Skip to content

Releases: gkanitz/CodeRepute

Release list

v0.1.0 — First public release

v0.1.0 — First public release Latest
Marketplace
Latest
Marketplace

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Jun 10:34
v0.1.0
d98d247

CodeRepute v0.1.0

First public release. CodeRepute generates cryptographically attested developer collaboration reports for private-repo engineers — giving candidates verifiable evidence of their code review activity without exposing proprietary code.

What's included

Report generation

  • Pull commits, pull requests, review comments, and approval events from GitHub (org-scoped or single-repo) and GitLab (group-scoped)
  • Computes collaboration metrics: reviews given/received, comment depth, approval rate, volume trends, and a per-year activity heatmap
  • Renders a self-contained report.html with narrative front page, KPI strip, SVG charts, and a technical annex; report JSON is embedded directly in the HTML

Cryptographic attestation (GitHub Actions)

  • Both report.html and report.pdf (CI-generated via headless Chromium) are independently attested using Sigstore via actions/attest-build-provenance
  • Verify either file with gh attestation verify report.html --repo gkanitz/CodeRepute or via the verify page
  • Rekor transparency-log fallback when the GitHub attestation API is unavailable

Verification page

  • Browser-side verification at https://gkanitz.github.io/CodeRepute/verify/
  • Accepts report.html or report.pdf uploads; extracts embedded metadata automatically
  • Pre-fills repo and subject from URL params (QR code in report footer links here)
  • No server — all verification logic runs client-side in JavaScript

GitHub Action

  • gkanitz/CodeRepute@v0.1.0 — composite action; runs in any GitHub Actions workflow
  • Inputs: subject, repo, org, token, out, attest, window
  • Outputs: report-html, report-pdf
  • All internal action dependencies pinned to commit SHAs

GitLab CI component

  • gitlab.com/gkanitz/coderepute/coderepute-report@v0.1.0
  • Provides honest verification block (job identity, pipeline URL) with a clear note that GitLab CI does not issue Sigstore tokens

Install

Download the binary for your platform below, or install from source:

go install github.com/gkanitz/coderepute/cmd/coderepute@v0.1.0

All release archives are attested — verify with:

gh attestation verify coderepute_linux_amd64.tar.gz --repo gkanitz/CodeRepute

Checksums

See checksums.txt attached to this release.

Assets 8
Loading