Evaluating open-source or commercial software repositories requires verifiable evidence, not probabilistic guesses. Catalayer Code analyzes public GitHub repositories using deterministic AST parsers, git commit delta analysis, and structural heuristics to evaluate structural gaps, test risk, and change reviewability.
Deterministic evidence takes precedence over probabilistic AI inference.
Every finding is anchored to verifiable repository artifacts: file paths, line diffs, or missing configuration files.
Checks evaluate structural health before generative models summarize context.
Analyses do not execute untrusted user code; all inspections are static and deterministic.
Specific verifiable repository conditions evaluated by Catalayer Code.
| SIGNAL NAME | VERIFIED REPOSITORY CONDITION | CONFIDENCE | TARGET RISK MITIGATED |
|---|---|---|---|
| CI/CD Pipeline Verification | Checks presence of .github/workflows, .gitlab-ci.yml, or Jenkinsfile | HIGH | Untested merges and unautomated build regressions |
| Lockfile Consistency | Validates existence of package-lock.json, yarn.lock, Cargo.lock, or poetry.lock | HIGH | Non-deterministic dependency resolution and build drift |
| Test Directory Association | Inspects ratio of test files to implementation source modules | HIGH | Omission of automated unit and integration verification |
Many code intelligence tools pass entire codebases to large language models, prompting for "security vulnerabilities". This approach generates high false-positive rates and hallucinations, inventing line numbers and non-existent CVEs.
Catalayer Code reverses this sequence: it executes verifiable deterministic AST scanners first. If a repository lacks a CI pipeline, that is a proven boolean fact. Only after deterministic facts are established does AI provide contextual summaries.
1. Structural Layer: Scans repository root for manifest hygiene, license files, CI scripts, and security policy declarations.
2. Delta Layer: Inspects commit cadence, branch divergence, and file change concentration across recent git commits.
3. Reviewability Layer: Calculates cognitive review load based on diff dispersion and mixed-concern refactoring.
What this inspection method does not and cannot evaluate.
Run deterministic checks against any public repository without granting OAuth permissions. Review structural gaps, untested changes, and reviewability findings with evidence.
No. Public repositories can be inspected anonymously via the public inspection API or the Chrome extension without granting write permissions or private repository access.