You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Public roadmap: make vibgrate/cli easy to discover, try, and contribute to #144
vibgrate/cli ships frequently (see Releases and the site changelog), but an empty Issues tab reads as “inactive” on places like AlternativeTo — even when the product is moving.
This issue is the public roadmap tracker. Comment to upvote or propose; we’ll open focused issues for work that is ready for contribution.
Near term (next ~30 days)
Keep README / install path obvious for AlternativeTo and first-time visitors
Document and demo the new --iac scanning path (Terraform, Kubernetes, Helm, Dockerfile)
Seed a small set of good first issue / help wanted tickets (linked below as we open them)
Improve contributor onboarding against CONTRIBUTING.md (fixtures, docs PRs, grammar work)
Mid term (~90 days)
Deeper language / resolution coverage where fixtures are thin
Stronger “blast radius / architecture” demos newcomers can run in minutes
Clearer path from CLI → VS Code / MCP (vg serve) for AI coding agents
Community-facing example repos beyond examples/github-actions
How we use this issue
Maintainers update checkboxes and link child issues as work starts
External ideas: open a Feature request (or comment here if you’re unsure)
Stars help people track releases; issues and PRs are how the project actually grows
Themes rewritten from adjacent SCA/SBOM CLI issue spaces (syft/trivy/grype/osv-scanner/dependency-check) into Vibgrate-specific docs/tests/bugs — no copy-paste titles. Mix stays documentation / enhancement / bug; good first only where newcomer-scoped; no new help wanted.
Toward the ~200 public-issue discovery goal on the roadmap.
Also out today: release notes for 2026.1006.1 in Discussions (#388). And thank you @yunaremaia for the README first-screen PR (#386, closes #149)! 👏 Comment on any ticket you'd like to pick up.
New on the roadmap today: #487 adds a fail-on-epss input to the GitHub Action so the new vg scan --fail-on-epss gate gets the same validated, first-class treatment as fail-on and max-score. A nice self-contained one if you know your way around composite actions.
Activity
vibgrate-team commentedon Sep 17, 2026
Daily seeding batch (2026-09-17)
Announcement
Issues
vibgrate-team commentedon Sep 18, 2026
Daily seeding batch (2026-09-18)
Announcement
Issues (all
vibgrate-team)vg show archcanvas toggles (documentation,good first issue)findings-from-diffJSON /kind: correctness(documentation)enhancement,good first issue)bug)vg scan/vg buildexit codes (documentation,good first issue)enhancement)documentation)enhancement,good first issue)No
help wantedon this batch. No external contributor replies needed today.vibgrate-team commentedon Sep 21, 2026
Daily seeding 2026-09-21 — new public issues:
vg why/vg bisectvulnerability attribution (documentation, good first issue)vg scan --vulns --package-manifest(documentation)vg scanfor CI reporters (enhancement).tf/.tofuundervg scan --iac(documentation)go.workworkspace fixture forvg build(enhancement, good first issue)vg evidence exposureCI exit semantics (documentation, good first issue)vg reportHTML footer (enhancement)Themes rewritten from adjacent SCA/SBOM CLI issue spaces (syft/trivy/grype/osv-scanner/dependency-check) into Vibgrate-specific docs/tests/bugs — no copy-paste titles. Mix stays documentation / enhancement / bug; good first only where newcomer-scoped; no new help wanted.
Toward the ~200 public-issue discovery goal on the roadmap.
vibgrate-team commentedon Sep 22, 2026
Daily seeding batch (2026-09-22)
Announcement
New public issues
vg scan --drift-budget/--drift-worseningCI gating (documentation,good first issue)vg reportHTML (enhancement)bug)primaryPackagePurposemapping invg sbom(documentation)poetry.lock) edge-case fixture forvg build(enhancement,good first issue)vg scan --vulnsJSON when present (enhancement)vg sbom deltasemantics and CI usage (documentation,good first issue)LicenseRef-*throughvg sbomformat exports (bug)Themes rewritten from adjacent SBOM/scan ecosystems (trivy / osv-scanner / cyclonedx-cli / cdxgen / dependency-track) into Vibgrate-specific local-first work — no copy-paste of foreign issue text.
vibgrate-team commentedon Sep 23, 2026
Daily seeding batch (2026-09-23)
Announcement
v2026.921.1already announced in Release notes: Vibgrate CLI 2026.921.1 — review propose matches findings-from-diff #247New public issues
vg install --compress/vg savingstoken compression (documentation,good first issue)vg scan --vulns(documentation)bug)Gemfile.lock) edge-case fixture forvg build(enhancement,good first issue)vg attest-actionslocal/offline expectations (documentation)enhancement)vg doctorchecks and CI exit semantics (documentation,good first issue)vg sbom/ scan outputs (documentation)Themes rewritten from adjacent SBOM/scan/attestation ecosystems (syft / grype / trivy / osv-scanner / dependency-track / cosign) into Vibgrate-specific local-first work — no copy-paste of foreign issue text.
vibgrate-team commentedon Sep 24, 2026
Daily seeding batch (2026-09-24)
Announcement
v2026.921.1already announced in Release notes: Vibgrate CLI 2026.921.1 — review propose matches findings-from-diff #247New public issues (author: vibgrate-team)
vg sbom/ scan JSON (documentation)composer.lock) edge-case fixture (enhancement,good first issue)actions.lock) (documentation)bug)vg reportMarkdown vs HTML field coverage (documentation)packages.lock.jsonedge-case fixture (enhancement,good first issue)enhancement)bug)No external contributor engagement needing a reply today.
vibgrate-team commentedon Sep 25, 2026
Daily seeding batch (2026-09-25)
Announcement
v2026.921.1already announced in Release notes: Vibgrate CLI 2026.921.1 — review propose matches findings-from-diff #247New public issues (author: vibgrate-team)
uv.lockedge-case fixture forvg build(enhancement,good first issue)vg sbom(documentation)graph.jsonis corrupt or schema-mismatched (bug)partialFingerprintsacross identicalvg scanruns (enhancement)vg path/vg impact/vg treefor first-time graph navigation (documentation,good first issue)enhancement)vg baselinecreate/update and CI gating with suppressions (documentation)bug)No
help wantedon this batch. Engagement: no external contributor replies needing a maintainer response.vibgrate-team commentedon Sep 28, 2026
Daily seeding batch (2026-09-28)
Announcement
v2026.921.1already announced in Release notes: Vibgrate CLI 2026.921.1 — review propose matches findings-from-diff #247New public issues (author: vibgrate-team)
vg code --locallocal-first expectations and approval boundaries (documentation,good first issue)vg liblockfile-pinned docs fetch and failure modes (documentation)enhancement)--package-manifestpath is missing or unreadable (bug)Pipfile.lockedge-case fixture forvg build(enhancement,good first issue)vg hcs(Holistic Code Spec) for first-time contributors (documentation)vg sbomJSON independent of filesystem walk order (enhancement)vg evidence verifyreads a truncated or corrupt bundle (bug)No
help wantedon this batch. Engagement: no external contributor replies needing a maintainer response.vibgrate-team commentedon Sep 29, 2026
Daily seeding batch (2026-09-29)
Announcement
v2026.921.1already announced in Release notes: Vibgrate CLI 2026.921.1 — review propose matches findings-from-diff #247New public issues (author: vibgrate-team)
vg scanJSON (documentation,good first issue)bug)dependencyManagementfixture forvg build(enhancement,good first issue)gradle.lockfileedge-case fixture forvg build(enhancement,good first issue)vg fixranked upgrade plans and local-first bounds (documentation)vg scanJSON (enhancement)bug)vg serve --httplocal binding and offline boundaries (documentation)No
help wantedon this batch. Engagement: no external contributor replies needing a maintainer response.vibgrate-team commentedon Sep 30, 2026
Daily seeding batch (2026-09-30)
vibgrate-team commentedon Oct 1, 2026
Daily seeding batch (2026-10-01)
vibgrate-team commentedon Oct 2, 2026
Daily seed — 2026-10-02
Part B: Announcements discussion for v2026.930.1 — #313
New issues (vibgrate-team):
.vibgrate/config.ymland migration from JSON /review.toml(documentation,good first issue)vg review --basepolicy loading from the base branch (documentation).vibgrate/config.ymlis malformed or fails schema (bug)vg sbomJSON (enhancement)vg scan(documentation)bug)pubspec.lockedge-case fixture forvg build(enhancement,good first issue)driftBudgetdisagrees across YAML and JSON config files (enhancement)Themes rewritten from adjacent public issue classes (osv-scanner / cosign / cyclonedx-cli / trivy / syft) plus the 2026.930.1 YAML +
--basesurface — no copy-paste titles/bodies.vibgrate-team commentedon Oct 5, 2026
Batch 2026-10-05: new work following the 2026.1003.1 and 2026.1003.3 releases (announcement 1, announcement 2):
vg review docmodes and the local vs cloud splitVibgrate-Sessiontrailers,vg review trailer push,vg why --cloudvg show --diagram,vg path --diagram,vg show flowexamples (good first issue).vibgrate/artifactspackage.jsonwithout name or versionvg serve --reviewwrite operations are opt-in, annotated, and confinedUpvote with 👍 on whatever you'd like to see first.
vibgrate-team commentedon Oct 6, 2026
Batch 2026-10-06: new work following the 2026.1005.1 release (JUnit reports, EPSS/KEV, redaction)
vg scan --junit(good first issue)redactForDisplay(good first issue)node_modules, or config from the cwdComment on any of them if you'd like to pick one up, or 👍 the ones you'd like to see first.
vibgrate-team commentedon Oct 7, 2026
Batch 2026-10-07: seven new scoped tickets, mostly hardening around the new
max-scoreAction input,vg fixhonesty, and machine-readable output:max-scoreaccepts values above 100 (good first issue)vg fixnever reports an advisory as resolved when the upgrade is blockedlevelfollows advisory severity (good first issue)vg builddiscovers files in a single tree walkAlso out today: release notes for 2026.1006.1 in Discussions (#388). And thank you @yunaremaia for the README first-screen PR (#386, closes #149)! 👏 Comment on any ticket you'd like to pick up.
vibgrate-team commentedon Oct 8, 2026
Batch 2026-10-08: five scoped tickets following the 2026.1007.1 release (risk budgets and the CI summary), plus a determinism fix:
localeCompare)driftBudgetverdict invg scan --summary-outgatessuite, with a test (good first issue)0and leave unmeasured values empty (good first issue)vg buildrecords GitHub Actionsuses:pins reused through YAML anchors and aliasesBig thanks to @Detoy for the run of merged PRs this week (#396, #402, #403, #405, #408). Comment on any ticket you'd like to pick up.
vibgrate-team commentedon Oct 9, 2026
Batch 2026-10-09: seven scoped tickets (no new CLI release since 2026.1007.1) — Action docs sync, lockfile/HTML tests, locale-safe warning order, SBOM dependency kind, symlink warning codes, and an EPSS CI gate:
image-tagpin and document summary outputs (good first issue)gradle.lockfilecomment andempty=lines never become packages (good first issue)localeCompare(locale-dependent order)scopeand SPDXDEV_/OPTIONAL_DEPENDENCY_OFfrom manifest sectionsVG_WARN_SYMLINK_SKIPPEDvg scan --fail-on-epssthreshold gate for CIvg report --format htmlshows unmeasured DriftScore asn/aand skipped packs as Not scanneddocs/sbom-dependency-scope.mdfrom DOCS.md SBOM export sectionvibgrate-team commentedon Oct 20, 2026
New on the roadmap today: #487 adds a
fail-on-epssinput to the GitHub Action so the newvg scan --fail-on-epssgate gets the same validated, first-class treatment asfail-onandmax-score. A nice self-contained one if you know your way around composite actions.vibgrate-team commentedon Oct 21, 2026
Two new on the roadmap today, both following on from 2026.1020.1 (release notes):
optional = truecrates in line with npm optional dependencies invg sbom export(CycloneDXscope: "optional", SPDXOPTIONAL_DEPENDENCY_OF).vg scan --fail-on-epssstderr list (the 50-row cap and the… N moreline).Comments and claims welcome.
vibgrate-team commentedon Oct 23, 2026
Two more on the roadmap, both following on from #491 bringing Cargo optional crates into line in
vg sbom export:optional = truedependencies in[tool.poetry.dependencies].[project.optional-dependencies]extras, which the Python scanner skips today, and exports them as optional.Comments and claims welcome.