trusty-audit

What it is

trusty-audit is a client that a recipient runs against their own codebases. It installs its own pinned copies of four tools — tga, trusty-search, trusty-analyze, and trusty-review — then registers the repositories and ticketing boards under audit, drives the sweep, and packages the result into a signed return package.

The command that actually runs the sweep is tga audit, documented below. It has its own page here because it is a deliverable in its own right — someone reading a due-diligence report wants that report, not a git-analytics crate.

The gaps are named, not filled in

A stage that fails does not stop the sweep; it becomes a named line in the report's Gaps & Caveats instead of a zero in a cell. Point the sweep at a config with no JIRA project key and the jira sync stage fails — that failure is recorded as a gap, not silently rendered as "no JIRA activity".

What you need installed

Two binaries. tga collects and classifies; trusty-review renders the report at the end of the sweep by running trusty-review report as a subprocess. They meet at a file — the manifest — not at a Cargo dependency edge, so the renderer is a separate install.

cargo install tga --locked
cargo install trusty-review --locked

trusty-review 0.15.0 or newer is required — an older copy is rejected before the first stage runs, with the upgrade command, rather than delivering a report with no written analysis. The sweep looks for trusty-review on PATH; set TRUSTY_REVIEW_BIN to a full path if it lives somewhere PATH cannot see it.

The renderer writes the report's analysis with a model, so an audit cannot finish without a credential. It is checked before the first stage runs, not at the end:

export OPENROUTER_API_KEY=…