13	## Step 1: Install gh-aw CLI Extension	COMMENT
LOW	install.md	35	## Step 2: Initialize Repository for Agentic Workflows	COMMENT
LOW	install.md	53	## Step 3: Review Changes	COMMENT
LOW	create.md	10	## Step 1: Install GitHub Agentic Workflows CLI Extension	COMMENT
LOW	create.md	44	## Step 2: Create the Workflow or do Other Actions	COMMENT
LOW	create.md	121	## Step 3: Review Changes	COMMENT
LOW	create.md	153	## Step 4: Commit and Push Changes	COMMENT
LOW	CONTRIBUTING.md	47	### Step 1: Analyze with an Agent (for bug reports)	COMMENT
LOW	CONTRIBUTING.md	57	### Step 2: Open an Issue with Your Agentic Plan	COMMENT
LOW	CONTRIBUTING.md	108	### Step 3: Discuss and Refine with the Team	COMMENT
LOW	CONTRIBUTING.md	116	### Step 4: A Core Team Member Implements the PR	COMMENT
LOW	optimize.md	19	## Step 1: Install GitHub Agentic Workflows CLI Extension	COMMENT
LOW	optimize.md	53	## Step 2: Optimize Token Consumption	COMMENT
LOW	optimize.md	71	## Step 3: Apply Optimizations	COMMENT
LOW	optimize.md	84	## Step 4: Commit and Push Changes	COMMENT
LOW	package.md	15	## Step 1: Discover Package Contents	COMMENT
LOW	package.md	29	## Step 2: Standardize Structure	COMMENT
LOW	package.md	40	## Step 3: Create `aw.yml` Package Manifest	COMMENT
LOW	package.md	82	## Step 4: Dependency Cleanup for Reusability	COMMENT
LOW	package.md	93	## Step 5: Update `README.md` for Consumers	COMMENT
LOW	package.md	107	## Step 6: Validate and Deliver	COMMENT
LOW⚡	test-setup-local.sh	18	# Step 1: Check if we're in the right directory	COMMENT
LOW⚡	test-setup-local.sh	26	# Step 2: Build the actions if js/ directory doesn't exist	COMMENT
LOW⚡	test-setup-local.sh	39	# Step 3: Verify js/ directory has files	COMMENT
LOW⚡	test-setup-local.sh	47	# Step 4: Create a temporary destination directory	COMMENT
LOW⚡	test-setup-local.sh	52	# Step 5: Run setup.sh	COMMENT
LOW⚡	test-setup-local.sh	66	# Step 6: Verify files were copied	COMMENT
LOW⚡	test-setup-local.sh	76	# Step 7: Check output file	COMMENT
LOW⚡	test-setup-local.sh	82	# Step 8: List some of the copied files	COMMENT
LOW⚡	test-setup-local.sh	87	# Step 9: Cleanup	COMMENT
LOW	scratchpad/validation-refactoring.md	51	### Step 1: Analyze Current Structure	COMMENT
LOW	scratchpad/validation-refactoring.md	76	### Step 2: Group by Domain	COMMENT
LOW	scratchpad/validation-refactoring.md	91	### Step 3: Create New Files	COMMENT
LOW	scratchpad/validation-refactoring.md	131	### Step 4: Move Functions	COMMENT
LOW	scratchpad/validation-refactoring.md	159	### Step 5: Reorganize Tests	COMMENT
LOW	scratchpad/validation-refactoring.md	188	### Step 6: Update Documentation	COMMENT
LOW	scratchpad/validation-refactoring.md	205	### Step 7: Verify No Functional Changes	COMMENT
LOW	scratchpad/end-to-end-feature-testing.md	18	### Step 1: Instruct GitHub Copilot Agent to Modify dev.md	COMMENT
LOW	scratchpad/end-to-end-feature-testing.md	44	### Step 2: Trigger the Dev Workflow	COMMENT
LOW	scratchpad/end-to-end-feature-testing.md	66	### Step 3: Monitor the Dev Workflow Execution	COMMENT
LOW	scratchpad/end-to-end-feature-testing.md	81	### Step 4: Review Dev Hawk's Analysis	COMMENT
LOW	scratchpad/end-to-end-feature-testing.md	99	### Step 5: Iterate Based on Feedback	COMMENT
LOW	scratchpad/adding-new-engines.md	197	### Step 1: Create Engine File	COMMENT
LOW	scratchpad/adding-new-engines.md	236	### Step 2: Implement Required Secrets	COMMENT
LOW	scratchpad/adding-new-engines.md	262	### Step 3: Implement Installation Steps	COMMENT
LOW	scratchpad/adding-new-engines.md	321	### Step 4: Implement Execution Steps	COMMENT
LOW	scratchpad/adding-new-engines.md	397	### Step 5: Implement MCP Configuration	COMMENT
LOW	scratchpad/adding-new-engines.md	438	### Step 6: Implement Log Parsing (Optional)	COMMENT
LOW	scratchpad/adding-new-engines.md	461	### Step 7: Register Engine	COMMENT
LOW	scratchpad/adding-new-engines.md	482	### Step 8: Add Engine Constant (Optional)	COMMENT
LOW	scratchpad/adding-new-engines.md	493	### Step 9: Add Tests	COMMENT
LOW	scratchpad/adding-new-engines.md	566	### Step 10: Update Documentation	COMMENT
LOW	scratchpad/actions.md	787	#### Step 1: Register Script with Action Path	COMMENT
LOW	scratchpad/actions.md	799	#### Step 2: Compile with Action Mode	COMMENT
LOW	scratchpad/actions.md	836	#### Step 3: Output Comparison	COMMENT
LOW⚡	scratchpad/html-entity-mention-bypass-fix.md	32	// Step 1: Normalize Unicode (NFC)	COMMENT
LOW⚡	scratchpad/html-entity-mention-bypass-fix.md	35	// Step 2: Decode HTML entities (CRITICAL - must be early)	COMMENT
LOW⚡	scratchpad/html-entity-mention-bypass-fix.md	38	// Step 3: Strip zero-width characters	COMMENT
LOW⚡	scratchpad/html-entity-mention-bypass-fix.md	39	// Step 4: Remove bidirectional overrides	COMMENT
LOW⚡	scratchpad/html-entity-mention-bypass-fix.md	40	// Step 5: Convert full-width ASCII	COMMENT
615 more matches not shown…

Decorative Section Separators215 hits · 676 pts

Severity	File	Line	Snippet	Context
MEDIUM	…tory/src/rules/no-core-error-then-process-exit.test.ts	112	// ── Non-adjacent pairs (intervening statements) ─────────────────────────	COMMENT
MEDIUM⚡	scripts/resolve-base-commit_test.sh	42	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	scripts/resolve-base-commit_test.sh	44	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	scripts/resolve-base-commit_test.sh	53	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	scripts/resolve-base-commit_test.sh	55	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	scripts/resolve-base-commit_test.sh	71	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	scripts/resolve-base-commit_test.sh	74	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/resolve-base-commit_test.sh	92	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/resolve-base-commit_test.sh	94	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/resolve-base-commit_test.sh	111	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/resolve-base-commit_test.sh	113	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	scripts/resolve-base-commit_test.sh	124	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	scripts/resolve-base-commit_test.sh	127	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	scripts/check-stale-lock-files_test.sh	146	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	scripts/check-stale-lock-files_test.sh	148	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	scripts/check-stale-lock-files_test.sh	227	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	scripts/check-stale-lock-files_test.sh	229	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	scripts/check-stale-lock-files_test.sh	248	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	scripts/check-stale-lock-files_test.sh	250	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/check-stale-lock-files_test.sh	39	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/check-stale-lock-files_test.sh	41	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/check-stale-lock-files_test.sh	53	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/check-stale-lock-files_test.sh	56	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/check-stale-lock-files_test.sh	72	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/check-stale-lock-files_test.sh	74	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/check-stale-lock-files_test.sh	88	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/check-stale-lock-files_test.sh	90	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/check-stale-lock-files_test.sh	107	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/check-stale-lock-files_test.sh	109	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/check-stale-lock-files_test.sh	130	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/check-stale-lock-files_test.sh	132	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/check-stale-lock-files_test.sh	170	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/check-stale-lock-files_test.sh	172	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/check-stale-lock-files_test.sh	186	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/check-stale-lock-files_test.sh	188	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/check-stale-lock-files_test.sh	207	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/check-stale-lock-files_test.sh	209	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/check-stale-lock-files_test.sh	269	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/check-stale-lock-files_test.sh	272	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/workflows/dataflow-pr-discussion-dataset.md	277	# ── Discussions ───────────────────────────────────────────────────────────────	COMMENT
MEDIUM	.github/workflows/dataflow-pr-discussion-dataset.md	299	# ── Pull Requests ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	.github/workflows/dataflow-pr-discussion-dataset.md	483	# ── Write stats ───────────────────────────────────────────────────────────────	COMMENT
MEDIUM	.github/workflows/upgrade-test.yml	66	# ──────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	.github/workflows/upgrade-test.yml	87	# ──────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	actions/setup/js/types/safe-output-script.d.ts	26	// ── Input-definition types ──────────────────────────────────────────────────	COMMENT
MEDIUM	actions/setup/js/types/safe-output-script.d.ts	48	// ── Config type ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	actions/setup/js/types/safe-output-script.d.ts	85	// ── Per-call message type ───────────────────────────────────────────────────	COMMENT
MEDIUM	actions/setup/js/types/safe-output-script.d.ts	118	// ── Resolved temporary IDs ──────────────────────────────────────────────────	COMMENT
MEDIUM	actions/setup/js/types/safe-output-script.d.ts	166	// ── sanitizeContent ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	actions/setup/js/types/safe-output-script.d.ts	202	// ── Handler and factory function types ─────────────────────────────────────	COMMENT
MEDIUM	actions/setup/js/types/safe-output-script.d.ts	264	// ── Globals available in the script body ────────────────────────────────────	COMMENT
MEDIUM	actions/setup/sh/save_base_github_folders_test.sh	41	# ── Test 1: Core folders and root files are saved ────────────────────────────	COMMENT
MEDIUM	actions/setup/sh/save_base_github_folders_test.sh	71	# ── Test 2: Absent items are skipped without error ───────────────────────────	COMMENT
MEDIUM	actions/setup/sh/save_base_github_folders_test.sh	90	# ── Test 3: Empty env vars → nothing saved, exits 0 ─────────────────────────	COMMENT
MEDIUM	actions/setup/sh/save_base_github_folders_test.sh	105	# ── Test 4: Re-run clears stale snapshot (idempotent) ────────────────────────	COMMENT
MEDIUM	actions/setup/sh/save_base_github_folders_test.sh	122	# ── Test 5: Unset env vars → graceful no-op ──────────────────────────────────	COMMENT
MEDIUM	actions/setup/sh/save_base_github_folders_test.sh	135	# ── Summary ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	actions/setup/sh/print_firewall_logs_test.sh	36	# ── Test 1: Script syntax is valid ──────────────────────────────────────────	COMMENT
MEDIUM⚡	actions/setup/sh/print_firewall_logs_test.sh	41	# ── Test 2: Unknown argument exits 1 ────────────────────────────────────────	COMMENT
MEDIUM⚡	actions/setup/sh/print_firewall_logs_test.sh	50	# ── Test 3: AWF not installed prints informational message ──────────────────	COMMENT
155 more matches not shown…

Fake / Example Data579 hits · 468 pts

Severity	File	Line	Snippet	Context
LOW	.claude/skills/playwright-cli/SKILL.md	39	playwright-cli fill e5 "user@example.com" --submit	CODE
LOW	.claude/skills/playwright-cli/SKILL.md	330	playwright-cli fill e1 "user@example.com"	CODE
LOW	…de/skills/playwright-cli/references/test-generation.md	21	playwright-cli fill e1 "user@example.com"	CODE
LOW	…de/skills/playwright-cli/references/test-generation.md	23	# await page.getByRole('textbox', { name: 'Email' }).fill('user@example.com');	COMMENT
LOW	…de/skills/playwright-cli/references/test-generation.md	44	await page.getByRole('textbox', { name: 'Email' }).fill('user@example.com');	CODE
LOW	…de/skills/playwright-cli/references/test-generation.md	118	await expect(page.getByRole('textbox', { name: 'Email' })).toHaveValue('user@example.com');	CODE
LOW	…laude/skills/playwright-cli/references/running-code.md	223	await page.getByRole('textbox', { name: 'Email' }).fill('user@example.com');	CODE
LOW⚡	…aude/skills/playwright-cli/references/storage-state.md	238	playwright-cli fill e1 "user@example.com"	CODE
LOW	…kills/playwright-cli/references/spec-driven-testing.md	180	playwright-cli fill e3 "John Doe" # -> page.getByRole('textbox', {...}).fill(...)	CODE
LOW	…kills/playwright-cli/references/spec-driven-testing.md	199	// 2. Type 'John Doe' into the username field	COMMENT
LOW	…kills/playwright-cli/references/spec-driven-testing.md	200	await page.getByRole('textbox', { name: 'username' }).fill('John Doe');	CODE
LOW	…skills/playwright-cli/references/session-management.md	17	playwright-cli -s=auth fill e1 "user@example.com"	CODE
LOW	scripts/resolve-base-commit_test.sh	25	git -C "$dir" config user.email "test@test.com"	CODE
LOW⚡	scripts/resolve-base-commit_test.sh	58	git -C "$FULL" config user.email "test@test.com"	CODE
LOW⚡	scripts/resolve-base-commit_test.sh	77	git -C "$SHALLOW" config user.email "test@test.com"	CODE
LOW⚡	scripts/resolve-base-commit_test.sh	130	git -C "$DIVERGED" config user.email "test@test.com"	CODE
LOW⚡	scripts/check-stale-lock-files_test.sh	153	git -C "$T7" config user.email "test@test.com"	CODE
LOW⚡	scripts/check-stale-lock-files_test.sh	234	git -C "$T11" config user.email "test@test.com"	CODE
LOW⚡	scripts/check-stale-lock-files_test.sh	255	git -C "$T12" config user.email "test@test.com"	CODE
LOW	scripts/check-stale-lock-files_test.sh	23	git -C "$repo_dir" config user.email "test@test.com"	CODE
LOW	pkg/workqueue/provisioning_test.go	167	node, err := NewWork([]byte(`{"task":"placeholder"}`), "placeholder", "root", "default", policy, 1000)	CODE
LOW	pkg/cli/compile_integration_test.go	475	gitConfigEmail := exec.Command("git", "config", "user.email", "test@test.com")	CODE
LOW	pkg/cli/compile_integration_test.go	1527	gitConfigEmail := exec.Command("git", "config", "user.email", "test@test.com")	CODE
LOW	pkg/cli/poutine_integration_test.go	25	gitConfigEmail := exec.Command("git", "config", "user.email", "test@test.com")	CODE
LOW	pkg/cli/poutine_integration_test.go	106	gitConfigEmail := exec.Command("git", "config", "user.email", "test@test.com")	CODE
LOW	pkg/cli/copilot_billing_check_test.go	41	AuthToken: "fake-token-for-test",	CODE
LOW⚡	pkg/cli/workflows/test-long.md	7	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	7	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	8	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	8	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	9	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	9	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	10	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	10	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	11	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	11	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	12	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	12	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	13	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	13	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	14	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	14	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	15	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	15	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	16	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	16	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	17	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	17	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	18	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	18	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	19	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	19	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	20	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	20	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	21	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	21	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	22	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	22	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	23	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
LOW⚡	pkg/cli/workflows/test-long.md	23	Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliq	CODE
519 more matches not shown…

Hyper-Verbose Identifiers432 hits · 412 pts

Severity	File	Line	Snippet	Context
LOW	specs/work-queue/verify_native.py	266	def verify_benchmark_serialization(output, text):	CODE
LOW	specs/work-queue/verify_native.py	273	def verify_benchmark_resources(output):	CODE
LOW	specs/work-queue/verify_native.py	379	def future_reference_workload(parent_count, assignment_bytes=None):	CODE
LOW	specs/work-queue/verify_native.py	391	def future_reference_assignment_bound(ledger):	CODE
LOW⚡	specs/work-queue/verify_native_test.py	256	def test_shared_typed_numeric_oracles_preserve_negative_zero_and_nested_payload(self):	CODE
LOW⚡	specs/work-queue/verify_native_test.py	439	def test_integer_and_unicode_canonical_oracle(self):	CODE
LOW⚡	specs/work-queue/verify_native_test.py	444	def test_shared_canonical_error_codes_preserve_literal_answers(self):	CODE
LOW	specs/work-queue/verify_native_test.py	25	def test_native_adapter_rejects_oversized_ledger_from_open_file(self):	CODE
LOW	specs/work-queue/verify_native_test.py	39	def test_conformance_refuses_missing_positive_before_native_execution(self):	CODE
LOW	specs/work-queue/verify_native_test.py	63	def test_worker_child_required_scenarios_allow_additions_not_substitution(self):	CODE
LOW	specs/work-queue/verify_native_test.py	102	def test_recovery_headroom_audit_requires_exact_exported_integer_measurements(self):	CODE
LOW	specs/work-queue/verify_native_test.py	126	def test_native_shutdown_timeout_kills_and_closes_owned_process(self):	CODE
LOW	specs/work-queue/verify_native_test.py	137	def test_native_build_cleanup_retains_reports_on_success_and_failure(self):	CODE
LOW	specs/work-queue/verify_native_test.py	167	def test_existing_evidence_cannot_be_overwritten(self):	CODE
LOW	specs/work-queue/verify_native_test.py	180	def test_empty_caller_run_log_does_not_block_fresh_capture(self):	CODE
LOW	specs/work-queue/verify_native_test.py	192	def test_benchmark_resources_require_real_finite_measurements(self):	CODE
LOW	specs/work-queue/verify_native_test.py	205	def test_typed_parser_controls_preserve_literal_answers(self):	CODE
LOW	specs/work-queue/verify_native_test.py	220	def test_constructed_number_fixture_answers_and_typed_transport_are_preserved(self):	CODE
LOW	specs/work-queue/verify_native_test.py	290	def test_worker_child_provenance_uses_public_request_records(self):	CODE
LOW	specs/work-queue/verify_native_test.py	359	def test_worker_child_mixed_sibling_output_checks_all_independent_expectations(self):	CODE
LOW	specs/work-queue/verify_native_test.py	415	def test_worker_child_fixtures_retain_literal_authority_and_valid_fingerprints(self):	CODE
LOW	specs/work-queue/verify_native_test.py	463	def test_canonical_rejections_require_exact_optional_error_code(self):	CODE
LOW	specs/work-queue/verify_native_test.py	479	def test_independent_lone_surrogate_literal_requires_unicode_code(self):	CODE
LOW	specs/work-queue/verify_native_test.py	488	def test_actual_shared_canonical_error_cases_are_consumed(self):	CODE
LOW	specs/work-queue/verify_native_test.py	500	def test_reversed_restart_chain(self):	CODE
LOW	specs/work-queue/verify_native_test.py	512	def test_full_mixed_graph_and_real_ready_frontier(self):	CODE
LOW	specs/work-queue/verify_native_test.py	521	def test_drained_workload_preserves_original_prefix_and_cancels_every_work(self):	CODE
LOW	specs/work-queue/verify_native_test.py	539	def test_benchmark_serialization_checks_content_not_just_equal_lengths(self):	CODE
LOW	specs/work-queue/verify_native_test.py	550	def test_full_projection_parity_preserves_authority_and_metadata(self):	CODE
LOW	specs/work-queue/verify_native_test.py	568	def test_source_identity_includes_native_adapters_and_contract_inputs(self):	CODE
LOW	specs/work-queue/verify_native_test.py	609	def test_principal_policy_answers_are_not_engine_outputs(self):	CODE
LOW	specs/work-queue/verify_native_test.py	623	def test_future_reference_budget_control_is_independent(self):	CODE
LOW	specs/work-queue/verify_native_test.py	649	def test_future_reference_closed_envelope_bounds_are_literal_and_legal(self):	CODE
LOW	specs/work-queue/verify_native_test.py	672	def test_future_exact_boundary_policy_is_installed_before_fingerprinting(self):	CODE
LOW	specs/work-queue/verify_native_test.py	686	def test_structural_wire_answers_preserve_shared_inputs_and_request_binding(self):	CODE
LOW	specs/work-queue/verify_native_test.py	710	def test_shared_deadline_answers_and_trusted_record_binding_are_preserved(self):	CODE
LOW	specs/work-queue/verify_native_test.py	739	def test_shared_reason_answers_and_authenticated_input_are_preserved(self):	CODE
LOW	specs/work-queue/verify_native_test.py	754	def test_closure_audit_counts_duplicate_result_and_escaped_metadata(self):	CODE
LOW	specs/work-queue/verify_native_test.py	772	def test_shared_identity_answers_and_typed_positions_are_preserved(self):	CODE
LOW	specs/work-queue/verify_native_test.py	793	def test_additional_shared_selection_answers_survive_shape_adapter(self):	CODE
LOW	specs/work-queue/verify_native_test.py	812	def test_default_recovery_allocation_is_distinct_from_graph_ceiling(self):	CODE
LOW	specs/work-queue/verify_native_test.py	827	def test_byte_overflow_packing_oracle_uses_earliest_compatible_group(self):	CODE
LOW	specs/work-queue/verify_models_test.py	44	def test_positive_requires_success_status_and_exhaustion_message(self):	CODE
LOW	specs/work-queue/verify_models_test.py	52	def test_negative_requires_exact_named_diagnostic_and_status(self):	CODE
LOW	specs/work-queue/verify_models_test.py	64	def test_witness_does_not_accept_safety_failure(self):	CODE
LOW	specs/work-queue/verify_models_test.py	70	def test_reservation_recovery_configs_require_exact_verdicts(self):	CODE
LOW	specs/work-queue/verify_models_test.py	87	def test_unmatched_config_cannot_report_success(self):	CODE
LOW	specs/work-queue/verify_models_test.py	92	def test_delivery_health_configs_require_exact_verdicts(self):	CODE
LOW	specs/work-queue/verify_models_test.py	121	def test_unknown_model_is_rejected(self):	CODE
LOW	specs/work-queue/verify_models_test.py	126	def test_expiration_configs_require_exact_verdicts(self):	CODE
LOW	specs/work-queue/verify_models_test.py	145	def test_delivery_recovery_configs_require_exact_verdicts(self):	CODE
LOW	specs/work-queue/verify_models_test.py	172	def test_released_recovery_control_requires_temporal_counterexample(self):	CODE
LOW	specs/work-queue/verify_models_test.py	184	def test_default_evidence_and_java_extraction_stay_repository_local(self):	CODE
LOW	specs/work-queue/verify_models_test.py	199	def test_all_new_configs_are_registered_with_real_invariants(self):	CODE
LOW	specs/work-queue/verify_official_contract_test.py	24	def test_root_refs_and_sealed_objects(self):	CODE
LOW	specs/work-queue/verify_official_contract_test.py	38	def test_local_and_external_references(self):	CODE
LOW⚡	specs/work-queue/verify_official_contract_test.py	64	def test_ref_siblings_intersect_bounds(self):	CODE
LOW⚡	specs/work-queue/verify_official_contract_test.py	72	def test_const_type_and_order_are_redundant(self):	CODE
LOW⚡	specs/work-queue/verify_official_contract_test.py	77	def test_required_order_is_not_semantic(self):	CODE
LOW	specs/work-queue/verify_official_contract_test.py	90	def test_annotations_do_not_change_validation(self):	CODE
372 more matches not shown…

Synthetic Comment Markers44 hits · 294 pts

Severity	File	Line	Snippet	Context
HIGH	docs/src/content/docs/reference/glossary.md	633	A field available on `create-issue:`, `add-comment:`, and `create-pull-request:` safe outputs that strips wrapping backt	CODE
HIGH	docs/src/content/docs/reference/glossary.md	1840	A [MultiRepoOps](#multirepoops) topology where workflows run from a separate dedicated automation repository targeting y	CODE
HIGH	…c/content/docs/reference/safe-outputs-pull-requests.md	192	footer: false # omit AI-generated footer from body updates (default: true)	CODE
HIGH	…c/content/docs/reference/safe-outputs-pull-requests.md	350	footer: true # add AI-generated footer (default: true)	CODE
HIGH⚡	docs/src/content/docs/reference/frontmatter-full.md	10816	# Controls when AI-generated footer is added to the review body. Accepts boolean	COMMENT
HIGH⚡	docs/src/content/docs/reference/frontmatter-full.md	10822	# Format 1: Controls whether AI-generated footer is added to the review body. true	COMMENT
HIGH⚡	docs/src/content/docs/reference/frontmatter-full.md	10826	# Format 2: Controls when AI-generated footer is added to the review body:	COMMENT
HIGH	docs/src/content/docs/reference/frontmatter-full.md	4726	# Controls whether AI-generated footer is added to the managed comment. Defaults	COMMENT
HIGH	docs/src/content/docs/reference/frontmatter-full.md	5203	# Controls whether AI-generated footer is added to the issue. When false, the	COMMENT
HIGH	docs/src/content/docs/reference/frontmatter-full.md	7020	# Controls whether AI-generated footer is added to the discussion. When false, the	COMMENT
HIGH	docs/src/content/docs/reference/frontmatter-full.md	7616	# Controls whether AI-generated footer is added when updating the discussion body.	COMMENT
HIGH	docs/src/content/docs/reference/frontmatter-full.md	9384	# Controls whether AI-generated footer is added to the comment. When false, the	COMMENT
HIGH	docs/src/content/docs/reference/frontmatter-full.md	10099	# Controls whether AI-generated footer is added to the pull request. When false,	COMMENT
HIGH	docs/src/content/docs/reference/frontmatter-full.md	11708	# Controls whether AI-generated footer is added to the reply body. When false, the	COMMENT
HIGH	docs/src/content/docs/reference/frontmatter-full.md	15997	# Controls whether AI-generated footer is added when updating the issue body. When	COMMENT
HIGH	docs/src/content/docs/reference/frontmatter-full.md	16314	# Controls whether AI-generated footer is added when updating the pull request	COMMENT
HIGH	docs/src/content/docs/reference/frontmatter-full.md	21020	# Controls whether AI-generated footer is added when updating the release body.	COMMENT
HIGH	docs/src/content/docs/reference/frontmatter-full.md	22338	# Custom footer message template for AI-generated content. Available placeholders:	COMMENT
HIGH	docs/src/content/docs/reference/frontmatter-full.md	22460	# @mentions in AI-generated content are allowed or escaped.	COMMENT
HIGH	docs/src/content/docs/reference/frontmatter-full.md	22716	# AI-generated footer content from all created/updated entities (issues, PRs,	COMMENT
HIGH	docs/src/content/docs/reference/safe-outputs.md	471	footer: false # omit AI-generated footer (default: true)	CODE
HIGH	docs/src/content/docs/reference/safe-outputs.md	1072	footer: false # omit AI-generated footer from review body (default: true)	CODE
HIGH	.github/aw/messages.md	28	### Footer messages (appended to every AI-generated comment/issue/PR)	COMMENT
HIGH	.github/aw/messages.md	54	### Body headers (prepended to every AI-generated message body)	COMMENT
HIGH	.github/aw/safe-outputs-content.md	119	footer: false # Optional: omit AI-generated footer while preserving XML markers (default: true)	CODE
HIGH	.github/aw/safe-outputs-content.md	194	footer: false # Optional: omit AI-generated footer while preserving XML markers (default: true)	CODE
HIGH	.github/aw/memory.md	303	footer: false # Optional: omit AI-generated footer (default: true)	CODE
HIGH	.github/workflows/copilot-agent-analysis.md	233	_Generated by Copilot Agent Analysis (Run: [run_id])_	CODE
HIGH	.github/workflows/pr-description-caveman.md	7	description: Rewrites a merged PR description with a structured, considered summary optimised for downstream agentic ana	CODE
HIGH	.github/workflows/pr-description-caveman.lock.yml	26	# Rewrites a merged PR description with a structured, considered summary optimised for downstream agentic analysis. Proc	COMMENT
HIGH	.github/workflows/pr-description-caveman.lock.yml	1913	WORKFLOW_DESCRIPTION: "Rewrites a merged PR description with a structured, considered summary optimised for do	CODE
HIGH	.github/workflows/pr-description-caveman.lock.yml	1986	WORKFLOW_DESCRIPTION: "Rewrites a merged PR description with a structured, considered summary optimised for do	CODE
HIGH	.github/workflows/pr-nitpick-reviewer.md	356	### Auto-generated Code	COMMENT
HIGH	.github/workflows/copilot-cli-deep-research.md	436	_Generated by Copilot CLI Deep Research (Run: ${{ github.run_id }})_	CODE
HIGH	.github/workflows/copilot-pr-prompt-analysis.md	274	_Generated by Copilot PR Prompt Analysis (Run: ${{ github.run_id }})_	CODE
HIGH	.github/workflows/copilot-pr-merged-report.md	214	_Generated by Copilot PR Merged Report (Run: [${{ github.run_id }}](https://github.com/${{ github.repository }}/actions/	CODE
HIGH	.github/workflows/copilot-pr-merged-report.md	254	_Generated by Copilot PR Merged Report (Run: [${{ github.run_id }}](...))_	CODE
HIGH	pkg/cli/mcp_secrets.go	57	// If we get a 403 error, ignore it as requested	COMMENT
HIGH	pkg/workflow/safe_outputs_config_types.go	27	Footer *string `yaml:"footer,omitempty"` // Controls AI-generated footer	CODE
HIGH	pkg/workflow/markdown_code_region_balancer_fuzz_test.go	20	// 4. Common AI-generated patterns are properly handled	COMMENT
HIGH	pkg/workflow/markdown_code_region_balancer_fuzz_test.go	81	// AI-generated nested markdown examples (common error pattern)	COMMENT
HIGH⚡	pkg/workflow/test_data/sample_codex_log.txt	163	"text": "{\"total_count\":20,\"incomplete_results\":false,\"items\":[{\"id\":3316382552,\"number\":14,\"state\":\"	CODE
HIGH⚡	pkg/workflow/test_data/sample_codex_log.txt	163	"text": "{\"total_count\":20,\"incomplete_results\":false,\"items\":[{\"id\":3316382552,\"number\":14,\"state\":\"	CODE
HIGH	pkg/workflow/test_data/sample_claude_log.txt	215	[{"type":"system","subtype":"init","cwd":"/home/runner/work/gh-aw/gh-aw","session_id":"29d324d8-1a92-43c6-8740-babc2875a	CODE

Verbosity Indicators111 hits · 215 pts

Severity	File	Line	Snippet	Context
LOW⚡	test-setup-local.sh	18	# Step 1: Check if we're in the right directory	COMMENT
LOW⚡	test-setup-local.sh	26	# Step 2: Build the actions if js/ directory doesn't exist	COMMENT
LOW⚡	test-setup-local.sh	39	# Step 3: Verify js/ directory has files	COMMENT
LOW⚡	test-setup-local.sh	47	# Step 4: Create a temporary destination directory	COMMENT
LOW⚡	test-setup-local.sh	52	# Step 5: Run setup.sh	COMMENT
LOW⚡	test-setup-local.sh	66	# Step 6: Verify files were copied	COMMENT
LOW⚡	test-setup-local.sh	76	# Step 7: Check output file	COMMENT
LOW⚡	test-setup-local.sh	82	# Step 8: List some of the copied files	COMMENT
LOW⚡	test-setup-local.sh	87	# Step 9: Cleanup	COMMENT
LOW⚡	.github/skills/agentic-workflows/tests/test_guidance.py	461	for obsolete in ("curl -sL", "\| bash", "git push", "## Step 3: Apply Fixes"):	CODE
LOW	actions/setup/sh/check_mcp_servers.sh	207	# Step 1: Send ping to verify basic connectivity	COMMENT
LOW	actions/setup/sh/check_mcp_servers.sh	221	# Step 2: Send MCP initialize request, capturing response headers for Mcp-Session-Id	COMMENT
LOW	actions/setup/sh/check_mcp_servers.sh	237	# Step 3: Send tools/list, including Mcp-Session-Id header if returned by initialize	COMMENT
LOW⚡	actions/setup/sh/validate_gatewayed_server.sh	119	# Step 1: Validate config file exists	COMMENT
LOW⚡	actions/setup/sh/validate_gatewayed_server.sh	124	# Step 2: Check if server exists	COMMENT
LOW⚡	actions/setup/sh/validate_gatewayed_server.sh	129	# Step 3: Extract server configuration	COMMENT
LOW⚡	actions/setup/sh/validate_gatewayed_server.sh	135	# Step 4: Validate server has URL	COMMENT
LOW⚡	actions/setup/sh/validate_gatewayed_server.sh	141	# Step 5: Validate server type	COMMENT
LOW⚡	actions/setup/sh/validate_gatewayed_server.sh	146	# Step 6: Validate URL points to gateway	COMMENT
LOW	pkg/cli/compile_schedule_calendar_test.go	472	// Step 1: scatter the fuzzy expression to a real cron string.	COMMENT
LOW⚡	pkg/cli/compile_schedule_calendar_test.go	483	// Step 2: parse the scattered cron with parseCronSchedule.	COMMENT
LOW⚡	pkg/cli/compile_schedule_calendar_test.go	492	// Step 3: buildScheduleGrid should register at least one slot.	COMMENT
LOW	pkg/cli/compile_schedule_calendar_test.go	509	// Step 4: displayScheduleCalendar should produce output referencing the hour.	COMMENT
LOW⚡	pkg/cli/logs_json_clean_test.go	83	// Step 1: Build logs data (what happens in the function)	COMMENT
LOW⚡	pkg/cli/logs_json_clean_test.go	86	// Step 2: Capture both stdout and stderr	COMMENT
LOW⚡	pkg/cli/logs_json_clean_test.go	105	// Step 3: Output JSON FIRST (as our fix does)	COMMENT
LOW⚡	pkg/cli/logs_json_clean_test.go	108	// Step 4: Then output stderr message (as our fix does)	COMMENT
LOW⚡	pkg/cli/checks_command.go	158	// Step 1: Resolve head SHA from PR (skipped when caller provides it).	COMMENT
LOW⚡	pkg/cli/checks_command.go	167	// Step 2: Fetch check runs	COMMENT
LOW⚡	pkg/cli/checks_command.go	175	// Step 3: Fetch commit statuses	COMMENT
LOW	pkg/cli/trial_confirmation.go	138	// Step 1: Repository creation/reuse	COMMENT
LOW	pkg/cli/trial_confirmation.go	149	// Step 2: Clone contents (only in clone-repo mode)	COMMENT
LOW	pkg/cli/compile_safe_update_integration_test.go	233	// Step 1: Compile to generate the full lock file + manifest.	COMMENT
LOW	pkg/cli/compile_safe_update_integration_test.go	247	// Step 2: Compile the identical workflow again. The lock file from step 1 acts	COMMENT
LOW	pkg/cli/compile_safe_update_integration_test.go	273	// Step 1: Establish the baseline manifest with a normal compile.	COMMENT
LOW	pkg/cli/compile_safe_update_integration_test.go	286	// Step 2: Re-compile. No secrets were added so this must succeed.	COMMENT
LOW	pkg/cli/compile_safe_update_integration_test.go	530	// Step 1: Compile to generate the lock file + manifest.	COMMENT
LOW	pkg/cli/compile_safe_update_integration_test.go	544	// Step 2: Compile again. The lock file from step 1 serves as the prior manifest.	COMMENT
LOW	pkg/cli/add_package_manifest_skills.go	24	// Step 1: resolve manifest skills first (explicit dirs).	COMMENT
LOW	pkg/cli/add_package_manifest_skills.go	63	// Step 2: always auto-scan and append any skills not already in the manifest.	COMMENT
LOW	pkg/cli/trial_runner.go	47	// Step 0: Determine workflow mode (mutual exclusion is enforced by Cobra)	COMMENT
LOW	pkg/cli/trial_runner.go	100	// Step 1: Determine host repository slug	COMMENT
LOW	pkg/cli/trial_runner.go	138	// Step 2: Create or reuse host repository	COMMENT
LOW	pkg/cli/trial_helpers.go	50	// Step 3: Clone host repository to local temp directory	COMMENT
LOW⚡	pkg/cli/trial_helpers.go	63	// Step 4: Create trials directory	COMMENT
LOW⚡	pkg/cli/trial_helpers.go	68	// Step 5: Run trials for each workflow	COMMENT
LOW	pkg/cli/trial_helpers.go	194	// Step 6: Save combined results for multi-workflow trials	COMMENT
LOW⚡	…cli/pr_code_quality_reviewer_workflow_contract_test.go	87	_, adjudication, ok := strings.Cut(text, "### Step 3: Judge Agent-to-Agent Findings")	CODE
LOW⚡	…cli/pr_code_quality_reviewer_workflow_contract_test.go	89	barrier, publication, ok := strings.Cut(adjudication, "### Step 4: Write Review Comments")	CODE
LOW	…cli/pr_code_quality_reviewer_workflow_contract_test.go	104	comments, submission, ok := strings.Cut(publication, "### Step 5: Submit the Overall Review")	CODE
LOW	pkg/cli/logs_copilot_flattening_integration_test.go	25	// Step 1: Simulate downloaded artifacts structure (before flattening)	COMMENT
LOW	pkg/cli/logs_copilot_flattening_integration_test.go	64	// Step 2: Flatten the artifact (mimics flattenAgentOutputsArtifact)	COMMENT
LOW	pkg/cli/logs_copilot_flattening_integration_test.go	83	// Step 3: Test that findAgentLogFile can find the session log after flattening	COMMENT
LOW	pkg/cli/logs_copilot_flattening_integration_test.go	106	// Step 1: Simulate downloaded artifacts structure (before flattening)	COMMENT
LOW	pkg/cli/logs_copilot_flattening_integration_test.go	140	// Step 2: Flatten the artifact	COMMENT
LOW	pkg/cli/logs_copilot_flattening_integration_test.go	158	// Step 3: Test that findAgentLogFile can find the session log via recursive search	COMMENT
LOW	pkg/cli/upgrade_command.go	322	// Step 1: Update dispatcher skill and related Copilot artifacts (like init command)	COMMENT
LOW	pkg/cli/upgrade_command.go	335	// Step 2: Apply codemods to all workflows (unless --no-fix is specified)	COMMENT
LOW	pkg/cli/upgrade_command.go	364	// Step 3: Update GitHub Actions versions (unless --no-fix or --no-actions is specified)	COMMENT
LOW	pkg/cli/upgrade_command.go	403	// Step 4: Compile all workflows (unless --no-fix or --no-compile is specified)	COMMENT
51 more matches not shown…

Redundant / Tautological Comments82 hits · 120 pts

Severity	File	Line	Snippet	Context
LOW	install-gh-aw.sh	29	# Check if INPUT_VERSION is set (GitHub Actions context)	COMMENT
LOW⚡	install-gh-aw.sh	86	# Check if HOME is set	COMMENT
LOW⚡	install-gh-aw.sh	92	# Check if curl is available	COMMENT
LOW⚡	install-gh-aw.sh	98	# Check if sha256sum or shasum is available (for checksum verification)	COMMENT
LOW	install-gh-aw.sh	471	# Check if binary already exists	COMMENT
LOW	cmd/gh-aw/main.go	335	` + string(constants.CLIExtensionPrefix) + ` run daily-perf-improver --json # Output results in JSON format`,	CODE
LOW	.serena/project.yml	46	# Set this to [] to disable base modes for this project.	COMMENT
LOW	.serena/project.yml	47	# Set this to a list of mode names to always include the respective modes for this project.	COMMENT
LOW	scripts/generate-video-posters.sh	14	# Check if ffmpeg is installed	COMMENT
LOW	scripts/delete-old-copilot-branches.sh	120	# Check if commit is at least 7 days old	COMMENT
LOW	scripts/delete-old-copilot-branches.sh	152	# Check if we've reached the max branches limit	COMMENT
LOW	scripts/check-safe-outputs-conformance.sh	69	# Check if agent job has write permissions	COMMENT
LOW	scripts/check-safe-outputs-conformance.sh	95	# Check if handler has API calls	COMMENT
LOW	scripts/check-safe-outputs-conformance.sh	97	# Check if validation appears before API calls	COMMENT
LOW	scripts/check-safe-outputs-conformance.sh	125	# Check if handler enforces max limits using any recognized pattern	COMMENT
LOW	scripts/check-safe-outputs-conformance.sh	185	# Check if handler supports target-repo (match explicit config-surface identifiers only)	COMMENT
LOW	scripts/check-safe-outputs-conformance.sh	216	# Check if handler throws errors	COMMENT
LOW	scripts/check-safe-outputs-conformance.sh	241	# Check if handler adds footers	COMMENT
LOW	scripts/check-safe-outputs-conformance.sh	358	# Check if standard handlers exist	COMMENT
LOW	scripts/check-safe-outputs-conformance.sh	376	# Check if permission computation file exists and is well-formed	COMMENT
LOW	scripts/check-safe-outputs-conformance.sh	395	# Check if safe outputs config generation file exists with schema functions	COMMENT
LOW	scripts/check-safe-outputs-conformance.sh	407	# Check if static schemas file exists (embedded JSON)	COMMENT
LOW	scripts/check-safe-outputs-conformance.sh	419	# Check if safe_outputs_config.go has documentation about schema architecture	COMMENT
LOW	scripts/check-safe-outputs-conformance.sh	1553	# Check if the gateway handler skips tools not present in config (indirectly validates zero-max)	COMMENT
LOW	scripts/build-release.sh	45	# Check if platform is supported	COMMENT
LOW	.github/workflows/daily-hippo-learn.lock.yml	624	run: "# Symlink .hippo into cache-memory so the SQLite store persists across runs.\n# All writes to .hippo/ land	CODE
LOW	.github/workflows/copilot-pr-merged-report.lock.yml	613	run: "# Create output directories\nmkdir -p /tmp/gh-aw/agent/pr-data\nmkdir -p /tmp/gh-aw/cache-memory\n\n# Cach	CODE
LOW	.github/workflows/copilot-agent-analysis.lock.yml	700	run: "# Create output directories\nmkdir -p /tmp/gh-aw/agent/pr-data\nmkdir -p /tmp/gh-aw/cache-memory\n\n# Cach	CODE
LOW	.github/workflows/docs-noob-tester.lock.yml	692	run: "MAX_WAIT=135 # 45 attempts × 3s = 135s max wait\nWAITED=0\n# runner-guard:ignore RGS-012 -- loopback-only	CODE
LOW	.github/workflows/copilot-opt.lock.yml	632	run: "# Create output directories\nmkdir -p /tmp/gh-aw/agent/session-data\nmkdir -p /tmp/gh-aw/agent/session-dat	CODE
LOW	.github/workflows/copilot-opt.lock.yml	640	run: "# Create output directories\nmkdir -p /tmp/gh-aw/agent/pr-data\nmkdir -p /tmp/gh-aw/cache-memory\n\n# Cach	CODE
LOW	.github/workflows/deep-report.lock.yml	781	# Check if cached data exists from this six-hour bucket	COMMENT
LOW	.github/workflows/deep-report.lock.yml	868	# Check if there are more pages	COMMENT
LOW	.github/workflows/deep-report.lock.yml	872	# Check if we've reached the requested count	COMMENT
LOW	.github/workflows/deep-report.lock.yml	925	# Check if cached data exists from this six-hour bucket	COMMENT
LOW	.github/workflows/daily-news.lock.yml	733	run: "set -e\n\n# Create directories\nmkdir -p /tmp/gh-aw/agent/daily-news-data\nmkdir -p /tmp/gh-aw/repo-memory	CODE
LOW⚡	.github/workflows/prompt-clustering-analysis.lock.yml	699	run: "# Create output directories\nmkdir -p /tmp/gh-aw/agent/pr-data\nmkdir -p /tmp/gh-aw/cache-memory\n\n# Cach	CODE
LOW	…thub/workflows/dataflow-pr-discussion-dataset.lock.yml	721	# Check if cached data exists from this six-hour bucket	COMMENT
LOW	…thub/workflows/dataflow-pr-discussion-dataset.lock.yml	808	# Check if there are more pages	COMMENT
LOW	…thub/workflows/dataflow-pr-discussion-dataset.lock.yml	812	# Check if we've reached the requested count	COMMENT
LOW	.github/workflows/daily-issues-report.lock.yml	771	# Check if cached data exists from today	COMMENT
LOW	.github/workflows/copilot-session-insights.lock.yml	683	run: "# Create output directories\nmkdir -p /tmp/gh-aw/agent/session-data\nmkdir -p /tmp/gh-aw/agent/session-dat	CODE
LOW	.github/workflows/copilot-pr-nlp-analysis.lock.yml	710	run: "# Create output directories\nmkdir -p /tmp/gh-aw/agent/pr-data\nmkdir -p /tmp/gh-aw/cache-memory\n\n# Cach	CODE
LOW	.github/workflows/copilot-pr-prompt-analysis.lock.yml	649	run: "# Create output directories\nmkdir -p /tmp/gh-aw/agent/pr-data\nmkdir -p /tmp/gh-aw/cache-memory\n\n# Cach	CODE
LOW	.github/workflows/install.yml	134	# Check if binary exists	COMMENT
LOW	.github/workflows/install.yml	142	# Check if binary is executable	COMMENT
LOW	.github/workflows/ci.yml	1224	# Check if the workflow has relative imports	COMMENT
LOW	.github/workflows/hippo-embed.lock.yml	617	run: "# Symlink .hippo into cache-memory so the SQLite store persists across runs.\n# All writes to .hippo/ land	CODE
LOW	.github/workflows/cgo.yml	1964	# Check if the failure was due to context deadline (expected)	COMMENT
LOW	.github/workflows/cgo.yml	2672	# Check if lock file was generated	COMMENT
LOW	actions/setup-cli/install.sh	29	# Check if INPUT_VERSION is set (GitHub Actions context)	COMMENT
LOW⚡	actions/setup-cli/install.sh	86	# Check if HOME is set	COMMENT
LOW⚡	actions/setup-cli/install.sh	92	# Check if curl is available	COMMENT
LOW⚡	actions/setup-cli/install.sh	98	# Check if sha256sum or shasum is available (for checksum verification)	COMMENT
LOW	actions/setup-cli/install.sh	471	# Check if binary already exists	COMMENT
LOW	actions/setup/setup.sh	146	# Check if js directory exists	COMMENT
LOW	actions/setup/sh/check_mcp_servers.sh	103	# Check if mcpServers is null or empty	COMMENT
LOW	actions/setup/sh/check_mcp_servers.sh	248	# Check if tools/list succeeded	COMMENT
LOW	actions/setup/sh/start_mcp_scripts_server.sh	96	# Check if process is still running	COMMENT
LOW	actions/setup/sh/start_mcp_scripts_server.sh	104	# Check if server is responding	COMMENT
22 more matches not shown…

AI Slop Vocabulary42 hits · 118 pts

Severity	File	Line	Snippet	Context
MEDIUM	.golangci.yml	17	- testifylint # Enforce testify best practices	CODE
MEDIUM	docs/public/schemas/unified-session.schema.json	792	"reason": { "$ref": "#/definitions/HarnessFailureClass", "description": "Existing allowlisted harness failure cl	CODE
MEDIUM	docs/public/schemas/unified-session.schema.json	859	"reason": { "$ref": "#/definitions/HarnessFailureClass", "description": "Existing allowlisted harness failure cl	CODE
MEDIUM	.github/workflows/artifacts-summary.lock.yml	26	# Generates a comprehensive summary of GitHub Actions artifacts usage across all workflows in the repository	COMMENT
MEDIUM	…workflows/engine-conformance-deepseek-harness.lock.yml	1	# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"a6a6fea8720f8be10ad04705ed42b06356ba54988c92baf4674ce7dffec	COMMENT
MEDIUM	…workflows/engine-conformance-deepseek-harness.lock.yml	30	# - shared/deepseek-harness.md	COMMENT
MEDIUM	.github/workflows/agentic_commands.yml	1	# gh-aw-commands: {"payload_version":"v1","schema_version":"v1","compiler_version":"dev","commands":["*","ace","approach	COMMENT
MEDIUM	.github/workflows/agentic_commands.yml	47	# /smoke-deepseek-harness -> smoke-deepseek-harness [issue_comment,issues,pull_request,pull_request_comment] reactio	COMMENT
MEDIUM	.github/workflows/smoke-pydantic.lock.yml	718	run: "# This step runs on the host runner with the checkout as its working\n# directory, before the AWF sandbox	CODE
MEDIUM	.github/workflows/github-mcp-tools-report.lock.yml	26	# Generates a comprehensive report of available MCP server tools and their capabilities for GitHub integration	COMMENT
MEDIUM	.github/workflows/example-permissions-warning.lock.yml	26	# Example workflow demonstrating proper permission provisioning and security best practices	COMMENT
MEDIUM	.github/workflows/daily-vulnhunter-scan.lock.yml	2714	# (agents, harness, fix tooling) would just be dead weight in the sandbox.	COMMENT
MEDIUM	.github/workflows/daily-fact.lock.yml	353	GH_AW_PROMPT_CONTENT_0007: "{{#runtime-import? .github/shared-instructions.md}}\n\n### Daily Fact About gh-aw\	CODE
MEDIUM	.github/workflows/pr-nitpick-reviewer.lock.yml	26	# ⚠️ DEPRECATED: Use PR Code Quality Reviewer (pr-code-quality-reviewer) instead. Provides detailed nitpicky code review	COMMENT
MEDIUM	.github/workflows/example-workflow-analyzer.lock.yml	26	# Analyzes workflow examples to identify patterns, best practices, and potential improvements	COMMENT
MEDIUM	.github/workflows/smoke-codex-routed.lock.yml	960	printf '%s\n' "{\"\$schema\":\"https://github.com/github/gh-aw-firewall/releases/download/v0.29.0/awf-config.s	CODE
MEDIUM	.github/workflows/smoke-deepseek-harness.lock.yml	1	# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"da35e0a3830d6f3d2ed330302110bf229b8dbbc66b914afa16ac2006d34	COMMENT
MEDIUM	.github/workflows/smoke-deepseek-harness.lock.yml	30	# - shared/deepseek-harness.md	COMMENT
MEDIUM	.github/workflows/smoke-deepseek-harness.lock.yml	370	GH_AW_PROMPT_CONTENT_0005: "{{#runtime-import .github/workflows/shared/deepseek-harness.md}}\n"	CODE
MEDIUM	.github/workflows/smoke-deepseek-harness.lock.yml	377	GH_AW_PROMPT_CONTENT_0012: "{{#runtime-import .github/workflows/smoke-deepseek-harness.md}}\n"	CODE
MEDIUM	.github/workflows/commit-changes-analyzer.lock.yml	26	# Analyzes and provides a comprehensive developer-focused report of all changes in the repository since a specified comm	COMMENT
MEDIUM	.github/workflows/scout.lock.yml	26	# Performs deep research investigations using web search to gather and synthesize comprehensive information on any topic	COMMENT
MEDIUM	…thub/workflows/engine-conformance-pydantic-ai.lock.yml	676	run: "# This step runs on the host runner with the checkout as its working\n# directory, before the AWF sandbox	CODE
MEDIUM	.github/workflows/pr-code-quality-reviewer.lock.yml	26	# Comprehensive code quality review covering bugs, performance, style, naming, and best practices — consolidates Grumpy	COMMENT
MEDIUM	.github/workflows/ci.yml	1228	# Python is used for robust YAML-aware parsing instead of fragile AWK patterns.	COMMENT
MEDIUM	…b/workflows/daily-harness-experiment-proposer.lock.yml	26	# Converts compact existing workflow evidence (concluded experiment decisions/analyses, 14-day run/failure aggregates, a	COMMENT
MEDIUM	…b/workflows/daily-harness-experiment-proposer.lock.yml	63	# skip-if-match: is:open in:title "[harness-experiment-proposal]" # Skip-if-match processed as search check in pre-act	COMMENT
MEDIUM	…b/workflows/daily-harness-experiment-proposer.lock.yml	311	GH_AW_PROMPT_CONTENT_0007: "{{#runtime-import .github/workflows/daily-harness-experiment-proposer.md}}\n"	CODE
MEDIUM	…b/workflows/daily-harness-experiment-proposer.lock.yml	635	run: "set -euo pipefail\ncd \"$GITHUB_WORKSPACE\"\nSELF_BASENAME=\"daily-harness-experiment-proposer.md\"\n: > /	CODE
MEDIUM	.github/workflows/smoke-pi-routed-claude.lock.yml	26	# Smoke pi model routing to a Claude main model in robust mode with deterministic runner and proxy evidence checks	COMMENT
MEDIUM	.github/workflows/smoke-pi-routed-claude.lock.yml	1069	printf '%s\n' "{\"\$schema\":\"https://github.com/github/gh-aw-firewall/releases/download/v0.29.0/awf-config.s	CODE
MEDIUM	actions/setup/setup.sh	168	# shared runtime dependencies used by the Copilot harness and SDK driver.	COMMENT
MEDIUM⚡	actions/setup/sh/run_awf_with_startup_retries.sh	8	# before the engine harness writes its first marker line.	COMMENT
MEDIUM⚡	actions/setup/sh/run_awf_with_startup_retries.sh	12	# GH_AW_AWF_HARNESS_MARKER Marker emitted by the engine harness, e.g. [claude-harness].	COMMENT
MEDIUM⚡	actions/setup/sh/run_awf_with_startup_retries.sh	22	# "not_started" when AWF never reached the harness.	COMMENT
MEDIUM	actions/setup/sh/run_awf_with_startup_retries.sh	79	# The harness marker is emitted before the engine process is spawned, so its	COMMENT
MEDIUM	pkg/parser/schedule_parser_fuzz_test.go	19	// 6. UTC offset parsing is robust	COMMENT
MEDIUM	…flow/threat_detection_external_detector_config_test.go	312	// a template variable expression. Checking for '${{' is more robust than	COMMENT
MEDIUM	pkg/workflow/compiler_activation_job_test.go	1360	// TestInjectIfConditionAfterName verifies the robust line-oriented implementation of	COMMENT
MEDIUM	pkg/workflow/mcp_renderer.go	314	// Resolve the node binary to its absolute path so the command is robust	COMMENT
MEDIUM	pkg/workflow/sanitize_output_fuzz_test.go	20	// via Node.js. This allows us to fuzz test JavaScript code using Go's robust	COMMENT
MEDIUM	pkg/workflow/mentions_fuzz_test.go	19	// via Node.js. This allows us to fuzz test JavaScript code using Go's robust	COMMENT

Self-Referential Comments44 hits · 118 pts

Severity	File	Line	Snippet	Context
MEDIUM	install-gh-aw.sh	465	# Create the installation directory if it doesn't exist	COMMENT
MEDIUM	scripts/test-build-release.sh	12	# Create a temporary directory for testing	COMMENT
MEDIUM	scripts/convert-astro-to-gfm.sh	21	# Create a temporary file	COMMENT
MEDIUM	.github/workflows/agentic-workqueue.yml	24	# This file is generated by gh-aw for work queue events.	COMMENT
MEDIUM	…thub/workflows/github-mcp-structural-analysis.lock.yml	648	run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\n# Use /tmp/g	CODE
MEDIUM	.github/workflows/python-data-charts.lock.yml	673	run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\n# Use /tmp/g	CODE
MEDIUM	.github/workflows/smoke-issues.lock.yml	26	# Create a daily haiku issue in Linear and Jira through safe outputs	COMMENT
MEDIUM	.github/workflows/daily-news.lock.yml	714	run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\n# Use /tmp/g	CODE
MEDIUM⚡	.github/workflows/prompt-clustering-analysis.lock.yml	703	run: "mkdir -p /tmp/gh-aw/python/{data,charts,artifacts}\n# Create a virtual environment for proper package isol	CODE
MEDIUM⚡	.github/workflows/prompt-clustering-analysis.lock.yml	708	run: "# Create output directory for full PR data\nmkdir -p /tmp/gh-aw/agent/prompt-cache/pr-full-data\n\n# Downl	CODE
MEDIUM	.github/workflows/daily-security-observability.lock.yml	700	run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\n# Use /tmp/g	CODE
MEDIUM	.github/workflows/daily-issues-report.lock.yml	842	# Create a virtual environment for proper package isolation (avoids --break-system-packages)	COMMENT
MEDIUM	.github/workflows/daily-issues-report.lock.yml	886	# Create a virtual environment for proper package isolation (avoids --break-system-packages)	COMMENT
MEDIUM	.github/workflows/daily-repo-chronicle.lock.yml	675	run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\n# Use /tmp/g	CODE
MEDIUM	.github/workflows/portfolio-analyst.lock.yml	651	run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\n# Use /tmp/g	CODE
MEDIUM	.github/workflows/daily-code-metrics.lock.yml	690	run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\n# Use /tmp/g	CODE
MEDIUM	.github/workflows/copilot-session-insights.lock.yml	689	run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\n# Use /tmp/g	CODE
MEDIUM	.github/workflows/org-health-report.lock.yml	644	run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\n# Use /tmp/g	CODE
MEDIUM	.github/workflows/weekly-issue-summary.lock.yml	633	run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\n# Use /tmp/g	CODE
MEDIUM	.github/workflows/copilot-pr-nlp-analysis.lock.yml	716	run: "# Create a virtual environment for proper package isolation (avoids --break-system-packages)\n# Use /tmp/g	CODE
MEDIUM	.github/workflows/copilot-pr-nlp-analysis.lock.yml	730	run: "mkdir -p /tmp/gh-aw/python/{data,charts,artifacts}\n# Create a virtual environment for proper package isol	CODE
MEDIUM	.github/workflows/format-and-commit.yml	70	# Create a unique branch name	COMMENT
MEDIUM	.github/workflows/agentics-maintenance.yml	24	# This file defines the generated agentic maintenance workflow for this repository.	COMMENT
MEDIUM	.github/workflows/cgo.yml	2176	# Create a test script using the MCP Go SDK	COMMENT
MEDIUM	actions/setup-cli/install.sh	465	# Create the installation directory if it doesn't exist	COMMENT
MEDIUM	actions/setup/sh/resolve_docker_socket_gid_test.sh	62	# Create a temporary test socket	COMMENT
MEDIUM	actions/setup/sh/resolve_docker_socket_gid_test.sh	100	# Create a temporary test socket	COMMENT
MEDIUM	actions/setup/sh/resolve_docker_socket_gid_test.sh	133	# Create a temporary test socket	COMMENT
MEDIUM	actions/setup/sh/resolve_docker_socket_gid_test.sh	171	# Create a temporary test socket	COMMENT
MEDIUM	actions/setup/sh/resolve_docker_socket_gid_test.sh	209	# Create a temporary test socket	COMMENT
MEDIUM	actions/setup/sh/resolve_docker_socket_gid_test.sh	271	# Create a temporary test socket and symlink	COMMENT
MEDIUM	actions/setup/sh/resolve_docker_socket_gid_test.sh	383	# Create a temporary test socket	COMMENT
MEDIUM	actions/setup/sh/resolve_docker_socket_gid_test.sh	420	# Create a temporary test socket	COMMENT
MEDIUM	actions/setup/sh/start_mcp_gateway_test.sh	92	# Create a modified script that uses our fake home	COMMENT
MEDIUM	actions/setup/sh/start_mcp_gateway_test.sh	119	# Create a modified script that uses our fake home	COMMENT
MEDIUM	actions/setup/sh/start_mcp_gateway_test.sh	145	# Create a modified script that uses our fake home	COMMENT
MEDIUM	actions/setup/sh/start_mcp_gateway_test.sh	172	# Create a modified script that uses our fake home	COMMENT
MEDIUM	actions/setup/sh/start_mcp_gateway_test.sh	199	# Create a modified script that uses our fake home	COMMENT
MEDIUM	actions/setup/sh/start_mcp_gateway_test.sh	226	# Create a modified script that uses our fake home	COMMENT
MEDIUM	actions/setup/sh/convert_gateway_config_codex_test.sh	22	# Create the output directory the script writes to	COMMENT
MEDIUM	actions/setup/sh/setup_cache_memory_git.sh	78	# Create an empty initial commit as the trusted baseline for all branches	COMMENT
MEDIUM	actions/setup/sh/convert_gateway_config_codex.sh	82	# Create the TOML configuration	COMMENT
MEDIUM	pkg/cli/codemod_agent_session_test.go	89	create-agent-task: # Create a new agent task	CODE
MEDIUM	pkg/cli/codemod_agent_session_test.go	108	assert.Contains(t, result, "create-agent-session: # Create a new agent task")	CODE

Cross-File Repetition15 hits · 75 pts

Severity	File	Snippet	Context
HIGH	.github/workflows/duplicate-code-detector.lock.yml	env: awf_reflect_enabled: 1 copilot_github_token: ${{ github.token }} gh_aw_admission_max_ai_credits: ${{ needs.activati	STRING
HIGH	.github/workflows/daily-hippo-learn.lock.yml	env: awf_reflect_enabled: 1 copilot_github_token: ${{ github.token }} gh_aw_admission_max_ai_credits: ${{ needs.activati	STRING
HIGH	.github/workflows/stale-repo-identifier.lock.yml	env: awf_reflect_enabled: 1 copilot_github_token: ${{ github.token }} gh_aw_admission_max_ai_credits: ${{ needs.activati	STRING
HIGH	.github/workflows/research.lock.yml	env: awf_reflect_enabled: 1 copilot_github_token: ${{ github.token }} gh_aw_admission_max_ai_credits: ${{ needs.activati	STRING
HIGH	.github/workflows/pr-sous-chef.lock.yml	env: awf_reflect_enabled: 1 copilot_github_token: ${{ github.token }} gh_aw_admission_max_ai_credits: ${{ needs.activati	STRING
HIGH	.github/workflows/design-decision-gate.lock.yml	env: awf_reflect_enabled: 1 copilot_github_token: ${{ github.token }} gh_aw_admission_max_ai_credits: ${{ needs.activati	STRING
HIGH	.github/workflows/daily-news.lock.yml	env: awf_reflect_enabled: 1 copilot_github_token: ${{ github.token }} gh_aw_admission_max_ai_credits: ${{ needs.activati	STRING
HIGH	.github/workflows/daily-performance-summary.lock.yml	env: awf_reflect_enabled: 1 copilot_github_token: ${{ github.token }} gh_aw_admission_max_ai_credits: ${{ needs.activati	STRING
HIGH	.github/workflows/sub-issue-closer.lock.yml	env: awf_reflect_enabled: 1 copilot_github_token: ${{ github.token }} gh_aw_admission_max_ai_credits: ${{ needs.activati	STRING
HIGH	.github/workflows/necromancer.lock.yml	env: awf_reflect_enabled: 1 copilot_github_token: ${{ github.token }} gh_aw_admission_max_ai_credits: ${{ needs.activati	STRING
HIGH	.github/workflows/unbloat-docs.lock.yml	env: awf_reflect_enabled: 1 copilot_github_token: ${{ github.token }} gh_aw_admission_max_ai_credits: ${{ needs.activati	STRING
HIGH	.github/workflows/issue-monster.lock.yml	env: awf_reflect_enabled: 1 copilot_github_token: ${{ github.token }} gh_aw_admission_max_ai_credits: ${{ needs.activati	STRING
HIGH	.github/workflows/cli-version-checker.lock.yml	env: awf_reflect_enabled: 1 copilot_github_token: ${{ github.token }} gh_aw_admission_max_ai_credits: ${{ needs.activati	STRING
HIGH	…thub/workflows/daily-multi-device-docs-tester.lock.yml	env: awf_reflect_enabled: 1 copilot_github_token: ${{ github.token }} gh_aw_admission_max_ai_credits: ${{ needs.activati	STRING
HIGH	.github/workflows/daily-function-namer.lock.yml	env: awf_reflect_enabled: 1 copilot_github_token: ${{ github.token }} gh_aw_admission_max_ai_credits: ${{ needs.activati	STRING

Example Usage Blocks28 hits · 42 pts

Severity	File	Line	Snippet	Context
LOW	scripts/sync-compat.sh	10	# Usage:	COMMENT
LOW	scripts/check-stale-schema-binary.sh	16	# Usage:	COMMENT
LOW	scripts/check-stale-lock-files.sh	19	# Usage:	COMMENT
LOW	scripts/delete-old-copilot-branches.sh	12	# Usage:	COMMENT
LOW	scripts/update-install-script-hashes.sh	7	# Usage:	COMMENT
LOW	scripts/bundle-wasm-docs.sh	8	# Usage:	COMMENT
LOW	scripts/resolve-base-commit.sh	23	# Usage:	COMMENT
LOW	scripts/check-workflow-drift.sh	10	# Usage:	COMMENT
LOW	actions/setup/sh/resolve_docker_socket_gid.sh	9	# Usage:	COMMENT
LOW	pkg/constants/job_constants.go	7	// Example usage:	COMMENT
LOW	pkg/constants/job_constants.go	27	// Example usage:	COMMENT
LOW	pkg/constants/job_constants.go	47	// Example usage:	COMMENT
LOW	pkg/constants/constants.go	30	// Example usage:	COMMENT
LOW	pkg/constants/constants.go	41	// Example usage:	COMMENT
LOW	pkg/constants/constants.go	61	// Example usage:	COMMENT
LOW	pkg/constants/constants.go	72	// Example usage:	COMMENT
LOW	pkg/constants/constants.go	92	// Example usage:	COMMENT
LOW	pkg/constants/constants.go	112	// Example usage:	COMMENT
LOW	pkg/constants/url_constants.go	7	// Example usage:	COMMENT
LOW	pkg/constants/url_constants.go	17	// Example usage:	COMMENT
LOW	pkg/constants/engine_constants.go	9	// Example usage:	COMMENT
LOW	pkg/constants/feature_constants.go	7	// Example usage:	COMMENT
LOW	pkg/constants/version_constants.go	8	// Example usage:	COMMENT
LOW	pkg/constants/version_constants.go	28	// Example usage:	COMMENT
LOW	pkg/workflow/config_helpers.go	162	// Example usage:	COMMENT
LOW	pkg/workflow/mcp_renderer.go	35	// Example usage:	COMMENT
LOW	pkg/workflow/update_entity_helpers.go	420	// Usage example:	COMMENT
LOW	pkg/workflow/mcp_environment.go	42	// Example usage:	COMMENT

Cross-Language Confusion6 hits · 40 pts

Severity	File	Line	Snippet	Context
HIGH⚡	specs/work-queue/verify_native_test.py	258	"valid": [{"name": "nested", "input": '{"z":["1.25",null,0,{"n":"-0"}]}',	CODE
HIGH⚡	specs/work-queue/verify_native_test.py	259	"expected": '{"z":["1.25",null,0,{"n":"-0"}]}'}],	CODE
HIGH⚡	specs/work-queue/verify_native_test.py	442	self.assertEqual(verify.canonical({"a": False, "b": None, "c": "\n"}), '{"a":false,"b":null,"c":"\\n"}')	CODE
HIGH⚡	…skills/statistics-infographic/tests/test_statistics.py	366	for contents in ("{", '{"origins": null}'):	CODE
HIGH	…ub/skills/github-discussion-query/query-discussions.py	93	{"description": "Get answered discussions", "query": ".[] \| select(.answer != null)"},	CODE
HIGH	…ub/skills/github-discussion-query/query-discussions.py	94	{"description": "Get unanswered discussions", "query": ".[] \| select(.answer == null) \| {number, title, cate	CODE

Deep Nesting38 hits · 32 pts

Severity	File	Line	Context
LOW	specs/work-queue/verify_official_contract.py	43	CODE
LOW	specs/work-queue/verify_official_contract.py	90	CODE
LOW	specs/work-queue/generate_contract.py	18	CODE
LOW	specs/work-queue/verify_native.py	38	CODE
LOW	specs/work-queue/verify_native.py	127	CODE
LOW	specs/work-queue/verify_native.py	282	CODE
LOW	specs/work-queue/verify_native.py	449	CODE
LOW	specs/work-queue/verify_native.py	472	CODE
LOW	specs/work-queue/verify_native.py	493	CODE
LOW	specs/work-queue/verify_native.py	130	CODE
LOW	specs/work-queue/verify_native_test.py	39	CODE
LOW	specs/work-queue/verify_native_test.py	63	CODE
LOW	specs/work-queue/verify_native_test.py	137	CODE
LOW	specs/work-queue/verify_native_test.py	167	CODE
LOW	specs/work-queue/verify_native_test.py	220	CODE
LOW	specs/work-queue/verify_native_test.py	290	CODE
LOW	specs/work-queue/verify_native_test.py	359	CODE
LOW	specs/work-queue/verify_models_test.py	199	CODE
LOW	specs/work-queue/verify_native_fixtures.py	384	CODE
LOW	specs/workflow-security/check_transport.py	84	CODE
LOW	specs/workflow-security/check.py	301	CODE
LOW	specs/workflow-security/check_test.py	134	CODE
LOW	specs/workflow-security/check_test.py	232	CODE
LOW	scripts/test_harbor_conformance.py	75	CODE
LOW	scripts/test_harbor_conformance.py	210	CODE
LOW	scripts/model-routing-golden.py	91	CODE
LOW	scripts/model-routing-golden.py	137	CODE
LOW	scripts/model-routing-golden.py	224	CODE
LOW	scripts/model-routing-golden.py	278	CODE
LOW	scripts/model-routing-golden.py	452	CODE
LOW	scripts/aider_go_test_coverage.py	98	CODE
LOW	scripts/test_model_routing_golden.py	105	CODE
LOW	…skills/statistics-infographic/scripts/audit_sources.py	88	CODE
LOW	…s/statistics-infographic/scripts/render_infographic.py	63	CODE
LOW	…ills/statistics-infographic/scripts/statistics_data.py	203	CODE
LOW	…ills/statistics-infographic/scripts/statistics_data.py	274	CODE
LOW	.github/skills/agentic-workflows/tests/test_guidance.py	66	CODE
LOW	.github/skills/agentic-workflows/tests/test_guidance.py	782	CODE

Excessive Try-Catch Wrapping15 hits · 17 pts

Severity	File	Line	Snippet	Context
LOW	scripts/model-routing-golden.py	444	except Exception:	CODE
LOW	scripts/check-safe-outputs-conformance.sh	1446	except Exception as e:	CODE
LOW	.github/drivers/copilot_sdk_driver_sample_python.py	119	except Exception as error:	CODE
LOW	…b17c17dd14c3/src_pydantic_ai_harness_gh-aw_pydantic.md	445	except Exception as exc:	CODE
LOW	…b17c17dd14c3/src_pydantic_ai_harness_gh-aw_pydantic.md	459	except Exception as exc:	CODE
LOW	.github/workflows/daily-function-namer.md	97	except Exception:	CODE
LOW	.github/workflows/smoke-pydantic.lock.yml	1542	except Exception as exc:	CODE
LOW	.github/workflows/smoke-pydantic.lock.yml	1556	except Exception as exc:	CODE
MEDIUM	.github/workflows/static-analysis-report.md	183	print(f"Error: Incomplete Grype image scans: missing={dict(planned - completed)}, unexpected={dict(completed -	CODE
MEDIUM	.github/workflows/static-analysis-report.md	186	print("Error: No Grype per-image completion evidence found")	CODE
LOW	.github/workflows/dataflow-pr-discussion-dataset.md	427	except Exception as e:	CODE
LOW	.github/workflows/dataflow-pr-discussion-dataset.md	451	except Exception as e:	CODE
LOW	.github/workflows/daily-security-observability.md	354	except Exception:	CODE
LOW	…thub/workflows/engine-conformance-pydantic-ai.lock.yml	1587	except Exception as exc:	CODE
LOW	…thub/workflows/engine-conformance-pydantic-ai.lock.yml	1601	except Exception as exc:	CODE

Magic Placeholder Names2 hits · 10 pts

Severity	File	Line	Snippet	Context
HIGH	scratchpad/adding-new-engines.md	586	gh aw secrets set MY_ENGINE_API_KEY --value "<your-api-key>"	CODE
HIGH	docs/src/content/docs/reference/web-search.md	43	gh aw secrets set TAVILY_API_KEY --value "<your-api-key>"	CODE

Unused Imports6 hits · 6 pts

Severity	File	Line	Context
LOW	…skills/statistics-infographic/tests/test_statistics.py	3	CODE
LOW	…/statistics-infographic/scripts/compute_pr_activity.py	3	CODE
LOW	…skills/statistics-infographic/scripts/audit_sources.py	3	CODE
LOW	…s/statistics-infographic/scripts/render_infographic.py	3	CODE
LOW	…ills/statistics-infographic/scripts/statistics_data.py	3	CODE
LOW	…s/statistics-infographic/scripts/compute_pr_changes.py	3	CODE

AI Response Leakage1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	docs/src/content/docs/reference/model-routing.md	230	In Copilot CLI mode, a sub-agent from a different family than the selected main model fails ([copilot-cli#5103](https://	CODE

Slop Phrases1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	.serena/project.yml	10	# Same syntax as gitignore, so you can use * and **.	COMMENT

AI Structural Patterns2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	specs/workflow-security/check.py	301		CODE
LOW	scripts/model-routing-golden.py	159		CODE

TODO Padding2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	pkg/workflow/aider_discovery_test.go	38	"source.go": "// TODO: implement this\n\t// FIXME handle error\nfunc printConfigTODO() {}\n// printConfigTODO	CODE
LOW	pkg/workflow/aider_discovery_test.go	51	assert.Equal(t, "./source.go:1:// TODO: implement this\n./source.go:2:\t// FIXME handle error\n", string(output))	CODE

github/gh-aw

Open-Source Code Quality, Security and Technical Debt Review