CLI tool that calculates contributor reputation scores from Git provider APIs. Currently supported provider: GitHub.

Reputation is a value between 0 (no/low reputation) and 1.0 (high reputation). The scoring model uses only provider-sourced signals, so the score is best understood as an identity confidence indicator.

A personal access token for the target provider:

Homebrew:

brew tap mchmarny/tap
brew install reputer

Go:

go install github.com/mchmarny/reputer/cmd/reputer@latest

Or download a binary from the releases page.

reputer [flags]

Example:

export GITHUB_TOKEN=ghp_...
reputer --repo github.com/mchmarny/reputer

Output:

{
  "repo": "github.com/mchmarny/reputer",
  "at_commit": "",
  "generated_on": "2025-06-10T14:49:19Z",
  "total_commits": 338,
  "total_contributors": 4,
  "meta": {
    "model_version": "3.2.0",
    "categories": [
      { "name": "code_provenance", "weight": 0.15 },
      { "name": "identity", "weight": 0.25 },
      { "name": "engagement", "weight": 0.25 },
      { "name": "community", "weight": 0.15 },
      { "name": "behavioral", "weight": 0.2 }
    ]
  },
  "contributors": [
    {
      "username": "mchmarny",
      "reputation": 1.0
    }
  ]
}

With --stats:

{
  "contributors": [
    {
      "username": "mchmarny",
      "reputation": 1.0,
      "context": {
        "created": "2010-01-04T00:19:57Z",
        "name": "Mark Chmarny",
        "company": "@Company"
      },
      "stats": {
        "verified_commits": true,
        "age_days": 5640,
        "commits": 282,
        "unverified_commits": 0,
        "public_repos": 149,
        "followers": 231,
        "following": 8,
        "last_commit_days": 3,
        "org_member": true,
        "author_association": "MEMBER",
        "has_bio": true,
        "has_company": true,
        "has_location": true,
        "has_website": true,
        "prs_merged": 85,
        "prs_closed": 3,
        "recent_pr_repo_count": 2,
        "forked_repos": 1
      }
    }
  ]
}

Reputation is calculated using a v3 risk-weighted categorical model (model version 3.2.0). Signals are grouped into five categories ranked by threat-model priority. Suspended users always score 0.

A composite action that posts contributor reputation scores on pull requests.

Add this to your repo at .github/workflows/reputation.yaml:

name: reputation
on:
  pull_request:
    types: [opened, synchronize]
permissions:
  pull-requests: write
  contents: read
jobs:
  score:
    runs-on: ubuntu-latest
    steps:
      - uses: mchmarny/reputer@main

The caller's permissions block grants pull-requests: write and contents: read to the automatic GITHUB_TOKEN. No additional secrets are needed.

Rate limits: The default GITHUB_TOKEN allows 1,000 API requests/hour. Each contributor requires ~8+ API calls (more with trusted-orgs). For repos with many contributors, use a Personal Access Token (5,000 requests/hour) by passing it via the github-token input and storing it as a repository secret.

1. Installs reputer (pinned version or latest release, with checksum verification)
2. Runs reputer against the calling repository
3. Posts a Contributor Reputation comment with the PR author's v3 score and stats

Contributions are welcome. See CONTRIBUTING.md for guidelines and DEVELOPMENT.md for development setup.

Apache License 2.0

This is my personal project and it does not represent my employer. While I do my best to ensure that everything works, I take no responsibility for issues caused by this code.