{"id":22326547,"url":"https://github.com/jsfpdn/git-audit","last_synced_at":"2026-07-19T02:06:12.522Z","repository":{"id":49569250,"uuid":"376060941","full_name":"jsfpdn/git-audit","owner":"jsfpdn","description":"Git Audit tool computing changelogs from public GitHub repositories. ","archived":false,"fork":false,"pushed_at":"2021-06-14T08:54:12.000Z","size":42,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-10-23T11:42:01.804Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jsfpdn.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-06-11T15:02:45.000Z","updated_at":"2021-06-14T08:54:15.000Z","dependencies_parsed_at":"2022-08-30T14:50:51.199Z","dependency_job_id":null,"html_url":"https://github.com/jsfpdn/git-audit","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/jsfpdn/git-audit","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsfpdn%2Fgit-audit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsfpdn%2Fgit-audit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsfpdn%2Fgit-audit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsfpdn%2Fgit-audit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jsfpdn","download_url":"https://codeload.github.com/jsfpdn/git-audit/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsfpdn%2Fgit-audit/sbom","scorecard":{"id":538171,"data":{"date":"2025-08-11","repo":{"name":"github.com/jsfpdn/git-audit","commit":"d3455456f7d196e77b09273e1f92e1abe956582f"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":1.8,"checks":[{"name":"Code-Review","score":0,"reason":"Found 0/7 approved changesets -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Dangerous-Workflow","score":-1,"reason":"no workflows found","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Token-Permissions","score":-1,"reason":"No tokens found","details":null,"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Pinned-Dependencies","score":3,"reason":"dependency not pinned by hash detected -- score normalized to 3","details":["Warn: containerImage not pinned by hash: Dockerfile:1","Warn: containerImage not pinned by hash: Dockerfile:11: pin your Docker image by updating alpine to alpine@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1","Info:   0 out of   2 containerImage dependencies pinned","Info:   1 out of   1 goCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'main'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 7 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Vulnerabilities","score":0,"reason":"13 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GO-2022-0288","Warn: Project is vulnerable to: GO-2022-0969 / GHSA-69cg-p879-7622","Warn: Project is vulnerable to: GO-2022-1144 / GHSA-xrjj-mj9h-534m","Warn: Project is vulnerable to: GO-2023-1571 / GHSA-vvpx-j8f3-3w6h","Warn: Project is vulnerable to: GO-2023-1988 / GHSA-2wrh-6pvc-2jm9","Warn: Project is vulnerable to: GO-2023-2102 / GHSA-4374-p667-p6c8","Warn: Project is vulnerable to: GO-2023-2153 / GHSA-m425-mq94-257g / GHSA-qppj-fm5r-hxr3","Warn: Project is vulnerable to: GO-2024-2687 / GHSA-4v7x-pqxf-cx7m","Warn: Project is vulnerable to: GO-2024-3333","Warn: Project is vulnerable to: GO-2025-3503 / GHSA-qxp5-gwg8-xv66","Warn: Project is vulnerable to: GO-2025-3595 / GHSA-vvgc-356p-c3xw","Warn: Project is vulnerable to: GO-2022-0493 / GHSA-p782-xgp4-8hr8","Warn: Project is vulnerable to: GO-2024-2611 / GHSA-8r3f-844c-mc37"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-20T07:32:17.301Z","repository_id":49569250,"created_at":"2025-08-20T07:32:17.301Z","updated_at":"2025-08-20T07:32:17.301Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35637771,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-19T02:00:06.923Z","response_time":112,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-04T02:18:04.294Z","updated_at":"2026-07-19T02:06:12.507Z","avatar_url":"https://github.com/jsfpdn.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Git Audit\n\nGit Audit tool computing changelogs from public GitHub repositories.\nThis tool can be either run as a client, calling the GitHub API directly,\nor as a gRPC server.\n\n\u003e Note: This tool uses public GitHub API which is rate limited to 60 requests per hour.\n\n## Install\n\n```bash\ngit clone https://github.com/jsfpdn/git-audit.git\ncd git-audit\nmake install\n```\n\n## Usage\n\nShow help with `git-audit help`.\nTo see help for individual subcommands,\nrun `git-audit help client` or `git-audit help server`.\n\n### Using CLI Client\n\n```bash\ngit-audit client --owner \u003cOWNER\u003e --repository \u003cREPOSITORY\u003e\n```\n\nBy default, commits are pretty-printed on a single line,\nsimilar to `git log --pretty=oneline`.\nTo see whole commit messages, use the `--verbose` (`-v`) flag.\n\n#### Examples\n\nDisplay the latest commit from the\n[octocat/Hello-World](https://github.com/octocat/Hello-World) repository:\n\n```bash\n$ git-audit client --owner octocat --repository Hello-World\n```\n\nOutput:\n\n```text\nchangelog for github.com/octocat/Hello-World from HEAD\n7fd1a60b01f91b314f59955a4e4d4e80d8edf11d Merge pull request #6 from Spaceghost/patch-1\n```\n\nThis can be equivalently called by appending `--sha HEAD` flag to the previous command:\n\n```bash\n$ git-audit client --owner octocat --repository Hello-World --sha HEAD\n```\n\nOutput:\n\n```text\nchangelog for github.com/octocat/Hello-World from HEAD\n7fd1a60b01f91b314f59955a4e4d4e80d8edf11d Merge pull request #6 from Spaceghost/patch-1\n```\n\nShow the full commit message of the latest commit:\n\n```bash\n$ git-audit client --owner octocat --repository Hello-World --verbose\n```\n\nOutput:\n\n```text\nchangelog for github.com/octocat/Hello-World from HEAD\n7fd1a60b01f91b314f59955a4e4d4e80d8edf11d Merge pull request #6 from Spaceghost/patch-1\n\tNew line at end of file.\n```\n\nTo get the complete changelog of the repository,\nsupply the commit hash of the first commit.\nInitial commit of this repository has hash `553c2077f0edc3d5dc5d17262f6aa498e69d6f8e`.\n\n```bash\n$ git-audit client --owner octocat --repository Hello-World --sha 553c2077f0edc3d5dc5d17262f6aa498e69d6f8e\n```\n\nOutput:\n\n```text\nchangelog for github.com/octocat/Hello-World from 553c2077f0edc3d5dc5d17262f6aa498e69d6f8e\n762941318ee16e59dabbacb1b4049eec22f0d303 New line at end of file. --Signed off by Spaceghost\n7fd1a60b01f91b314f59955a4e4d4e80d8edf11d Merge pull request #6 from Spaceghost/patch-1\n553c2077f0edc3d5dc5d17262f6aa498e69d6f8e first commit\n```\n\n### Running the gRPC Server\n\n```bash\ngit-audit server --port \u003cPORT\u003e\n```\n\n#### Examples\n\nRun the gRPC server on port 8080:\n\n```bash\ngit-audit server --port 8080\n```\n\nExample of calling this gRPC server from a client can be found at\n[`/examples/grpc_client`](https://github.com/jsfpdn/git-audit/blob/main/examples/grpc_client/main.go).\nTo get the latest commit merged to the default branch in the official Go repository,\nrun the following command.\n\n```bash\n$ go run examples/grpc_client/main.go localhost:8080 golang go HEAD\n```\n\nThe output should look something like this:\n\n```text\nowner:\"golang\" repo:\"go\" SHA:\"HEAD\"\n326ea438bb579a2010e38e00f515a04344ff96b0 cmd/compile: rewrite a, b = f() to use temporaries when type not identical\n\tIf any of the LHS expressions of an OAS2FUNC are not identical to the\n\trespective function call results, escape analysis mishandles the\n\timplicit conversion, causes memory corruption.\n\n\tInstead, we should insert autotmps like we already do for f(g()) calls\n\tand return g() statements.\n\n\tFixes #46725\n\n\tChange-Id: I71a08da0bf1a03d09a023da5b6f78fb37a4a4690\n\tReviewed-on: https://go-review.googlesource.com/c/go/+/327651\n\tTrust: Cuong Manh Le \u003ccuong.manhle.vn@gmail.com\u003e\n\tRun-TryBot: Cuong Manh Le \u003ccuong.manhle.vn@gmail.com\u003e\n\tTryBot-Result: Go Bot \u003cgobot@golang.org\u003e\n\tReviewed-by: Matthew Dempsky \u003cmdempsky@google.com\u003e\n```\n\n#### Running the gRPC Server in a Container\n\ngRPC server can be ran in a Docker container.\nRun the following commands to build a docker image\nand run a docker container with the gRPC server listening on port 8080.\n\n```bash\nmake docker\ndocker run --rm -p 8080:8080 josefpodanyml/git-audit server --port 8080\n```\n\nTry running the gRPC client from above.\n\n```bash\n$ go run examples/grpc_client/main.go localhost:8080 golang go HEAD\n```\n\nThe output should look something like this:\n\n```text\nowner:\"golang\" repo:\"go\" SHA:\"HEAD\"\n326ea438bb579a2010e38e00f515a04344ff96b0 cmd/compile: rewrite a, b = f() to use temporaries when type not identical\n\tIf any of the LHS expressions of an OAS2FUNC are not identical to the\n\trespective function call results, escape analysis mishandles the\n\timplicit conversion, causes memory corruption.\n\n\tInstead, we should insert autotmps like we already do for f(g()) calls\n\tand return g() statements.\n\n\tFixes #46725\n\n\tChange-Id: I71a08da0bf1a03d09a023da5b6f78fb37a4a4690\n\tReviewed-on: https://go-review.googlesource.com/c/go/+/327651\n\tTrust: Cuong Manh Le \u003ccuong.manhle.vn@gmail.com\u003e\n\tRun-TryBot: Cuong Manh Le \u003ccuong.manhle.vn@gmail.com\u003e\n\tTryBot-Result: Go Bot \u003cgobot@golang.org\u003e\n\tReviewed-by: Matthew Dempsky \u003cmdempsky@google.com\u003e\n```\n\n## Deploying the gRPC Server\n\n```bash\nk apply -f ./deployment/deployment.yaml\nk apply -f ./deployment/service.yaml\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjsfpdn%2Fgit-audit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjsfpdn%2Fgit-audit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjsfpdn%2Fgit-audit/lists"}