RepoLens Core
RepoLens inspects a local repository and produces a deterministic, explainable best-practice report. It reads files only; it never imports or executes code from the repository and never accesses GitHub.
Installation
pip install repolens-core
For development, install the project with its development dependencies using your preferred PEP 517 workflow.
Usage
repolens scan ./my-project
repolens scan ./my-project --output json
repolens scan ./my-project --output markdown --fail-below 70
The score is weighted across applicable rules. Each result includes a status,
evidence, and actionable guidance. JSON output is versioned by
schema_version and is stable for identical input.
The same scanner is available from Python:
from pathlib import Path
from repolens.api import scan_repository
from repolens.reporting.json import render_json
report = scan_repository(Path("."))
print(report.score.value)
print(render_json(report))
Example terminal output:
RepoLens: 52/100 (python)
[pass] README: README.md has meaningful content.
[fail] .gitignore: .gitignore was not detected.
Configuration
An optional repolens.toml can customize safe directory exclusions, the source
file size threshold, and the default CI threshold:
[scanner]
max_source_file_lines = 500
excluded_directories = [".git", ".venv", "node_modules", "vendor"]
fail_below = 70
The scanner skips .git, binary files, inaccessible files, and symbolic links.
It reports relative evidence paths and does not modify the analyzed repository.
Architecture
The package is split into immutable domain models, safe repository discovery,
an explicit rule registry, application orchestration, and terminal/JSON/Markdown
renderers. Architectural decisions are documented in docs/adr.
Limitations and next steps
Detection is intentionally conservative and marker-based; it does not parse every build system or prove that a configuration is correct. Future work can add language-specific rules, richer diagnostics, and additional report formats.
Metadata
Release files for repolens-core 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| repolens_core-0.1.0.tar.gz | 18.1 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| repolens_core-0.1.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 37.7 kB
Release files / repolens_core-0.1.0.tar.gz
| Download URL | repolens_core-0.1.0.tar.gz |
|---|---|
| Size | 18.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
492c76eee3d942fd1454644d4bac4520acae53706042432f253f48dd58ae22fb
|
|
BLAKE2b-256 checksum How to use checksums |
bcd90de221783c6d8c04aa1158617e854ac5009114e56c660c1bda90e0f31c73
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.12.3
|
Release files / repolens_core-0.1.0-py3-none-any.whl
| Download URL | repolens_core-0.1.0-py3-none-any.whl |
|---|---|
| Size | 19.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
01f7ee6c4f02632eb24db44bf856ae479b21a8b5dfb30642e406520ab2f20767
|
|
BLAKE2b-256 checksum How to use checksums |
a8882214f0bad6ca4cae65f5d6a4cbd96a35d961ebcee4a98420fc257039fbe5
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.12.3
|
Security for repolens-core 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.