Skip to content
CAI
Software that uses CAICheck a score

bazelbuild/bazel

57.4

Adequate · 29 July 2026

727.4k

lines of production code

Java

primary language

2

measurements over time

CAI band scale
CAI trend line
CAI lens gauges

How this codebase got here

This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.

Score

  • CAI 51 → 57 (+5.9)
  • Rubric changed (rubric-2026.08.17 → rubric-2026.08.18) — scores are not directly comparable.

Lenses

  • Architecture 100 → 100 (+0.0)
  • Maturity 58 → 61 (+3.3)
  • Readiness 64 → 64 (+0.0)
  • Security 32 → 46 (+14.3)

Resolved (171)

  • Dependency hygiene not measured — no supported dependency manifest was read
  • Duplicated block (10 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/Initializer.java)
  • Duplicated block (10 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/Initializer.java)
  • Duplicated block (10 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/backport/Backporter.java)
  • Duplicated block (10 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/classfile/LibraryClass.java)
  • Duplicated block (10 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/classfile/editor/ConstantPoolShrinker.java)
  • Duplicated block (10 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/classfile/visitor/ConcreteClassDownTraveler.java)
  • Duplicated block (10 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/optimize/evaluation/InstructionUsageMarker.java)
  • Duplicated block (10 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/optimize/evaluation/VariableOptimizer.java)
  • Duplicated block (10 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/optimize/info/ParameterEscapedMarker.java)
  • Duplicated block (10 lines × 6) (third_party/java/proguard/proguard6.2.2/src/proguard/ConfigurationChecker.java)
  • Duplicated block (11 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/ClassSpecificationVisitorFactory.java)
  • Duplicated block (11 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/backport/LambdaExpression.java)
  • Duplicated block (11 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/classfile/ProgramClass.java)
  • Duplicated block (11 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/classfile/editor/CompactCodeAttributeComposer.java)
  • Duplicated block (11 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/classfile/editor/CompactCodeAttributeComposer.java)
  • Duplicated block (11 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/obfuscate/Obfuscator.java)
  • Duplicated block (11 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/optimize/evaluation/EvaluationSimplifier.java)
  • Duplicated block (11 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/optimize/evaluation/SimpleEnumDescriptorSimplifier.java)
  • Duplicated block (11 lines × 2) (third_party/java/proguard/proguard6.2.2/src/proguard/optimize/peephole/MethodInliner.java)
  • …and 151 more

New (70)

  • Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
  • Further orphaned files (smaller)
  • High CVE: [GHSA redacted] (requirements.txt)
  • High: security finding (details withheld)
  • High: security finding (details withheld)
  • High: security finding (details withheld)
  • Off-boarding risk: anonymized user #3
  • Off-boarding risk: anonymized user #2
  • Off-boarding risk: anonymized user #1
  • Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/ClassSpecificationVisitorFactory.java)
  • Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/ConfigurationParser.java)
  • Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/ConfigurationWriter.java)
  • Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/Initializer.java)
  • Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/backport/AbstractAPIConverter.java)
  • Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/backport/LambdaExpressionConverter.java)
  • Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/backport/StreamSupportConverter.java)
  • Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/classfile/ClassConstants.java)
  • Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/classfile/attribute/visitor/DebugAttributeVisitor.java)
  • Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/classfile/attribute/visitor/SingleTimeAttributeVisitor.java)
  • Orphaned knowledge (third_party/java/proguard/proguard6.2.2/src/proguard/classfile/editor/AttributeAdder.java)
  • …and 50 more

Changes since last survey

  • 118 commits — 100 feature/other, 18 fixes

By area

  • src/main — 71 commits
  • src/test — 26 commits
  • (root) — 7 commits
  • src/tools — 6 commits
  • .bazelci/build_bazel_binaries.yml — 1 commit
  • .github/scripts — 1 commit
  • .github/workflows — 1 commit
  • docs/contribute — 1 commit
  • docs/docs — 1 commit
  • scripts/release — 1 commit
  • third_party/protobuf.patch — 1 commit
  • tools/jdk — 1 commit

Notable commits

  • fix: Fix /proc/<pid>/stat parsing to handle process names with spaces.
  • fix: Fix HTTP-proxy Proxy-Authorization leak to HTTPS origins.
  • fix: Fix setup_javabase on Windows
  • fix: Fix action rewinding with a non-verifying AC (https://github.com/bazelbuild/bazel/pull/30266)
  • fix: Fix chained-symlink escape handling in CompressedTarFunction.
  • fix: Fix critical path gap when actions consume TreeFileArtifacts from fast template expansion actions.
  • fix: Fix handling of symbolic/hard links when using strip_components (https://github.com/bazelbuild/bazel/pull/30044)
  • fix: Fix incorrect TargetSummaryEvent when target-building actions are cached with Skymeld.
  • fix: Fix macOS build breakage introduced by https://github.com/bazelbuild/bazel/commit/b0f8378f16614779db8f92827440b42b7ba96746.
  • fix: Fix out-of-bounds heap access in singlejar extra field copying.
  • fix: Fix post-analysis query (cquery/aquery) output truncation under --keep_going.
  • fix: Fix race condition in worker death detection (https://github.com/bazelbuild/bazel/pull/30067)
  • fix: Fix race condition when reading worker response from exiting process.
  • fix: Fix read-only enforcement for hermetic sandbox mounts.
  • fix: Fix release script for rolling releases
  • fix: Fix scope leak in ParsedFlagsValue.applyTo() (https://github.com/bazelbuild/bazel/pull/29494)
  • fix: Minor grammar and formatting fixes.
  • fix: Quote TAB in Windows command-line escaper and fix narrowing.
  • change: .
  • change: Add --experimental_max_repeated_lost_inputs to make the action-rewinding lost-input limit configurable (https://github.com/bazelbuild/bazel/pull/30164)
  • …and 98 more

Architecture

  • Unchanged — 0 containers · 2 contexts · 0 edges

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

Survey your own repository

bazelbuild/bazel was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.

About this page

  • The score is its most recent published measurement, taken on 29 July 2026 at a pinned commit. It is not a live figure and does not change until the project is measured again.
  • Measured at commit 55dcbb1b7ef7a28ea1ef458bc4861e873396a27f — the exact code this score is about.
  • Scored under rubric-2026.08.18 — the same rubric and the same method as every other entry in this index.
  • Measured by watchdog.canine.dev using codehealth-analyzer latest.
The project's source repositorygithub.com/bazelbuild/bazelHow this project comparesEvery measured codebase read together — the same rubric, the same instrumentVerify this score yourselfReproduce the number from the published evidence