Repository Analysis

helm/helm

The Kubernetes Package Manager

1.6 Likely human-written View on GitHub
1.6
Adjusted Score
1.6
Raw Score
100%
Time Factor
2026-05-30
Last Push
29,830
Stars
Go
Language
127,244
Lines of Code
1639
Files
167
Pattern Hits
2026-05-31
Scan Date

Score History

Severity Breakdown

CRITICAL 0HIGH 0MEDIUM 16LOW 151

Pattern Findings

167 matches across 7 categories. Click a row to expand file-level details.

Over-Commented Block147 hits · 147 pts
SeverityFileLineSnippet
LOWinternal/chart/v3/metadata.go61 // A list of name and URL/email address combinations for the maintainer(s)
LOWinternal/chart/v3/dependency.go21//
LOW…ternal/chart/v3/lint/rules/testdata/v3-fail/Chart.yaml1apiVersion: v3
LOW…ernal/chart/v3/lint/rules/testdata/v3-fail/values.yaml41 # kubernetes.io/tls-acme: "true"
LOW…t/v3/lint/rules/testdata/malformed-template/Chart.yaml1apiVersion: v3
LOW…t/v3/lint/rules/testdata/malformed-template/Chart.yaml21# incremented each time you make changes to the application. Versions are not expected to
LOW…/v3/lint/rules/testdata/multi-template-fail/Chart.yaml1apiVersion: v3
LOWinternal/chart/v3/util/create.go81const defaultChartfile = `apiVersion: v3
LOWinternal/chart/v3/util/create.go141# For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
LOWinternal/chart/v3/util/create.go201 - path:
LOWinternal/chart/v3/util/create.go221 # For publicly distributed charts, we recommend leaving 'resources' commented out.
LOWinternal/chart/v3/util/create.go681 // needs to be replaced on that file.
LOWinternal/chart/v3/util/validate_name.go21 "fmt"
LOWinternal/chart/v3/util/validate_name.go61 // maxMetadataNameLen is the maximum length Kubernetes allows for any name.
LOWinternal/chart/v3/util/validate_name.go81 return errMissingName
LOW…quirements-yaml/charts/alpine/charts/mast1/values.yaml1# Default values for mast1.
LOW…quirements-yaml/charts/alpine/charts/mast1/values.yaml1# Default values for mast1.
LOW…hart-helmignore/charts/alpine/charts/mast1/values.yaml1# Default values for mast1.
LOW…ent-chart-alias/charts/alpine/charts/mast1/values.yaml1# Default values for mast1.
LOW…stdata/frobnitz/charts/alpine/charts/mast1/values.yaml1# Default values for mast1.
LOW…quirements-yaml/charts/alpine/charts/mast1/values.yaml1# Default values for mast1.
LOW…bnitz_backslash/charts/alpine/charts/mast1/values.yaml1# Default values for mast1.
LOW…robnitz.v3.reqs/charts/alpine/charts/mast1/values.yaml1# Default values for mast1.
LOW…z_with_dev_null/charts/alpine/charts/mast1/values.yaml1# Default values for mast1.
LOW…tz_with_symlink/charts/alpine/charts/mast1/values.yaml1# Default values for mast1.
LOW…stdata/frobnitz/charts/alpine/charts/mast1/values.yaml1# Default values for mast1.
LOW…obnitz_with_bom/charts/alpine/charts/mast1/values.yaml1# Default values for mast1.
LOWinternal/plugin/installer/extractor.go81// to be malicious. (If you don't care about this, use the securejoin-filepath library.)
LOWinternal/release/v2/util/manifest.go41// **Note for Chart API v3**: This function (due to the regex above) has allowed _WRONG_
LOWinternal/release/v2/util/manifest_sorter.go121// annotations:
LOWinternal/third_party/dep/fs/fs_test.go441 fn := filepath.Join(dstdir, "file")
LOWinternal/third_party/dep/fs/fs.go261 // the kernel is arbitrarily okay with < 248 bytes. That
LOWscripts/release-notes.sh1#!/usr/bin/env bash
LOWscripts/validate-license.sh1#!/usr/bin/env bash
LOWscripts/util.sh1#!/usr/bin/env bash
LOWscripts/coverage.sh1#!/usr/bin/env bash
LOW.github/workflows/codeql-analysis.yml1# For most projects, this workflow file will not need changing; you simply need
LOW.github/workflows/scorecards.yml41 # - you want to enable the Branch-Protection check on a *public* repository, or
LOWpkg/cmd/testdata/testcharts/lib-chart/values.yaml1# Default values for commons.
LOW…charts/chart-with-template-lib-archive-dep/values.yaml21 annotations: {}
LOW…t-with-template-lib-archive-dep/templates/service.yaml1{{- template "common.service" (list . "chart-with-template-lib-archive-dep.service") -}}
LOW…cmd/testdata/testcharts/chart-missing-deps/values.yaml1# Default values for reqtest.
LOW…arts/chart-missing-deps/charts/reqsubchart/values.yaml1# Default values for reqsubchart.
LOW…ata/testcharts/chart-with-template-lib-dep/values.yaml21 annotations: {}
LOW…/chart-with-template-lib-dep/charts/common/values.yaml1# Default values for commons.
LOW…rts/chart-with-template-lib-dep/templates/service.yaml1{{- template "common.service" (list . "chart-with-template-lib-dep.service") -}}
LOW…md/testdata/testcharts/chart-with-only-crds/Chart.yaml1apiVersion: v2
LOWpkg/cmd/testdata/testcharts/reqtest/values.yaml1# Default values for reqtest.
LOW…data/testcharts/reqtest/charts/reqsubchart/values.yaml1# Default values for reqsubchart.
LOW…ata/testcharts/reqtest/charts/reqsubchart2/values.yaml1# Default values for reqsubchart.
LOW…testdata/testcharts/chart-bad-requirements/values.yaml1# Default values for reqtest.
LOW…/chart-bad-requirements/charts/reqsubchart/values.yaml1# Default values for reqsubchart.
LOW…cmd/testdata/testcharts/chart-with-lib-dep/values.yaml21 annotations: {}
LOW…a/testcharts/chart-with-lib-dep/templates/service.yaml1{{- template "common.service" (list . "mychart.service") -}}
LOWpkg/helmpath/home.go1// Copyright The Helm Authors.
LOWpkg/helmpath/lazypath_unix_test.go1// Copyright The Helm Authors.
LOWpkg/helmpath/home_unix_test.go1// Copyright The Helm Authors.
LOWpkg/helmpath/lazypath_darwin.go1// Copyright The Helm Authors.
LOWpkg/helmpath/lazypath_darwin_test.go1// Copyright The Helm Authors.
LOWpkg/helmpath/home_windows_test.go1// Copyright The Helm Authors.
87 more matches not shown…
Self-Referential Comments11 hits · 33 pts
SeverityFileLineSnippet
MEDIUMscripts/util.sh49# Create a temp dir that'll be deleted at the end of this bash session.
MEDIUM…h-schema-negative-skip-validation/templates/empty.yaml1# This file is intentionally blank
MEDIUMpkg/cmd/testdata/testcharts/empty/templates/empty.yaml1# This file is intentionally blank
MEDIUM…chart/charts/subchart-with-schema/templates/empty.yaml1# This file is intentionally blank
MEDIUM…ts/chart-with-schema-and-subchart/templates/empty.yaml1# This file is intentionally blank
MEDIUM…data/testcharts/chart-with-schema/templates/empty.yaml1# This file is intentionally blank
MEDIUM…charts/chart-with-schema-negative/templates/empty.yaml1# This file is intentionally blank
MEDIUMpkg/cmd/testdata/testcharts/subchart/extra_values.yaml1# This file is used to test values passed by file at the command line
MEDIUM…testdata/charts/chart-with-schema/templates/empty.yaml1# This file is intentionally blank
MEDIUM…harts/chart-with-uncompressed-dependencies/values.yaml99 ## Create a database and a database user
MEDIUM…charts/chart-with-schema-negative/templates/empty.yaml1# This file is intentionally blank
Decorative Section Separators4 hits · 12 pts
SeverityFileLineSnippet
MEDIUMpkg/action/action_test.go691 # ---------------------------------------------------------------------------
MEDIUMpkg/action/action_test.go694 # ---------------------------------------------------------------------------
MEDIUMpkg/action/action_test.go705 # ---------------------------------------------------------------------------
MEDIUMpkg/action/action_test.go708 # ---------------------------------------------------------------------------
AI Slop Vocabulary1 hit · 3 pts
SeverityFileLineSnippet
MEDIUMinternal/plugin/installer/oci_installer.go55 // Extract plugin name from OCI reference using robust registry parsing
Fake / Example Data2 hits · 2 pts
SeverityFileLineSnippet
LOWinternal/chart/v3/lint/rules/chartfile_test.go120 {"", "test@test.com", "each maintainer requires a name"},
LOWpkg/chart/v2/lint/rules/chartfile_test.go147 {"", "test@test.com", "each maintainer requires a name"},
Redundant / Tautological Comments1 hit · 2 pts
SeverityFileLineSnippet
LOW…harts/chart-with-uncompressed-dependencies/values.yaml180 ## Set this to true in order to enable TLS on the ingress record
Slop Phrases1 hit · 1 pts
SeverityFileLineSnippet
LOWpkg/downloader/manager.go641"example". Don't forget to add the repo, too ('helm repo add').`