# Provenance

## Upstream target {#upstream-target}


| Field | Value |
|---|---|
| Repository | `github.com/stretchr/testify` |
| Pinned commit | `87a7b9d57689f6579db2da795ab8deeab29cb724` |
| Commit date | 2026-09-24T14:59:34Z |
| Default branch | `master` |
| Licence | MIT (`LICENSE` in the tree, "Copyright (c) 2012-2020 Mat Ryer, Tyler Bunnell and contributors.") |
| Module path | `github.com/stretchr/testify` (`go.mod`, `go 1.17`) |
| Packages documented | `./assert`, `./require`, `./mock`, `./suite`, `./http` |

The commit is pinned rather than tracking `master`: the tree was fetched as a tarball at that
exact SHA, so the text on this site cannot change under the reader's feet.


## Generator {#generator}


| Field | Value |
|---|---|
| Tool | [Sourcey](https://github.com/sourcey/sourcey) `v3.8.3` (MIT, published on npm as `sourcey`) |
| Adapter | `godoc` (snapshot mode) |
| Node.js | `v22.20.0` (Sourcey 3.8.x requires Node >= 22.19) |
| Go toolchain | `go1.27.3` (used only to produce the snapshot) |


## Exact commands {#exact-commands}


Sourcey was obtained from the public npm registry:

```bash
npm install sourcey@3.8.3
```

The godoc snapshot was taken from the pinned module tree:

```bash
sourcey godoc \
  -m . \
  -p "./assert,./require,./mock,./suite,./http" \
  --exclude "github.com/stretchr/testify/internal" \
  -o godoc.json
```

which reported:

```
Sourcey: wrote godoc snapshot for github.com/stretchr/testify
  Packages:    5
  Output:      godoc.json
```

The site itself was built from that committed snapshot, so the build host needs no Go toolchain
and two builds of the same snapshot produce the same site:

```bash
sourcey build -c sourcey.config.ts -o dist
```


## Why snapshot mode {#why-snapshot-mode}


`godoc.json` is committed next to `sourcey.config.ts` and the adapter runs with
`mode: "snapshot"`. This means the published site is a pure function of (a) the pinned upstream
commit and (b) the committed snapshot, and it can be rebuilt and re-verified by a third party
without installing Go.


## Reproducing the inventory numbers {#reproducing-the-inventory-numbers}


The per-package counts on the [coverage](https://testify.anonymux.org/coverage.md) page come from a source-level parse of the
same tree, independent of the Go toolchain:

```bash
python3 agent2-inventory-33.py <pinned-module-dir> inventory.json --min 20
```

It exits non-zero if fewer than twenty public APIs are found, so it cannot silently produce a
thin reference.