| name | dependencies |
| description | Run git-pkgs list and sbom against the repository and emit one envelope with per-section status. |
| license | MIT |
| compatibility | Requires `git-pkgs` (https://github.com/git-pkgs/git-pkgs) and `python3` on PATH. |
| metadata | {"scrutineer.version":1,"scrutineer.output_file":"report.json","scrutineer.output_kind":"dependencies","scrutineer.paths":["**"],"scrutineer.ignore_paths":["**/node_modules/**","**/dist/**","**/generated/**","**/__generated__/**","**/*.min.js","**/*.min.css"]} |
dependencies
Run the two per-repository git-pkgs analyses after one git-pkgs init and assemble the results into a versioned envelope. analyses.inventory is the manifest occurrence list from git-pkgs list; analyses.sbom is the CycloneDX document from git-pkgs sbom --skip-enrichment. Each section has its own status so a failure in one does not discard the other. Per-package registry lookups (licences, vulnerabilities, latest-version, deprecation) are not run here; scrutineer performs those once per package outside the scan. Scrutineer's worker resolves Maven requirements from local pom.xml files with git-pkgs/pom, fills requirement_resolution, and marks unresolved placeholders with requirement_unresolved.
Workspace
./src — the cloned repository./scripts/index.sh — the wrapper script./report.json — write the final report here./schema.json — output shape
Available scripts
scripts/index.sh — runs git-pkgs init inside ./src, then list and sbom --skip-enrichment, capturing stdout, stderr, and exit code per command, and writes the assembled envelope to stdout.
What to do
Run the script and capture its stdout as the report:
bash scripts/index.sh > ./report.json
If the script exits non-zero, read its stderr, then write {"schema_version": 1, "analyses": {}, "error": "..."} to ./report.json so the caller sees why nothing was collected.
The wrapper already emits the exact schema the parser expects, including per-section status: "error" for a failed command. Do not post-process, merge sections, or hand-author dependency rows. Do not inspect manifests yourself or infer dependencies from files that git-pkgs did not report. An empty analyses.inventory.result means git-pkgs found no manifests; write that report and stop.
