Attested proof of your collaboration and judgment — in an era when AI writes more code, CodeRepute measures the human contribution that still matters. Works on private repositories, no source code access required.
Runs inside your CI with a narrowly-scoped read-only token. No public exposure ever required.
Reads only API event metadata — pull requests, reviews, and comments. Repository contents are never fetched.
report.pdf and report.html are independently attested in CI.
CodeRepute's cryptographic attestation becomes more valuable as AI makes output cheap and fakeable — here is how we approach the AI-native development world.
As AI writes more code, raw output metrics — PRs authored, commits, active days — decay as signals of a developer's value. The human contribution shifts toward judgment: reviewing AI-generated code, directing AI agents, and making the decisions that shape shipped work. CodeRepute measures that shift.
Reviews given on AI/bot-authored PRs and the deep-review share on them — judgment applied to machine-written code, an uninflatable signal. This is the AI-era-defining human work that survives when raw output is cheap to generate.
CodeRepute does not infer whether code "looks AI-generated" — that would be gameable and is off-ethos. It does not read commit messages, an attested invariant recorded in every report's transparency manifest. Therefore it cannot and will not measure how much AI you personally used, and says so in every report. This is a trust statement, not a limitation.
AI/bot classification uses a curated, versioned recognition ruleset disclosed in the transparency manifest. Unrecognized agents pass as human. No claim of exhaustive AI detection is made.
Cryptographic attestation of what really happened becomes more valuable precisely as AI makes output cheap and fakeable. When anyone can generate plausible code, a Sigstore-signed record of review engagement and collaboration is the durable, verifiable signal — one that cannot be edited after the fact.
Every metric ships with honest interpretation copy and explicit statements of what it cannot show. No composite score is computed.
| Metric | What it shows |
|---|---|
| Pull requests authored / merged | Shipping cadence |
| Reviews given (approve / changes requested) | Peer review engagement |
| Deep review % (≥ 3 inline comments) | Review depth, not just approval clicks |
| AI/bot PRs reviewed + deep-review share | Judgment applied to AI-authored code |
| Review comments written / received | Collaboration texture |
| Median time to merge | PR scoping and team review responsiveness |
| Time to first review | How quickly teammates pick up your PRs |
| Rework rate | Share of PRs that required a revision cycle |
| Active days / contribution cadence | Consistency of engagement over the window |
| Monthly trend charts | How contribution patterns evolved over time |
CodeRepute presents numbers in context — not verdicts. It shows you collaboration data in context — with honest framing about what each metric can and cannot tell you.
Developer collaboration is not a competition. Applying platform metrics — whether from DORA, individual productivity dashboards, or any other framework — as personal judgements ignores the context that makes each team and each role different. CodeRepute shows raw numbers with size-normalised rates so you can see the texture of collaboration without reducing it to a single number.
This skepticism is widespread. The JetBrains State of Developer Ecosystem 2025 survey (24,534 developers) found that 66% of developers do not trust DORA metrics when applied as personal performance indicators — a finding that aligns with our decision to keep the report score-free.
Pull requests come in different sizes, and size affects how many inline review comments a PR typically receives. Larger PRs naturally attract fewer comments per line changed than small, focused PRs — reviewers cannot sustain the same density of feedback across hundreds of files. For this reason, CodeRepute groups PRs into size bands and shows both the raw count of review comments alongside a size-normalised rate (comments per PR within each band). This gives you the full picture: the raw number tells you about absolute review investment, while the normalised rate accounts for the structural effect of PR size.
Pin to a tagged version. The Sigstore certificate records the exact producing workflow identity — making the attestation machine-checkable.
jobs:
coderepute:
permissions:
contents: read
pull-requests: read
id-token: write
attestations: write
uses: gkanitz/CodeRepute/.github/workflows/coderepute-report.yml@v0.1.0
with:
repos: your-org/your-repo
subject: some-username
Cover an entire org:
org: your-org
instead of repos:
No org? Run from your personal repository with no org admin needed.
The action builds the CLI from this action's own pinned source, collects API event metadata, and generates the report — entirely within your environment.
report.pdf and
report.html (with embedded JSON) are independently signed.
The Sigstore certificate records the exact producing workflow at the exact pinned version.
Share the report.pdf with recruiters or host the report.html on your site. The footer QR code links to this verify page — recipients can confirm the file has not been altered since the attested CI run.
Wherever your best work is locked in private repositories and you need a trustworthy way to share it.
Most of your best work lives in private repositories. Get a shareable, verifiable record of collaboration activity without exposing any code or repo names.
Request a report as part of a technical screen. The attestation proves the numbers come directly from the platform API and were not edited by the candidate.
Demonstrate code review investment and team impact that doesn't show up in personal commit counts.
Upload report.pdf or
report.html to verify it
has not been modified since the CI run that produced it.
Verification runs entirely in your browser — no data is sent to any server.
CodeRepute has no telemetry, tracking, or analytics. Feedback is explicit or it does not exist. Open a bug report or share your experience — every submission is read.