Circuit grade
proxmox: F
43% of the points that apply, read from conn3xorg/circuit-proxmox at v0.1.0 on 2 November 2026. That's not a pass, and no score could make it one until this changes: A second plan comes back clean; CI uses the thing, past "service is active".This tells you what we checked. It doesn't tell you the circuit is safe, because no grade can: it runs as root on your servers, so read it before you run it.
Testing
| Check | Result | Points | What we saw |
|---|---|---|---|
| CI isn't staying red on main (must pass) | Passed | 15 of 15 | Run of 2026-11-02 passed. |
| Applied on real distributions in CI | Failed | 0 of 10 | CI never applies this circuit to a host. |
| A second plan comes back clean (must pass) | Failed | 0 of 15 | CI doesn't run plan -detailed-exitcode after an apply. |
| CI uses the thing, past "service is active" (must pass) | Failed | 0 of 20 | After apply, CI only looks at the host: it never uses what was installed. |
| CI checks secrets stay out of state | Doesn't apply | – | No sensitive or ephemeral inputs. |
| Restart or reboot tested | Failed | 0 of 5 | CI never restarts it after apply. |
| Upgrade tested | Failed | 0 of 5 | No CI step upgrades an existing install. |
| Recent run on a real host | Failed | 0 of 5 | No real-host workflow has passed. A README saying so doesn't count. |
Supply chain
| Check | Result | Points | What we saw |
|---|---|---|---|
| Downloads are checksummed | Passed | 5 of 5 | All 1 download steps have a checksum. |
| Container images pinned by digest | Doesn't apply | – | Pulls no images. |
| Pinned repo keys aren't near expiry | Doesn't apply | – | Pins no signing keys. |
| Default listen address | Passed | 5 of 5 | Found no default or literal that listens on every address. |
| Privileged shell patterns | Passed | 5 of 5 | Found none of the listed patterns. |
Repository
| Check | Result | Points | What we saw |
|---|---|---|---|
| Release tag is signed | Passed | 5 of 5 | GitHub verified the signature on v0.1.0. |
| Main is protected | Passed | 5 of 5 | A ruleset requires pull requests and passing checks. |
| Released recently | Passed | 5 of 5 | v0.1.0 is 4 days old. |
How to read this
Every point comes from a CI file, a workflow run or a signature that a script read. A README can't earn one. So a pass here means CI ran what it says; a miss can mean the work was done and never written into CI, which we count the same way. The rubric lists every check, what it's worth and what it can't see.
The CI run we read is on GitHub, so you can check our reading.
Badge
[](https://conn3x.org/circuits/proxmox/grade)