v0.2.0

Local detection replaces Scorecard

v0.2.0 removes Scorecard as a runtime dependency. Nine checks keep their Scorecard names and now use parsers in signals, while additional detectors cover other repository evidence. Scans operate on local Git objects, reuse parsed blobs across commits, and make no forge API calls. Each signal names its source commit and path, and output contains no score.

Inspect and compare revisions

signals summary reports the complete detected state at a commit, branch, or tag; signals diff compares two states without walking the commits between them. Direct comparisons share detector and blob caches across the two revisions. Both commands support text, Markdown, and JSON output.

signals summary --ref v1.0.0 --markdown .
signals diff --json v1.0.0 v2.0.0 .

New repository evidence

• Supply-chain detection reads committed attestations, artifact-provenance workflows, publication provenance, and GoReleaser signing or SBOM configuration. Signed release tags and locally available Gittuf refs appear as commit events.
• Repository policy coverage includes CODEOWNERS, maintainer and governance files, security changelogs, threat models, audit documents, disclosure documents, sensitive ignore rules, and Agent Skills.
• Source and workflow scanning traces shell downloads through checksum checks and later execution. It also detects Subresource Integrity metadata, committed SARIF results, certificates, trust stores, cache modes, job timeouts, runner selection, and workflow permissions.
• Package analysis adds manifest license expressions, notices, publication settings, dependency constraints, and project threat-surface signals.
• History output suppresses remove/add pairs caused only by changed line numbers.

Release artifacts

The GitHub release publishes six archives covering Linux, macOS, and Windows on AMD64 and ARM64. The checksum file has a keyless Cosign bundle. Go 1.27.3 or newer is required for installation from source.

go install github.com/git-pkgs/signals@v0.2.0

Scope

signals reads repository content and Git metadata. Branch protection, successful workflow runs, issue activity, release assets from earlier releases, webhooks, and vulnerability databases are stored elsewhere and remain outside the scan. Configuration signals show what a repository declares without proving that a workflow completed. Signature events record presence without validating key or certificate trust. The full comparison between v0.1.0 and v0.2.0 lists all 25 commits.