Evidence reports

What can we hand an auditor, an acquirer or a migration committee, and how much of it is measured? repowise report writes three documents from the local index. Every item says how it is known (measured, inferred, declared or unresolved), and missing evidence is reported as unresolved, never as a low score or a pass.

repowise report assessment --format html --out assessment.html
repowise report changes --since 2026-07-01 --until 2026-10-01 --format markdown --out q3-changes.md
repowise report inventory --format csv --out inventory.csv

JSON is the canonical form (schema_version: 1), with Markdown, CSV and a self-contained HTML file. The HTML has inline CSS, no scripts and a policy that blocks every fetch, so it opens offline and prints as is. In a workspace, assessment and inventory cover every repository (--repo ALIAS picks one).

How to read an item#

Assessment items keep the OpenSSF Scorecard check shape (name, score 0 to 10 or -1 inconclusive, reason, details, documentation) plus method and basis, so tooling that reads Scorecard reads them. A descriptive item, such as a count or a list, has score: null. Missing or held-back evidence is always -1, never a low score.

The assessment#

--sections picks a subset. Layers held back on a language (see findings) are reported as gated, not counted.

The change evidence pack#

repowise report changes answers, for every change merged in the period:

• which components and owning teams it touched;
• its review record. Git holds none, so this reads "not recorded in git" unless Approved-by: trailers or a change-metadata plugin supply one;
• the tests that reach it, measured and inferred;
• the verdict of the condition rules in .repowise/policies.yaml ("no policy configured" without one; gate rules are not re-run);
• its provenance, with coverage;
• whether a later commit reverted it or named it as the cause of a fix.

A period summary counts the answers, with unknown counted apart and never as a failure. A method appendix states what git alone cannot attest, such as a review that left no trace in the history.

With no --since, the period is the 90 days before the newest indexed commit; --since all covers every indexed change. The report shares one evidence pass with repowise changes export: it builds any missing checklist a few at a time, after printing how many and roughly how long. --no-build reports kept checklists only and counts the rest as unknown.

Mapping to control frameworks#

The reports are evidence a reviewer can use for these controls. They are not a certification, an attestation of compliance, or a substitute for the auditor's own testing.

What the evidence covers is what git and the index hold. A review that happened in a forge but left no trailer, a test run that is not in an ingested coverage report, or a deployment step outside the repository is reported as unknown.

Privacy#

• Reports describe code and components. Owners and reviewers are counted, never ranked or named.
• Local paths are removed from every item.
• Nothing is sent anywhere: the report is a file you choose to share.

Extending#

Sections and renderers are plugin seams (report-section and report-renderer), so an organization can add its own section or output format. A section whose data is absent is left out, as outcomes is until a change's checklist has been opened.