{
  "repository": "Homebrew/brew",
  "ref": "b09052073720e4b4be4c46c3c4b3425f678c4512",
  "methods": [
    {
      "slug": "formal",
      "title": "Formal verification and model checking"
    },
    {
      "slug": "static_analysis",
      "title": "Static analysis"
    },
    {
      "slug": "testing",
      "title": "Testing"
    },
    {
      "slug": "formatting",
      "title": "Formatting and hygiene"
    },
    {
      "slug": "supply_chain",
      "title": "Supply chain"
    },
    {
      "slug": "unclassified",
      "title": "Unclassified"
    }
  ],
  "verifications": [
    {
      "tool": "actionlint",
      "method": "static_analysis",
      "commands": [
        "actionlint"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/actionlint.yml",
          "locator": "jobs.workflow_syntax.steps[6]"
        }
      ],
      "upstream": "https://github.com/rhysd/actionlint",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "codeql",
      "method": "static_analysis",
      "commands": [
        "uses github/codeql-action/analyze"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/codeql-analysis.yml",
          "locator": "jobs.analyze.steps[2] (Perform CodeQL Analysis)"
        }
      ],
      "upstream": "https://github.com/github/codeql",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "zizmor",
      "method": "static_analysis",
      "commands": [
        "zizmor --format sarif . > results.sarif"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/actionlint.yml",
          "locator": "jobs.workflow_syntax.steps[3]"
        }
      ],
      "upstream": "https://github.com/zizmorcore/zizmor",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "base64 --decode >${RUNNER_TEMP:?}/check_template.rb"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-issues.yml",
          "locator": "jobs.manage.steps[3] (Fetch template checker)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "base64 --decode >${RUNNER_TEMP}/check-issues/templates/${repo//\\//-}-${template_path##*/}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-issues.yml",
          "locator": "jobs.manage.steps[2] (Fetch issue templates)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash .github/scripts/check-licenses.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/licenses.yml",
          "locator": "jobs.licenses.steps[4] (Check licences)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "brewtest /opt/homebrew/bin/hello --version"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.test.steps[14] (Install Homebrew for a non-admin user)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "brewtest /usr/bin/env HOMEBREW_NO_SUDO=1 /opt/homebrew/bin/brew install --force-bottle hello"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.test.steps[14] (Install Homebrew for a non-admin user)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "done <${RUNNER_TEMP:?}/check-issues/incomplete-template-comment-ids"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-issues.yml",
          "locator": "jobs.manage.steps[8] (Remove resolved template comments)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "done <${RUNNER_TEMP:?}/check-prs/incomplete-template-comment-ids"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-prs.yml",
          "locator": "jobs.manage.steps[8] (Remove resolved template comments)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "done <${RUNNER_TEMP:?}/check-prs/missing-description-comment-ids"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-prs.yml",
          "locator": "jobs.manage.steps[12] (Remove resolved description comments)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "read -ra test_flags <<< $TEST_FLAGS"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/tests.yml",
          "locator": "jobs.tests.steps[11] (Run brew tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "ruby ${RUNNER_TEMP:?}/check_template.rb issue ${RUNNER_TEMP}/check-issues/body ${RUNNER_TEMP}/check-issues/templates ${GITHUB_REPOSITORY:?} 2>${RUNNER_TEMP}/check-issues/missing-checkboxes"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-issues.yml",
          "locator": "jobs.manage.steps[4] (Check issue template)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "ruby ${RUNNER_TEMP:?}/check_template.rb pull-request ${RUNNER_TEMP}/check-prs/body ${RUNNER_TEMP}/check-prs/template ${PR_TITLE} ${GITHUB_REPOSITORY:?}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-prs.yml",
          "locator": "jobs.manage.steps[4] (Check pull request template)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "ruby ${RUNNER_TEMP}/check_template.rb pull-request-description ${RUNNER_TEMP}/check-prs/body ${RUNNER_TEMP}/check-prs/template ${PR_TITLE} ${GITHUB_REPOSITORY}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-prs.yml",
          "locator": "jobs.manage.steps[4] (Check pull request template)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security create-keychain -p ${TEMPORARY_KEYCHAIN_PASSWORD} ${TEMPORARY_KEYCHAIN_PATH}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.build.steps[4] (Create and unlock temporary macOS keychain)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security delete-keychain ${RUNNER_TEMP}/${TEMPORARY_KEYCHAIN_FILE}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.build.steps[17] (Clean up temporary macOS keychain)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security import ${RUNNER_TEMP}/${TEMPORARY_CERTIFICATE_FILE} -k ${RUNNER_TEMP}/${TEMPORARY_KEYCHAIN_FILE} -P ${PKG_APPLE_SIGNING_CERTIFICATE_PASSWORD} -t cert -f pkcs12 -A"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.build.steps[6] (Import certificate file into macOS keychain)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security list-keychain -d user -s ${RUNNER_TEMP}/${TEMPORARY_KEYCHAIN_FILE}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.build.steps[12] (Open macOS keychain)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security set-keychain-settings -l -u -t 21600 ${TEMPORARY_KEYCHAIN_PATH}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.build.steps[4] (Create and unlock temporary macOS keychain)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "security unlock-keychain -p ${TEMPORARY_KEYCHAIN_PASSWORD} ${TEMPORARY_KEYCHAIN_PATH}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.build.steps[4] (Create and unlock temporary macOS keychain)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sysadminctl -addUser brewtest -password $(uuidgen) -shell /bin/bash"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.test.steps[14] (Install Homebrew for a non-admin user)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "typeset -A push_hash"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/docker.yml",
          "locator": "jobs.generate-tags.steps[2] (Determine build attributes)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "typeset -A tag_hash"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/docker.yml",
          "locator": "jobs.generate-tags.steps[2] (Determine build attributes)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "vale docs/"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/docs.yml",
          "locator": "jobs.docs.steps[4] (Run Vale)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    }
  ]
}