stackvitals 0.1.1__tar.gz → 0.1.2__tar.gz

{stackvitals-0.1.1 → stackvitals-0.1.2}/.github/workflows/daily.yml

@@ -34,18 +34,18 @@ jobs:
             echo "skip=true" >> "$GITHUB_OUTPUT"
             echo "Today's snapshot is already published; nothing to do."
           fi
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         if: steps.guard.outputs.skip != 'true'
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         if: steps.guard.outputs.skip != 'true'
         with:
           python-version: "3.11"
           cache: pip
           cache-dependency-path: pyproject.toml
       # Downloaded crawl bundles are kept between runs, so each day fetches only new ones.
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         if: steps.guard.outputs.skip != 'true'
         with:
           path: data/bronze

stackvitals-0.1.2/.github/workflows/mcp-registry.yml

@@ -0,0 +1,32 @@
+name: MCP registry
+# Lists server.json in the MCP registry after each successful release (or by hand). GitHub's OIDC token proves the
+# org namespace, so no token is stored.
+on:
+  workflow_run:
+    workflows: [Release]
+    types: [completed]
+  workflow_dispatch:
+permissions: {}
+jobs:
+  publish:
+    if: github.repository == 'stackvitals/stackvitals' && (github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success')
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write   # the registry's GitHub OIDC sign-in
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
+          # The released commit, not whatever main holds now.
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
+      - name: Install mcp-publisher (pinned, checksum checked)
+        run: |
+          curl -sSfL -o mcp-publisher.tar.gz https://github.com/modelcontextprotocol/registry/releases/download/v1.8.7/mcp-publisher_linux_amd64.tar.gz
+          echo "00b21004149a4ce66f0782508ae4a2bce67d1bea395a8da0bd8028159fb59579  mcp-publisher.tar.gz" | sha256sum -c -
+          tar -xzf mcp-publisher.tar.gz mcp-publisher
+      - name: Publish
+        run: |
+          ./mcp-publisher login github-oidc
+          ./mcp-publisher publish

{stackvitals-0.1.1 → stackvitals-0.1.2}/.github/workflows/prospective.yml

@@ -30,8 +30,8 @@ jobs:
       # Code search (finding adopters) needs a person's token; the built-in one reads everything else.
       GH_TOKEN: ${{ secrets.PROSPECTIVE_TOKEN || github.token }}
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.11"
           cache: pip

{stackvitals-0.1.1 → stackvitals-0.1.2}/.github/workflows/release.yml

@@ -14,7 +14,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           persist-credentials: false
       - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
@@ -23,7 +23,7 @@ jobs:
       - name: Build
         # The build backend is pinned, so a new upload to PyPI can never change what gets signed.
         run: uv build --build-constraint .github/build-constraints.txt --no-cache --out-dir dist
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: dist
           path: dist/
@@ -39,7 +39,7 @@ jobs:
       id-token: write      # Sigstore's keyless signing and the provenance attestation
       attestations: write
     steps:
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: dist
           path: dist
@@ -85,7 +85,7 @@ jobs:
       id-token: write      # the short-lived PyPI upload token, by OIDC
     steps:
       # The files the build job made and the publish job signed, not a rebuild.
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: dist
           path: dist

{stackvitals-0.1.1 → stackvitals-0.1.2}/.github/workflows/tests.yml

@@ -13,11 +13,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           persist-credentials: false
       - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: 22
       # The web app's build tools, so the suite can rebuild the app and check the committed build is current.

{stackvitals-0.1.1 → stackvitals-0.1.2}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.1.2 (2026-10-31)
+
+- `stackvitals init owner/repo` sets StackVitals up in one command: commits the workflow (or opens a pull request), follows
+  the first run and turns on Pages for a public repo; a private repo keeps Pages off and opens with `stackvitals ui`.
+- The StackVitals cube is the app's logo in the sidebar, the browser tab and the splash; the logo picker is gone.
+- The README opens with the logo, a short tour and the architecture; the architecture docs open with a detailed diagram.
+
 ## 0.1.1 (2026-10-31)
 
 - The Action's description is shorter, to fit the GitHub Marketplace listing. No other change.

{stackvitals-0.1.1 → stackvitals-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stackvitals
-Version: 0.1.1
+Version: 0.1.2
 Summary: Free, open-source developer suite: CI health, team flow, dependencies, community, and MergeScout for contributors.
 License-Expression: Apache-2.0
 License-File: LICENSE
@@ -40,11 +40,29 @@ Provides-Extra: sql
 Requires-Dist: duckdb<3,>=1.3; extra == 'sql'
 Description-Content-Type: text/markdown
 
-# StackVitals
-
-[![PyPI](https://img.shields.io/pypi/v/stackvitals)](https://pypi.org/project/stackvitals/)
-[![GitHub Marketplace](https://img.shields.io/badge/Marketplace-StackVitals-green?logo=github)](https://github.com/marketplace/actions/stackvitals)
-[![Tests](https://github.com/stackvitals/stackvitals/actions/workflows/tests.yml/badge.svg)](https://github.com/stackvitals/stackvitals/actions/workflows/tests.yml)
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/lockup-dark.png">
+    <img alt="StackVitals" src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/lockup-light.png" width="420">
+  </picture>
+</p>
+
+<p align="center"><b>The vital signs of your GitHub repo.</b> Flaky tests, slow reviews, delivery and DORA, risky
+dependencies and community health, measured in your own GitHub Actions.</p>
+
+<p align="center">
+  <a href="https://pypi.org/project/stackvitals/"><img alt="PyPI" src="https://img.shields.io/pypi/v/stackvitals?label=PyPI"></a>
+  <a href="https://github.com/marketplace/actions/stackvitals"><img alt="GitHub Marketplace" src="https://img.shields.io/badge/Marketplace-StackVitals-green?logo=github"></a>
+  <a href="https://github.com/stackvitals/stackvitals/actions/workflows/tests.yml"><img alt="Tests" src="https://github.com/stackvitals/stackvitals/actions/workflows/tests.yml/badge.svg"></a>
+</p>
+
+<p align="center">
+  <picture>
+    <source type="image/avif" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/stackvitals-video.avif">
+    <img alt="A 27-second tour: three failing CI checks sorted by StackVitals, then the app's Overview, CI Health, Pull Requests and Delivery pages" src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/stackvitals-video.gif" width="880">
+  </picture>
+  <br><sub>A tour on demo data. <a href="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/stackvitals-video.mp4">Watch it with sound</a>.</sub>
+</p>
 
 A free, open-source developer suite for GitHub: CI health and flaky tests, pull request flow, delivery and DORA,
 dependencies, community health and an org portal. It runs in your own GitHub Actions and keeps its history in your own
@@ -65,31 +83,14 @@ Install it as the GitHub Action `stackvitals/stackvitals@v0` (also on the
 
 <!-- mcp-name: io.github.stackvitals/stackvitals -->
 
-## Three things it gets right that others get wrong
+<picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-dark.png"><img alt="" src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-light.png" width="100%"></picture>
 
-Measured on public repos beside the rules other tools use ([docs/accuracy.md](docs/accuracy.md)):
-
-- **Where you deploy from.** With no setup, StackVitals named the right deployment source for 53 of 60 repos (30 of
-  35 held out). On the same 60, DevLake's default pattern got 9 and a pattern a user would typically write got 22. A
-  wrong source makes every DORA number wrong.
-- **Who answered an issue.** Of the first comments by non-maintainers that the github/issue-metrics action counts as
-  the answer, 46% are drive-bys (40-52%, held-out repos). StackVitals counts the project's answers: maintainers,
-  regular responders and triagers.
-- **Whether AI help changed anything.** Agents' pull requests look 9 points less likely than people's to be merged by someone else.
-  Compared within the same repo, month and size, the gap is +0.5 points (0.0 to +1.1): most of the raw gap comes
-  from which repos agents work in and the size of their changes.
-
-It publishes what failed too. Of the failures an old rule called safe to re-run, 44% (15 of 34) were caused by the
-change. The tightened rule still got 13 of 81 held-out calls wrong (16%). A stricter one (a flake's sign in the log,
-no changed file named) got none of 4 fresh calls wrong, too few to show 5%, so nothing is called safe: likely flakes
-are re-run, never passed by the check. Each sample was labelled by two
-model families (Claude and Gemini); no person has audited the labels.
-
-## What you see first
+# What you see first
 
 When CI fails on a pull request, one comment sorts each failure, from the repo's own CI history:
 
 > **StackVitals: about this CI failure**
+>
 > 1 of 3 failure(s) look like flakes; the rest need a look.
 >
 > | Verdict | What failed | Why |
@@ -100,7 +101,43 @@ When CI fails on a pull request, one comment sorts each failure, from the repo's
 
 The verdict check still blocks until CI is green: a known flake is re-run, never waved through.
 
-## Modules
+<picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-dark.png"><img alt="" src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-light.png" width="100%"></picture>
+
+# Quick start
+
+```sh
+pip install stackvitals
+gh auth login                        # once, so StackVitals can use your GitHub sign-in
+stackvitals init your-name/your-repo
+```
+
+`init` adds one workflow file to your repo, runs it once and turns on your dashboard:
+
+- **Public repo:** the dashboard goes live at `https://your-name.github.io/your-repo/`.
+- **Private repo:** your data stays in your private repo, and the dashboard opens on your machine:
+
+  ```sh
+  stackvitals ui your-name/your-repo
+  ```
+
+Just looking? `stackvitals ci report owner/repo` reports CI health for any public repo in about 20 seconds, with
+nothing added to it. Prefer clicking? The app's **Setup** page does the same as `init`. More:
+[docs/quickstart.md](docs/quickstart.md).
+
+<picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-dark.png"><img alt="" src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-light.png" width="100%"></picture>
+
+# How it works
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/architecture-overview-dark.png">
+  <img alt="How StackVitals works: your repo and your tools feed a StackVitals run in GitHub Actions (collect, analyse with six modules, save), which commits to the stackvitals-data branch and feeds the web app, PR comments, alerts and the MCP server. No server, no account." src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/architecture-overview-light.png">
+</picture>
+
+Every step, from what starts a run to what you see: [the architecture in detail](docs/architecture.md).
+
+<picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-dark.png"><img alt="" src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-light.png" width="100%"></picture>
+
+# Modules
 
 | Module | What it answers | Status |
 |---|---|---|
@@ -121,7 +158,76 @@ less; its behaviour may still change.
 test reports from other CI systems, Backstage, and DevLake's tables ([docs/connectors.md](docs/connectors.md)). AI
 agents get every module through one MCP server (11 core tools by default, all 35 with `--tools all`).
 
-## Start
+<picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-dark.png"><img alt="" src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-light.png" width="100%"></picture>
+
+# Connect your tools (optional)
+
+Everything works with GitHub's built-in token. Integrations are optional; pass their keys as repository secrets:
+
+```yaml
+- uses: stackvitals/stackvitals@v0
+  with:
+    webhook: ${{ secrets.SLACK_WEBHOOK }}            # alerts to Slack, Teams or Discord
+    pagerduty-token: ${{ secrets.PAGERDUTY_TOKEN }}  # incidents count in DORA
+    jira-email: ${{ secrets.JIRA_EMAIL }}            # Jira, with its site URL under
+    jira-token: ${{ secrets.JIRA_TOKEN }}            # [connectors.jira] in .github/stackvitals.toml
+```
+
+Every input: [docs/install.md](docs/install.md). Every setting: [docs/settings.md](docs/settings.md).
+
+<picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-dark.png"><img alt="" src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-light.png" width="100%"></picture>
+
+# AI agents (MCP)
+
+Your coding agent can ask StackVitals before and while it changes code: *is this failure a known flake?*, *what is
+blocking PR #123?*, *who should review this?*, *is this package safe to add?* It answers from your repo's history, with
+the evidence.
+
+Claude Code:
+
+```sh
+claude mcp add stackvitals -- uvx stackvitals serve
+```
+
+Claude Desktop, Cursor, VS Code and other MCP clients:
+
+```json
+{
+  "mcpServers": {
+    "stackvitals": { "command": "uvx", "args": ["stackvitals", "serve"] }
+  }
+}
+```
+
+It uses your `gh` login or `GITHUB_TOKEN`. The 11 core tools load by default (`ci_failure`, `is_known_flake`,
+`pr_queue`, `who_should_review`, `check_package`, `insights` and more); `stackvitals serve --tools all` loads all 35.
+Listed in the MCP registry as `io.github.stackvitals/stackvitals`.
+
+<picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-dark.png"><img alt="" src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-light.png" width="100%"></picture>
+
+# Three things it gets right that others get wrong
+
+Measured on public repos beside the rules other tools use ([docs/accuracy.md](docs/accuracy.md)):
+
+- **Where you deploy from.** With no setup, StackVitals named the right deployment source for 53 of 60 repos (30 of
+  35 held out). On the same 60, DevLake's default pattern got 9 and a pattern a user would typically write got 22. A
+  wrong source makes every DORA number wrong.
+- **Who answered an issue.** Of the first comments by non-maintainers that the github/issue-metrics action counts as
+  the answer, 46% are drive-bys (40-52%, held-out repos). StackVitals counts the project's answers: maintainers,
+  regular responders and triagers.
+- **Whether AI help changed anything.** Agents' pull requests look 9 points less likely than people's to be merged by someone else.
+  Compared within the same repo, month and size, the gap is +0.5 points (0.0 to +1.1): most of the raw gap comes
+  from which repos agents work in and the size of their changes.
+
+It publishes what failed too. Of the failures an old rule called safe to re-run, 44% (15 of 34) were caused by the
+change. The tightened rule still got 13 of 81 held-out calls wrong (16%). A stricter one (a flake's sign in the log,
+no changed file named) got none of 4 fresh calls wrong, too few to show 5%, so nothing is called safe: likely flakes
+are re-run, never passed by the check. Each sample was labelled by two
+model families (Claude and Gemini); no person has audited the labels.
+
+<picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-dark.png"><img alt="" src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-light.png" width="100%"></picture>
+
+# Learn more
 
 - **Five minutes:** [docs/quickstart.md](docs/quickstart.md). Try CI Health on any public repo first (needs
   [uv](https://docs.astral.sh/uv/) and `gh auth login` or a `GITHUB_TOKEN`):

stackvitals-0.1.2/README.md

@@ -0,0 +1,198 @@
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/lockup-dark.png">
+    <img alt="StackVitals" src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/lockup-light.png" width="420">
+  </picture>
+</p>
+
+<p align="center"><b>The vital signs of your GitHub repo.</b> Flaky tests, slow reviews, delivery and DORA, risky
+dependencies and community health, measured in your own GitHub Actions.</p>
+
+<p align="center">
+  <a href="https://pypi.org/project/stackvitals/"><img alt="PyPI" src="https://img.shields.io/pypi/v/stackvitals?label=PyPI"></a>
+  <a href="https://github.com/marketplace/actions/stackvitals"><img alt="GitHub Marketplace" src="https://img.shields.io/badge/Marketplace-StackVitals-green?logo=github"></a>
+  <a href="https://github.com/stackvitals/stackvitals/actions/workflows/tests.yml"><img alt="Tests" src="https://github.com/stackvitals/stackvitals/actions/workflows/tests.yml/badge.svg"></a>
+</p>
+
+<p align="center">
+  <picture>
+    <source type="image/avif" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/stackvitals-video.avif">
+    <img alt="A 27-second tour: three failing CI checks sorted by StackVitals, then the app's Overview, CI Health, Pull Requests and Delivery pages" src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/stackvitals-video.gif" width="880">
+  </picture>
+  <br><sub>A tour on demo data. <a href="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/stackvitals-video.mp4">Watch it with sound</a>.</sub>
+</p>
+
+A free, open-source developer suite for GitHub: CI health and flaky tests, pull request flow, delivery and DORA,
+dependencies, community health and an org portal. It runs in your own GitHub Actions and keeps its history in your own
+repo: no StackVitals-hosted backend, account or subscription, and optional integrations use services and keys you
+choose. GitHub's built-in token covers every module in a repo; an org's private repos in the Portal need a read-only
+App, and org-wide Copilot usage an org token. Actions minutes on private repos are billed by GitHub as usual
+([docs/scaling.md](docs/scaling.md#actions-minutes-private-repos)). The rules behind its verdicts are checked on public
+data, with the losses published.
+
+Every run publishes an app on your repo's GitHub Pages (or `stackvitals ui owner/repo` on your machine): one page per
+module, decisions and settings saved straight from the browser, setup for more repos in a few clicks once GitHub is
+connected (connecting takes one token, made from a prefilled GitHub page; Pages are turned on for public repos), and a demo at
+`?demo=1`. [docs/app.md](docs/app.md) walks through it.
+
+Install it as the GitHub Action `stackvitals/stackvitals@v0` (also on the
+[GitHub Marketplace](https://github.com/marketplace/actions/stackvitals)), or the CLI and MCP server from PyPI:
+`pip install stackvitals` (or run it without installing: `uvx stackvitals`).
+
+<!-- mcp-name: io.github.stackvitals/stackvitals -->
+
+<picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-dark.png"><img alt="" src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-light.png" width="100%"></picture>
+
+# What you see first
+
+When CI fails on a pull request, one comment sorts each failure, from the repo's own CI history:
+
+> **StackVitals: about this CI failure**
+>
+> 1 of 3 failure(s) look like flakes; the rest need a look.
+>
+> | Verdict | What failed | Why |
+> |---|---|---|
+> | Likely flaky | test `t::flaky_one` | flaked 6 times in 80 runs in the last 30 days, last 2026-10-20, and the message shows a flake's sign ("TimeoutError"): looks like a flake, check the error, then re-run it |
+> | New | test `t::new_one` | no earlier flakes: likely from this change (fails with "assert result == 2") |
+> | Already failing on main | test `t::broken_one` | also failing on the default branch, not caused by this change |
+
+The verdict check still blocks until CI is green: a known flake is re-run, never waved through.
+
+<picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-dark.png"><img alt="" src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-light.png" width="100%"></picture>
+
+# Quick start
+
+```sh
+pip install stackvitals
+gh auth login                        # once, so StackVitals can use your GitHub sign-in
+stackvitals init your-name/your-repo
+```
+
+`init` adds one workflow file to your repo, runs it once and turns on your dashboard:
+
+- **Public repo:** the dashboard goes live at `https://your-name.github.io/your-repo/`.
+- **Private repo:** your data stays in your private repo, and the dashboard opens on your machine:
+
+  ```sh
+  stackvitals ui your-name/your-repo
+  ```
+
+Just looking? `stackvitals ci report owner/repo` reports CI health for any public repo in about 20 seconds, with
+nothing added to it. Prefer clicking? The app's **Setup** page does the same as `init`. More:
+[docs/quickstart.md](docs/quickstart.md).
+
+<picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-dark.png"><img alt="" src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-light.png" width="100%"></picture>
+
+# How it works
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/architecture-overview-dark.png">
+  <img alt="How StackVitals works: your repo and your tools feed a StackVitals run in GitHub Actions (collect, analyse with six modules, save), which commits to the stackvitals-data branch and feeds the web app, PR comments, alerts and the MCP server. No server, no account." src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/architecture-overview-light.png">
+</picture>
+
+Every step, from what starts a run to what you see: [the architecture in detail](docs/architecture.md).
+
+<picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-dark.png"><img alt="" src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-light.png" width="100%"></picture>
+
+# Modules
+
+| Module | What it answers | Status |
+|---|---|---|
+| **[CI Health](docs/modules.md#ci-health)** | Which jobs and tests are flaky or slowing down, who owns them, coverage and patch coverage | stable |
+| **[Team Flow](docs/modules.md#team-flow)** | Who has to act next on each pull request, and how long reviews take | stable |
+| **[Delivery](docs/modules.md#delivery-cycle-time-and-dora)** | Cycle time split into coding, pickup, review and deploy (LinearB's phases), DORA's five metrics, AI-assisted work compared like with like | stable |
+| **[Insights](docs/modules.md#insights-what-to-fix-first)** | What to fix first across modules, ranked by hours lost, with alerts and a weekly digest | stable |
+| **[Dependency Steward](docs/modules.md#dependency-steward)** | Known vulnerabilities and malware in the lockfiles OSV-Scanner reads (npm, PyPI, Go, Rust, Maven, Ruby, .NET, PHP and more; 65 of 100 sampled repos had one); whether to add, keep or upgrade a package, with upgrade evidence from public repos | preview |
+| **[Community](docs/modules.md#community)** | Where newcomers drop out, how fast they get an answer, who carries the work | stable |
+| **[Portal](docs/modules.md#portal)** | A lightweight catalog on GitHub alone: what an org owns, who owns it (checked), scorecards, golden paths and an org-wide view | preview |
+| **Explore** | SQL over your repo's data in the browser, with links to share a query | preview |
+| **[Contribute](docs/modules.md#contribute-mergescout)** | Open-source issues an outsider can realistically get merged | stable |
+
+Stable: measured, reviewed and used on the sandbox for every release. Preview: built and tested, but newer or measured on
+less; its behaviour may still change.
+
+**Works with** Jira Cloud, Linear, PagerDuty, incident.io, Copilot usage reports, Slack, Teams, Discord, Discourse,
+test reports from other CI systems, Backstage, and DevLake's tables ([docs/connectors.md](docs/connectors.md)). AI
+agents get every module through one MCP server (11 core tools by default, all 35 with `--tools all`).
+
+<picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-dark.png"><img alt="" src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-light.png" width="100%"></picture>
+
+# Connect your tools (optional)
+
+Everything works with GitHub's built-in token. Integrations are optional; pass their keys as repository secrets:
+
+```yaml
+- uses: stackvitals/stackvitals@v0
+  with:
+    webhook: ${{ secrets.SLACK_WEBHOOK }}            # alerts to Slack, Teams or Discord
+    pagerduty-token: ${{ secrets.PAGERDUTY_TOKEN }}  # incidents count in DORA
+    jira-email: ${{ secrets.JIRA_EMAIL }}            # Jira, with its site URL under
+    jira-token: ${{ secrets.JIRA_TOKEN }}            # [connectors.jira] in .github/stackvitals.toml
+```
+
+Every input: [docs/install.md](docs/install.md). Every setting: [docs/settings.md](docs/settings.md).
+
+<picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-dark.png"><img alt="" src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-light.png" width="100%"></picture>
+
+# AI agents (MCP)
+
+Your coding agent can ask StackVitals before and while it changes code: *is this failure a known flake?*, *what is
+blocking PR #123?*, *who should review this?*, *is this package safe to add?* It answers from your repo's history, with
+the evidence.
+
+Claude Code:
+
+```sh
+claude mcp add stackvitals -- uvx stackvitals serve
+```
+
+Claude Desktop, Cursor, VS Code and other MCP clients:
+
+```json
+{
+  "mcpServers": {
+    "stackvitals": { "command": "uvx", "args": ["stackvitals", "serve"] }
+  }
+}
+```
+
+It uses your `gh` login or `GITHUB_TOKEN`. The 11 core tools load by default (`ci_failure`, `is_known_flake`,
+`pr_queue`, `who_should_review`, `check_package`, `insights` and more); `stackvitals serve --tools all` loads all 35.
+Listed in the MCP registry as `io.github.stackvitals/stackvitals`.
+
+<picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-dark.png"><img alt="" src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-light.png" width="100%"></picture>
+
+# Three things it gets right that others get wrong
+
+Measured on public repos beside the rules other tools use ([docs/accuracy.md](docs/accuracy.md)):
+
+- **Where you deploy from.** With no setup, StackVitals named the right deployment source for 53 of 60 repos (30 of
+  35 held out). On the same 60, DevLake's default pattern got 9 and a pattern a user would typically write got 22. A
+  wrong source makes every DORA number wrong.
+- **Who answered an issue.** Of the first comments by non-maintainers that the github/issue-metrics action counts as
+  the answer, 46% are drive-bys (40-52%, held-out repos). StackVitals counts the project's answers: maintainers,
+  regular responders and triagers.
+- **Whether AI help changed anything.** Agents' pull requests look 9 points less likely than people's to be merged by someone else.
+  Compared within the same repo, month and size, the gap is +0.5 points (0.0 to +1.1): most of the raw gap comes
+  from which repos agents work in and the size of their changes.
+
+It publishes what failed too. Of the failures an old rule called safe to re-run, 44% (15 of 34) were caused by the
+change. The tightened rule still got 13 of 81 held-out calls wrong (16%). A stricter one (a flake's sign in the log,
+no changed file named) got none of 4 fresh calls wrong, too few to show 5%, so nothing is called safe: likely flakes
+are re-run, never passed by the check. Each sample was labelled by two
+model families (Claude and Gemini); no person has audited the labels.
+
+<picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-dark.png"><img alt="" src="https://raw.githubusercontent.com/stackvitals/stackvitals/main/docs/assets/divider-light.png" width="100%"></picture>
+
+# Learn more
+
+- **Five minutes:** [docs/quickstart.md](docs/quickstart.md). Try CI Health on any public repo first (needs
+  [uv](https://docs.astral.sh/uv/) and `gh auth login` or a `GITHUB_TOKEN`):
+  `uvx stackvitals ci report owner/repo --days 14 --html ./ci-report`.
+- **By role:** [engineering managers](docs/guides/manager.md), [maintainers](docs/guides/maintainer.md),
+  [platform teams](docs/guides/platform.md).
+- **Before you rely on it:** [what each rule does](docs/rules.md), [known limitations](docs/limitations.md),
+  [what leaves your repo](docs/privacy.md), [threat model](docs/threat-model.md), [enterprise controls](docs/enterprise.md).
+- **More:** [FAQ](docs/faq.md), [how it works](docs/architecture.md), [roadmap](docs/roadmap.md),
+  [contributing](CONTRIBUTING.md), [governance](GOVERNANCE.md), [security](SECURITY.md).

{stackvitals-0.1.1 → stackvitals-0.1.2}/action.yml

@@ -149,7 +149,7 @@ runs:
         cache-dependency-glob: ""
     # The pinned vulnerability scanner (checked against its SHA-256 when downloaded), kept between runs.
     - if: contains(inputs.modules, 'deps')
-      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
       with:
         path: ${{ runner.tool_cache }}/stackvitals/osv-scanner-2.7.0
         key: stackvitals-osv-scanner-2.7.0-${{ runner.os }}-${{ runner.arch }}
@@ -207,7 +207,7 @@ runs:
       run: PYTHONPATH="$GITHUB_ACTION_PATH/src" uv run --quiet --frozen --only-group action --project "$GITHUB_ACTION_PATH" python -m stackvitals action --modules "$SV_MODULES" --days "$SV_DAYS" --budget "$SV_BUDGET" --tests "$SV_TESTS" --test-artifacts "$SV_TEST_ARTIFACTS" --pr-comments "$SV_PR_COMMENTS" --rerun-flaky "$SV_RERUN" --quarantine "$SV_QUARANTINE" --issues "$SV_ISSUES" --preflight-comments "$SV_PREFLIGHT" --deps-comments "$SV_DEPS_COMMENTS" --mention-owners "$SV_MENTION_OWNERS" --label-stuck "$SV_LABEL_STUCK"
     # The app as a download (opt-in, for private repos), only when this run changed it.
     - if: inputs.pages == 'artifact' && steps.vitals.outputs.pages == 'true'
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: stackvitals-app-${{ github.job }}
         path: ${{ runner.temp }}/stackvitals-pages

{stackvitals-0.1.1 → stackvitals-0.1.2}/deploy/crawler/workflows/bench.yml

@@ -27,10 +27,10 @@ jobs:
       MS_RELEASE_TOKEN: ${{ secrets.MS_STORE_TOKEN }}
       MS_STORE_REPO: kaushik-yadav/merge-scout
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.11"
           cache: pip

{stackvitals-0.1.1 → stackvitals-0.1.2}/deploy/crawler/workflows/check.yml

@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.11"
           cache: pip

{stackvitals-0.1.1 → stackvitals-0.1.2}/deploy/crawler/workflows/crawl.yml

@@ -32,17 +32,17 @@ jobs:
       MS_STORE_REPO: kaushik-yadav/merge-scout
     steps:
       # Checkout first: it empties the folder, so the restored state must come after it.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           persist-credentials: false
       - name: Restore state from the cache
         id: cache
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: data
           key: crawl-state-${{ github.run_id }}
           restore-keys: crawl-state-
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.11"
           cache: pip
@@ -85,7 +85,7 @@ jobs:
         run: python -m mergescout.store push
       - name: Save state to the cache
         if: always() && steps.state.outcome == 'success'
-        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: data
           key: crawl-state-${{ github.run_id }}-${{ github.run_attempt }}