reputer

reputer

CLI tool that calculates contributor reputation scores from Git provider APIs. Currently supported providers: GitHub and GitLab.

Reputation is a value between 0 (no/low reputation) and 1.0 (high reputation). The scoring model uses only provider-sourced signals, so the score is best understood as an identity confidence indicator.

Prerequisites

A personal access token for the target provider:

Install

Homebrew:

brew tap mchmarny/tap
brew install reputer

Go:

go install github.com/mchmarny/reputer/cmd/reputer@latest

Or download a binary from the releases page.

Usage

reputer [flags]

Example:

export GITHUB_TOKEN=ghp_...
reputer --repo github.com/mchmarny/reputer

Output:

{
  "repo": "github.com/mchmarny/reputer",
  "at_commit": "",
  "generated_on": "2025-06-10T14:49:19Z",
  "total_commits": 338,
  "total_contributors": 4,
  "meta": {
    "model_version": "3.2.0",
    "categories": [
      { "name": "code_provenance", "weight": 0.15 },
      { "name": "identity", "weight": 0.25 },
      { "name": "engagement", "weight": 0.25 },
      { "name": "community", "weight": 0.15 },
      { "name": "behavioral", "weight": 0.2 }
    ]
  },
  "contributors": [
    {
      "username": "mchmarny",
      "reputation": 1.0
    }
  ]
}

With --stats:

{
  "contributors": [
    {
      "username": "mchmarny",
      "reputation": 1.0,
      "context": {
        "created": "2010-01-04T00:19:57Z",
        "name": "Mark Chmarny",
        "company": "@Company"
      },
      "stats": {
        "verified_commits": true,
        "age_days": 5640,
        "commits": 282,
        "unverified_commits": 0,
        "public_repos": 149,
        "followers": 231,
        "following": 8,
        "last_commit_days": 3,
        "org_member": true,
        "author_association": "MEMBER",
        "has_bio": true,
        "has_company": true,
        "has_location": true,
        "has_website": true,
        "prs_merged": 85,
        "prs_closed": 3,
        "recent_pr_repo_count": 2,
        "forked_repos": 1
      }
    }
  ]
}

Scoring

Reputation is calculated using a v3 risk-weighted categorical model (model version 3.2.0). Signals are grouped into five categories ranked by threat-model priority. Suspended users always score 0.

Categories

Signals

GitHub Action

A composite action that posts contributor reputation scores on pull requests.

Caller example

Add this to your repo at .github/workflows/reputation.yaml:

name: reputation
on:
  pull_request:
    types: [opened, synchronize]
permissions:
  pull-requests: write
  contents: read
jobs:
  score:
    runs-on: ubuntu-latest
    steps:
      - uses: mchmarny/reputer@main

Inputs

The caller's permissions block grants pull-requests: write and contents: read to the automatic GITHUB_TOKEN. No additional secrets are needed.

Behavior

1. Installs reputer (pinned version or latest release, with checksum verification)
2. Runs reputer against the calling repository
3. Posts a Contributor Reputation comment with the PR author's v3 score and stats

Contributing

Contributions are welcome. See CONTRIBUTING.md for guidelines and DEVELOPMENT.md for development setup.

License

Apache License 2.0

Disclaimer

This is my personal project and it does not represent my employer. While I do my best to ensure that everything works, I take no responsibility for issues caused by this code.