Skip to content

CommitAtlas v0.1.0 — Your GitHub work, mapped clearly

Marketplace
Marketplace

Choose a tag to compare

View all tags
@Chris0Jeky Chris0Jeky released this 24 Aug 11:50
v0.1.0
ee24f80
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Your GitHub work, mapped clearly.

The first tagged release of CommitAtlas: eight embeddable SVG cards, a project-health dashboard, a credential-free static generator, and a bundled GitHub Action — deployed and continuously verified on Cloudflare Workers.

Live now: https://commit-atlas.commit-atlas.workers.dev · Studio

The rule this project is built around

An unknown, missing, or stale signal is never displayed as healthy or passing.

Most GitHub card projects render whatever comes back and paint the gaps green. CommitAtlas doesn't.

CI freshness has a 72-hour window, and a run older than that reports stale rather than passing. A repository whose workflow cannot be read reports unavailable, not "0 failures". A rate limit, an upstream outage, and a genuine 404 are three distinct answers, never collapsed into one. The rhythm score says on its own face that it is a personal consistency measure and not a GitHub rank. The languages card reports byte share and refuses to imply proficiency. The breakdown card labels its own scope whenever it falls back to calendar-year profile percentages.

That rule is enforced by tests, not by discipline — including against the project's own authors. Two examples from this release: a negative project count was being clamped to a confident-looking 0 attention in the healthy style, and the machine-readable licence metadata briefly claimed MIT on a GPL-3.0-only project. Both were caught by review and are now pinned by tests.

What's in it

Eight cards

Card What it shows
Atlas A full year in one 860×380 SVG: heatmap, density, streaks, collaboration mix, 12-bucket momentum, rhythm, languages, project health
Profile Repositories, followers, following, stars, contribution total
Streak Current and longest streak inside the displayed window, active days, last activity
Breakdown Window-scoped categorized counts when exact; otherwise calendar-year percentages, labelled as not window-scoped
Rhythm Personal consistency from density, streak, and momentum — not a rank
Activity Bounded daily contribution graph with its exact date window
Languages Repository-language byte share, never guessed proficiency
Projects Up to six curated projects with declared lifecycle, named-workflow CI, release, and freshness

Four themes (aurora, midnight, paper, ember), wide and compact layouts, and motion=none|subtle. subtle ships a prefers-reduced-motion override; none emits no keyframes at all. The paper light theme exists because README embeds land on light GitHub profiles.

Three ways to use it

  • Hosted API — /api/v1/cards/*.svg. No credentials needed for any documented surface.
  • Static generator — reads the logged-out public profile, renders every selected card from one snapshot, and writes a SHA-256 manifest. The config is one-owner and public-only by design: it rejects unknown fields, credentials, absolute/traversing/symlinked paths, untracked config, duplicate cards, and invalid workflow identities.
  • GitHub Action — repository-root action.yml, Node 24, bundled. It only generates files. It never commits, never pushes, never uploads, and never receives GITHUB_TOKEN.

The Studio

Configure, preview, and copy the exact README Markdown. Project Docs / Install / Download / Release / Source / CI links live in the accessible HTML dashboard rather than in the SVG, because a README-embedded SVG is one linked image and cannot reliably carry independent links.

Deployment

CommitAtlas is a Cloudflare Worker with static assets and needs no credentials to serve every documented surface, so the free Workers plan is enough.

npx wrangler login
npm run deploy

npm run deploy builds, publishes, reads the deployed origin out of Wrangler's own output, and runs seventeen deterministic probes against it. The origin is never hard-coded: a workers.dev hostname is account-specific, and a hard-coded one would have a fork's verification probe someone else's healthy site and report success for a deployment that never happened.

Push-to-deploy from GitHub Actions is wired and proven end to end — CI green on main, then build, deploy, verify. Without deployment secrets configured the workflow reports unconfigured and skips cleanly rather than failing, so a fork gets a clean skip and not a red workflow.

Deploying a fork? Set SITE_ORIGIN in wrangler.jsonc to your own origin. It is the canonical URL your deployment advertises — in rel=canonical, the sitemap, and the JSON-LD — and leaving it unset makes your site tell crawlers the canonical copy lives somewhere else. See docs/DEPLOYMENT.md.

Security and privacy posture

  • Credential-free by default. Public GitHub data only. No token is required for anything documented here.
  • Outbound data hosts stay GitHub-owned. Rendering never fetches a link it displays.
  • All user text is schema-bounded and XML-escaped at the package boundary, not at the route.
  • Generated SVGs contain no script, no foreignObject, no event handlers, and no external references.
  • Invalid, duplicate, and traversal queries are rejected as bounded 400 JSON with no-store.
  • The deploy workflow refuses to run on a fork's workflow_run, checking head_repository.full_name rather than the spoofable head_branch. This is reviewed, not demonstrated — no fork has opened a pull request, so the guard has never been exercised by a real fork event.

Known limitations

Named rather than hidden. Every one is a tracked issue:

  • #62 — a genuine non-rate-limit 403 (a blocked repository, an organisation restriction) is still reported as github_rate_limited. Wrong label, correct direction: it reports unavailable, never healthy.
  • #58 — bar geometry can overflow at absurd intermediate magnitudes. Measured clean at 3.7e306 and broken at 3.8e306; unreachable from any GitHub response, reachable by a direct library caller.
  • #54 — npm run check can abort on Windows from a deeply nested checkout path. Environmental, not a product defect.
  • Safari and older Windows want a raster favicon; only an SVG icon ships. No .ico is faked from it.
  • npm publication is not claimed. The packages are built and pack-verified but are not on the registry, and nothing here will say otherwise until a registry lookup succeeds.

Requirements

Node.js 22.13 or newer. Licensed GPL-3.0-only.

235 commits, merge history intact — nothing squashed. Every card, metric, renderer, and GitHub response shape ships with a fixture and a focused test.

What's Changed

  • ci: add locked quality and dependency gates by @Chris0Jeky in #3
  • chore(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #4
  • fix: restore the declared GPL-3.0-only license by @Chris0Jeky in #12
  • docs: add contributor and security guidance by @Chris0Jeky in #11
  • feat(core): add truthful GitHub metric contracts by @Chris0Jeky in #1
  • fix(core): bound streaks to the as-of date by @Chris0Jeky in #22
  • fix(core): reject future CI observations by @Chris0Jeky in #23
  • feat(svg): add accessible card renderers by @Chris0Jeky in #2
  • fix(core): require non-empty contribution calendars by @Chris0Jeky in #24
  • docs(state): save implementation checkpoint by @Chris0Jeky in #26
  • fix(release): close core package blockers by @Chris0Jeky in #27
  • feat(data): add versioned GitHub signal API by @Chris0Jeky in #25
  • fix(svg): ship bounded accessible renderer contracts by @Chris0Jeky in #39
  • fix(core): harden manifest identity contracts by @Chris0Jeky in #43
  • feat(api): ship versioned SVG card routes by @Chris0Jeky in #44
  • feat(studio): ship interactive portfolio dashboard by @Chris0Jeky in #47
  • fix(tests): stop pinned CI fixtures from decaying into stale by @Chris0Jeky in #51
  • chore(deps): bump actions/setup-node from 4 to 7 by @dependabot[bot] in #5
  • build(deps-dev): bump the development-dependencies group across 1 directory with 8 updates by @dependabot[bot] in #6
  • fix(svg): bound caller prose on the breakdown and rhythm cards by @Chris0Jeky in #56
  • feat(deploy): publish CommitAtlas on Cloudflare Workers by @Chris0Jeky in #52
  • hardening(static): tighten generated project catalog boundaries by @Chris0Jeky in #53
  • hardening(api): stable not-found contract and reviewed response-contract gaps by @Chris0Jeky in #57
  • fix(studio): confirm live card evidence per preview run by @Chris0Jeky in #59
  • fix(svg): bound direct caller input on the atlas card by @Chris0Jeky in #61
  • build(deps-dev): bump vinext from 1.0.0-beta.6 to 1.0.0-beta.8 by @dependabot[bot] in #64
  • build(deps-dev): bump globals from 16.4.0 to 17.11.0 by @dependabot[bot] in #65
  • build(deps-dev): bump the build toolchain by four patch and minor versions by @Chris0Jeky in #68
  • feat(app): make the public surface discoverable and self-describing by @Chris0Jeky in #66
  • docs: state the released posture honestly, and what is still not claimed by @Chris0Jeky in #70
  • build(deps-dev): bump @next/eslint-plugin-next from 16.3.1 to 16.3.2 in the development-dependencies group across 1 directory by @dependabot[bot] in #69

New Contributors

Full Changelog: https://github.com/Chris0Jeky/CommitAtlas/commits/v0.1.0

Contributors

dependabot and Chris0Jeky
Assets 2
Loading