@biomejs/monorepo

Date
Run
unknown @ 01bba129afefced1c04aa69592b1b7f337a7b609
Rubric
witan-rubric-v17-2026-07-24
3.0/4.0 overall

Conditional

Code 2.9 · Process 3.0

code 3/5 · process 4/6 measured

Criterion profile

Measured scores are plotted on a 0–4 scale. Unknown and not-applicable dimensions remain explicit.

7 measured 0 no data 4 N/A

Code trust

A1Test integrity and regression signal
2.2
A2Data-layer isolation and secrets posture
3.2
A3Production readiness
N/A
A4Dependency hygiene
3.2
A5Claim-vs-reality reconciliation
N/A

Process trust

B1Internal process dimension
N/A
B2PR outcome traceability
4.0
B3CI and QA discipline
3.1
B4Audit trail and report-up completeness
3.3
B5Internal process dimension
N/A
B6Privileged-operation human gating
1.7

Code trust

A1

Test integrity and regression signal

dimension band: verified
2.2
  • Test-to-source file ratio4102 ratio (capped; 7395 raw)
  • Static coverage percentage0/100 percent
  • Verification script ratio2/4 ratio
  • Non-hollow test share242/268 ratio
  • Detected test file crates/biome_cli/tests/cases/assist.rs:1 · sha256:573b5be1cc14
  • Detected test file crates/biome_cli/tests/cases/biome_json_support.rs:1 · sha256:d50764af1869
  • Detected test file crates/biome_cli/tests/cases/config_extends.rs:1 · sha256:47327dbcb347
  • Detected test file crates/biome_cli/tests/cases/config_path.rs:1 · sha256:7b1c3cab9926
  • Detected test file crates/biome_cli/tests/cases/configuration.rs:1 · sha256:f4593b405a90
  • Detected test file crates/biome_cli/tests/cases/css_parsing.rs:1 · sha256:22f310515e03
  • Detected test file crates/biome_cli/tests/cases/cts_files.rs:1 · sha256:118b92335981
  • Detected test file crates/biome_cli/tests/cases/diagnostics.rs:1 · sha256:6c6865b26143
  • Configured test runner packages/@biomejs/js-api/vitest.config.ts:1 · sha256:f828699f2e60
  • CI workflow runs the test suite .github/workflows/main.yml:1 · sha256:bba10c59142a
  • finding severity info: Test suite files are present, but no coverage configuration was detected. (Detected test file crates/biome_cli/tests/cases/assist.rs:1 · sha256:573b5be1cc14)
A2

Data-layer isolation and secrets posture

dimension band: verified
3.2
  • Secret cleanliness1/1 clean
  • Environment handling depth1/3 practices
  • Data layer migration crates/biome_migrate/tests/specs/migrations/all/group_level.json:1 · sha256:ebc9a6301ba7
A4

Dependency hygiene

dimension band: verified
3.2
  • Declared version range ratio145/173 ratio
  • Lockfile coverage1/1 present
  • Dependency automation ratio1/2 ratio
  • Dependency count sanity0.78/1 sane
  • Dependency manifest packages/@biomejs/backend-jsonrpc/package.json:1 · sha256:b39f81f670f2
  • Dependency lockfile Cargo.lock:1 · sha256:125c812c4ab9
  • Dependency update config .github/renovate.json5:1 · sha256:a2ac41dcfccc

Not applicable to this repository

  • A3 Production readiness — No deployable-service surface detected — production-readiness not applicable to this library/CLI archetype. Signals checked: production server entrypoint (HTTP/RPC port binding in main/server/app files, outside examples/tests/demo dirs), deploy config (vercel.json, render.yaml, fly.toml, Procfile, app.yaml, serverless.yml, docker-compose, k8s/helm manifests), CI deploy job (fly deploy, kubectl apply, helm install/upgrade, docker push). A Dockerfile without an explicit runtime start/service command is ambiguous and does not qualify.
  • A5 Claim-vs-reality reconciliation — No README or docs found — nothing is claimed about this repo, so there is nothing for A5 to reconcile against.

Process trust

B2

PR outcome traceability

dimension band: verified
4.0
  • PR trace basic checks2 signals (capped; 27 raw)
  • Recent PR merge ratio1/1 ratio
  • Pull-request CI workflow .github/workflows/actions_linter.yml:1 · sha256:517c943a21f6
  • Pull-request CI workflow .github/workflows/agent_scan.yml:1 · sha256:a56db26d82be
  • Pull-request CI workflow .github/workflows/autofix.yml:1 · sha256:60a60574b234
  • Pull request template .github/PULL_REQUEST_TEMPLATE.md:1 · sha256:543aeb946a86
  • Review gate configuration .github/CODEOWNERS:1 · sha256:a56979cfb10c
B3

CI and QA discipline

dimension band: verified
3.1
  • CI verification depth2/4 signals
  • PR-gate CI workflow count4 workflows (capped; 13 raw)
  • CI workflow .github/workflows/actions_linter.yml:1 · sha256:517c943a21f6
B4

Audit trail and report-up completeness

dimension band: verified
3.3
  • Audit artifact depth3 files (capped; 16 raw)
  • Audit freshness depth2/16 ratio
  • Audit or changelog artifact RELEASES.md:1 · sha256:866544ca7756
  • Audit or changelog artifact crates/biome_deserialize/CHANGELOG.md:1 · sha256:5601252ef960
  • Audit or changelog artifact packages/@biomejs/backend-jsonrpc/CHANGELOG.md:1 · sha256:9f04dd92dcb3
  • Audit or changelog artifact packages/@biomejs/biome/CHANGELOG.md:1 · sha256:0cad3a786eb6
  • Audit or changelog artifact packages/@biomejs/cli-darwin-arm64/CHANGELOG.md:1 · sha256:86d0667e6a39
B6

Privileged-operation human gating

dimension band: verified
1.7
  • Human gate documented0/1 present
  • Fail-closed privilege check present0/1 present
  • Privilege-escalation cleanliness1/1 clean
  • Protected-path review gate1/1 present
  • CODEOWNERS/required-review gate on protected paths .github/CODEOWNERS:1 · sha256:a56979cfb10c

Not applicable to this repository

  • B1 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B5 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.

Verified evidence

  • A1 - Test integrity and regression signalDetected test file crates/biome_cli/tests/cases/assist.rs:1 · sha256:573b5be1cc14
  • A1 - Test integrity and regression signalDetected test file crates/biome_cli/tests/cases/biome_json_support.rs:1 · sha256:d50764af1869
  • A1 - Test integrity and regression signalDetected test file crates/biome_cli/tests/cases/config_extends.rs:1 · sha256:47327dbcb347
  • A1 - Test integrity and regression signalDetected test file crates/biome_cli/tests/cases/config_path.rs:1 · sha256:7b1c3cab9926
  • A1 - Test integrity and regression signalDetected test file crates/biome_cli/tests/cases/configuration.rs:1 · sha256:f4593b405a90
  • A1 - Test integrity and regression signalDetected test file crates/biome_cli/tests/cases/css_parsing.rs:1 · sha256:22f310515e03
  • A1 - Test integrity and regression signalDetected test file crates/biome_cli/tests/cases/cts_files.rs:1 · sha256:118b92335981
  • A1 - Test integrity and regression signalDetected test file crates/biome_cli/tests/cases/diagnostics.rs:1 · sha256:6c6865b26143
  • A1 - Test integrity and regression signalConfigured test runner packages/@biomejs/js-api/vitest.config.ts:1 · sha256:f828699f2e60
  • A1 - Test integrity and regression signalCI workflow runs the test suite .github/workflows/main.yml:1 · sha256:bba10c59142a
  • A2 - Data-layer isolation and secrets postureData layer migration crates/biome_migrate/tests/specs/migrations/all/group_level.json:1 · sha256:ebc9a6301ba7
  • A4 - Dependency hygieneDependency manifest packages/@biomejs/backend-jsonrpc/package.json:1 · sha256:b39f81f670f2
  • A4 - Dependency hygieneDependency lockfile Cargo.lock:1 · sha256:125c812c4ab9
  • A4 - Dependency hygieneDependency update config .github/renovate.json5:1 · sha256:a2ac41dcfccc
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/actions_linter.yml:1 · sha256:517c943a21f6
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/agent_scan.yml:1 · sha256:a56db26d82be
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/autofix.yml:1 · sha256:60a60574b234
  • B2 - PR outcome traceabilityPull request template .github/PULL_REQUEST_TEMPLATE.md:1 · sha256:543aeb946a86
  • B2 - PR outcome traceabilityReview gate configuration .github/CODEOWNERS:1 · sha256:a56979cfb10c
  • B3 - CI and QA disciplineCI workflow .github/workflows/actions_linter.yml:1 · sha256:517c943a21f6
  • B4 - Audit trail and report-up completenessAudit or changelog artifact RELEASES.md:1 · sha256:866544ca7756
  • B4 - Audit trail and report-up completenessAudit or changelog artifact crates/biome_deserialize/CHANGELOG.md:1 · sha256:5601252ef960
  • B4 - Audit trail and report-up completenessAudit or changelog artifact packages/@biomejs/backend-jsonrpc/CHANGELOG.md:1 · sha256:9f04dd92dcb3
  • B4 - Audit trail and report-up completenessAudit or changelog artifact packages/@biomejs/biome/CHANGELOG.md:1 · sha256:0cad3a786eb6
  • B4 - Audit trail and report-up completenessAudit or changelog artifact packages/@biomejs/cli-darwin-arm64/CHANGELOG.md:1 · sha256:86d0667e6a39
  • B6 - Privileged-operation human gatingCODEOWNERS/required-review gate on protected paths .github/CODEOWNERS:1 · sha256:a56979cfb10c

Open / unverified

  • No open findings listed.