Google Git
Sign in
apache/tooling-agents/45a5d6f44e6034a0638e9da6ee2787f7d1cc68df
commit
45a5d6f44e6034a0638e9da6ee2787f7d1cc68df
[log]
author
Andrew Musselman <akm@apache.org>
Fri Jul 10 17:14:11 2026 -0700
committer
Andrew Musselman <akm@apache.org>
Fri Jul 10 17:14:11 2026 -0700
tree
9cc0f4f29adf2cf37429aaaa458551cba20a048d
parent
6b068f6a95eeaeb96e8d8140ff78275c3ca11180 [diff]
Bernies: redirects, Go resolution, Gradle/SBT, stability, polish

Fix HTTP 301 redirects — follow_redirects=True on all GitHub API
calls. junit-team/junit5, eclipse-ee4j/*, casbin/*, protobuf,
react, docker now resolve correctly.

Go vanity URL resolution — gopkg.in/*, sigs.k8s.io/*, k8s.io/*
resolved via go-import meta tag. Static map for golang.org/x,
go.uber.org, google.golang.org.

Gradle and SBT support — build.gradle, build.gradle.kts, build.sbt
parsed for Maven coordinates. Covers Kafka, Flink, Scala projects.

Stability algorithm: max(active, total) for maintainer count.
Packages with 1 active but 10+ total classified LOW (stable).
GitHub repo dedup via _gh_repo_cache cuts API calls ~50%.

Report: methodology section, uncheckable dependencies table.
Health cache: api_success tracking, smart validation, on-load
recalculation.
1 file changed
tree: 9cc0f4f29adf2cf37429aaaa458551cba20a048d
  1. ASVS/
  2. docs/
  3. gh-helper/
  4. gha-review/
  5. scrutineer/
  6. util/
  7. .asf.yaml
  8. .gitignore
  9. LICENSE
  10. README.md
README.md

Apache Tooling Agents

AI-driven security auditing and code review for ASF projects

Pipelines

ASVS Security Audit

Automated OWASP ASVS v5.0.0 compliance auditing for any GitHub-hosted codebase. Downloads source code, discovers the architecture, runs per-requirement security analysis with Claude, and produces a consolidated report with deduplicated findings and GitHub issues. In production — piloted on ATR and Apache Steve.

GitHub Actions Review

Automated security scan of GitHub Actions workflows across an entire GitHub organization. Combines LLM classification (which repos publish what, where) with static pattern matching (12 check types from CRITICAL to INFO) to identify exploitable workflows, supply chain risks, and policy violations. Scanned 2,500+ Apache repos.

Both pipelines run on Gofannon — see docs/gofannon for platform setup.

Repository Structure

├── ASVS/                  # ASVS security audit pipeline
│   ├── agents/            # Pipeline agent code (6 agents)
│   ├── audit_guidance/    # Project-specific false positive guidance
│   ├── reports/           # Audit output organized by project and commit
│   └── rerun-sections.sh  # QA: re-run failed sections, re-consolidate
├── gha-review/            # GitHub Actions security review
│   ├── agents/            # Review pipeline agents (7 agents + tests)
│   └── reports/           # Review output
├── docs/
│   ├── gofannon/          # Gofannon setup and agent development guide
│   ├── tooling/           # Security tooling landscape and comparisons
│   ├── roadmap/           # Eval framework, multi-spec expansion plans
│   └── how-to-contribute.md
└── util/                  # Utility scripts

Documentation

Getting Involved

Join the Conversation

  1. Mailing list: Say hello at 📧 dev@tooling.apache.org (Subscribe by sending an email with empty subject and body to dev-subscribe@tooling.apache.org and replying to the automated response, per the ASF mailing list how-to)

  2. Slack: #tooling-discuss on the ASF Slack

  3. Issues: Use GitHub Issues to ask questions, suggest approaches, or report bugs

Contribute

  • How to contribute
  • Request an audit: Just ask on the mailing list or Slack — we handle everything. No tokens, no setup needed.
  • Write audit guidance: Help reduce false positives for your project — see audit_guidance/README.md

Note: Please introduce yourself on the mailing list before submitting a PR; this helps us deter spam and means your contribution won't be overlooked.

License

This project is licensed under the Apache License 2.0.

Part of the Apache Tooling Initiative.