ebb

Find AI model references before their provider retirement dates become outages.

ebb scans a repository for model identifiers, resolves them against a reviewed retirement registry, and reports the file, deadline, replacement, severity, and owner for every match.

Install and run

uvx foretop-ebb scan .

The default command prints a terminal report and exits successfully. Add a gate only when you want findings to affect CI:

uvx foretop-ebb scan . --fail-on high

Run uvx foretop-ebb scan --help for every option.

What it checks

• Model identifiers in Python, TypeScript, YAML, TOML, JSON, Terraform, Dockerfiles, and Jupyter notebooks.
• Canonical model aliases and dated snapshots against the registry bundled with the package.
• Repository ownership through CODEOWNERS, with git attribution as a fallback.
• Published retirement dates, suggested replacements, and evidence for each result.

Unverified identifiers are reported as unknown; they are never treated as clear.

Output and CI gating

--format supports table, markdown, json, sarif, annotations, and triage-json. Without --fail-on, the scan is report-only. With a severity threshold, exit code 1 means a finding met the threshold and 2 means the scan itself failed.

GitHub Action

- uses: foretop-dev/ebb@v0.2.2
  with:
    fail-on: critical

The Action emits inline annotations and can maintain one summary comment on pull requests. Grant pull-requests: write to the job when comments are enabled. Set comment-on-pr: false to disable them, or set fail-on to an empty string for report-only operation.

Privacy

Detection is local and deterministic. The registry ships inside the package, so a normal scan does not upload source or require an account. --report and --gate are explicit hosted-mode options that require FORETOP_TOKEN; the CLI prints the metadata payload before reporting it. Source contents are never part of that payload.

Current limitations

• Detection is static: dynamically constructed identifiers may not be visible.
• Retirement coverage is limited to entries with reviewed provider evidence.
• A missing registry entry produces unknown, not a claim that the model is supported.

Registry corrections

If a model ID, date, replacement, source, or entry is wrong or missing, submit the structured registry-correction form. Include the affected model ID, the exact proposed value, authoritative source URLs, the evidence location, and the date you observed it.

The issue is public. Do not include secrets, credentials, customer code, or customer data. A maintainer will respond within five business days. That response commitment does not guarantee resolution; registry changes still require evidence review.

License

Apache-2.0. See LICENSE.

Questions and bug reports are welcome in GitHub Issues.