{
  "repository": "astral-sh/uv",
  "ref": "d71db4f5a81972de58bcbff0338dd1d5e45b0021",
  "methods": [
    {
      "slug": "formal",
      "title": "Formal verification and model checking"
    },
    {
      "slug": "static_analysis",
      "title": "Static analysis"
    },
    {
      "slug": "testing",
      "title": "Testing"
    },
    {
      "slug": "formatting",
      "title": "Formatting and hygiene"
    },
    {
      "slug": "supply_chain",
      "title": "Supply chain"
    },
    {
      "slug": "unclassified",
      "title": "Unclassified"
    }
  ],
  "verifications": [
    {
      "tool": "clippy",
      "method": "static_analysis",
      "commands": [
        "cargo clippy --workspace --all-targets --all-features --locked",
        "cargo clippy --all-features --locked --target x86_64-pc-windows-msvc --tests"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-lint.yml",
          "locator": "jobs.clippy-ubuntu.steps[3] (Clippy)"
        },
        {
          "path": ".github/workflows/check-lint.yml",
          "locator": "jobs.clippy-windows.steps[5] (Clippy)"
        },
        {
          "path": ".github/workflows/test-windows-trampolines.yml",
          "locator": "jobs.windows-trampoline-check.steps[7] (Clippy)"
        },
        {
          "path": "clippy.toml",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/rust-lang/rust-clippy",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "zizmor",
      "method": "static_analysis",
      "commands": [
        "uses zizmorcore/zizmor-action"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-zizmor.yml",
          "locator": "jobs.zizmor.steps[1]"
        }
      ],
      "upstream": "https://github.com/zizmorcore/zizmor",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "mkdocs",
      "method": "static_analysis",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "pyproject.toml",
          "locator": "[dependency-groups] docs: mkdocs"
        }
      ],
      "upstream": "https://github.com/mkdocs/mkdocs",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": true
    },
    {
      "tool": "ruff-check",
      "method": "static_analysis",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "pyproject.toml",
          "locator": "[dependency-groups] check: ruff"
        },
        {
          "path": "crates/uv-build/ruff.toml",
          "locator": "config file"
        },
        {
          "path": "crates/uv-python-interpreter/python/ruff.toml",
          "locator": "config file"
        },
        {
          "path": "python/ruff.toml",
          "locator": "config file"
        },
        {
          "path": "ruff.toml",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/astral-sh/ruff",
      "docs": "https://docs.astral.sh/ruff/linter/#exit-codes",
      "exit_codes": {
        "0": "no violations",
        "1": "violations found",
        "2": "invalid configuration, CLI options or internal error"
      },
      "autofix": true,
      "declared_only": true
    },
    {
      "tool": "cargo-test",
      "method": "testing",
      "commands": [
        "cargo test --locked -p uv-trampoline-builder --target $EXPR-pc-windows-msvc",
        "cargo test --locked -p uv-trampoline-builder --target $EXPR-pc-windows-msvc --no-default-features"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-windows-trampolines.yml",
          "locator": "jobs.windows-trampoline-test.steps[6] (Test committed binaries)"
        },
        {
          "path": ".github/workflows/test-windows-trampolines.yml",
          "locator": "jobs.windows-trampoline-test.steps[8] (Test new binaries)"
        }
      ],
      "upstream": "https://github.com/rust-lang/cargo",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "ci-matrix",
      "method": "testing",
      "commands": [
        "windows-trampoline-check (target-arch: 3)",
        "windows-trampoline-test (include: 3)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-windows-trampolines.yml",
          "locator": "jobs.windows-trampoline-check.strategy.matrix"
        },
        {
          "path": ".github/workflows/test-windows-trampolines.yml",
          "locator": "jobs.windows-trampoline-test.strategy.matrix"
        }
      ],
      "upstream": "https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "ruff-format",
      "method": "formatting",
      "commands": [
        "ruff format --diff ."
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-fmt.yml",
          "locator": "jobs.python.steps[2]"
        }
      ],
      "upstream": "https://github.com/astral-sh/ruff",
      "docs": "https://docs.astral.sh/ruff/formatter/#exit-codes",
      "exit_codes": {
        "0": "already formatted",
        "1": "files would be reformatted (--check)",
        "2": "error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "rustfmt",
      "method": "formatting",
      "commands": [
        "cargo fmt --all --check",
        "cargo fmt --check"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-fmt.yml",
          "locator": "jobs.rust.steps[2]"
        },
        {
          "path": ".github/workflows/test-windows-trampolines.yml",
          "locator": "jobs.windows-trampoline-check.steps[6] (rustfmt)"
        },
        {
          "path": "rustfmt.toml",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/rust-lang/rustfmt",
      "docs": null,
      "exit_codes": {},
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "black",
      "method": "formatting",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "pyproject.toml",
          "locator": "[dependency-groups] docs: black"
        }
      ],
      "upstream": "https://github.com/psf/black",
      "docs": null,
      "exit_codes": {
        "0": "nothing to change",
        "1": "files would be reformatted (--check)",
        "123": "internal error"
      },
      "autofix": true,
      "declared_only": true
    },
    {
      "tool": "prettier",
      "method": "formatting",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": ".prettierrc",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/prettier/prettier",
      "docs": "https://prettier.io/docs/cli#exit-codes",
      "exit_codes": {
        "0": "everything formatted",
        "1": "something was not formatted (--check)",
        "2": "prettier error"
      },
      "autofix": true,
      "declared_only": true
    },
    {
      "tool": "cargo-deny",
      "method": "supply_chain",
      "commands": [
        "cargo deny --all-features check licenses",
        "cargo deny --all-features check sources",
        "cargo deny --all-features check bans",
        "cargo deny --manifest-path crates/uv-build/Cargo.toml --all-features check bans"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-lint.yml",
          "locator": "jobs.cargo-deny.steps[2] (Check licenses)"
        },
        {
          "path": ".github/workflows/check-lint.yml",
          "locator": "jobs.cargo-deny.steps[3] (Check sources)"
        },
        {
          "path": ".github/workflows/check-lint.yml",
          "locator": "jobs.cargo-deny.steps[5] (Check bans)"
        },
        {
          "path": ".github/workflows/check-lint.yml",
          "locator": "jobs.cargo-deny.steps[6] (Check uv_build dependencies)"
        },
        {
          "path": ".cargo/deny.toml",
          "locator": "config file"
        },
        {
          "path": "crates/uv-build/deny.toml",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/EmbarkStudios/cargo-deny",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "Re-run the check after the policy is updated."
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-crates-policies.yml",
          "locator": "jobs.check.steps[4] (Comment on the release pull request)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "Select-String -Pattern 'core::fmt"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-windows-trampolines.yml",
          "locator": "jobs.windows-trampoline-check.steps[8] (Bloat Check)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "Select-String -Pattern 'core::fmt::write"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-windows-trampolines.yml",
          "locator": "jobs.windows-trampoline-check.steps[8] (Bloat Check)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "Write-Host Verifying pyenv-win installation..."
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-integration.yml",
          "locator": "jobs.integration-test-wsl.steps[3] (Install pyenv-win)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "and (test([\\r\\n])"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/fix-bug.yml",
          "locator": "jobs.fix.steps[9] (Commit verified bug fix)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "buildx imagetools inspect ${image_tags[0]} --format {{.Manifest.Digest}})"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/publish-docker-image.yml",
          "locator": "jobs.publish.steps[7] (Copy saved image and publish tags)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "buildx imagetools inspect registry.depot.dev/${DEPOT_PROJECT_ID}:$build_id --format {{.Manifest.Digest}})"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/publish-docker-image.yml",
          "locator": "jobs.publish.steps[7] (Copy saved image and publish tags)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cargo hawk check -D warnings"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-lint.yml",
          "locator": "jobs.hawk.steps[4] (Hawk)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "check cargo-shear --deny-warnings"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-lint.yml",
          "locator": "jobs.shear.steps[2]"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "check ruff check ."
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-lint.yml",
          "locator": "jobs.ruff.steps[2]"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "check ty check python/uv"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-lint.yml",
          "locator": "jobs.ty.steps[2]"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "check typos"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-lint.yml",
          "locator": "jobs.typos.steps[2]"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "check_in_bin $executable_name $folder_path"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-integration.yml",
          "locator": "jobs.integration-test-pypy-linux.steps[5] (Check for executables)"
        },
        {
          "path": ".github/workflows/test-integration.yml",
          "locator": "jobs.integration-test-graalpy-linux.steps[5] (Check for executables)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "dist ${dist_args[@]} --output-format=json > plan-dist-manifest.json"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.plan.steps[3]"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "dist plan --output-format=json > plan-dist-manifest.json"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-release.yml",
          "locator": "jobs.dist-plan.steps[2] (Run dist plan)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "docs mkdocs build --strict -f mkdocs.yml"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-docs.yml",
          "locator": "jobs.docs.steps[6] (Build docs)"
        },
        {
          "path": ".github/workflows/publish-docs.yml",
          "locator": "jobs.mkdocs.steps[6] (Build docs)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "gnome-keyring-daemon --components=secrets --daemonize --unlock <<< foobar"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test.yml",
          "locator": "jobs.cargo-test-linux.steps[7] (Start gnome-keyring)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "graalpy scripts/check_system_python.py --uv ./uv"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-graalpy.steps[5] (Validate global Python install)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "out check_crates_policies $check_crates_policies"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/plan.yml",
          "locator": "jobs.plan.steps[3] (Plan)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "out check_schema $check_schema"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/plan.yml",
          "locator": "jobs.plan.steps[3] (Plan)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "out require_check_release $require_check_release"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/plan.yml",
          "locator": "jobs.plan.steps[3] (Plan)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "out review_security $review_security"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/plan.yml",
          "locator": "jobs.plan.steps[3] (Plan)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "out run_checks $run_checks"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/plan.yml",
          "locator": "jobs.plan.steps[3] (Plan)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "out test_code $test_code"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/plan.yml",
          "locator": "jobs.plan.steps[3] (Plan)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "out test_ecosystem $test_ecosystem"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/plan.yml",
          "locator": "jobs.plan.steps[3] (Plan)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "out test_integration $test_integration"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/plan.yml",
          "locator": "jobs.plan.steps[3] (Plan)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "out test_macos $test_macos"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/plan.yml",
          "locator": "jobs.plan.steps[3] (Plan)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "out test_publish $test_publish"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/plan.yml",
          "locator": "jobs.plan.steps[3] (Plan)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "out test_smoke $test_smoke"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/plan.yml",
          "locator": "jobs.plan.steps[3] (Plan)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "out test_system $test_system"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/plan.yml",
          "locator": "jobs.plan.steps[3] (Plan)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "out test_windows_trampoline $test_windows_trampoline"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/plan.yml",
          "locator": "jobs.plan.steps[3] (Plan)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "out test_windows_trampoline_check_binary $test_windows_trampoline_check_binary"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/plan.yml",
          "locator": "jobs.plan.steps[3] (Plan)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pypy scripts/check_system_python.py --uv ./uv"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-pypy.steps[5] (Validate global Python install)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pyston scripts/check_system_python.py --uv ./uv"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-pyston.steps[4] (Validate global Python install)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python -3.10 ./scripts/check_system_python.py --uv ./uv.exe"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-windows-python-310.steps[4] (Validate global Python install)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python -3.13 ./scripts/check_system_python.py --uv ./uv.exe"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-windows-x86_64-python-313.steps[4] (Validate global Python install)"
        },
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-windows-aarch64-x86-python-313.steps[3] (Validate global Python install)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python -3.13-arm64 ./scripts/check_system_python.py --uv ./uv.exe"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-windows-aarch64-aarch64-python-313.steps[3] (Validate global Python install)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python ./scripts/check_embedded_python.py --uv ./uv.exe"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-windows-embedded-python-310.steps[7] (Validate embedded Python install)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python ./scripts/check_registry.py --uv ./uv.exe"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-integration.yml",
          "locator": "jobs.integration-test-windows-registry.steps[2] (Test PEP 514 registration)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python ./scripts/check_system_python.py --uv ./uv"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-conda.steps[8] (Validate global Python install)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python ./scripts/check_system_python.py --uv ./uv.exe"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-windows-x86_64-python-310.steps[4] (Validate global Python install)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python ./scripts/check_system_python.py --uv ./uv.exe --check-python-version $env:TEST_PYTHON_VERSION --check-path"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-choco.steps[3] (Validate global Python install)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check_cache_compat.py --uv-current ./uv --uv-previous ./uv-aarch64-apple-darwin/uv"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-integration.yml",
          "locator": "jobs.cache-test-macos-aarch64.steps[6] (Check cache compatibility)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check_cache_compat.py --uv-current ./uv --uv-previous ./uv-x86_64-unknown-linux-gnu/uv"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-integration.yml",
          "locator": "jobs.cache-test-ubuntu.steps[5] (Check cache compatibility)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check_system_python.py --uv ./uv"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-fedora.steps[5] (Validate global Python install)"
        },
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-ubuntu.steps[5] (Validate global Python install)"
        },
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-python.steps[4] (Validate global Python install)"
        },
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-python-36.steps[4] (Validate global Python install)"
        },
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-python-37.steps[4] (Validate global Python install)"
        },
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-rocky-linux.steps[8] (Validate global Python install)"
        },
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-chainguard-dev.steps[4] (Validate global Python install)"
        },
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-pyenv.steps[5] (Validate global Python install)"
        },
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-linux-313.steps[5] (Validate global Python install)"
        },
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-amazonlinux.steps[7] (Validate global Python install)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check_system_python.py --uv ./uv --externally-managed"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-debian.steps[5] (Validate global Python install)"
        },
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-alpine.steps[5] (Validate global Python install)"
        },
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-macos-aarch64.steps[5] (Validate global Python install)"
        },
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-macos-aarch64-emulated.steps[6] (Validate global Python install)"
        },
        {
          "path": ".github/workflows/test-system.yml",
          "locator": "jobs.system-test-macos-x86_64.steps[6] (Validate global Python install)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/patch-dist-manifest-checksums.py --manifest $temp_manifest --artifacts-dir target/distrib"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.generate-local-dist-manifest.steps[3] (Generate local dist manifest)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "reject The private pull request is no longer approved by a repository writer."
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/promote-pull-request.yml",
          "locator": "jobs.promote.steps[5] (Promote pull request)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "reject The private pull request was not approved by a repository writer."
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/promote-pull-request.yml",
          "locator": "jobs.prepare.steps[3] (Plan promotion)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "rev-parse --verify refs/remotes/origin/$BASE_REF^{commit})"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/promote-pull-request.yml",
          "locator": "jobs.promote.steps[2] (Verify promotion revision)"
        },
        {
          "path": ".github/workflows/rebase-conflicted-pull-request.yml",
          "locator": "jobs.rebase.steps[6] (Prepare pull request branch)"
        },
        {
          "path": ".github/workflows/rebase-conflicted-pull-request.yml",
          "locator": "jobs.push.steps[2] (Import rebased pull request)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security create-keychain -p  $RUNNER_TEMP/uv-ci.keychain-db"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test.yml",
          "locator": "jobs.cargo-test-macos.steps[5] (Create CI keychain)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security default-keychain -d user -s $RUNNER_TEMP/uv-ci.keychain-db"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test.yml",
          "locator": "jobs.cargo-test-macos.steps[5] (Create CI keychain)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security list-keychains -d user -s $RUNNER_TEMP/uv-ci.keychain-db"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test.yml",
          "locator": "jobs.cargo-test-macos.steps[5] (Create CI keychain)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security set-keychain-settings -lut 21600 $RUNNER_TEMP/uv-ci.keychain-db"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test.yml",
          "locator": "jobs.cargo-test-macos.steps[5] (Create CI keychain)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security unlock-keychain -p  $RUNNER_TEMP/uv-ci.keychain-db"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test.yml",
          "locator": "jobs.cargo-test-macos.steps[5] (Create CI keychain)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "throw NASM installer checksum mismatch"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/build-release-binaries.yml",
          "locator": "jobs.windows.steps[4] (Install NASM)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "type == array)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/fix-bug.yml",
          "locator": "jobs.context.steps[2] (Prepare fix context)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "type == object)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/update-issue-context.yml",
          "locator": "jobs.update.steps[5] (Validate Codex thread)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "type == string"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pull-request-labels.yml",
          "locator": "jobs.validate.steps[2] (Validate recommended labels)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "type == string and length > 0"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/fix-bug.yml",
          "locator": "jobs.fix.steps[9] (Commit verified bug fix)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "type == string and length > 0)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/diagnose-workflow-failure.yml",
          "locator": "jobs.report.steps[2] (Report workflow failure)"
        },
        {
          "path": ".github/workflows/fix-bug.yml",
          "locator": "jobs.context.steps[2] (Prepare fix context)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "type == string)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/diagnose-workflow-failure.yml",
          "locator": "jobs.report.steps[2] (Report workflow failure)"
        },
        {
          "path": ".github/workflows/update-issue-context.yml",
          "locator": "jobs.update.steps[5] (Validate Codex thread)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "xargs shellcheck --shell bash --severity style"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-lint.yml",
          "locator": "jobs.shellcheck.steps[2] (Run shellcheck)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    }
  ]
}