{
  "repository": "crewaiinc/crewai",
  "ref": "dd21ecce11aa008d5ef0325e6802a3962ce4d443",
  "methods": [
    {
      "slug": "formal",
      "title": "Formal verification and model checking"
    },
    {
      "slug": "static_analysis",
      "title": "Static analysis"
    },
    {
      "slug": "testing",
      "title": "Testing"
    },
    {
      "slug": "formatting",
      "title": "Formatting and hygiene"
    },
    {
      "slug": "supply_chain",
      "title": "Supply chain"
    },
    {
      "slug": "unclassified",
      "title": "Unclassified"
    }
  ],
  "verifications": [
    {
      "tool": "codeql",
      "method": "static_analysis",
      "commands": [
        "uses github/codeql-action/analyze"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/codeql.yml",
          "locator": "jobs.analyze.steps[3] (Perform CodeQL Analysis)"
        }
      ],
      "upstream": "https://github.com/github/codeql",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "mypy",
      "method": "static_analysis",
      "commands": [
        "mypy lib/",
        "mypy --config-file pyproject.toml \"$@\"' --"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/type-checker.yml",
          "locator": "jobs.type-checker-matrix.steps[4] (Run type checks)"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.mypy"
        },
        {
          "path": "pyproject.toml",
          "locator": "[tool.mypy]"
        },
        {
          "path": "pyproject.toml",
          "locator": "[dependency-groups] dev: mypy"
        }
      ],
      "upstream": "https://github.com/python/mypy",
      "docs": "https://mypy.readthedocs.io/en/stable/command_line.html",
      "exit_codes": {
        "0": "no type errors",
        "1": "type errors found",
        "2": "crash or invalid invocation"
      },
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "ruff-check",
      "method": "static_analysis",
      "commands": [
        "ruff check lib/",
        "ruff check --config pyproject.toml \"$@\"' --"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/linter.yml",
          "locator": "jobs.lint-run.steps[4] (Ruff check)"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.ruff"
        },
        {
          "path": "pyproject.toml",
          "locator": "[tool.ruff]"
        },
        {
          "path": "pyproject.toml",
          "locator": "[dependency-groups] dev: ruff"
        }
      ],
      "upstream": "https://github.com/astral-sh/ruff",
      "docs": "https://docs.astral.sh/ruff/linter/#exit-codes",
      "exit_codes": {
        "0": "no violations",
        "1": "violations found",
        "2": "invalid configuration, CLI options or internal error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "bandit",
      "method": "static_analysis",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "pyproject.toml",
          "locator": "[tool.bandit]"
        },
        {
          "path": "pyproject.toml",
          "locator": "[dependency-groups] dev: bandit"
        }
      ],
      "upstream": "https://github.com/PyCQA/bandit",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": true
    },
    {
      "tool": "ci-matrix",
      "method": "testing",
      "commands": [
        "analyze (include: 2)",
        "tests-matrix (python-version: 4, group: 8)",
        "type-checker-matrix (python-version: 4)",
        "update-durations (python-version: 4)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/codeql.yml",
          "locator": "jobs.analyze.strategy.matrix"
        },
        {
          "path": ".github/workflows/tests.yml",
          "locator": "jobs.tests-matrix.strategy.matrix"
        },
        {
          "path": ".github/workflows/type-checker.yml",
          "locator": "jobs.type-checker-matrix.strategy.matrix"
        },
        {
          "path": ".github/workflows/update-test-durations.yml",
          "locator": "jobs.update-durations.strategy.matrix"
        }
      ],
      "upstream": "https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "pytest",
      "method": "testing",
      "commands": [
        "pytest lib/cli/tests/test_create_crew.py -k agents_md -p no:randomly -n 0",
        "pytest lib/devtools/tests/test_agents_md_eval.py -n 0",
        "pytest -vv --splits 8 --group $EXPR --randomly-seed=$EXPR $DURATIONS_ARG --durations=10 --maxfail=3",
        "pytest -vv --splits 8 --group $EXPR --randomly-seed=$EXPR --durations=10 --maxfail=3",
        "pytest lib/cli/tests lib/crewai-core/tests lib/crewai-files/tests -vv --splits 8 --group $EXPR --randomly-seed=$EXPR --durations=10 --maxfail=3"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/agents-md.yml",
          "locator": "jobs.guards.steps[4] (Run the AGENTS.md guards and the eval's own tests)"
        },
        {
          "path": ".github/workflows/tests.yml",
          "locator": "jobs.tests-matrix.steps[5] (Run tests (group ${{ matrix.group }} of 8))"
        },
        {
          "path": ".github/workflows/tests.yml",
          "locator": "jobs.tests-matrix.steps[6] (Run tool tests (group ${{ matrix.group }} of 8))"
        },
        {
          "path": ".github/workflows/tests.yml",
          "locator": "jobs.tests-matrix.steps[7] (Run CLI, core and files tests (group ${{ matrix.group }} of 8))"
        },
        {
          "path": ".github/workflows/update-test-durations.yml",
          "locator": "jobs.update-durations.steps[4] (Run all tests and store durations)"
        },
        {
          "path": "pyproject.toml",
          "locator": "[tool.pytest]"
        },
        {
          "path": "pyproject.toml",
          "locator": "[dependency-groups] dev: pytest"
        }
      ],
      "upstream": "https://github.com/pytest-dev/pytest",
      "docs": "https://docs.pytest.org/en/stable/reference/exit-codes.html",
      "exit_codes": {
        "0": "all tests passed",
        "1": "some tests failed",
        "2": "interrupted by the user",
        "3": "internal error",
        "4": "command line usage error",
        "5": "no tests were collected"
      },
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "ruff-format",
      "method": "formatting",
      "commands": [
        "ruff format --check lib/",
        "ruff format --config pyproject.toml \"$@\"' --"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/linter.yml",
          "locator": "jobs.lint-run.steps[5] (Ruff format)"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.ruff-format"
        }
      ],
      "upstream": "https://github.com/astral-sh/ruff",
      "docs": "https://docs.astral.sh/ruff/formatter/#exit-codes",
      "exit_codes": {
        "0": "already formatted",
        "1": "files would be reformatted (--check)",
        "2": "error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "pip-audit",
      "method": "supply_chain",
      "commands": [
        "pip-audit ${pip_audit_args[@]}",
        "pip-audit --skip-editable --ignore-vuln PYSEC-2024-277 --ignore-vuln PYSEC-2026-89 --ignore-vuln PYSEC-2026-97 --ignore-vuln PYSEC-2026-597 --ignore-vuln PYSEC-2025-148 --ignore-vuln PYSEC-2025-183 --ignore-vuln PYSEC-2025-189 --ignore-vuln PYSEC-2025-190 --ignore-vuln PYSEC-2025-191 --ignore-vuln PYSEC-2025-192 --ignore-vuln PYSEC-2025-193 --ignore-vuln PYSEC-2025-194 --ignore-vuln PYSEC-2025-195 --ignore-vuln PYSEC-2025-196 --ignore-vuln PYSEC-2025-197 --ignore-vuln PYSEC-2025-210 --ignore-vuln PYSEC-2026-139 --ignore-vuln PYSEC-2025-211 --ignore-vuln PYSEC-2025-212 --ignore-vuln PYSEC-2025-213 --ignore-vuln PYSEC-2025-214 --ignore-vuln PYSEC-2025-215 --ignore-vuln PYSEC-2025-216 --ignore-vuln PYSEC-2025-217 --ignore-vuln PYSEC-2025-218 --ignore-vuln GHSA-f4j7-r4q5-qw2c --ignore-vuln GHSA-2wm9-hf6c-p5cr --ignore-vuln GHSA-36p7-vc44-83pf --ignore-vuln GHSA-xph7-9rjv-w5fr --ignore-vuln GHSA-4j2p-28q2-5m79' --"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/vulnerability-scan.yml",
          "locator": "jobs.pip-audit.steps[5] (Run pip-audit)"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.pip-audit"
        },
        {
          "path": "pyproject.toml",
          "locator": "[dependency-groups] dev: pip-audit"
        }
      ],
      "upstream": "https://github.com/pypa/pip-audit",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "uv-lock",
      "method": "supply_chain",
      "commands": [
        "pre-commit hook uv-lock"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.uv-lock"
        }
      ],
      "upstream": "https://github.com/astral-sh/uv",
      "docs": null,
      "exit_codes": {},
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash -c 'case \"$OSTYPE\" in msys*"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.ruff-format"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.pip-audit"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "docs = Path(docs)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/docs-broken-links.yml",
          "locator": "jobs.check-links.steps[3] (Prune frozen doc versions (keep edge and latest))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "esac"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.ruff-format"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.pip-audit"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook commitizen"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.commitizen"
        }
      ],
      "upstream": "https://github.com/commitizen-tools/commitizen",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook commitizen-branch"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.commitizen-branch"
        }
      ],
      "upstream": "https://github.com/commitizen-tools/commitizen",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python src/crewai_tools/generate_tool_specs.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/generate-tool-specs.yml",
          "locator": "jobs.generate-specs.steps[4] (Generate tool specifications)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "raise SystemExit(fdocs.json version labels do not match directories: {missing})"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/docs-broken-links.yml",
          "locator": "jobs.check-links.steps[3] (Prune frozen doc versions (keep edge and latest))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "spec = json.loads(spec_path.read_text())"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/docs-broken-links.yml",
          "locator": "jobs.check-links.steps[3] (Prune frozen doc versions (keep edge and latest))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "spec_path = docs / docs.json"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/docs-broken-links.yml",
          "locator": "jobs.check-links.steps[3] (Prune frozen doc versions (keep edge and latest))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "with open(pip-audit-report.json) as f:"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/vulnerability-scan.yml",
          "locator": "jobs.pip-audit.steps[6] (Display results)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    }
  ]
}