1.4

Adjusted Signal

1.4

Raw Pattern Score

100%

Time Factor

2026-10-29

Last Push

9.1K

Stars

Language

395.8K

Lines of Code

1.5K

Files

486

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 6.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 483 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 3 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 0 finding(s).

PR Review Velocity Impact 6.5/100 · LOW

Which changes need focused human review? 486 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 1MEDIUM 21LOW 464

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 486 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block430 hits · 425 pts

Severity	File	Line	Snippet	Context
LOW	DEVELOPMENT.md	581	If you want to debug your controller you first need to update its deployment configuration and comment the probes. If yo	COMMENT
LOW	cmd/entrypoint/namespaces_test.go	21	import (	COMMENT
LOW	test/e2e-common.sh	1	#!/usr/bin/env bash	COMMENT
LOW	test/artifacts_test.go	1	//go:build e2e	COMMENT
LOW	test/metrics_otel_test.go	281		COMMENT
LOW	test/step_when_test.go	1	//go:build e2e	COMMENT
LOW	test/e2e-tests.sh	1	#!/usr/bin/env bash	COMMENT
LOW	test/pipelinerun_pinp_test.go	161	} else {	COMMENT
LOW	test/presubmit-tests.sh	1	#!/usr/bin/env bash	COMMENT
LOW	test/e2e-tests-upgrade.sh	1	#!/usr/bin/env bash	COMMENT
LOW	…ustom-task-ctrls/wait-task-beta/config/controller.yaml	121	app.kubernetes.io/instance: default	COMMENT
LOW	…h-timeout/config/resolver_with_timeout_deployment.yaml	1	# Copyright 2024 The Tekton Authors	COMMENT
LOW	config/config-info.yaml	1	# Copyright 2021 The Tekton Authors	COMMENT
LOW	config/webhook.yaml	1	# Copyright 2020 The Tekton Authors	COMMENT
LOW	config/webhook.yaml	101	value: config-observability	COMMENT
LOW	config/events.yaml	1	# Copyright 2023 The Tekton Authors	COMMENT
LOW	config/config-tracing.yaml	1	# Copyright 2023 The Tekton Authors	COMMENT
LOW	config/config-tracing.yaml	41	# to users that `kubectl edit` this config map.	COMMENT
LOW	config/config-feature-flags.yaml	1	# Copyright 2019 The Tekton Authors	COMMENT
LOW	config/config-feature-flags.yaml	21	app.kubernetes.io/instance: default	COMMENT
LOW	config/config-feature-flags.yaml	41	# accounts for secrets matching a specified format and automatically	COMMENT
LOW	config/config-feature-flags.yaml	61	# running. For clusters that use injected sidecars, setting this	COMMENT
LOW	config/config-feature-flags.yaml	81	# config-events ConfigMap. This flag only affects CustomRuns; it has no effect on	COMMENT
LOW	config/config-feature-flags.yaml	101	# "sidecar-logs" is now a beta feature.	COMMENT
LOW	config/config-feature-flags.yaml	121	# This feature is in preview mode and not implemented yet. Please check #7693 for updates.	COMMENT
LOW	config/config-feature-flags.yaml	141	# For advanced tuning of backoff parameters, update the 'wait-exponential-backoff' ConfigMap.	COMMENT
LOW	config/config-feature-flags.yaml	161	#	COMMENT
LOW	config/config-spire.yaml	1	# Copyright 2022 The Tekton Authors	COMMENT
LOW	config/config-spire.yaml	21	app.kubernetes.io/instance: default	COMMENT
LOW	config/config-spire.yaml	41	#	COMMENT
LOW	config/controller.yaml	1	# Copyright 2019 The Tekton Authors	COMMENT
LOW	config/webhook-hpa.yaml	1	# Copyright 2020 The Tekton Authors	COMMENT
LOW	config/config-observability.yaml	1	# Copyright 2019 The Tekton Authors	COMMENT
LOW	config/config-observability.yaml	21	app.kubernetes.io/instance: default	COMMENT
LOW	config/config-observability.yaml	41	# OpenTelemetry Metrics Configuration	COMMENT
LOW	config/config-observability.yaml	61	#	COMMENT
LOW	config/config-leader-election-controller.yaml	1	# Copyright 2020 Tekton Authors LLC	COMMENT
LOW	config/config-leader-election-controller.yaml	21	app.kubernetes.io/instance: default	COMMENT
LOW	config/config-leader-election-controller.yaml	41	# renew-deadline is how long a leader will try to renew the lease before	COMMENT
LOW	config/200-clusterrole.yaml	1	# Copyright 2020-2022 The Tekton Authors	COMMENT
LOW	config/201-clusterrolebinding.yaml	1	# Copyright 2019 The Tekton Authors	COMMENT
LOW	config/config-wait-exponential-backoff.yaml	1	# Copyright 2025 The Tekton Authors	COMMENT
LOW	config/201-rolebinding.yaml	1	# Copyright 2020 The Tekton Authors	COMMENT
LOW	config/200-role.yaml	1	# Copyright 2020 The Tekton Authors	COMMENT
LOW	config/clusterrole-aggregate-edit.yaml	1	# Copyright 2019-2022 The Tekton Authors	COMMENT
LOW	config/config-leader-election-events.yaml	1	# Copyright 2023 Tekton Authors LLC	COMMENT
LOW	config/config-leader-election-events.yaml	21	app.kubernetes.io/instance: default	COMMENT
LOW	config/config-leader-election-events.yaml	41	# renew-deadline is how long a leader will try to renew the lease before	COMMENT
LOW	config/config-logging.yaml	1	# Copyright 2019 Tekton Authors LLC	COMMENT
LOW	config/clusterrole-aggregate-view.yaml	1	# Copyright 2019-2022 The Tekton Authors	COMMENT
LOW	config/config-events.yaml	1	# Copyright 2023 The Tekton Authors	COMMENT
LOW	config/config-events.yaml	21	app.kubernetes.io/instance: default	COMMENT
LOW	config/config-events.yaml	41	# the only format supported today is "tektonv1". An empty string is not	COMMENT
LOW	config/500-webhooks.yaml	1	# Copyright 2020 The Tekton Authors	COMMENT
LOW	config/config-defaults.yaml	1	# Copyright 2019 The Tekton Authors	COMMENT
LOW	config/config-defaults.yaml	21	app.kubernetes.io/instance: default	COMMENT
LOW	config/config-defaults.yaml	41	# minutes to use for TaskRun and PipelineRun, if none is specified.	COMMENT
LOW	config/config-defaults.yaml	61	# PipelineRun, the default-affinity-assistant-pod-template is merged with	COMMENT
LOW	config/config-defaults.yaml	81		COMMENT
LOW	config/config-defaults.yaml	101	# default-maximum-resolution-timeout specifies the default duration used by the	COMMENT
370 more matches not shown…

Self-Referential Comments12 hits · 36 pts

Severity	File	Line	Snippet	Context
MEDIUM	test/git-resolver/gitea.yaml	1	# This file is used to install gitea into the e2e test cluster to be used in resolvers_test.go's TestGitResolver_API.	COMMENT
MEDIUM	hack/setup-kind.sh	223	# Create a cluster!	COMMENT
MEDIUM	hack/setup-kind.sh	293	# Create a registry-credentials secret and attach it to the list of service accounts in the namespace.	COMMENT
MEDIUM	hack/setup-kind.sh	298	# Create a secret resource with the contents of the docker auth configured above.	COMMENT
MEDIUM	hack/generate-dependabot.go	102	# This file is generated by hack/generate-dependabot.sh	COMMENT
MEDIUM	examples/v1/taskruns/authenticating-git-commands.yaml	95	# Create the git repo we're going to test against.	COMMENT
MEDIUM	examples/v1/taskruns/readonly-internal-dir.yaml	1	# This file is primarily used for test validation of internal Tekton	COMMENT
MEDIUM	…ples/v1/taskruns/beta/authenticating-git-commands.yaml	96	# Create the git repo we're going to test against.	COMMENT
MEDIUM	.github/dependabot.config.yml	2	# This file defines the base configuration and branches for dependabot updates.	COMMENT
MEDIUM	.github/dependabot.yml	2	# This file is generated by hack/generate-dependabot.sh	COMMENT
MEDIUM	.github/workflows/nightly-builds.yaml	135	# Create a Kubernetes secret for GHCR authentication.	COMMENT
MEDIUM	.github/workflows/dependabot-regen.yml	62	# Create a new branch	COMMENT

Structural Annotation Overuse14 hits · 25 pts

Severity	File	Line	Snippet	Context
LOW	docs/resolution-getting-started.md	30	## Step 1: Install Tekton Pipelines and the Resolvers	COMMENT
LOW	docs/resolution-getting-started.md	35	## Step 2: Ensure Pipelines is configured to enable resolvers	COMMENT
LOW	docs/resolution-getting-started.md	49	## Step 3: Try it out!	COMMENT
LOW	docs/resolution-getting-started.md	128	## Step 4: Monitor the PipelineRun	COMMENT
LOW	pkg/termination/write_test.go	333	// Step 1: Verify this exceeds the 4KB limit without compression	COMMENT
LOW	pkg/termination/write_test.go	346	// Step 2: Verify the same results fit with compression	COMMENT
LOW	pkg/termination/write_test.go	358	// Step 3: Verify all results survive the round-trip	COMMENT
LOW	pkg/reconciler/pipelinerun/pipelinerun_pinp_test.go	1019	// Step 1: Reconcile A's PipelineRun — should create child for B (no cycle)	COMMENT
LOW	pkg/reconciler/pipelinerun/pipelinerun_pinp_test.go	1045	// Step 2: Reconcile B's PipelineRun — should detect cycle (A is in ancestor chain)	COMMENT
LOW⚡	pkg/reconciler/events/cache/cache_test.go	366	// Step 1: running, no message — L1 miss	COMMENT
LOW⚡	pkg/reconciler/events/cache/cache_test.go	371	// Step 2: running, message "step 2/3" — L1 miss (new condition state)	COMMENT
LOW⚡	pkg/reconciler/events/cache/cache_test.go	376	// Step 3: same state repeated — L1 hit → skip	COMMENT
LOW⚡	pkg/reconciler/events/cache/cache_test.go	380	// Step 4: succeeded — L1 miss	COMMENT
LOW⚡	pkg/reconciler/events/cache/cache_test.go	387	// Step 5: succeeded with different message — L1 miss (message changed)	COMMENT

Verbosity Indicators14 hits · 25 pts

Severity	File	Line	Snippet	Context
LOW	pkg/apis/pipeline/v1/param_types.go	510	// data so we need to check if it is empty.	COMMENT
LOW	pkg/apis/pipeline/v1/types/param_types.go	68	// data so we need to check if it is empty.	COMMENT
LOW	pkg/apis/pipeline/v1beta1/param_types.go	460	// data so we need to check if it is empty.	COMMENT
LOW	pkg/termination/write_test.go	333	// Step 1: Verify this exceeds the 4KB limit without compression	COMMENT
LOW	pkg/termination/write_test.go	346	// Step 2: Verify the same results fit with compression	COMMENT
LOW	pkg/termination/write_test.go	358	// Step 3: Verify all results survive the round-trip	COMMENT
LOW	pkg/workspace/apply.go	73	// If it's a PVC, we need to check if we've encountered it before so we avoid mounting it twice	COMMENT
LOW	pkg/reconciler/pipelinerun/pipelinerun_pinp_test.go	1019	// Step 1: Reconcile A's PipelineRun — should create child for B (no cycle)	COMMENT
LOW	pkg/reconciler/pipelinerun/pipelinerun_pinp_test.go	1045	// Step 2: Reconcile B's PipelineRun — should detect cycle (A is in ancestor chain)	COMMENT
LOW⚡	pkg/reconciler/events/cache/cache_test.go	366	// Step 1: running, no message — L1 miss	COMMENT
LOW⚡	pkg/reconciler/events/cache/cache_test.go	371	// Step 2: running, message "step 2/3" — L1 miss (new condition state)	COMMENT
LOW⚡	pkg/reconciler/events/cache/cache_test.go	376	// Step 3: same state repeated — L1 hit → skip	COMMENT
LOW⚡	pkg/reconciler/events/cache/cache_test.go	380	// Step 4: succeeded — L1 miss	COMMENT
LOW⚡	pkg/reconciler/events/cache/cache_test.go	387	// Step 5: succeeded with different message — L1 miss (message changed)	COMMENT

Slop Phrases7 hits · 14 pts

Severity	File	Line	Snippet	Context
MEDIUM	test/resolvers_test.go	97	- ReadWriteOnce # access mode may affect how you can use this volume in parallel tasks	CODE
MEDIUM	test/resolvers_test.go	157	- ReadWriteOnce # access mode may affect how you can use this volume in parallel tasks	CODE
MEDIUM	test/resolvers_test.go	437	- ReadWriteOnce # access mode may affect how you can use this volume in parallel tasks	CODE
MEDIUM	test/resolvers_test.go	543	- ReadWriteOnce # access mode may affect how you can use this volume in parallel tasks	CODE
MEDIUM	examples/v1/pipelineruns/beta/git-resolver.yaml	11	- ReadWriteOnce # access mode may affect how you can use this volume in parallel tasks	CODE
MEDIUM	…/v1/pipelineruns/no-ci/git-resolver-custom-apiurl.yaml	11	- ReadWriteOnce # access mode may affect how you can use this volume in parallel tasks	CODE
MEDIUM	…/v1/pipelineruns/no-ci/git-resolver-custom-secret.yaml	11	- ReadWriteOnce # access mode may affect how you can use this volume in parallel tasks	CODE

AI Response Leakage1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	examples/v1/pipelineruns/beta/isolated-workspaces.yaml	1	# In this example a PipelineRun accepts a workspace	COMMENT

AI Slop Vocabulary2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	pkg/apis/resolution/v1beta1/resolution_request_types.go	65	// path to file, the kind of authentication to leverage, etc.	COMMENT
MEDIUM	…g/apis/resolution/v1alpha1/resolution_request_types.go	64	// path to file, the kind of authentication to leverage, etc.	COMMENT

Redundant / Tautological Comments2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	test/excessive_reconciliation_test.go	92	# Set timeout to 0 to disable timeout and trigger the excessive reconciliation bug	COMMENT
LOW	config/config-feature-flags.yaml	110	# Set it to "false" if the generated security contexts are incompatible with the injected	COMMENT

Fake / Example Data3 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	…remoteresolution/resolver/framework/reconciler_test.go	364	expectedErr: errors.New(`invalid resource request "foo/rr": missing fake-key`),	CODE
LOW	pkg/remoteresolution/resolver/framework/fakeresolver.go	43	FakeParamName string = "fake-key"	CODE
LOW	pkg/resolution/resolver/framework/fakeresolver.go	40	FakeParamName string = "fake-key"	CODE

Example Usage Blocks1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	pkg/reconciler/notifications/testing/assets.go	69	// Example usage:	COMMENT

tektoncd/pipeline

Open-Source Code Quality, Security and Technical Debt Review