2.2

Adjusted Signal

2.2

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

9.1K

Stars

Rust

Language

556.6K

Lines of Code

2.2K

Files

899

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 8.7/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 858 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.4/100 · LOW

Are imports declared and package/API names verified? 18 finding(s).

Agent Over-Engineering Ratio 0.8/100 · LOW

Are wrappers, guards, and repeated structures necessary? 29 finding(s).

PR Review Velocity Impact 10.2/100 · LOW

Which changes need focused human review? 899 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 15HIGH 9MEDIUM 58LOW 817

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 899 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block738 hits · 720 pts

Severity	File	Line	Snippet	Context
LOW	…kaging/kata-deploy/local-build/kata-deploy-binaries.sh	761	latest_artefact+="-$(get_latest_nvidia_repo_version)"	COMMENT
LOW	…kaging/kata-deploy/local-build/kata-deploy-binaries.sh	1181	# gpudirect -> enable use-cases like GPUDirect RDMA, GPUDirect GDS	COMMENT
LOW	…ackaging/kata-deploy/helm-chart/kata-deploy/Chart.yaml	1	apiVersion: v2	COMMENT
LOW	…helm-chart/kata-deploy/try-kata-nvidia-gpu.values.yaml	1	# Example values file to enable NVIDIA GPU shims	COMMENT
LOW	…helm-chart/kata-deploy/try-kata-nvidia-gpu.values.yaml	21	# Nodes upgrading from an earlier profile must recreate cached EROFS layers	COMMENT
LOW	…helm-chart/kata-deploy/try-kata-nvidia-gpu.values.yaml	41	# host feature we do not control, we disable fs-verity so it works on the widest	COMMENT
LOW	…loy/helm-chart/kata-deploy/try-kata-remote.values.yaml	1	# Example values file to enable the remote hypervisor shim (peer pods)	COMMENT
LOW	…helm-chart/kata-deploy/try-kata-nvidia-cpu.values.yaml	1	# Example values file to enable NVIDIA CPU shims	COMMENT
LOW	…helm-chart/kata-deploy/try-kata-nvidia-cpu.values.yaml	21	# (image) layer integrity.	COMMENT
LOW	…helm-chart/kata-deploy/try-kata-nvidia-cpu.values.yaml	41	# possible range of setups; we take that hit deliberately to keep the profile	COMMENT
LOW	…-deploy/helm-chart/kata-deploy/try-kata-fc.values.yaml	1	# Example values file to enable the Firecracker shim (fc)	COMMENT
LOW	…deploy/helm-chart/kata-deploy/try-kata-tee.values.yaml	1	# Example values file to enable Trusted Execution Environment (TEE) shims	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	1	# Deployment model for installing/cleaning up Kata on nodes.	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	21	# When you add nodes later, re-run `helm upgrade` so the dispatcher enumerates	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	41	#	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	61	tag: "0.3.0"	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	81	# schedulable on clusters whose every node is tainted (a single-node cluster, for	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	101	# nodes: ["worker-1", "worker-2"]	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	121	# (`--timeout`, 5m by default) TOGETHER with extracting the artifacts and	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	141	# Scheduled reconcile: covers the nodes that join after the release was applied.	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	161	schedule: "/15 * * *"	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	181	# there - the safe direction. Narrow it to this install's own mark	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	201	# collection (seconds). Applies to both install and cleanup per-node Jobs.	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	281	# holds containerd's configuration, which is mounted into the install, and where	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	301	#	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	321	# Optional user-provided containerd drop-in TOML content.	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	341	# (nodeSelector/affinity to select, tolerations to decide which tainted nodes are	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	361	# Install on control-plane nodes ONLY (select them, and tolerate their taint -	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	381	# requests a Kata RuntimeClass can be scheduled before the runtime binaries exist	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	401	# - "katacontainers.io/kata-runtime:NoSchedule"	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	421	#	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	441	# podAntiAffinity, and preferredDuringSchedulingIgnoredDuringExecution pass through.	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	461	affinity: {}	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	481	# Default is RollingUpdate with maxUnavailable: 1	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	501	# a ~220-vCPU node tops out under 10 MiB, and the patched post-re-exec	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	521	# pods that need guest debugging.	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	541	# /healthz returns 200 as soon as the server starts (process is alive).	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	581	# shims that do need one - guest pull through nydus, shared_fs=none through	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	601	# - "disk" → default_size = "10G" (disk-backed rw layer)	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	621	# nodeBinaries:	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	641	# Requires deploymentMode: job, the install being staged so the binaries are in	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	661	# devmapper), a confidential-computing capable CPU, an NVIDIA GPU, a peer-pod	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	681	# helm pull oci://ghcr.io/kata-containers/kata-deploy-charts/kata-deploy \	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	701	# shims:	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	721	# example.io/feature: "true"	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	841		COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	861	#	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	881	# The rule and the key requests are gated together on purpose: an extended-resource	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	901		COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	921	# --set-file verification.pod=/path/to/your-verification-pod.yaml	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	941	# enabled: true	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	961	# scheduling:	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	981	#	COMMENT
LOW	tools/packaging/kata-deploy/binary/src/rootless.rs	401	#[rstest]	COMMENT
LOW	tools/packaging/kata-deploy/binary/src/rootless.rs	501	#[case] mode: u32,	COMMENT
LOW	tools/packaging/kata-deploy/binary/src/config.rs	221	/// Independent of rw-layer backing; works with both disk and memory modes.	COMMENT
LOW	tools/packaging/kata-deploy/binary/src/config.rs	241	pub containerd_shim_extra_pod_annotations_for_arch: Vec<String>,	COMMENT
LOW	tools/packaging/kata-deploy/binary/src/main.rs	21		COMMENT
LOW	tools/packaging/kata-deploy/binary/src/main.rs	81	#[clap(name = "install-stage-load-kernel-modules")]	COMMENT
LOW	tools/packaging/kata-deploy/binary/src/main.rs	141	/// Every install marks its own nodes with a label named after its	COMMENT
678 more matches not shown…

Hallucination Indicators15 hits · 150 pts

Severity	File	Line	Snippet	Context
CRITICAL	tests/cleanup_resources.py	6	from azure.core.exceptions import ResourceNotFoundError	CODE
CRITICAL	src/tools/genpolicy/src/policy.rs	793	.set_container_path(self.config.settings.devices.vfio.device_path.clone());	CODE
CRITICAL	src/tools/genpolicy/src/policy.rs	808	self.config.settings.devices.vfio.anno_key_regex.clone(),	CODE
CRITICAL	src/tools/genpolicy/src/policy.rs	848	Version: self.config.settings.kata_config.oci_version.clone(),	CODE
CRITICAL	src/tools/genpolicy/src/job.rs	172	self.spec.template.spec.securityContext.as_ref()	CODE
CRITICAL	src/tools/genpolicy/src/deployment.rs	183	self.spec.template.spec.securityContext.as_ref()	CODE
CRITICAL	src/tools/genpolicy/src/stateful_set.rs	216	self.spec.template.spec.securityContext.as_ref()	CODE
CRITICAL	src/tools/genpolicy/src/replication_controller.rs	136	self.spec.template.spec.securityContext.as_ref()	CODE
CRITICAL	src/tools/genpolicy/src/replica_set.rs	133	self.spec.template.spec.securityContext.as_ref()	CODE
CRITICAL	src/tools/genpolicy/src/daemon_set.rs	172	self.spec.template.spec.securityContext.as_ref()	CODE
CRITICAL	…rates/resource/src/network/endpoint/ipvlan_endpoint.rs	75	self.net_pair.tap.tap_iface.hard_addr.clone()	CODE
CRITICAL	…ates/resource/src/network/endpoint/macvlan_endpoint.rs	74	self.net_pair.tap.tap_iface.hard_addr.clone()	CODE
CRITICAL	…/crates/resource/src/network/endpoint/veth_endpoint.rs	74	self.net_pair.tap.tap_iface.hard_addr.clone()	CODE
CRITICAL	…/crates/resource/src/network/endpoint/vlan_endpoint.rs	74	self.net_pair.tap.tap_iface.hard_addr.clone()	CODE
CRITICAL	…/runtime-rs/crates/hypervisor/ch-config/src/convert.rs	1666	if !d.cfg.cfg.boot_info.image.is_empty() {	CODE

Self-Referential Comments29 hits · 92 pts

Severity	File	Line	Snippet	Context
MEDIUM	…kaging/kata-deploy/local-build/kata-deploy-binaries.sh	1884	# Create a sym-link with the extension removed	COMMENT
MEDIUM	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	938	# Create a custom-runtimes.values.yaml file:	COMMENT
MEDIUM	tools/osbuilder/scripts/lib.sh	198	# Create a YAML metadata file inside the rootfs.	COMMENT
MEDIUM	tools/osbuilder/rootfs-builder/rootfs.sh	728	# This file is part of systemd.	COMMENT
MEDIUM	tools/osbuilder/rootfs-builder/rootfs.sh	918	# Create an empty /etc/resolv.conf, to allow agent to bind mount container resolv.conf to Kata VM	COMMENT
MEDIUM	tools/testing/kata-webhook/create-certs.sh	37	# Create a Certificate Signing Request configuration file.	COMMENT
MEDIUM	ci/openshift-ci/run_smoke_test.sh	16	# Create a pod.	COMMENT
MEDIUM	ci/openshift-ci/smoke/service.yaml	5	# Create the service on port 80 for the http-server app.	COMMENT
MEDIUM	ci/openshift-ci/smoke/service.yaml	18	# Create the route to the app's service '/'.	COMMENT
MEDIUM	ci/openshift-ci/smoke/service_kubernetes.yaml	5	# Create the service on port 80 for the http-server app.	COMMENT
MEDIUM	tests/gha-run-k8s-common.sh	248	# Create the cluster.	COMMENT
MEDIUM	tests/gha-run-k8s-common.sh	871	# Create a new namespace for the tests and switch to it	COMMENT
MEDIUM	tests/common.bash	7	# This file contains common functions that	COMMENT
MEDIUM	tests/common.bash	48	# This function is called to indicate a fatal error occurred, so	COMMENT
MEDIUM	tests/common.bash	1626	# This function provides consistent test execution and reporting across	COMMENT
MEDIUM	tests/cmd/github-labels/github-labels.sh	109	# Create the master database from the template	COMMENT
MEDIUM	tests/integration/nerdctl/gha-run.sh	54	# Create the default containerd configuration	COMMENT
MEDIUM⚡	tests/integration/kubernetes/confidential_common.sh	223	# Create the sealed secret test secret:	COMMENT
MEDIUM⚡	tests/integration/kubernetes/confidential_common.sh	229	# Create the NIM test instruct secret:	COMMENT
MEDIUM⚡	tests/integration/kubernetes/confidential_common.sh	235	# Create the NIM test embedqa secret:	COMMENT
MEDIUM	tests/integration/kubernetes/lib.sh	34	# Create a pod with a given number of retries if an output includes a timeout.	COMMENT
MEDIUM	tests/integration/kubernetes/lib.sh	73	# Create a pod and wait it be ready, otherwise fail.	COMMENT
MEDIUM	tests/integration/kubernetes/lib.sh	252	# Create a pod then assert it fails to run. Use in tests that you expect the	COMMENT
MEDIUM	tests/integration/kubernetes/lib.sh	301	# Create a pod then assert it remains in ContainerCreating.	COMMENT
MEDIUM	tests/integration/kubernetes/lib.sh	377	# Create a pod configuration out of a template file.	COMMENT
MEDIUM	tests/functional/vfio-ap/run.sh	168	# Create a mediated device (mdev) for the released device	COMMENT
MEDIUM	tests/functional/vfio-ap/run.sh	223	# Create a container and run the test	COMMENT
MEDIUM	utils/kata-manager.sh	196	# Create an array to store architecture names	COMMENT
MEDIUM	utils/kata-manager.sh	215	# Create a regular expression for matching	COMMENT

Decorative Section Separators23 hits · 80 pts

Severity	File	Line	Snippet	Context
MEDIUM	…/packaging/kata-deploy/binary/src/artifacts/install.rs	1253	const KATA_DEPLOY_CONFIG_WARNING: &str = r#"# ==========================================================================	CODE
MEDIUM	…/packaging/kata-deploy/binary/src/artifacts/install.rs	1264	# =============================================================================	COMMENT
MEDIUM	tools/packaging/scripts/configure-hypervisor.sh	7	#---------------------------------------------------------------------	COMMENT
MEDIUM	tools/packaging/scripts/configure-hypervisor.sh	15	#---------------------------------------------------------------------	COMMENT
MEDIUM	tools/packaging/scripts/configure-hypervisor.sh	210	#---------------------------------------------------------------------	COMMENT
MEDIUM	tools/packaging/scripts/configure-hypervisor.sh	218	#---------------------------------------------------------------------	COMMENT
MEDIUM	tools/packaging/scripts/configure-hypervisor.sh	419	#---------------------------------------------------------------------	COMMENT
MEDIUM	tools/packaging/scripts/configure-hypervisor.sh	496	#---------------------------------------------------------------------	COMMENT
MEDIUM	ci/gh-util.sh	17	#---------------------------------------------------------------------	COMMENT
MEDIUM	ci/check_agent_policy_coverage.sh	25	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	ci/check_agent_policy_coverage.sh	27	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	ci/check_agent_policy_coverage.sh	52	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	ci/check_agent_policy_coverage.sh	56	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	ci/check_agent_policy_coverage.sh	66	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	ci/check_agent_policy_coverage.sh	68	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	ci/check_agent_policy_coverage.sh	94	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	ci/check_agent_policy_coverage.sh	96	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/kata-doc-to-script.sh	125	#----------------------------------------------	COMMENT
MEDIUM⚡	tests/kata-doc-to-script.sh	129	#----------------------------------------------	COMMENT
MEDIUM⚡	tests/kata-doc-to-script.sh	131	#----------------------------------------------	COMMENT
MEDIUM⚡	tests/kata-doc-to-script.sh	133	#----------------------------------------------	COMMENT
MEDIUM	src/tools/log-parser/display.go	20	#----------------------------------------	COMMENT
MEDIUM	src/tools/log-parser/display.go	26	#----------------------------------------	COMMENT

Synthetic Comment Markers8 hits · 60 pts

Severity	File	Line	Snippet	Context
HIGH	CONTRIBUTING.md	50	## AI generated code	COMMENT
HIGH	…untime-rs/crates/hypervisor/src/ch/inner_hypervisor.rs	910	// Early Check to verify if boot memory is the same as requested	COMMENT
HIGH	src/runtime/virtcontainers/clh.go	1371	// Early Check to verify if boot memory is the same as requested	COMMENT
HIGH	…gent/rustjail/src/cgroups/systemd/interface/session.rs	11	//! This code was generated by `zbus-xmlgen` `2.0.1` from DBus introspection data.	COMMENT
HIGH	…agent/rustjail/src/cgroups/systemd/interface/system.rs	11	//! This code was generated by `zbus-xmlgen` `3.1.1` from DBus introspection data.	COMMENT
HIGH	src/dragonball/crates/dbs_virtio_devices/src/mem.rs	1271	// Make sure we have the correct resource as requested.	COMMENT
HIGH	…l/crates/dbs_virtio_devices/src/vhost/vhost_user/fs.rs	446	// Make sure we have the correct resource as requested, and currently we only support one	COMMENT
HIGH	…/dragonball/crates/dbs_virtio_devices/src/fs/device.rs	916	// Make sure we have the correct resource as requested, and currently we only support one	COMMENT

Redundant / Tautological Comments25 hits · 38 pts

Severity	File	Line	Snippet	Context
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	116	# Set it to 0 on clusters that may legitimately have no eligible node, which	COMMENT
LOW	…helm-chart/kata-deploy/templates/verification-job.yaml	306	# Check if pod is stuck - look for events indicating it can't start	COMMENT
LOW	tools/packaging/scripts/download-with-oras-cache.sh	104	# Check if artifact exists in GHCR and pull it	COMMENT
LOW	tools/packaging/scripts/download-with-oras-cache.sh	151	# Check if this version already exists in cache (avoid race conditions with parallel builds)	COMMENT
LOW	tools/packaging/scripts/configure-hypervisor.sh	66	# Display message to stderr and exit indicating script failed.	COMMENT
LOW	tools/packaging/static-build/kernel/install_yq.sh	49	# Check if we need sudo to install yq	COMMENT
LOW	tools/packaging/static-build/kernel/install_yq.sh	51	# Check if we have sudo privileges	COMMENT
LOW	tools/packaging/guest-image/build_se_image.sh	56	# Check if FAKE_SE_IMAGE mode is enabled	COMMENT
LOW	tools/osbuilder/image-builder/image_builder.sh	213	# Check if we have alternative init systems installed	COMMENT
LOW	tools/osbuilder/rootfs-builder/debian/config.sh	9	# Set OS_NAME to the desired debian "codename"	COMMENT
LOW	ci/install_yq.sh	49	# Check if we need sudo to install yq	COMMENT
LOW	ci/install_yq.sh	51	# Check if we have sudo privileges	COMMENT
LOW	ci/openshift-ci/cluster/install_kata.sh	190	# Set SELinux to permissive mode	COMMENT
LOW	tests/gha-run-k8s-common.sh	1285	# Check if this mapping has a colon (shim-specific)	COMMENT
LOW	tests/static-checks.sh	943	# Check if the expected linter version	COMMENT
LOW	tests/govulncheck-runner.sh	93	# Check if any real vulnerabilities remain	COMMENT
LOW	tests/govulncheck-runner.sh	102	# Check if binary exists	COMMENT
LOW	tests/common.bash	144	# Check if first two arguments are numbers (for max_tries and interval)	COMMENT
LOW	tests/common.bash	222	# Check if the $1 argument is the name of a 'known'	COMMENT
LOW	tests/common.bash	1122	# Check if helm is available in the system's PATH	COMMENT
LOW	tests/common.bash	1603	# Check if the 1st argument version is greater than and equal to 2nd one	COMMENT
LOW	tests/integration/kubernetes/lib.sh	114	# Check if there is an existing node debugger pod and reuse it	COMMENT
LOW	tests/integration/kubernetes/run_kubernetes_nv_tests.sh	42	# Check if drop-in already exists	COMMENT
LOW	…n/kubernetes/runtimeclass_workloads/numa/entrypoint.sh	20	# Print results to stdout (readable via "kubectl logs"), then sleep to	COMMENT
LOW	tests/stability/common_stability.bash	12	# Set variables to reasonable defaults if unset or empty	COMMENT

Structural Annotation Overuse20 hits · 34 pts

Severity	File	Line	Snippet	Context
LOW	tests/integration/kubernetes/numa-pinning-check.sh	7	# WARNING: This script runs directly on the host, NOT inside a container.	COMMENT
LOW	docs/how-to/how-to-use-erofs-snapshotter-with-kata.md	71	### Step 1: Install erofs-utils	COMMENT
LOW	docs/how-to/how-to-use-erofs-snapshotter-with-kata.md	109	### Step 2: Configure containerd	COMMENT
LOW	docs/how-to/how-to-use-erofs-snapshotter-with-kata.md	221	### Step 3: Configure Kata Containers (runtime-rs)	COMMENT
LOW	docs/how-to/how-to-use-numa-with-kata.md	26	## Step 1: Inspect the Host NUMA Topology	COMMENT
LOW	docs/how-to/how-to-use-numa-with-kata.md	66	## Step 2: Kubernetes CPU Manager Policy	COMMENT
LOW	docs/how-to/how-to-use-numa-with-kata.md	103	## Step 3: Configure Kata Containers for NUMA	COMMENT
LOW	docs/how-to/how-to-use-numa-with-kata.md	205	## Step 4: Deploy a NUMA-Aware Pod	COMMENT
LOW	docs/how-to/how-to-use-numa-with-kata.md	269	## Step 5: Verify NUMA Inside the Guest	COMMENT
LOW	docs/how-to/how-to-use-numa-with-kata.md	344	## Step 6: Verify NUMA on the Host	COMMENT
LOW	docs/how-to/how-to-use-numa-with-kata.md	412	## Step 7: Verify GPU NUMA Placement (GPU Passthrough Only)	COMMENT
LOW	src/tools/agent-ctl/src/image.rs	43	// Step 1: Use skopeo to copy the image to a local OCI directory with explicit tag	COMMENT
LOW	src/tools/agent-ctl/src/image.rs	63	// Step 2: Use umoci to unpack the OCI image into a bundle	COMMENT
LOW⚡	…rs/crates/resource/src/cdi_devices/container_device.rs	47	// Step 1: Extract all devices and filter out devices without device_info for vfio_devices	COMMENT
LOW⚡	…rs/crates/resource/src/cdi_devices/container_device.rs	57	// Step 2: Group devices by vendor_id-class_id	COMMENT
LOW	…rs/crates/resource/src/cdi_devices/container_device.rs	73	// Step 3: Sort devices within each group by guest_pcipath	COMMENT
LOW⚡	src/libs/kata-types/src/dmverity.rs	247	// Step 0: Remove stale device if it already exists	COMMENT
LOW⚡	src/libs/kata-types/src/dmverity.rs	253	// Step 1: Create device as read-only	COMMENT
LOW⚡	src/libs/kata-types/src/dmverity.rs	302	// Step 2: Load table and resume (activate)	COMMENT
LOW⚡	src/libs/kata-types/src/dmverity.rs	306	// Step 3: Ensure the device node exists under /dev/mapper/.	COMMENT

Verbosity Indicators10 hits · 20 pts

Severity	File	Line	Snippet	Context
LOW	…kaging/kata-deploy/local-build/kata-deploy-binaries.sh	2243	# The variants could be built independently we need to check if	COMMENT
LOW	src/tools/agent-ctl/src/image.rs	43	// Step 1: Use skopeo to copy the image to a local OCI directory with explicit tag	COMMENT
LOW	src/tools/agent-ctl/src/image.rs	63	// Step 2: Use umoci to unpack the OCI image into a bundle	COMMENT
LOW⚡	…rs/crates/resource/src/cdi_devices/container_device.rs	47	// Step 1: Extract all devices and filter out devices without device_info for vfio_devices	COMMENT
LOW⚡	…rs/crates/resource/src/cdi_devices/container_device.rs	57	// Step 2: Group devices by vendor_id-class_id	COMMENT
LOW	…rs/crates/resource/src/cdi_devices/container_device.rs	73	// Step 3: Sort devices within each group by guest_pcipath	COMMENT
LOW⚡	src/libs/kata-types/src/dmverity.rs	247	// Step 0: Remove stale device if it already exists	COMMENT
LOW⚡	src/libs/kata-types/src/dmverity.rs	253	// Step 1: Create device as read-only	COMMENT
LOW⚡	src/libs/kata-types/src/dmverity.rs	302	// Step 2: Load table and resume (activate)	COMMENT
LOW⚡	src/libs/kata-types/src/dmverity.rs	306	// Step 3: Ensure the device node exists under /dev/mapper/.	COMMENT

Example Usage Blocks10 hits · 15 pts

Severity	File	Line	Snippet	Context
LOW	…helm-chart/kata-deploy/try-kata-nvidia-gpu.values.yaml	4	# Usage:	COMMENT
LOW	…loy/helm-chart/kata-deploy/try-kata-remote.values.yaml	14	# Usage:	COMMENT
LOW	…helm-chart/kata-deploy/try-kata-nvidia-cpu.values.yaml	5	# Usage:	COMMENT
LOW	…-deploy/helm-chart/kata-deploy/try-kata-fc.values.yaml	12	# Usage:	COMMENT
LOW	…deploy/helm-chart/kata-deploy/try-kata-tee.values.yaml	4	# Usage:	COMMENT
LOW	…ckaging/kata-deploy/helm-chart/kata-deploy/values.yaml	919	# Usage:	COMMENT
LOW	tools/packaging/scripts/populate-oras-tarball-cache.sh	15	# Usage:	COMMENT
LOW	tests/common.bash	136	# Usage:	COMMENT
LOW	tests/common.bash	1636	# Example usage:	COMMENT
LOW	tests/common.bash	1687	# Example usage:	COMMENT

AI Slop Vocabulary7 hits · 15 pts

Severity	File	Line	Snippet	Context
LOW	tools/packaging/scripts/gen_versions_txt.sh	160	# (ie, 1.8.0-alpha0 may live on stable-1.8 as well as master: we'd just use master in this case)	COMMENT
LOW	tests/gha-run-k8s-common.sh	347	# Due to this issue, let's simply use a different port (:9999) and	COMMENT
LOW	tests/integration/kubernetes/lib.sh	14	# Delete all pods if any exist, otherwise just return	COMMENT
LOW	tests/stability/soak_parallel_rm.sh	39	# then just set this to a very large number	COMMENT
MEDIUM	…ime-rs/crates/resource/src/coco_data/initdata_block.rs	235	// Essentially, it unwraps the layered writers (compression, buffering) to get back the original temporary file (tem	COMMENT
MEDIUM	src/runtime/virtcontainers/container_test.go	340	// Create container to utilize this mount/secret	COMMENT
MEDIUM	src/runtime/virtcontainers/kata_agent.go	2086	// given container and will update the OCI spec to utilize this mount point as the new source for the	COMMENT

AI Response Leakage1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	…/crates/dbs_virtio_devices/src/vsock/csm/connection.rs	60	// is undefined. In this implementation, we forcefully terminate the	COMMENT

Modern AI Meta-Vocabulary2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	…kaging/kata-deploy/local-build/kata-deploy-binaries.sh	543	# docker export dumps the container filesystem, which carries scaffolding the	COMMENT
MEDIUM	docs/use-cases/NVIDIA-GPU-passthrough-and-Kata-QEMU.md	177	#### UVM orchestration flow	COMMENT

Hyper-Verbose Identifiers6 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW	tools/testing/gatekeeper/jobs.py	253	def get_jobs_for_workflow_run(self, run_id):	CODE
LOW	tools/testing/gatekeeper/jobs.py	259	def check_workflow_runs_status(self, attempt):	CODE
LOW	tests/integration/cri-containerd/integration-tests.sh	414	function TestContainerMemoryUpdate() {	CODE
LOW	tests/integration/cri-containerd/integration-tests.sh	446	function PrepareContainerMemoryUpdate() {	CODE
LOW	tests/integration/cri-containerd/integration-tests.sh	664	function startDeviceCgroupContainers() {	CODE
LOW	tests/integration/cri-containerd/integration-tests.sh	719	function stopDeviceCgroupContainers() {	CODE

Slop Phrases1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	.github/workflows/codeql.yml	59	# If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how	COMMENT

Fake / Example Data3 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	src/dragonball/src/device_manager/blk_dev_mgr.rs	1284	let dummy_id = String::from("1");	CODE
LOW	src/dragonball/src/device_manager/blk_dev_mgr.rs	1293	drive_id: dummy_id.clone(),	CODE
LOW	src/dragonball/src/device_manager/blk_dev_mgr.rs	1341	.get_index_of_drive_id(&dummy_id)	CODE

Deep Nesting1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	tools/testing/gatekeeper/skips.py	76		CODE

kata-containers/kata-containers

Open-Source Code Quality, Security and Technical Debt Review