reputer

reputer

CLI tool that calculates contributor reputation scores from Git provider APIs. Currently supported providers: GitHub and GitLab.

Reputation is a value between 0 (no/low reputation) and 1.0 (high reputation). The scoring model uses only provider-sourced signals, so the score is best understood as an identity confidence indicator.

Prerequisites

A personal access token for the target provider:

Install

Homebrew:

brew tap mchmarny/tap
brew install reputer

Go:

go install github.com/mchmarny/reputer/cmd/reputer@latest

Or download a binary from the releases page.

Usage

reputer [flags]

Example:

export GITHUB_TOKEN=ghp_...
reputer --repo github.com/mchmarny/reputer

Output:

{
  "repo": "github.com/mchmarny/reputer",
  "at_commit": "",
  "generated_on": "2025-06-10T14:49:19Z",
  "total_commits": 338,
  "total_contributors": 4,
  "meta": {
    "model_version": "2.0.0",
    "categories": [
      { "name": "code_provenance", "weight": 0.35 },
      { "name": "identity", "weight": 0.25 },
      { "name": "engagement", "weight": 0.25 },
      { "name": "community", "weight": 0.15 }
    ]
  },
  "contributors": [
    {
      "username": "mchmarny",
      "reputation": 1.0
    }
  ]
}

With --stats:

{
  "contributors": [
    {
      "username": "mchmarny",
      "reputation": 1.0,
      "context": {
        "created": "2010-01-04T00:19:57Z",
        "name": "Mark Chmarny",
        "company": "@Company"
      },
      "stats": {
        "verified_commits": true,
        "strong_auth": true,
        "age_days": 5640,
        "commits": 282,
        "unverified_commits": 0,
        "public_repos": 149,
        "private_repos": 26,
        "followers": 231,
        "following": 8,
        "last_commit_days": 3,
        "org_member": true
      }
    }
  ]
}

Scoring

Reputation is calculated using a v2 risk-weighted categorical model (model version 2.0.0). Signals are grouped into four categories ranked by threat-model priority. Suspended users always score 0.

Categories

Signals

GitHub Action

A composite action is provided to welcome first-time PR contributors with a comment that includes their reputation stats.

Caller example

Add this to your repo at .github/workflows/welcome.yaml:

name: welcome
on:
  pull_request_target:
    types: [opened]
permissions:
  pull-requests: write
  contents: read
jobs:
  welcome:
    runs-on: ubuntu-latest
    steps:
      - uses: mchmarny/reputer@main

Inputs

The caller's permissions block grants pull-requests: write and contents: read to the automatic GITHUB_TOKEN. No additional secrets are needed.

Behavior

1. Checks if the PR author is a first-time contributor
2. Installs reputer (pinned version or latest release)
3. Runs reputer against the calling repository
4. Posts a comment with:
   • Welcome message (first-time contributors only)
   • Contributor Reputation table if reputer finds the author in the repo history
   • Contributor Profile table (GitHub API fallback) if the author has no commits yet

The workflow uses pull_request_target context and does not check out PR code, so it is safe for use on public repositories.

Contributing

Contributions are welcome. See CONTRIBUTING.md for guidelines and DEVELOPMENT.md for development setup.

License

Apache License 2.0

Disclaimer

This is my personal project and it does not represent my employer. While I do my best to ensure that everything works, I take no responsibility for issues caused by this code.