Your codebase, drawn from your own pipeline

Install it

One package, one dependency of its own. It reads your repository and writes a report; it never runs your code, never installs anything, and never reaches the network except to send the report here.

npm i -D mlreps

Publish on every push to main

This is what keeps your dashboard current. It runs on the default branch rather than on pull requests on purpose — a report published from every branch would make this a picture of whichever job finished last, not of your codebase.

name: MLReps

on:
  push:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          # Without this the scan reports that every file was never committed.
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: 24
      - run: npm install
      - run: npx mlreps scan . --publish
        env:
          MLREPS_KEY: ${{ secrets.MLREPS_KEY }}

Add the key as a repository secret named MLREPS_KEY. A key for publishing, which is what the card in step 1 makes — it cannot send telemetry, so a repository secret that leaks cannot start writing traffic onto your map either. The endpoint is /api/scan/v1/report, and the response to every publish is the diagnostic: what we stored, what we could not read, and what was swept out of it.

And on pull requests, if you want it

A second, separate workflow shows what a change affects on the pull request, as a check. It carries no credential of ours and sends us nothing — the analysis runs on your machine and the result is posted to your repository by your own CI token. It is the stronger arrangement of the two and it costs you the dashboard, which is why both are offered rather than one.

name: MLReps

on:
  pull_request:

# Without this, GITHUB_TOKEN cannot write a check run and every run ends in a 403.
permissions:
  contents: read
  checks: write

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 24
      - run: npm install
      - run: npx mlreps check .
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # On a pull request, GITHUB_SHA is a merge commit that exists nowhere in
          # the repository — a check run posted against it is invisible.
          PLATFORM_HEAD_SHA: ${{ github.event.pull_request.head.sha }}

Then look at it

Every screen starts with how much of your codebase we could read — because a part we could not read must never look like a part with nothing wrong in it.