contrib-checker
contrib-checker checks if code contributors are properly listed in metadata files such as CITATION.cff and codemeta.json based on the git history.
It provides:
- Python library: Installable package for programmatic use
- Command-line tool:
contrib-checkerCLI for local checking - GitHub Action: Automated checking in GitHub workflows
- GitLab CI: Support for GitLab merge request checking
Installation
As a Python package
pip install contrib-checker
For development
git clone https://github.com/vuillaut/contrib-checker.git
cd contrib-checker
pip install -e .
Usage
Command-line tool
After installation, you can use the contrib-checker command:
# Check all contributors in current repository
contrib-checker
# Check with specific mode
contrib-checker --mode fail
# Check with ignore lists
contrib-checker --ignore-emails bot@example.com --ignore-logins bot-user
# Check specific commit range
contrib-checker --from-sha abc123 --to-sha def456
# Use specific repository path
contrib-checker --repo-path /path/to/repo
# See all options
contrib-checker --help
As a Python library
from contrib_checker import ContributorChecker
from pathlib import Path
# Initialize checker
config = {
'mode': 'warn', # or 'fail'
'ignore_emails': ['bot@example.com'],
'ignore_logins': ['bot-user']
}
checker = ContributorChecker(
repo_path=Path('.'),
config=config
)
# Check all contributors
success, results = checker.check_all_contributors()
# Check specific commit range
success, results = checker.check_range_contributors(
from_sha='abc123',
to_sha='def456',
description='PR commits'
)
# Check results
if results['missing_overall']:
print("Missing contributors:")
for contributor in results['missing_overall']:
print(f" {contributor}")
Platform-specific usage
# GitHub-specific wrapper
from contrib_checker import GitHubContributorChecker
github_checker = GitHubContributorChecker()
success = github_checker.check_pr_contributors()
# GitLab-specific wrapper
from contrib_checker import GitLabContributorChecker
gitlab_checker = GitLabContributorChecker()
success = gitlab_checker.check_mr_contributors()
GitHub Action Setup
Quick start
- Ensure your repository has
CITATION.cffand/orcodemeta.jsonwith author/contributor entries. - Add a
.mailmapat the repository root if you need to unify alternate emails or names from the git history. - Add this action (or copy the workflow) into your repo in
.github/workflows/contrib-check.yml; the included workflow triggers on pull requests.
Example .github/workflows/contrib-check.yml
name: Contributor Check
on:
pull_request:
types: [opened, synchronize]
permissions:
contents: read
pull-requests: write # allows posting comments on PRs
jobs:
contrib-check:
runs-on: ubuntu-latest
steps:
- name: Contrib metadata check
uses: vuillaut/contrib-checker@main
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
mode: warn # or 'fail' to make the workflow fail when contributors are missing
ignore_emails: "dependabot[bot]@users.noreply.github.com,ci-bot@example.com"
ignore_logins: "dependabot[bot],github-actions[bot]"
GitLab CI Setup
See GITLAB_CI_USAGE.md for detailed GitLab CI setup instructions.
Example .gitlab-ci.yml
contrib-check:
stage: test
image: python:3.11
script:
- pip install contrib-checker
- contrib-checker
rules:
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
How it works
- Uses
git log --use-mailmapto collect commit authors, so ensure.mailmapis present if you need to unify multiple emails - Compares commit authors against
CITATION.cffandcodemeta.jsoncontributors - Posts comments on GitHub PRs or GitLab MRs when missing contributors are found
- Can be configured to fail CI when contributors are missing (
mode: fail)
Requirements
- Python 3.8+
- Git repository with contributor metadata files
- For GitHub Actions:
CITATION.cfforcodemeta.jsonfile - For GitLab CI: Same metadata files plus GitLab API token
- Optional:
.mailmapfile to unify contributor names/emails
Configuration
The tool can be configured via:
- Configuration file:
.github/contrib-metadata-check.yml(GitHub) or environment variables (GitLab) - Command-line arguments: When using the CLI
- Environment variables: For CI/CD integration
Configuration options
mode:warn(default) orfailignore_emails: List of email addresses to ignoreignore_logins: List of login names to ignore
Contributing
See CONTRIBUTING.md for development guidelines.
License
This project is licensed under the MIT License - see the LICENSE file for details.
Metadata
Release files for contrib-checker 1.0.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| contrib_checker-1.0.0.tar.gz | 23.1 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| contrib_checker-1.0.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 36.7 kB
Release files / contrib_checker-1.0.0.tar.gz
| Download URL | contrib_checker-1.0.0.tar.gz |
|---|---|
| Size | 23.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
fad000903a6334b41b81401395017c30604ec777636731982a831745108c2b5a
|
|
BLAKE2b-256 checksum How to use checksums |
856b9a08ef6348896dd821d01c72790dfcf2abe3e20663f42f24c78f832e40f4
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.12.9
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 19, 2025.
Transparency logRelease files / contrib_checker-1.0.0-py3-none-any.whl
| Download URL | contrib_checker-1.0.0-py3-none-any.whl |
|---|---|
| Size | 13.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
502a61b7905b120f9dbd0f2b98f04bb282f80f05e5da2b15c1016c980d0f48b9
|
|
BLAKE2b-256 checksum How to use checksums |
70b8019de04d1ea1396fc2b1488f789fbbcea5bd12681d0785d0577540789a6a
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.12.9
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 19, 2025.
Transparency log