@vitejs/vite-monorepo

Date
Run
unknown @ 5d95f1631bfde08ee2613a53517dd5ea5d388cda
Rubric
witan-rubric-v17-2026-07-24
3.4/4.0 overall

Conditional

Code 2.8 · Process 4.0

code 5/5 · process 3/6 measured

Criterion profile

Measured scores are plotted on a 0–4 scale. Unknown and not-applicable dimensions remain explicit.

8 measured 0 no data 3 N/A

Code trust

A1Test integrity and regression signal
2.5
A2Data-layer isolation and secrets posture
3.2
A3Production readiness
2.8
A4Dependency hygiene
2.8
A5Claim-vs-reality reconciliation
2.7

Process trust

B1Internal process dimension
N/A
B2PR outcome traceability
4.0
B3CI and QA discipline
4.0
B4Audit trail and report-up completeness
4.0
B5Internal process dimension
N/A
B6Privileged-operation human gating
N/A

Code trust

A1

Test integrity and regression signal

dimension band: verified
2.5
  • Test-to-source file ratio317 ratio (capped; 381 raw)
  • Static coverage percentage0/100 percent
  • Verification script ratio4/4 ratio
  • Non-hollow test share168/380 ratio
  • Detected test file packages/create-vite/__tests__/cli.spec.ts:1 · sha256:32713f162d0d
  • Detected test file packages/plugin-legacy/src/__tests__/index.spec.ts:1 · sha256:c0f8ee1b60c5
  • Detected test file packages/plugin-legacy/src/__tests__/readme.spec.ts:1 · sha256:ab7e7df2117e
  • Detected test file packages/plugin-legacy/src/__tests__/snippets.spec.ts:1 · sha256:1cff4e960452
  • Detected test file packages/vite/src/node/__tests__/assetSource.spec.ts:1 · sha256:bea16fff4bae
  • Detected test file packages/vite/src/node/__tests__/build.spec.ts:1 · sha256:54721ae21f61
  • Detected test file packages/vite/src/node/__tests__/config.spec.ts:1 · sha256:5407eae6cf20
  • Detected test file packages/vite/src/node/__tests__/constants.spec.ts:1 · sha256:d634c8ecf058
  • Configured test runner vitest.config.ts:1 · sha256:ca84ddb6a6ea
  • Configured test runner package.json:1 · sha256:65b15bd911af
  • CI workflow runs the test suite .github/workflows/ci.yml:1 · sha256:48ba7a33148b
  • finding severity info: Test suite files are present, but no coverage configuration was detected. (Detected test file packages/create-vite/__tests__/cli.spec.ts:1 · sha256:32713f162d0d)
A2

Data-layer isolation and secrets posture

dimension band: verified
3.2
  • Secret cleanliness1/1 clean
  • Environment handling depth1/3 practices
  • Committed .env file in repository tree playground/assets-sanitize/.env:1 · sha256:9036ff75734a
  • finding severity info: A non-template .env file is committed in the current repository tree; no secret-shaped value was detected. (Committed .env file (no confirmed secret value found) playground/assets-sanitize/.env:1 · sha256:9036ff75734a)
A3

Production readiness

dimension band: verified
2.8
  • Production-readiness basic checks4/6 checks
  • Production workflow depth6 signals (capped; 14 raw)
  • Observability depth4 signals (capped; 57 raw)
  • Rollback and migration-safety depth1/4 signals
  • Build or typecheck script package.json:1 · sha256:65b15bd911af
  • CI workflow .github/workflows/ci.yml:1 · sha256:48ba7a33148b
  • Release deploy configuration netlify.toml:1 · sha256:03ae0d222957
  • Error boundary packages/vite/src/node/server/middlewares/error.ts:1 · sha256:659f1a1980f9
A4

Dependency hygiene

dimension band: verified
2.8
  • Pinned dependency ratio177/470 ratio
  • Lockfile coverage1/1 present
  • Dependency automation ratio1/2 ratio
  • Dependency manifest packages/vite/package.json:1 · sha256:6ff1b098fb8b
  • Dependency lockfile pnpm-lock.yaml:1 · sha256:e478a9a87cb9
  • Dependency update config .github/renovate.json5:1 · sha256:1321e59dd9d9
A5

Claim-vs-reality reconciliation

dimension band: info
2.7
  • Claim match rate12/19 ratio
  • Claim source depth4 docs (capped; 7 raw)
  • Reconciliation artifact depth0/3 artifacts
  • Repository claim source README.md:1 · sha256:d41584fcf5e6
  • Code presence for claim reconciliation packages/create-vite/index.js:1 · sha256:69362351fdf4
  • Documented limitations / threat model / "not covered" section .github/SECURITY.md:1 · sha256:91350d5b5c5b
  • finding severity info: Claim source and implementation files are present; no dedicated claim-reality report artifact was supplied, but the repo explicitly documents what it does NOT cover/protect against — honest scoping, not overclaiming. (Repository claim source README.md:1 · sha256:d41584fcf5e6)

Process trust

B2

PR outcome traceability

dimension band: verified
4.0
  • PR trace basic checks2 signals (capped; 14 raw)
  • Recent PR merge ratio1/1 ratio
  • Pull-request CI workflow .github/workflows/ci.yml:1 · sha256:48ba7a33148b
  • Pull-request CI workflow .github/workflows/copilot-setup-steps.yml:1 · sha256:1e0e5d8e0dd4
  • Pull-request CI workflow .github/workflows/ecosystem-ci-trigger.yml:1 · sha256:1385479a72ff
  • Pull request template .github/PULL_REQUEST_TEMPLATE.md:1 · sha256:8de7596292eb
B3

CI and QA discipline

dimension band: verified
4.0
  • CI verification depth4 signals (capped; 5 raw)
  • PR-gate CI workflow count4 workflows (capped; 7 raw)
  • Test script package.json:1 · sha256:65b15bd911af
  • Lint script package.json:1 · sha256:65b15bd911af
  • CI workflow .github/workflows/ci.yml:1 · sha256:48ba7a33148b
B4

Audit trail and report-up completeness

dimension band: verified
4.0
  • Audit artifact depth3 files (capped; 5 raw)
  • Audit freshness depth5/5 ratio
  • Audit or changelog artifact .github/SECURITY.md:1 · sha256:91350d5b5c5b
  • Audit or changelog artifact docs/releases.md:1 · sha256:f7ef667a1354
  • Audit or changelog artifact packages/create-vite/CHANGELOG.md:1 · sha256:52e51ad6de85
  • Audit or changelog artifact packages/plugin-legacy/CHANGELOG.md:1 · sha256:167d69282784
  • Audit or changelog artifact packages/vite/CHANGELOG.md:1 · sha256:850589f92e3e

Not applicable to this repository

  • B1 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B5 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B6 Privileged-operation human gating — No privileged-operation surface (prod DB admin GRANT/privilege DDL, role escalation, or documented human-gate governance) detected in this repo.

Verified evidence

  • A1 - Test integrity and regression signalDetected test file packages/create-vite/__tests__/cli.spec.ts:1 · sha256:32713f162d0d
  • A1 - Test integrity and regression signalDetected test file packages/plugin-legacy/src/__tests__/index.spec.ts:1 · sha256:c0f8ee1b60c5
  • A1 - Test integrity and regression signalDetected test file packages/plugin-legacy/src/__tests__/readme.spec.ts:1 · sha256:ab7e7df2117e
  • A1 - Test integrity and regression signalDetected test file packages/plugin-legacy/src/__tests__/snippets.spec.ts:1 · sha256:1cff4e960452
  • A1 - Test integrity and regression signalDetected test file packages/vite/src/node/__tests__/assetSource.spec.ts:1 · sha256:bea16fff4bae
  • A1 - Test integrity and regression signalDetected test file packages/vite/src/node/__tests__/build.spec.ts:1 · sha256:54721ae21f61
  • A1 - Test integrity and regression signalDetected test file packages/vite/src/node/__tests__/config.spec.ts:1 · sha256:5407eae6cf20
  • A1 - Test integrity and regression signalDetected test file packages/vite/src/node/__tests__/constants.spec.ts:1 · sha256:d634c8ecf058
  • A1 - Test integrity and regression signalConfigured test runner vitest.config.ts:1 · sha256:ca84ddb6a6ea
  • A1 - Test integrity and regression signalConfigured test runner package.json:1 · sha256:65b15bd911af
  • A1 - Test integrity and regression signalCI workflow runs the test suite .github/workflows/ci.yml:1 · sha256:48ba7a33148b
  • A2 - Data-layer isolation and secrets postureCommitted .env file in repository tree playground/assets-sanitize/.env:1 · sha256:9036ff75734a
  • A3 - Production readinessBuild or typecheck script package.json:1 · sha256:65b15bd911af
  • A3 - Production readinessCI workflow .github/workflows/ci.yml:1 · sha256:48ba7a33148b
  • A3 - Production readinessRelease deploy configuration netlify.toml:1 · sha256:03ae0d222957
  • A3 - Production readinessError boundary packages/vite/src/node/server/middlewares/error.ts:1 · sha256:659f1a1980f9
  • A4 - Dependency hygieneDependency manifest packages/vite/package.json:1 · sha256:6ff1b098fb8b
  • A4 - Dependency hygieneDependency lockfile pnpm-lock.yaml:1 · sha256:e478a9a87cb9
  • A4 - Dependency hygieneDependency update config .github/renovate.json5:1 · sha256:1321e59dd9d9
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/ci.yml:1 · sha256:48ba7a33148b
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/copilot-setup-steps.yml:1 · sha256:1e0e5d8e0dd4
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/ecosystem-ci-trigger.yml:1 · sha256:1385479a72ff
  • B2 - PR outcome traceabilityPull request template .github/PULL_REQUEST_TEMPLATE.md:1 · sha256:8de7596292eb
  • B3 - CI and QA disciplineTest script package.json:1 · sha256:65b15bd911af
  • B3 - CI and QA disciplineLint script package.json:1 · sha256:65b15bd911af
  • B3 - CI and QA disciplineCI workflow .github/workflows/ci.yml:1 · sha256:48ba7a33148b
  • B4 - Audit trail and report-up completenessAudit or changelog artifact .github/SECURITY.md:1 · sha256:91350d5b5c5b
  • B4 - Audit trail and report-up completenessAudit or changelog artifact docs/releases.md:1 · sha256:f7ef667a1354
  • B4 - Audit trail and report-up completenessAudit or changelog artifact packages/create-vite/CHANGELOG.md:1 · sha256:52e51ad6de85
  • B4 - Audit trail and report-up completenessAudit or changelog artifact packages/plugin-legacy/CHANGELOG.md:1 · sha256:167d69282784
  • B4 - Audit trail and report-up completenessAudit or changelog artifact packages/vite/CHANGELOG.md:1 · sha256:850589f92e3e

Open / unverified

  • A5 - Claim-vs-reality reconciliationfinding severity info: Claim source and implementation files are present; no dedicated claim-reality report artifact was supplied, but the repo explicitly documents what it does NOT cover/protect against — honest scoping, not overclaiming. (Repository claim source README.md:1 · sha256:d41584fcf5e6)