ctoscope 0.35.0 — the feature found a bug that had been there all along

🚀 octoscope 0.35.0 is out — and this one started as a small feature and ended as a bug I am slightly embarrassed about.

The feature first. octoscope has a dashboard half and a scriptable half (--json and --plain), and the scriptable half could report on your repositories but never on what you actually did with them. --activity now puts the event feed into both, carrying the same fields the dashboard renders.

Then, while wiring it up, I checked the ordering. It was wrong. 27 of 99 adjacent events came back out of sequence — then 28 in the next feed, then 25 in the one after that. The events endpoint is not documented as returning a sorted feed, and it does not. octoscope had been trusting the order it was handed for as long as the Activity tab has existed.

So the tab you have been reading has been almost sorted for months. Which is worse than obviously unsorted, because it looks correct. It is fixed at the point where events are parsed, so the dashboard and the reports were both fixed by the same change.

⚠️ One design decision I would genuinely like opinions on: when you do not ask for the feed, the recent_activity key is absent from the JSON rather than present and empty. An empty array would be a claim — "we looked, nothing happened" — and that claim would be false. A missing key lets a consumer tell "not fetched" from "nothing to fetch". I think that is right, but it does make the schema less predictable.

🔍 Also in this release: the supply-chain scan reads the repository's own settings before scoring a trigger. A workflow reacting to discussions on a repository with discussions disabled is not an exposure. It moves scores both ways — fewer findings where a setting makes a trigger unreachable, more on private and internal repositories, where the axis used to go quiet and where a read-access user is exactly the supplier worth worrying about.

💡 Two tips for getting the most out of it: pipe the activity feed through jq and you have a personal work log you can diff from one day to the next; and if you script against it, branch on whether recent_activity is present, not on whether it is long.

📦 Upgrade:

brew upgrade gfazioli/tap/octoscope

How do you keep an eye on your own activity — the GitHub dashboard, notifications, something you built yourself? And if you already script against octoscope, what is the next thing you would want in --json? 👇

Site: https://gfazioli.github.io/octoscope

Newsletter: https://octoscope.substack.com

Mastodon: https://hachyderm.io/@undolog