Read 2026-11-03
ansible/awx: technical due diligence, read from its repository
What Borehole read in ansible/awx's code and history at a498310: its licence, security advisories, releases, review practice, tests, dependencies and operations. Every finding cites the file and line it rests on. The full report also covers the team and asks the questions the code cannot answer.
| Dimension | Rating |
|---|---|
| Architecture & Codebase — including AI provenance | strong |
| Engineering Process & SDLC Maturity | adequate |
| Product & Engineering Maturity | adequate |
| Security & Reliability Posture | adequate |
| Observability & Operations | not assessable |
| Fit with the Acquirer | not assessable |
What the repository says
CONTRIBUTING.md:139: The project does not take pull requests- No release for 28 months while development continues
COPYING: Relicensed: GPL-3.0 → AGPL-3.0 (2013-04-01) → GPL-3.0 (2013-04-09) → EULA (2017-01-28)
Architecture & Codebase — including AI provenance
strongawx/api/serializers.py is 6,690 lines, 102× this codebase's median file
adequateThe median source file here is 65 lines. 21 files exceed 1,000 lines, the largest being 6,690. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.
awx/api/serializers.py:1 — 6,690 lines (102× median) |
awx/api/views/__init__.py:1 — 5,078 lines (78× median) |
awx/main/access.py:1 — 2,965 lines (45× median) |
awx/main/tasks/jobs.py:1 — 2,336 lines (35× median) |
awx/main/migrations/0001_initial.py:1 — 1,757 lines (27× median) |
Engineering Process & SDLC Maturity
adequatePinned dependencies have not moved in 32 months
adequateThe lockfile last changed 964 days before the newest commit, and 1,173 commits have landed since. Every security fix published upstream in that time is absent until someone updates it, and the longer the gap the larger and riskier that update becomes.
| package-lock.json last changed 2024-03-13 |
Product & Engineering Maturity
adequate80 direct dependencies in a single manifest
adequaterequirements/requirements.in declares 80 direct dependencies. Each one is a maintenance obligation, a supply-chain surface and a potential licence question that transfers with the asset. The count says nothing about whether any given dependency was a good choice; it says how many such choices a buyer inherits.
requirements/requirements.in — 80 declared |
awx_collection/requirements.txt — 3 declared |
awxkit/requirements.txt — 1 declared |
Effort is shifting from building to rewriting
adequateDeleted lines per line added rose from 0.85 to 1.27 between the first and second halves of this history. Rework is normal and often healthy, but a rising ratio means an increasing share of the team's time is spent replacing code that already exists rather than building what does not. Whether that is deliberate repayment or churn is a question for the team.
| first half 0.85, second half 1.27 (split 2020-01-01) |
No release for 28 months while development continues
adequateThe last tag, 24.6.1, was cut 853 days before the survey; the typical gap between releases was 14 days, and 83 commits landed in the last 90 days. Users run the last release, not this code.
| last tag 24.6.1 |
Security & Reliability Posture
adequate1 credential-shaped string in the tree sit in tests, examples, documentation or local development settings
adequateStrings shaped like credentials appear only where fakes are usual: test fixtures, examples, documentation, placeholders and local stacks. They are almost always fakes. Ask someone to confirm that none of them works anywhere, because a real key in a development file is still a real key.
| private key block, where fakes are usual |
3 credential-shaped strings added in the history sit in tests, examples, documentation or local development settings
adequateStrings shaped like credentials appear only where fakes are usual: test fixtures, examples, documentation, placeholders and local stacks. They are almost always fakes. Ask someone to confirm that none of them works anywhere, because a real key in a development file is still a real key.
| 3 cited: private key block, where fakes are usual |
1 environment file is committed
adequate.env is tracked in git. Environment files are where credentials usually live, and committing one usually means nobody decided how secrets reach the running application. Whatever is in it is in the history for good. Check 05.1 says whether it holds anything credential-shaped.
.env — committed environment file |
The build runs third-party code it does not pin
adequate7 third-party CI actions are referenced by a tag or branch rather than a commit, so they run whatever that tag points to on the day. Tags have been moved to malicious commits in real supply-chain attacks, and a piped script is whatever the server returns that minute. Pinning to a commit is the fix, and it is small.
.github/workflows/ci.yml:116 — action pinned by tag |
.github/workflows/ci.yml:135 — action pinned by tag |
48 of 247 migrations cannot be rolled back
adequate48 schema migrations (19%) have no working way back: an empty `downgrade`, a `down` that does nothing, or a data migration with no reverse. A bad deploy that includes one is recovered from a backup, not reverted. Ask when a restore was last rehearsed.
awx/conf/migrations/0007_v380_rename_more_settings.py:14 — migration with no way back |
awx/conf/migrations/0009_rename_proot_settings.py:15 — migration with no way back |
awx/conf/migrations/0011_remove_ldap_auth_conf.py:114 — migration with no way back |
3 deserialisers that can run code
adequate3 places read data with a deserialiser that executes what it reads (`yaml.load` without a safe loader). That is safe on data the system wrote itself and remote code execution on anything else. Ask where each one's input comes from.
awxkit/awxkit/cli/resource.py:98 — code-executing deserialiser |
awxkit/awxkit/yaml_file.py:80 — code-executing deserialiser |
awxkit/awxkit/yaml_file.py:117 — code-executing deserialiser |
Licence text does not match a standard licence
adequateLICENSE.md exists but its text does not match any standard licence. A bespoke or hand-edited licence is not wrong, but it cannot be cleared by recognising its name: counsel has to read it, and until they do neither side knows precisely what rights transfer with the code.
LICENSE.md:1 — 168 lines, unrecognised |
Relicensed: GPL-3.0 → AGPL-3.0 (2013-04-01) → GPL-3.0 (2013-04-09) → EULA (2017-01-28)
adequateThe root licence changed 3 time(s). The latest terms restrict what users, hosts or a buyer may do in ways the earlier ones did not. Code taken under the old terms stays under them, so both matter in diligence.
Observability & Operations
not assessableNot rated: only 5 of 16 checks could reach a conclusion here; the rest do not apply to this repository or could not read it.
Fit with the Acquirer
not assessableNot rated: structurally not assessable from a repository.
Read more, or read your own
The full report on ansible/awx: every dimension, the questions for the room, and the audit log.
Survey a repository: free on public repositories. Private code is read on your own machine by a collector whose source you can read first.