{
  "repository": "prometheus/prometheus",
  "ref": "ac85e06f5a45bb80186bca49072f062863ba738b",
  "methods": [
    {
      "slug": "formal",
      "title": "Formal verification and model checking"
    },
    {
      "slug": "static_analysis",
      "title": "Static analysis"
    },
    {
      "slug": "testing",
      "title": "Testing"
    },
    {
      "slug": "formatting",
      "title": "Formatting and hygiene"
    },
    {
      "slug": "supply_chain",
      "title": "Supply chain"
    },
    {
      "slug": "unclassified",
      "title": "Unclassified"
    }
  ],
  "verifications": [
    {
      "tool": "codeql",
      "method": "static_analysis",
      "commands": [
        "uses github/codeql-action/analyze"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/codeql-analysis.yml",
          "locator": "jobs.analyze.steps[3] (Perform CodeQL Analysis)"
        }
      ],
      "upstream": "https://github.com/github/codeql",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "golangci-lint",
      "method": "static_analysis",
      "commands": [
        "uses golangci/golangci-lint-action"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.golangci.steps[4] (Lint)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.golangci.steps[5] (Lint with slicelabels)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.golangci.steps[6] (Lint with dedupelabels)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.golangci.steps[7] (Lint in compliance)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.golangci.steps[8] (Lint in documentation/examples/remote_storage)"
        },
        {
          "path": ".golangci.yml",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/golangci/golangci-lint",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "zizmor",
      "method": "static_analysis",
      "commands": [
        "uses zizmorcore/zizmor-action"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/zizmor.yml",
          "locator": "jobs.zizmor.steps[1] (Run zizmor)"
        }
      ],
      "upstream": "https://github.com/zizmorcore/zizmor",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "eslint",
      "method": "static_analysis",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "web/ui/mantine-ui/eslint.config.mjs",
          "locator": "config file"
        },
        {
          "path": "web/ui/module/codemirror-promql/eslint.config.mjs",
          "locator": "config file"
        },
        {
          "path": "web/ui/react-app/eslint.config.mjs",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/eslint/eslint",
      "docs": "https://eslint.org/docs/latest/use/command-line-interface#exit-codes",
      "exit_codes": {
        "0": "no errors",
        "1": "linting errors found",
        "2": "configuration problem or internal error"
      },
      "autofix": true,
      "declared_only": true
    },
    {
      "tool": "ci-matrix",
      "method": "testing",
      "commands": [
        "analyze (language: 1)",
        "fuzzing (fuzz_test: 4)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/codeql-analysis.yml",
          "locator": "jobs.analyze.strategy.matrix"
        },
        {
          "path": ".github/workflows/fuzzing.yml",
          "locator": "jobs.fuzzing.strategy.matrix"
        }
      ],
      "upstream": "https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "go-test",
      "method": "testing",
      "commands": [
        "go test ./tsdb/ -test.tsdb-isolation=false",
        "go test --tags=dedupelabels ./...",
        "go test --tags=slicelabels -race ./cmd/prometheus ./cmd/promtool/... ./model/textparse ./prompb/...",
        "go test --tags=forcedirectio -race ./tsdb/",
        "go test -parallel=1 ./..."
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_go.steps[3]"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_go_more.steps[2]"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_go_more.steps[3]"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_go_more.steps[4]"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_go_386.steps[2]"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_version_upgrade.steps[2]"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test_windows.steps[2]"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.test-compliance.steps[2]"
        },
        {
          "path": ".github/workflows/fuzzing.yml",
          "locator": "jobs.fuzzing.steps[2] (Run Fuzzing)"
        }
      ],
      "upstream": "https://github.com/golang/go",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "jest",
      "method": "testing",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "web/ui/module/codemirror-promql/jest.config.cjs",
          "locator": "config file"
        },
        {
          "path": "web/ui/module/lezer-promql/jest.config.cjs",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/jestjs/jest",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": true
    },
    {
      "tool": "vitest",
      "method": "testing",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "web/ui/mantine-ui/vitest.config.ts",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/vitest-dev/vitest",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": true
    },
    {
      "tool": "prettier",
      "method": "formatting",
      "commands": [
        "prettier --write --print-width 120 src/promql/functionSignatures.ts src/promql/functionDocs.tsx"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "Makefile",
          "locator": "target generate-promql-functions (line 99)"
        }
      ],
      "upstream": "https://github.com/prettier/prettier",
      "docs": "https://prettier.io/docs/cli#exit-codes",
      "exit_codes": {
        "0": "everything formatted",
        "1": "something was not formatted (--check)",
        "2": "prettier error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "govulncheck",
      "method": "supply_chain",
      "commands": [
        "uses golang/govulncheck-action"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/govulncheck.yml",
          "locator": "jobs.govulncheck.steps[1]"
        }
      ],
      "upstream": "https://github.com/golang/vuln",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "The scan can report existing issues in files your PR did not change."
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/zizmor.yml",
          "locator": "jobs.zizmor.steps[2] (Explain how to resolve findings)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "buf lint prompb --error-format github-actions"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/buf-lint.yml",
          "locator": "jobs.buf.steps[2] (Lint Protobuf)"
        },
        {
          "path": ".github/workflows/buf.yml",
          "locator": "jobs.buf.steps[2] (Lint Protobuf)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "for fuzz_test in $EXPR"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/fuzzing.yml",
          "locator": "jobs.fuzzing.steps[2] (Run Fuzzing)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    }
  ]
}