GitGalaxy Scanner

Version updated for https://github.com/squid-protocol/gitgalaxy to version v2.4.8.

  • This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

GitGalaxy is a technical tool designed to create a comprehensive, language-agnostic structural graph of an entire repository directly from source text. It addresses challenges in analyzing large and complex repositories by extracting common structural signatures without the need for successful builds or separate parser/toolchains for every language. The resulting graph can be used for various tasks such as architecture analysis, risk exposure prioritization, dependency/SBOM analysis, refactoring and ownership analysis, legacy-code analysis, AI-oriented codebase context, CI/CD workflows, and historical risk analysis.

What’s Changed

This release marks a major milestone in validating GitGalaxy’s core model. We have expanded our Tri-Comparison Accuracy Audit—cross-referencing GitGalaxy, Tree-sitter, and Universal Ctags—to empirically establish absolute ground truth for our codebase parsing.

The Central Thesis

GitGalaxy operates on a specific hypothesis: For repository-scale intelligence, targeted structural extraction can recover the entities required for useful code intelligence without requiring a complete language parser for every file.

Abstract Syntax Trees (ASTs) are mathematically precise but frequently fail on broken syntax, undocumented legacy code, or missing dependencies. By skipping the compilation step and leveraging heuristic extraction, we aim for maximum resilience. The tri-comparison audit is our way of proving that this resilience does not come at the cost of accuracy.

Current Validation Numbers (Rung 1: Structural Validity)

Our audit is now approximately halfway complete, establishing a verified baseline for our structural model:

  • 24 of 45 languages are now continuously cross-referenced against both Tree-sitter and Ctags.
  • 16 languages are compared against two tools.
  • 5 GitGalaxy-only languages (like Dockerfile and YAML) undergo hand-reviewed manual verification.
  • Of the 180 discrepancy shapes logged so far, 87 have been human-validated (48%) by reading the raw source to determine which tool is actually correct.

The Results: Unprecedented Structural Accuracy

Because GitGalaxy is highly resilient to macro-obfuscation, parse-error cascades, and syntactic anomalies, our heuristic extraction frequently out-performs or matches strict AST parsers on raw production code.

Based on our validated precision scores across function, class, and argument extraction, GitGalaxy currently leads or ties in 34 languages:

🏆 GitGalaxy Produced More Accurate Extractions (Wins): abap, agc_assembly, assembly, c, cobol, cpp, csharp, dockerfile, fortran, haskell, m4, rust

🤝 GitGalaxy Matched Strict AST/Lexical Ground Truth (Ties): apex, css, go, java, jcl, kotlin, makefile, matlab, objective-c, perl, php, powershell, python, ruby, scala, scheme, shell, solidity, swift, tcl, typescript, zig

(Note for transparency: Tree-sitter currently retains higher precision in dart and javascript, which has informed targeted improvements to our heuristics.)

What’s Next: Climbing the Verification Ladder

Validating our structural extraction is only Rung 1 of our Core Ladder of Verification.

With structural ground truth increasingly established, our immediate research direction moves to Temporal and Model Validity: testing whether these extracted structural metrics correctly map to real-world risk exposure. In upcoming releases, we will begin mapping Git-history to track how independently identified security and maintenance events correlate with GitGalaxy’s exposure deltas.