octoscope 0.30.0 — "not checked" stops looking like "fine"

Hey everyone 👋 octoscope 0.30.0 is out, and this one has an odd origin story: three of its four changes were written by one of you.

They came in as a comment under the 0.27.0 launch. He didn't ask for a single feature. Instead he found three places where octoscope's report claimed more than it had actually verified — and every one of them held up when I went and measured it. One even turned up a bug that had been sitting in the code for several releases. 😅

The fourth came from a real GitHub outage that made octoscope look broken.

So the whole release ended up being one idea: when octoscope can't tell you something, it should say so.

🔍 "Is it me, or is it GitHub?" — octoscope only ever talks to GitHub, so when GitHub has a bad day every symptom looks like octoscope being broken. It now asks GitHub's own status page and tells you which it is, right when you're deciding who to blame. The tricky part was what it doesn't do: it stays silent while GitHub is fine, and silent if it can't reach the status page either — showing you a green "all systems operational" that nobody verified is worse than showing nothing.

⏱️ The scan says how wide its window was — the supply-chain scan runs when you ask it to, not on a timer, so "nothing changed since the last scan" means very different things four minutes apart and four weeks apart. It used to read identically either way. Now the report says the span, and a repo where nothing changed says it too — which is exactly when you need it.

↩️ A file that changes back is noticed — octoscope now remembers every version it has seen at a path, with no expiry. A fixed lookback would just be a published waiting time, and patience is the whole point of the thing this is meant to catch. It's a note, not an accusation: reverting is usually someone undoing a mistake.

🧵 A chain it can't follow gets said out loud — when your workflow calls one in another repo, octoscope doesn't follow it, and now always tells you rather than only in the cases it judged risky. "Not checked" looking like "fine" is the one thing that part of the tool exists to prevent.

💡 Two tips: if you've never run the scan, press space on a repo in the Repos tab and hit s — the first run just records a baseline, and it says so rather than pretending it compared anything. And if you'd rather octoscope talked to exactly one host, check_service_status = false opts the status check out entirely; it's the only feature that contacts anything other than GitHub's API.

Upgrade with

brew upgrade gfazioli/tap/octoscope

I'm genuinely curious about one thing: has a tool ever told you it was fine when it hadn't actually checked? That's the failure this whole release is chasing, and I suspect everyone has a story. What would you want octoscope to be honest about next? 👇

Site: https://gfazioli.github.io/octoscope

Newsletter: https://octoscope.substack.com

Mastodon: https://hachyderm.io/@undolog