A rule-based audit of a public GitHub repository's presentation, documentation, installability, trust signals, and maintenance status
Project description
GitHub First Impression
What is it?
A deterministic quality gate for AI coding agents and maintainers auditing the presentation of public GitHub repositories.
Why?
Agents need a fast, predictable answer after changing a repository. GitHub First Impression applies transparent rules to documentation, installability signals, trust signals, releases, and maintenance indicators.
- Deterministic: every run produces the same score and audit decisions for the same repository state.
- Reproducible: rules and point allocations are public and contain no random component.
- Machine-readable: stable JSON fields and rule IDs support automation.
- CI-friendly: exit codes distinguish a passing gate, a failed gate, and a tool error.
- Bounded: it reads one public repository through GitHub's official REST API only.
It is not an AI reviewer, does not call an LLM, and does not analyze source-code quality. The score is a documentation and repository-presentation heuristic. It is not a code-quality, security, popularity, or maintainability guarantee.
Installation
For an isolated command-line installation:
pipx install github-first-impression
Or install it into the active Python environment:
python -m pip install github-first-impression
Python 3.12 or newer is required.
Quick example
github-first-impression \
https://github.com/psf/requests \
--format json \
--fail-under 80
Selected fields from an actual run on August 3, 2026 are shown below. The full document also contains every category, scored check, and metadata; repository changes can change the result.
{
"schema_version": "1.0",
"tool": {
"name": "github-first-impression",
"version": "0.2.1"
},
"repository": {
"url": "https://github.com/psf/requests",
"owner": "psf",
"name": "requests",
"default_branch": "main",
"archived": false
},
"result": {
"status": "pass",
"score": 86,
"grade": "Good",
"threshold": 80
},
"blocking_issues": [],
"warnings": [
{
"id": "readme_contribution_guidance_missing",
"check_id": "readme_has_contribution_guidance",
"severity": "warning",
"source": "repository",
"message": "README does not mention contribution guidance.",
"suggested_fix": "Link to contribution guidance from the README."
}
],
"artifacts": {
"markdown_report": null
}
}
Exit codes
| Exit | Meaning |
|---|---|
0 |
Quality gate passed |
1 |
Quality gate failed |
2 |
Tool error |
An invalid input, GitHub API failure, network failure, or local I/O failure is a tool error. Parse the JSON on every exit code instead of treating all nonzero results alike.
Features
- Stable JSON output for agents and automated workflows
- Deterministic 100-point scoring with a configurable
--fail-underthreshold - Prioritized
blocking_issueswhen a repository misses the configured gate - Stable category, check, issue, warning, and error IDs
- Explicit warning sources and concrete remediation suggestions
- Side-effect-free JSON mode unless a Markdown output path is requested
- CI-friendly exit codes and structured errors
- Optional Markdown reports for maintainers
Documentation
Usage
Audit one public GitHub repository:
github-first-impression https://github.com/owner/repository
The module entry point is equivalent:
python -m github_first_impression https://github.com/owner/repository
Text mode prints a terminal summary and creates first-impression-report.md. Use --output PATH to choose another report path or --output - to disable the Markdown report.
JSON mode has no Markdown side effect by default. Add --output report.md only when a Markdown artifact is wanted:
github-first-impression \
https://github.com/owner/repository \
--format json \
--fail-under 80 \
--output report.md
Use --verbose to include the full score breakdown in text-mode terminal output:
github-first-impression https://github.com/owner/repository --verbose
Optional GitHub token
GITHUB_TOKEN is optional. It increases GitHub's normal API rate limit but does not grant private-repository support or bypass access controls. Prefer the environment variable because command-line values may appear in shell history or process listings:
export GITHUB_TOKEN="your_token"
github-first-impression https://github.com/owner/repository
Use a token with no permissions beyond reading public repository information. The tool sends it only in the HTTPS Authorization header and does not include it in JSON or Markdown reports.
Scoring
The 100 available points are divided into five categories:
| Category | Points |
|---|---|
| Project description and positioning | 20 |
| README readability | 25 |
| Installation and usage | 20 |
| Trust signals | 20 |
| Release and maintenance | 15 |
Grades are Excellent (90–100), Good (75–89), Fair (60–74), Weak (40–59), and Poor (0–39). These labels summarize checklist coverage, not intrinsic project quality.
The score is most useful for finding missing repository-presentation signals. It should not be used as an absolute ranking between unrelated projects.
Limitations
GitHub First Impression does not verify:
- Code correctness or architecture
- Security or exploitability
- Dependency vulnerabilities or supply-chain safety
- Legal compliance or license compatibility
- Whether a project is suitable for a particular user
Additional boundaries:
- README checks use headings, keywords, and regular expressions rather than semantic understanding.
- Non-English READMEs and unconventional headings may be underestimated.
- Information available only in external documentation may not earn README points.
- File presence does not prove that a policy, test suite, or configuration is effective.
- GitHub may truncate very large repository trees, causing files to be missed.
- Private repositories and bulk repository discovery are intentionally unsupported.
Responsible use
Each audit is initiated for one user-supplied public repository and uses only GitHub's official REST API. The tool does not access GitHub HTML, bypass access controls, evade rate limits, enumerate targets, or collect contributor profiles.
Read RESPONSIBLE_USE.md for the complete boundaries and token-safety guidance.
Development
git clone https://github.com/PiggyDoggo/GitHub-First-Impression.git
cd GitHub-First-Impression
python3.12 -m venv .venv
source .venv/bin/activate
python -m pip install -e ".[development]"
python -m pytest
Build release artifacts with:
python -m build
Release notes are recorded in CHANGELOG.md.
License
GitHub First Impression is available under the MIT License.
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file github_first_impression-0.2.2.tar.gz.
File metadata
- Download URL: github_first_impression-0.2.2.tar.gz
- Upload date:
- Size: 36.3 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
da0493fe6419b0698f93157f4ee8d4d11268a543567dae5ac1b3dc2e0d650a84
|
|
| MD5 |
9a60685a4a2aab799f7d6d9bfab12c57
|
|
| BLAKE2b-256 |
f102f987c73d8dd1b95bd7ad94817cd8caac9c2b1208099f0f1fa459c5bec038
|
Provenance
The following attestation bundles were made for github_first_impression-0.2.2.tar.gz:
Publisher:
publish-pypi.yml on PiggyDoggo/GitHub-First-Impression
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
github_first_impression-0.2.2.tar.gz -
Subject digest:
da0493fe6419b0698f93157f4ee8d4d11268a543567dae5ac1b3dc2e0d650a84 - Sigstore transparency entry: 2335602762
- Sigstore integration time:
-
Permalink:
PiggyDoggo/GitHub-First-Impression@aa5d3d0477a52ae7b2ccde07487e8dc354c7106f -
Branch / Tag:
refs/tags/v0.2.2 - Owner: https://github.com/PiggyDoggo
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
publish-pypi.yml@aa5d3d0477a52ae7b2ccde07487e8dc354c7106f -
Trigger Event:
release
-
Statement type:
File details
Details for the file github_first_impression-0.2.2-py3-none-any.whl.
File metadata
- Download URL: github_first_impression-0.2.2-py3-none-any.whl
- Upload date:
- Size: 22.9 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
3479e0ba5a5b1162270b407c8970f136569cf994070c87a2b5154319db7ff99f
|
|
| MD5 |
89d42969e245d64377194b2d7e579a3f
|
|
| BLAKE2b-256 |
f002387746eb19c6028239d460321eec260d7b2e9ee6ccbe89556f49b5fb8d0c
|
Provenance
The following attestation bundles were made for github_first_impression-0.2.2-py3-none-any.whl:
Publisher:
publish-pypi.yml on PiggyDoggo/GitHub-First-Impression
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
github_first_impression-0.2.2-py3-none-any.whl -
Subject digest:
3479e0ba5a5b1162270b407c8970f136569cf994070c87a2b5154319db7ff99f - Sigstore transparency entry: 2335602768
- Sigstore integration time:
-
Permalink:
PiggyDoggo/GitHub-First-Impression@aa5d3d0477a52ae7b2ccde07487e8dc354c7106f -
Branch / Tag:
refs/tags/v0.2.2 - Owner: https://github.com/PiggyDoggo
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
publish-pypi.yml@aa5d3d0477a52ae7b2ccde07487e8dc354c7106f -
Trigger Event:
release
-
Statement type: