[ // AI AGENT & CLI BRIEF — curl -fsSL https://studio2201.com/install.sh | sh -s vigil ]

Vigil supply-chain dormancy scanner (`v0.2.13`). Parses lockfiles with zero external crates, scores upstream commit velocity, and gates CI via `studio2201/studio2201@v1` (`tools: 'vigil'`) · Agent & MCP Guide · Canary Testbed.

studio2201 / product 01 v0.2.13 Apache-2.0 Dormancy Healthy

Vigil

Supply-chain dormancy scanner. Reads your project manifest, scores each dependency by how long it has been since the upstream moved, and emits SUPPLY-CHAIN.md and a badge.

View on GitHub → Framework Doctrine →

What it does

Auto-detect Manifests

Parses package.json, Cargo.lock, pyproject.toml, go.mod, pom.xml, composer.json, pubspec.yaml, and Package.swift.

Upstream Activity Heuristic

Cross-references dependencies against upstream commit velocity, release cadence, maintainer activity, and dormancy thresholds.

SUPPLY-CHAIN.md

Emits an actionable audit ranking packages from dormant risk to actively maintained, with remediation budgets in repo-weeks.

README Badge

Generates an SVG badge for your repository to display supply-chain health and attestation state in real-time.

GitHub Actions & CI Enforcement

Automate dependency dormancy checks on every pull request and push using the Vigil GitHub Action.

# .github/workflows/vigil.yml (Prompt your AI Agent or copy directly)
name: vigil
on:
  push: { branches: [ master, main ] }
  pull_request: { branches: [ master, main ] }
  workflow_dispatch:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
permissions: { contents: read }
jobs:
  vigil:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: studio2201/studio2201@v1
        with: { tools: 'vigil', fail-on: 'block' }
      - uses: actions/upload-artifact@v4
        if: always()
        with: { name: vigil-report, path: vigil_report.md, if-no-files-found: ignore }

# Workstation CLI installation (unprivileged, installs to ~/.local/bin):
curl -fsSL https://studio2201.com/install.sh | sh -s vigil
vigil scan && vigil policy check --max-dormancy 180d

Why This Matters & Authoritative Mandates

Enforces NIST SP 800-218 Secure Software Development Framework (SSDF) mandates on software supply-chain integrity.

NIST SP 800-218 SSDF ↗

Federal Secure Software Development Framework requiring continuous verification of third-party software integrity and supply-chain surface reduction.

Harvard / LF Census III ↗

Finds that 96% of critical open source software applications rely on packages with fewer than 2 active maintainers.

OpenSSF Scorecards ↗

Identifies maintenance velocity and commit freshness as key indicators of open-source software security and health.

CVE-2024-3094 (XZ Utils) ↗

Demonstrates how social engineering over years targeted a single exhausted maintainer of a critical dormant library.

How It Works Under the Hood

Multi-Manifest Parsing

Scans project trees to locate lockfiles, extracting package names, versions, and repository coordinates with zero external crates.

Commit Velocity Scoring

Computes dormancy as days elapsed since the latest release or upstream commit, mapping scores to Red/Amber/Green tiers.

Native SVG Badge Emission

Generates standalone SVG badges directly in pure Rust without headless browser or image rendering dependencies.

Automated CI Gating

Fails builds with exit code 1 when dependencies exceed dormancy policies (e.g. --max-dormancy 180d).