2.2

Adjusted Signal

2.2

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

8.3K

Stars

Language

597.2K

Lines of Code

5.3K

Files

760

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.7/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 579 finding(s).

Hallucinated Dependency & Supply Chain Risk 4.3/100 · LOW

Are imports declared and package/API names verified? 102 finding(s).

Agent Over-Engineering Ratio 3.6/100 · LOW

Are wrappers, guards, and repeated structures necessary? 359 finding(s).

PR Review Velocity Impact 10.8/100 · LOW

Which changes need focused human review? 760 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 39HIGH 14MEDIUM 94LOW 613

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 760 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators39 hits · 390 pts

Severity	File	Line	Snippet	Context
CRITICAL	…on-policies/disallow-host-path/disallow-host-path.yaml	14	- expression: "!has(object.spec.template.spec.volumes) \|\| object.spec.template.spec.volumes.all(volume, !has(volume.	CODE
CRITICAL	…validating-policies/context/imagereference/policy.yaml	15	object.spec.template.spec.containers.map(e, parseImageReference(e.image))	CODE
CRITICAL	…s/exceptions/exclude-images-autogen/check-autogen.yaml	23	object.spec.jobTemplate.spec.template.spec.containers.all(container,	CODE
CRITICAL	…s/exceptions/exclude-images-autogen/check-autogen.yaml	67	object.spec.template.spec.containers.all(container,	CODE
CRITICAL	…idating-policies/exceptions/autogen/check-autogen.yaml	35	- expression: object.spec.template.spec.containers.all(container, has(container.securityContext)	CODE
CRITICAL	…idating-policies/exceptions/autogen/check-autogen.yaml	66	- expression: object.spec.jobTemplate.spec.template.spec.containers.all(container,	CODE
CRITICAL	…en/autogen-deployments-statefulsets/check-autogen.yaml	34	- expression: object.spec.template.spec.containers.all(container, has(container.securityContext)	CODE
CRITICAL	…uld-autogen-with-namespace-selector/check-autogen.yaml	37	- expression: object.spec.template.spec.containers.all(container, has(container.securityContext)	CODE
CRITICAL	…uld-autogen-with-namespace-selector/check-autogen.yaml	59	- expression: object.spec.jobTemplate.spec.template.spec.containers.all(container,	CODE
CRITICAL	…ing-policies/autogen/should-autogen/check-autogen.yaml	40	- expression: object.spec.template.spec.containers.all(container, has(container.securityContext)	CODE
CRITICAL	…ing-policies/autogen/should-autogen/check-autogen.yaml	65	- expression: object.spec.jobTemplate.spec.template.spec.containers.all(container,	CODE
CRITICAL	…utogen/autogen-deployments-cronjobs/check-autogen.yaml	33	- expression: object.spec.template.spec.containers.all(container, has(container.securityContext)	CODE
CRITICAL	…utogen/autogen-deployments-cronjobs/check-autogen.yaml	63	- expression: object.spec.jobTemplate.spec.template.spec.containers.all(container,	CODE
CRITICAL	…-policies/context/imagedata/imagereference/policy.yaml	17	object.spec.template.spec.containers.map(e, parseImageReference(e.image))	CODE
CRITICAL	docs/dev/proposals/schema-driven-cel-processing.md	789	object.attributes.request.http.path.startsWith("/public/")	CODE
CRITICAL	docs/dev/proposals/schema-driven-cel-processing.md	819	object.attributes.request.http.path.startsWith("/public/")	CODE
CRITICAL	pkg/admissionpolicy/validate_test.go	130	- expression: "object.spec.jobTemplate.spec.template.spec.containers.all(container, has(container.securityContext) &	CODE
CRITICAL	pkg/cel/policies/ivpol/autogen/autogen_test.go	121	Expression: "object.spec.jobTemplate.spec.template.spec.containers.map(e, e.image)",	CODE
CRITICAL	pkg/cel/policies/ivpol/autogen/autogen_test.go	127	Expression: "object.spec.template.spec.containers.map(e, e.image)",	CODE
CRITICAL	pkg/cel/policies/vpol/autogen/autogen_test.go	76	Expression: "object.spec.template.spec.containers.all(container, has(container.securityContext) && has(container	CODE
CRITICAL	pkg/cel/policies/vpol/autogen/autogen_test.go	138	Expression: "object.spec.template.spec.containers.all(container, has(container.securityContext) && has(container	CODE
CRITICAL	pkg/cel/policies/vpol/autogen/autogen_test.go	214	Expression: "object.spec.template.spec.containers.all(container, has(container.securityContext) && has(container	CODE
CRITICAL	pkg/cel/policies/vpol/autogen/autogen_test.go	278	Expression: "object.spec.template.spec.containers.all(container, has(container.securityContext) && has(container	CODE
CRITICAL	pkg/cel/policies/vpol/autogen/autogen_test.go	348	Expression: "object.spec.template.spec.containers.filter(c, !c.image.contains(':'))",	CODE
CRITICAL	pkg/cel/policies/vpol/autogen/autogen_test.go	417	Expression: "object.spec.template.spec.containers.all(container, has(container.securityContext) && has(container	CODE
CRITICAL	pkg/cel/policies/vpol/autogen/autogen_test.go	469	Expression: "object.spec.template.spec.containers.all(c, !c.image.endsWith(':latest'))",	CODE
CRITICAL	pkg/cel/policies/vpol/autogen/autogen_test.go	554	want: []string{"object.spec.template.spec.containers.exists(c, c.name == 'nginx')"},	CODE
CRITICAL	pkg/cel/policies/vpol/autogen/autogen_test.go	560	want: []string{"object.spec.jobTemplate.spec.template.spec.containers.exists(c, c.name == 'nginx')"},	CODE
CRITICAL	pkg/cel/policies/vpol/autogen/autogen_test.go	578	want: []string{"object.metadata.labels.app == 'nginx' && object.spec.jobTemplate.spec.template.spec.containers.	CODE
CRITICAL	pkg/cel/policies/vpol/autogen/autogen_test.go	596	want: []string{"object.spec.template.spec.containers.exists(c, c.name == 'nginx')", "oldObject.spec.template.sp	CODE
CRITICAL	pkg/cel/policies/vpol/autogen/autogen_test.go	698	Expression: "object.spec.jobTemplate.spec.template.spec.containers.all(container, has(container.securityContext)	CODE
CRITICAL	pkg/cel/policies/vpol/autogen/autogen_test.go	769	Expression: "object.spec.jobTemplate.spec.template.spec.containers.all(container, has(container.securityContext)	CODE
CRITICAL	pkg/cel/policies/mpol/autogen/autogen_test.go	43	containers: object.spec.template.spec.containers.map(container, Object.spec.template.spec.containers{	CODE
CRITICAL	pkg/cel/policies/mpol/autogen/autogen_test.go	67	containers: object.spec.jobTemplate.spec.template.spec.containers.map(container, Object.spec.jobTemplate.spec.templa	CODE
CRITICAL	pkg/cel/policies/mpol/autogen/autogen_test.go	662	containers: object.spec.jobTemplate.spec.template.spec.containers.map(container, Object.spec.jobTemplate.spec.templa	CODE
CRITICAL	pkg/cel/autogen/replacement_test.go	152	want: "object.spec.jobTemplate.spec.template.spec.containers.all(container, has(container.securityContext) && has(c	CODE
CRITICAL	pkg/cel/autogen/replacement_test.go	158	want: "object.spec.template.spec.containers.all(container, has(container.securityContext) && has(container.security	CODE
CRITICAL	pkg/cel/autogen/replacement_test.go	276	want: "object.spec.template.spec.containers.exists(c, c.name == 'nginx')",	CODE
CRITICAL	pkg/cel/autogen/replacement_test.go	282	want: "object.spec.template.spec.containers.exists(c, c.name == 'nginx')",	CODE

Decorative Section Separators76 hits · 230 pts

Severity	File	Line	Snippet	Context
MEDIUM	hack/pr-triage/retarget.py	154	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	hack/pr-triage/retarget.py	301	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	hack/pr-triage/retarget.py	378	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	hack/pr-triage/retarget.py	539	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	hack/pr-triage/retarget.py	618	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	hack/pr-triage/retarget.py	758	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	hack/pr-triage/retarget.py	836	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	hack/pr-triage/retarget.py	878	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	hack/pr-triage/apply-labels.sh	78	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	hack/pr-triage/apply-labels.sh	83	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	hack/pr-triage/apply-labels.sh	116	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	hack/pr-triage/apply-labels.sh	122	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	hack/pr-triage/pr-branch-triage.py	59	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	hack/pr-triage/pr-branch-triage.py	64	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	hack/pr-triage/pr-branch-triage.py	196	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	hack/pr-triage/pr-branch-triage.py	198	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	hack/pr-triage/pr-branch-triage.py	210	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	hack/pr-triage/pr-branch-triage.py	213	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	hack/pr-triage/pr-branch-triage.py	225	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	hack/pr-triage/pr-branch-triage.py	230	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/verify-legacy-policy-migration.sh	1169	# ==============================================================================	COMMENT
MEDIUM	scripts/verify-legacy-policy-migration.sh	1171	# ==============================================================================	COMMENT
MEDIUM	scripts/verify-legacy-policy-migration.sh	1469	# ==============================================================================	COMMENT
MEDIUM	scripts/verify-legacy-policy-migration.sh	1471	# ==============================================================================	COMMENT
MEDIUM⚡	.github/labels.yml	88	# ── Area: CEL (cyan #00BCD4) ─────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	89	# ── CEL ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	98	# ── Area: Webhooks & Controllers (teal #009688) ─────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	99	# ── Webhooks ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	109	# ── Controllers ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	146	# ── Area: CLI (green #0e8a16) ────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	147	# ── CLI (kubectl-kyverno) ──────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	157	# ── Area: Policy (sea green #2E7D32) ────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	158	# ── Policy & Policy Cache ──────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	187	# ── Area: Autogen (light green #4CAF50) ──────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	188	# ── Autogen ─────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	198	# ── Area: Global Context (olive #827717) ─────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	199	# ── Global Context ──────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	210	# ── Area: Events (amber #FFA000) ─────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	211	# ── Events ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	220	# ── Area: Auth & TLS (steel blue #5C6BC0) ───────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	221	# ── Auth & UserInfo ─────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	231	# ── TLS / Certificates ─────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	241	# ── Area: Observability (light blue #42A5F5) ─────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	242	# ── Metrics & Tracing ──────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	262	# ── Logging ─────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	272	# ── Area: Config & Registry (grey-blue #546E7A) ─────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	273	# ── Config ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	284	# ── Registry Client ────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	294	# ── Area: Infrastructure (blue-grey #607D8B) ────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	295	# ── Clients ─────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	305	# ── PSS (Pod Security Standards) ───────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	314	# ── Ext (extensions/utilities) ─────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	323	# ── Toggle / Feature Flags ─────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	332	# ── Leader Election ────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	341	# ── Circuit Breaker ────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	350	# ── cmd/internal (shared controller setup) ─────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	359	# ── Init Container ─────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	368	# ── Readiness Checker ──────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	479	# ── Kind: Dependencies (brown #795548) ──────────────────────────────────────	COMMENT
MEDIUM⚡	.github/labels.yml	489	# ── Kind: Security (dark red #B71C1C) ───────────────────────────────────────	COMMENT
16 more matches not shown…

Hyper-Verbose Identifiers280 hits · 207 pts

Severity	File	Line	Snippet	Context
LOW⚡	hack/pr-triage/test_branch_advisory.py	14	def test_legacy_guidance_does_not_recommend_base_flip(self):	CODE
LOW⚡	hack/pr-triage/test_branch_advisory.py	18	def test_cel_backports_are_allowed(self):	CODE
LOW⚡	hack/pr-triage/test_branch_advisory.py	22	def test_mixed_and_migration_are_manual(self):	CODE
LOW	hack/pr-triage/test_pr_branch_triage.py	19	def test_migration_word_forms_are_detected_on_migration_paths(self):	CODE
LOW	hack/pr-triage/test_pr_branch_triage.py	30	def test_migration_word_without_migration_path_is_not_flagged(self):	CODE
LOW	hack/pr-triage/test_pr_branch_triage.py	33	def test_explicit_retarget_override_survives_migration_classification(self):	CODE
LOW	hack/pr-triage/test_pr_branch_triage.py	59	def test_null_migration_override_defaults_to_keep_main(self):	CODE
LOW	hack/pr-triage/test_pr_branch_triage.py	81	def test_ref_collision_does_not_remove_existing_refs_or_worktrees(self):	CODE
LOW	hack/pr-triage/test_pr_branch_triage.py	96	def test_successful_probe_removes_only_its_unique_worktree_and_refs(self):	CODE
LOW	hack/pr-triage/test_pr_branch_triage.py	129	def test_head_change_between_snapshot_and_probe_is_not_accepted(self):	CODE
LOW⚡	hack/pr-triage/test_pr_branch_triage.py	202	def test_matching_live_snapshot_is_labeled(self):	CODE
LOW⚡	hack/pr-triage/test_pr_branch_triage.py	208	def test_execute_edits_labels_for_matching_snapshot(self):	CODE
LOW⚡	hack/pr-triage/test_pr_branch_triage.py	216	def test_metadata_only_update_invalidates_report_snapshot(self):	CODE
LOW⚡	hack/pr-triage/test_pr_branch_triage.py	224	def test_older_snapshot_without_update_time_is_skipped(self):	CODE
LOW⚡	hack/pr-triage/test_retarget.py	489	def test_rebased_commit_must_descend_from_target(self):	CODE
LOW⚡	hack/pr-triage/test_retarget.py	498	def test_prepared_ref_must_point_at_approved_sha(self):	CODE
LOW⚡	hack/pr-triage/test_retarget.py	505	def test_live_draft_change_is_stale(self):	CODE
LOW⚡	hack/pr-triage/test_retarget.py	512	def test_execute_requires_updater_paused_attestation(self):	CODE
LOW⚡	hack/pr-triage/test_retarget.py	521	def test_stale_live_state_refuses_before_any_write(self):	CODE
LOW⚡	hack/pr-triage/test_retarget.py	954	def test_create_timeout_then_resume_does_not_duplicate(self):	CODE
LOW⚡	hack/pr-triage/test_retarget.py	964	def test_existing_branch_not_ours_is_refused(self):	CODE
LOW⚡	hack/pr-triage/test_retarget.py	971	def test_resume_refuses_branch_with_other_sha(self):	CODE
LOW⚡	hack/pr-triage/test_retarget.py	1011	def test_unowned_sibling_pr_is_not_adopted(self):	CODE
LOW⚡	hack/pr-triage/test_retarget.py	1019	def test_rollback_without_pr_intent_leaves_everything(self):	CODE
LOW⚡	hack/pr-triage/test_retarget.py	1028	def test_pr_pending_resume_requires_same_body_and_title(self):	CODE
LOW⚡	hack/pr-triage/test_retarget.py	1118	def test_rollback_refuses_when_recorded_sibling_missing(self):	CODE
LOW⚡	hack/pr-triage/test_retarget.py	1126	def test_rollback_checks_live_branch_before_close(self):	CODE
LOW⚡	hack/pr-triage/test_retarget.py	1135	def test_rollback_closes_only_sibling_and_keeps_branch(self):	CODE
LOW⚡	hack/pr-triage/test_retarget.py	1144	def test_rollback_refuses_merged_or_changed(self):	CODE
LOW	hack/pr-triage/test_retarget.py	248	def test_other_repository_is_rejected_before_any_calls(self):	CODE
LOW	hack/pr-triage/test_retarget.py	259	def test_reviewer_requires_live_upstream_write_permission(self):	CODE
LOW	hack/pr-triage/test_retarget.py	267	def test_github_environment_cannot_redirect_host_or_configuration(self):	CODE
LOW	hack/pr-triage/test_retarget.py	283	def test_preview_makes_no_calls_and_no_journal(self):	CODE
LOW	hack/pr-triage/test_retarget.py	293	def test_preview_shows_blocked_and_execute_refuses_without_approval(self):	CODE
LOW	hack/pr-triage/test_retarget.py	304	def test_approval_must_bind_shas_and_evidence(self):	CODE
LOW	hack/pr-triage/test_retarget.py	322	def test_feature_flag_required_only_for_feature_titles_and_draft_never_publishes(self):	CODE
LOW	hack/pr-triage/test_retarget.py	347	def test_every_required_evidence_key_is_mandatory(self):	CODE
LOW	hack/pr-triage/test_retarget.py	361	def test_evidence_bytes_bound_to_candidate_and_approval(self):	CODE
LOW	hack/pr-triage/test_retarget.py	385	def test_only_main_to_release_routing_is_supported(self):	CODE
LOW	hack/pr-triage/test_retarget.py	424	def test_url_rewrite_config_refused_before_any_write(self):	CODE
LOW	hack/pr-triage/test_retarget.py	437	def test_url_rewrite_refused_for_rollback(self):	CODE
LOW	hack/pr-triage/test_retarget.py	447	def test_inherited_git_env_is_stripped(self):	CODE
LOW	hack/pr-triage/test_retarget.py	460	def test_only_legacy_only_category_is_publishable(self):	CODE
LOW	hack/pr-triage/test_retarget.py	471	def test_live_title_drift_refused_initially(self):	CODE
LOW	hack/pr-triage/test_retarget.py	478	def test_refs_outside_owned_namespace_are_refused(self):	CODE
LOW	hack/pr-triage/test_retarget.py	548	def test_journal_lock_is_exclusive(self):	CODE
LOW	hack/pr-triage/test_retarget.py	559	def test_resume_refuses_new_draft_after_partial_publication(self):	CODE
LOW	hack/pr-triage/test_retarget.py	586	def test_consent_and_permission_refusals(self):	CODE
LOW	hack/pr-triage/test_retarget.py	609	def test_lease_protects_against_concurrent_push(self):	CODE
LOW	hack/pr-triage/test_retarget.py	629	def test_push_timeout_then_resume(self):	CODE
LOW	hack/pr-triage/test_retarget.py	649	def test_base_edit_timeout_then_resume_does_not_repeat(self):	CODE
LOW	hack/pr-triage/test_retarget.py	660	def test_resume_refuses_changed_manifest_identity(self):	CODE
LOW	hack/pr-triage/test_retarget.py	669	def test_complete_resume_never_reapplies_base(self):	CODE
LOW	hack/pr-triage/test_retarget.py	680	def test_unowned_rebased_head_is_not_adopted(self):	CODE
LOW	hack/pr-triage/test_retarget.py	690	def test_rollback_refuses_foreign_base_change(self):	CODE
LOW	hack/pr-triage/test_retarget.py	703	def test_rollback_refuses_ambiguous_base_pending_with_original_head(self):	CODE
LOW	hack/pr-triage/test_retarget.py	719	def test_rollback_with_base_pending_and_prepared_head_is_owned(self):	CODE
LOW	hack/pr-triage/test_retarget.py	729	def test_rollback_pending_base_edit_is_not_replayed(self):	CODE
LOW	hack/pr-triage/test_retarget.py	749	def test_rollback_refuses_base_changed_by_others_mid_rollback(self):	CODE
LOW	hack/pr-triage/test_retarget.py	762	def test_base_pending_resume_with_source_base_never_replays_edit(self):	CODE
220 more matches not shown…

Over-Commented Block205 hits · 197 pts

Severity	File	Line	Snippet	Context
LOW	.coderabbit.yaml	1	# yaml-language-server: $schema=https://storage.googleapis.com/coderabbit_public_assets/schema.v2.json	COMMENT
LOW	cmd/cli/kubectl-kyverno/apis/v1alpha1/test_result.go	21	// +optional	COMMENT
LOW	cmd/cli/kubectl-kyverno/apis/v1alpha1/test_result.go	41	// +optional	COMMENT
LOW	cmd/cli/kubectl-kyverno/apis/v1alpha1/test_result.go	61	// object is null and oldObject is set to the resource, mirroring the API server.	COMMENT
LOW	cmd/cli/kubectl-kyverno/apis/v1alpha1/test.go	121		COMMENT
LOW	cmd/cli/kubectl-kyverno/context/load_test.go	1	package context	COMMENT
LOW	cmd/cli/kubectl-kyverno/context/load_test.go	21	// }	COMMENT
LOW	cmd/cli/kubectl-kyverno/context/load_test.go	41	// want: mustReadFile("../_testdata/values/bad-format.yaml"),	COMMENT
LOW	cmd/cli/kubectl-kyverno/context/load_test.go	61	// }	COMMENT
LOW	cmd/cli/kubectl-kyverno/context/load_test.go	81	// }	COMMENT
LOW	cmd/cli/kubectl-kyverno/context/load_test.go	101	// want: nil,	COMMENT
LOW	cmd/cli/kubectl-kyverno/context/load_test.go	121	// Resources: []v1alpha1.Resource{{	COMMENT
LOW	cmd/cli/kubectl-kyverno/context/load_test.go	141	// t.Errorf("Load() error = %v, wantErr %v", err, tt.wantErr)	COMMENT
LOW	cmd/cli/kubectl-kyverno/commands/test/command_test.go	181	wantOk: false,	COMMENT
LOW	cmd/cli/kubectl-kyverno/commands/test/command_test.go	2081	})	COMMENT
LOW	…/kubectl-kyverno/commands/oci/internal/bundle/types.go	1	// Package bundle implements the format 1.0 Kyverno CEL Policy Bundle pipeline described in	COMMENT
LOW	…bectl-kyverno/commands/oci/internal/bundle/validate.go	41	// resolving every PolicyException's policy references within the bundle (bundle-spec.md section	COMMENT
LOW	…bectl-kyverno/commands/oci/internal/bundle/validate.go	61	// that caller these branches are the only thing that rejects a legacy kind.	COMMENT
LOW	…bectl-kyverno/commands/oci/internal/bundle/validate.go	121	// validateResults is an unchanged, pure move of push/options.go's buildImage checks (rejecting	COMMENT
LOW	…bectl-kyverno/commands/oci/internal/bundle/assemble.go	41	// cli.kyverno.io documents and v1 List documents rejected everywhere) before any document	COMMENT
LOW	…bectl-kyverno/commands/oci/internal/bundle/assemble.go	61	return nil, fmt.Errorf("reading bundle root %s: %w", root, err)	COMMENT
LOW	…bectl-kyverno/commands/oci/internal/bundle/assemble.go	121	if d.IsDir() {	COMMENT
LOW	…i/kubectl-kyverno/commands/oci/internal/bundle/read.go	21	// reader MUST 1), extracts the content layer under the archive path rules (reader MUST 2),	COMMENT
LOW	…i/kubectl-kyverno/commands/oci/internal/bundle/read.go	41	// oci://` or `kyverno test oci://` that loads dir afterward. What's true as a result: every	COMMENT
LOW	…i/kubectl-kyverno/commands/oci/internal/bundle/read.go	141	msg = strings.ReplaceAll(msg, p, "")	COMMENT
LOW	…i/kubectl-kyverno/commands/oci/internal/bundle/read.go	181	return fmt.Errorf("unsupported bundle format major version %s (this reader supports major version %s)", major, support	COMMENT
LOW	…i/kubectl-kyverno/commands/oci/internal/bundle/read.go	221	return nil	COMMENT
LOW	…i/kubectl-kyverno/commands/oci/internal/bundle/read.go	301	// MiB is generous headroom over any realistic policy or exception document while still bounding	COMMENT
LOW	…cli/kubectl-kyverno/commands/legacypolicies/command.go	21		COMMENT
LOW	cmd/kyverno-init/legacy_policies.go	21	// legacyPolicyCheckTimeout bounds the metadata-list count plus the Deployment	COMMENT
LOW	cmd/kyverno-init/orphaned_webhooks.go	21		COMMENT
LOW	test/integration/framework/options.go	101	return func(c *setupConfig) { c.polexEnabled = true }	COMMENT
LOW	test/integration/framework/reports.go	21	// breaker, because the admission handler calls breaker.GetReportsBreaker().Do	COMMENT
LOW	test/conformance/chainsaw/cel/http/policy.yaml	1	# NamespacedValidatingPolicy that calls http.get() against the in-cluster	COMMENT
LOW	…-policies/context/imagedata/image-data/deployment.yaml	21	# matchLabels:	COMMENT
LOW	ext/wildcard/match_reference_test.go	81	for _, n := range names {	COMMENT
LOW	ext/wildcard/match.go	1	package wildcard	COMMENT
LOW	charts/kyverno-policies/values.yaml	1	# -- Pod Security Standard profile (`baseline`, `restricted`, `privileged`, `custom`).	COMMENT
LOW	charts/kyverno-policies/values.yaml	21	# set `spec.hostUsers` to `false`. A Pod that omits `hostUsers` or sets it to `true` is	COMMENT
LOW	charts/kyverno-policies/values.yaml	41	# -- Additional policies to include from `other`.	COMMENT
LOW	charts/kyverno-policies/values.yaml	61	# For more info https://kyverno.io/docs/policy-types/cluster-policy/validate.	COMMENT
LOW	charts/kyverno-policies/values.yaml	81	# violation-details: >-	COMMENT
LOW	charts/kyverno-policies/values.yaml	101	vpolExcludeByPolicy: {}	COMMENT
LOW	charts/kyverno-policies/values.yaml	121	# name: system:masters	COMMENT
LOW	charts/kyverno-policies/ci/test-vpol-userns-values.yaml	1	podSecurityStandard: restricted	COMMENT
LOW	charts/kyverno/values.yaml	21	# -- Enable/Disable custom resource watcher to invalidate cache	COMMENT
LOW	charts/kyverno/values.yaml	361	# -- Projected service account token configuration (only used when automountServiceAccountToken is false)	COMMENT
LOW	charts/kyverno/values.yaml	421	generateSuccessEvents: false	COMMENT
LOW	charts/kyverno/values.yaml	661	disabledLabelDimensions: ["resource_namespace", "policy_namespace"]	COMMENT
LOW	charts/kyverno/values.yaml	881	# -- Alert rule groups. Provide your own rules here; the examples below use	COMMENT
LOW	charts/kyverno/values.yaml	901	# above the 1s threshold. Kubernetes webhooks hard-timeout at 10s.	COMMENT
LOW	charts/kyverno/values.yaml	921	# histogram_quantile(0.99,	COMMENT
LOW	charts/kyverno/values.yaml	1121	# -- Extra resource permissions to add in the cluster role	COMMENT
LOW	charts/kyverno/values.yaml	1141	# -- Configure cert-manager to manage TLS certificates.	COMMENT
LOW	charts/kyverno/values.yaml	1241	# in case you are using hostNetwork: true, you might want to change the port the webhookServer is listening to	COMMENT
LOW	charts/kyverno/values.yaml	1461	lifecycle: {}	COMMENT
LOW	charts/kyverno/values.yaml	1481	# image: busybox	COMMENT
LOW	charts/kyverno/values.yaml	1501	# -- Service port.	COMMENT
LOW	charts/kyverno/values.yaml	1621	# -- Annotations for the ServiceAccount	COMMENT
LOW	charts/kyverno/values.yaml	1761	# For further reference: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy.	COMMENT
145 more matches not shown…

Cross-Language Confusion13 hits · 85 pts

Severity	File	Line	Snippet	Context
HIGH	hack/pr-triage/retarget.py	270	b.append("approval pending (approval is null)")	CODE
HIGH	hack/pr-triage/pr-branch-triage.py	32	((category=LEGACY_ONLY \|\| override=RETARGET) && override!=KEEP_MAIN &&	STRING
HIGH	hack/pr-triage/pr-branch-triage.py	608	"the automated-retarget gate requires `(category=LEGACY_ONLY \|\| override=RETARGET) "	CODE
HIGH	hack/pr-triage/pr-branch-triage.py	609	"&& override!=KEEP_MAIN && probe=OK`, with live PR identity unchanged.**\n")	CODE
HIGH⚡	scripts/test-cherry-pick-workflows.py	99	async createComment(data) { calls.push(['comment', data.body]); }	CODE
HIGH⚡	scripts/test-cherry-pick-workflows.py	103	calls.push(['reaction']);	CODE
HIGH⚡	scripts/test-cherry-pick-workflows.py	111	calls.push(['permission', username]);	CODE
HIGH⚡	scripts/test-cherry-pick-workflows.py	119	calls.push(['branch', branch]);	CODE
HIGH⚡	scripts/test-cherry-pick-workflows.py	123	if (input.branchErrors && input.branchErrors[branch]) {	CODE
HIGH⚡	scripts/test-cherry-pick-workflows.py	131	calls.push(['paginate', options.per_page]);	CODE
HIGH⚡	scripts/test-cherry-pick-workflows.py	137	warning(message) { warnings.push(message); },	CODE
HIGH⚡	scripts/test-cherry-pick-workflows.py	140	addRaw(body) { calls.push(['summary', body]); return this; },	CODE
HIGH⚡	scripts/release/test_release.py	1268	self.assertEqual(step["with"]["ref"], "${{ inputs.release-sha \|\| github.sha }}", name)	CODE

Fake / Example Data50 hits · 53 pts

Severity	File	Line	Snippet	Context
LOW	pkg/image/verifiers/ivpol/cosign/opts_test.go	270	Subject: "user@example.com",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	223	jmesPath: "replace('Lorem ipsum dolor sit amet', 'ipsum', 'muspi', `-1`)",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	223	jmesPath: "replace('Lorem ipsum dolor sit amet', 'ipsum', 'muspi', `-1`)",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	224	expectedResult: "Lorem muspi dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	227	jmesPath: "replace('Lorem ipsum ipsum ipsum dolor sit amet', 'ipsum', 'muspi', `-1`)",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	227	jmesPath: "replace('Lorem ipsum ipsum ipsum dolor sit amet', 'ipsum', 'muspi', `-1`)",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	228	expectedResult: "Lorem muspi muspi muspi dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	231	jmesPath: "replace('Lorem ipsum ipsum ipsum dolor sit amet', 'ipsum', 'muspi', `1`)",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	231	jmesPath: "replace('Lorem ipsum ipsum ipsum dolor sit amet', 'ipsum', 'muspi', `1`)",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	232	expectedResult: "Lorem muspi ipsum ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	251	jp, err := jmespathInterface.Query("replace_all('Lorem ipsum dolor sit amet', 'ipsum', 'muspi')")	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	251	jp, err := jmespathInterface.Query("replace_all('Lorem ipsum dolor sit amet', 'ipsum', 'muspi')")	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	259	assert.Equal(t, replaced, "Lorem muspi dolor sit amet")	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	794	jmesPath: "truncate('Lorem ipsum dolor sit amet', `5`)",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	794	jmesPath: "truncate('Lorem ipsum dolor sit amet', `5`)",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	798	jmesPath: "truncate('Lorem ipsum ipsum ipsum dolor sit amet', `11`)",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	798	jmesPath: "truncate('Lorem ipsum ipsum ipsum dolor sit amet', `11`)",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	799	expectedResult: "Lorem ipsum",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	802	jmesPath: "truncate('Lorem ipsum ipsum ipsum dolor sit amet', `40`)",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	802	jmesPath: "truncate('Lorem ipsum ipsum ipsum dolor sit amet', `40`)",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	803	expectedResult: "Lorem ipsum ipsum ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	803	expectedResult: "Lorem ipsum ipsum ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	806	jmesPath: "truncate('Lorem ipsum', `2.6`)",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	810	jmesPath: "truncate('Lorem ipsum', `0`)",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	814	jmesPath: "truncate('Lorem ipsum', `-1`)",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1389	"Lorem ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1389	"Lorem ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1395	want: "Lorem muspi dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1399	"Lorem ipsum ipsum ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1399	"Lorem ipsum ipsum ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1405	want: "Lorem muspi muspi muspi dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1409	"Lorem ipsum ipsum ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1409	"Lorem ipsum ipsum ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1415	want: "Lorem muspi ipsum ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1429	"Lorem ipsum ipsum ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1429	"Lorem ipsum ipsum ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1439	"Lorem ipsum ipsum ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1439	"Lorem ipsum ipsum ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1449	"Lorem ipsum ipsum ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1449	"Lorem ipsum ipsum ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1483	"Lorem ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1483	"Lorem ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1488	want: "Lorem muspi dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1492	"Lorem ipsum ipsum ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1492	"Lorem ipsum ipsum ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1497	want: "Lorem muspi muspi muspi dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1510	"Lorem ipsum ipsum ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1510	"Lorem ipsum ipsum ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1519	"Lorem ipsum ipsum ipsum dolor sit amet",	CODE
LOW⚡	pkg/engine/jmespath/functions_test.go	1519	"Lorem ipsum ipsum ipsum dolor sit amet",	CODE

Self-Referential Comments9 hits · 39 pts

Severity	File	Line	Snippet	Context
MEDIUM	…ting-policies/context/resource/post/chainsaw-test.yaml	63	#### Create the credential object and output the new kubeconfig file	COMMENT
MEDIUM⚡	…/tls-certificates/ecdsa-self-signed/chainsaw-test.yaml	63	# Create a test namespace	COMMENT
MEDIUM⚡	…/tls-certificates/ecdsa-self-signed/chainsaw-test.yaml	76	# Create a pod with the required label - should succeed	COMMENT
MEDIUM⚡	…tls-certificates/ecdsa-cert-manager/chainsaw-test.yaml	63	# Create a test namespace	COMMENT
MEDIUM⚡	…tls-certificates/ecdsa-cert-manager/chainsaw-test.yaml	76	# Create a pod with the required label - should succeed	COMMENT
MEDIUM⚡	…ls-certificates/ed25519-self-signed/chainsaw-test.yaml	63	# Create a test namespace	COMMENT
MEDIUM⚡	…ls-certificates/ed25519-self-signed/chainsaw-test.yaml	76	# Create a pod with the required label - should succeed	COMMENT
MEDIUM⚡	…w/tls-certificates/rsa-cert-manager/chainsaw-test.yaml	63	# Create a test namespace	COMMENT
MEDIUM⚡	…w/tls-certificates/rsa-cert-manager/chainsaw-test.yaml	76	# Create a pod with the required label - should succeed	COMMENT

Structural Annotation Overuse19 hits · 32 pts

Severity	File	Line	Snippet	Context
LOW⚡	…licies/exceptions/compensating-controls/exception.yaml	9	# Step 1: target the resources requesting the exception	COMMENT
LOW⚡	…licies/exceptions/compensating-controls/exception.yaml	13	# Step 2: compensating controls required to grant the exception	COMMENT
LOW	…/tls-certificates/ecdsa-self-signed/chainsaw-test.yaml	8	# Step 1: Verify the certificates are ECDSA	COMMENT
LOW	…/tls-certificates/ecdsa-self-signed/chainsaw-test.yaml	43	# Step 2: Test webhook functionality with a simple policy	COMMENT
LOW	…tls-certificates/ecdsa-cert-manager/chainsaw-test.yaml	8	# Step 1: Verify the certificates are ECDSA	COMMENT
LOW	…tls-certificates/ecdsa-cert-manager/chainsaw-test.yaml	43	# Step 2: Test webhook functionality with a simple policy	COMMENT
LOW	…ls-certificates/ed25519-self-signed/chainsaw-test.yaml	8	# Step 1: Verify the certificates are Ed25519	COMMENT
LOW	…ls-certificates/ed25519-self-signed/chainsaw-test.yaml	43	# Step 2: Test webhook functionality with a simple policy	COMMENT
LOW	…w/tls-certificates/rsa-cert-manager/chainsaw-test.yaml	8	# Step 1: Verify the certificates are RSA	COMMENT
LOW	…w/tls-certificates/rsa-cert-manager/chainsaw-test.yaml	43	# Step 2: Test webhook functionality with a simple policy	COMMENT
LOW⚡	hack/crd-splice/main.go	105	// Step 1: every frozen file must already exist in target. Never read	COMMENT
LOW⚡	hack/crd-splice/main.go	113	// Step 2: every non-frozen target file must have generated output, or	COMMENT
LOW	hack/crd-splice/main.go	133	// Step 3: reject unusable --freeze keys before writing anything, so a typo	COMMENT
LOW	hack/crd-splice/main.go	148	// Step 4: a version that exists in the target but has no Go type and is not	COMMENT
LOW	hack/crd-splice/main.go	175	// Step 5: write every non-frozen generated file, splicing in frozen	COMMENT
LOW	docs/operational-runbook.md	224	# Step 1: Set failurePolicy to Ignore first (see Option 1 above)	COMMENT
LOW	docs/operational-runbook.md	226	# Step 2: Scale down	COMMENT
LOW	pkg/image/verifiers/ivpol/cosign/opts.go	355	// Step 1: read optional root bytes — pure I/O, no TUF lock needed.	COMMENT
LOW	pkg/image/verifiers/ivpol/cosign/opts.go	376	// Step 2: hold the process-wide TUF mutex for init + all reads so	COMMENT

Verbosity Indicators18 hits · 30 pts

Severity	File	Line	Snippet	Context
LOW	cmd/kyverno/watch/watcher.go	78	// and we need to check if stop wasn't requested while doing so.	COMMENT
LOW⚡	…licies/exceptions/compensating-controls/exception.yaml	9	# Step 1: target the resources requesting the exception	COMMENT
LOW⚡	…licies/exceptions/compensating-controls/exception.yaml	13	# Step 2: compensating controls required to grant the exception	COMMENT
LOW	…/tls-certificates/ecdsa-self-signed/chainsaw-test.yaml	8	# Step 1: Verify the certificates are ECDSA	COMMENT
LOW	…/tls-certificates/ecdsa-self-signed/chainsaw-test.yaml	43	# Step 2: Test webhook functionality with a simple policy	COMMENT
LOW	…tls-certificates/ecdsa-cert-manager/chainsaw-test.yaml	8	# Step 1: Verify the certificates are ECDSA	COMMENT
LOW	…tls-certificates/ecdsa-cert-manager/chainsaw-test.yaml	43	# Step 2: Test webhook functionality with a simple policy	COMMENT
LOW	…ls-certificates/ed25519-self-signed/chainsaw-test.yaml	8	# Step 1: Verify the certificates are Ed25519	COMMENT
LOW	…ls-certificates/ed25519-self-signed/chainsaw-test.yaml	43	# Step 2: Test webhook functionality with a simple policy	COMMENT
LOW	…w/tls-certificates/rsa-cert-manager/chainsaw-test.yaml	8	# Step 1: Verify the certificates are RSA	COMMENT
LOW	…w/tls-certificates/rsa-cert-manager/chainsaw-test.yaml	43	# Step 2: Test webhook functionality with a simple policy	COMMENT
LOW⚡	hack/crd-splice/main.go	105	// Step 1: every frozen file must already exist in target. Never read	COMMENT
LOW⚡	hack/crd-splice/main.go	113	// Step 2: every non-frozen target file must have generated output, or	COMMENT
LOW	hack/crd-splice/main.go	133	// Step 3: reject unusable --freeze keys before writing anything, so a typo	COMMENT
LOW	hack/crd-splice/main.go	148	// Step 4: a version that exists in the target but has no Go type and is not	COMMENT
LOW	hack/crd-splice/main.go	175	// Step 5: write every non-frozen generated file, splicing in frozen	COMMENT
LOW	pkg/image/verifiers/ivpol/cosign/opts.go	355	// Step 1: read optional root bytes — pure I/O, no TUF lock needed.	COMMENT
LOW	pkg/image/verifiers/ivpol/cosign/opts.go	376	// Step 2: hold the process-wide TUF mutex for init + all reads so	COMMENT

Slop Phrases8 hits · 24 pts

Severity	File	Line	Snippet	Context
MEDIUM	charts/kyverno/values.yaml	1223	# The block is directly forwarded into the priorityLevelConfiguration, so you can use whatever specification you want.	COMMENT
MEDIUM	charts/kyverno/values.yaml	1258	# The block is directly forwarded into the deployment, so you can use whatever startupProbes configuration you want.	COMMENT
MEDIUM	charts/kyverno/values.yaml	1271	# The block is directly forwarded into the deployment, so you can use whatever livenessProbe configuration you want.	COMMENT
MEDIUM	charts/kyverno/values.yaml	1286	# The block is directly forwarded into the deployment, so you can use whatever readinessProbe configuration you want.	COMMENT
MEDIUM	charts/kyverno/values.yaml	2169	# The block is directly forwarded into the deployment, so you can use whatever startupProbes configuration you want.	COMMENT
MEDIUM	charts/kyverno/values.yaml	2182	# The block is directly forwarded into the deployment, so you can use whatever livenessProbe configuration you want.	COMMENT
MEDIUM	charts/kyverno/values.yaml	2197	# The block is directly forwarded into the deployment, so you can use whatever readinessProbe configuration you want.	COMMENT
MEDIUM	charts/kyverno/values.yaml	2513	# The block is directly forwarded into the priorityLevelConfiguration, so you can use whatever specification you want.	COMMENT

Deep Nesting25 hits · 20 pts

Severity	File	Line	Context
LOW	hack/pr-triage/retarget.py	900	CODE
LOW	hack/pr-triage/test_retarget.py	407	CODE
LOW	hack/pr-triage/pr-branch-triage.py	594	CODE
LOW	scripts/psa-release-issues.py	252	CODE
LOW	scripts/psa-release-issues.py	1011	CODE
LOW	scripts/psa-release-issues.py	950	CODE
LOW	scripts/release/test_release.py	356	CODE
LOW	scripts/release/test_release.py	647	CODE
LOW	scripts/release/test_release.py	699	CODE
LOW	scripts/release/test_release.py	1046	CODE
LOW	scripts/release/test_release.py	1218	CODE
LOW	scripts/release/test_release.py	1239	CODE
LOW	scripts/release/test_release.py	1260	CODE
LOW	scripts/release/test_release.py	648	CODE
LOW	scripts/release/build.py	21	CODE
LOW	scripts/release/release.py	256	CODE
LOW	scripts/release/release.py	299	CODE
LOW	scripts/release/release.py	625	CODE
LOW	scripts/release/release.py	660	CODE
LOW	scripts/release/release.py	694	CODE
LOW	scripts/release/release.py	262	CODE
LOW	scripts/release/krew.py	74	CODE
LOW	scripts/release/report.py	24	CODE
LOW	.github/actions/pr-management/run.py	96	CODE
LOW	.github/actions/pr-management/tests/test_management.py	350	CODE

Redundant / Tautological Comments10 hits · 18 pts

Severity	File	Line	Snippet	Context
LOW	…utating-policies/exceptions/regular/chainsaw-test.yaml	45	# Check if foo label is present on skipped-deployment	COMMENT
LOW	…-policies/exceptions/exclude-images/chainsaw-test.yaml	45	# Check if foo label is present on skipped-deployment	COMMENT
LOW	…g-policies/existing/expression/list/chainsaw-test.yaml	54	# Check if any foo label equals "bar"	COMMENT
LOW	…s/existing/different-trigger-target/chainsaw-test.yaml	57	# Check if any foo label equals "bar"	COMMENT
LOW⚡	…/tls-certificates/ecdsa-self-signed/chainsaw-test.yaml	70	# Check if the pod was created (it shouldn't be in audit mode)	COMMENT
LOW⚡	…tls-certificates/ecdsa-cert-manager/chainsaw-test.yaml	70	# Check if the pod was created (it shouldn't be in audit mode)	COMMENT
LOW⚡	…ls-certificates/ed25519-self-signed/chainsaw-test.yaml	70	# Check if the pod was created (it shouldn't be in audit mode)	COMMENT
LOW⚡	…w/tls-certificates/rsa-cert-manager/chainsaw-test.yaml	70	# Check if the pod was created (it shouldn't be in audit mode)	COMMENT
LOW	charts/kyverno/values.yaml	375	# Set this to the audience your receiving service validates in the OIDC token's	COMMENT
LOW	scripts/kyverno-pods-resources-aggregate-summary.sh	42	# Check if report has new stats shape (totals.memory_bytes.avg) vs old (totals.memory_bytes as number)	COMMENT

Empty Error Handlers1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	hack/pr-triage/pr-branch-triage.py	415	except OSError:	CODE

Example Usage Blocks2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	hack/pr-triage/apply-labels.sh	9	# Usage:	COMMENT
LOW	docs/perf-testing/provision/akamai-provision.sh	6	# Usage:	COMMENT

Modern AI Meta-Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	docs/dev/proposals/schema-driven-cel-processing.md	1586	### Starting guardrails and benchmark gates	COMMENT

Excessive Try-Catch Wrapping2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	hack/pr-triage/pr-branch-triage.py	310	except Exception as e: # noqa: BLE001 - best-effort, record and move on	CODE
LOW	hack/pr-triage/pr-branch-triage.py	405	except Exception as e: # noqa: BLE001	CODE

AI Slop Vocabulary1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	.github/pr-readiness-checks.yml	5	# `message` can name specifics from the PR's own data, not just return a fixed string. To add a check: add an	COMMENT

TODO Padding1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	pkg/engine/pattern/pattern_test.go	501	// TODO: Add test cases.	COMMENT

kyverno/kyverno

Open-Source Code Quality, Security and Technical Debt Review