coderot

Get started

coderot measures how hard your code is to maintain, month by month, and what changed since AI agents started writing it. The analysis runs in your own GitHub Actions. coderot receives numbers, never your code: what leaves your CI.

It works on GitHub repos written in TypeScript, JavaScript, C#, Python, Go and Rust (versions and file types). Setting up a repo takes about five minutes and one workflow file. To see what you’ll get first, the live demo shows the same dashboard on public repos.

1. Sign in

Open app.coderot.ai and sign in with GitHub. coderot’s GitHub App asks for one permission, read-only Metadata: it sees repo names and your role in them, never code.

2. Install the app and add a repo

Click Install the app on a repo. GitHub asks which repos the app may see: all of them, or the ones you pick. Installing it on an organization takes an owner of that organization; anyone else can send them a request from the same page. Afterwards, GitHub brings you back to coderot, where the repos you picked are listed.

Add one. Only an admin of the repo on GitHub can add it, because its reports will be visible to everyone in your coderot org.

3. Add the workflow

The repo’s page shows a workflow for its default branch. Add it on GitHub opens GitHub’s editor with .github/workflows/coderot.yml filled in: commit it, or open a pull request and merge it.

on:
  push:
    branches: [main] # your default branch: coderot takes reports from it only
  pull_request: # a comment on each PR with its complexity change; nothing is uploaded
permissions:
  contents: read
  id-token: write # signs the upload in to coderot, no secret needed
  pull-requests: write # commits and review counts per PR, and the PR comment
concurrency: coderot-${{ github.event.pull_request.number || github.sha }} # one run per PR at a time, so one comment
jobs:
  coderot:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0 # the full history
      - uses: coderot-ai/action@v1

The last step is the coderot code health Action on the GitHub Marketplace, whose source is public at coderot-ai/action.

There’s no secret to set. The run signs its upload in with the OIDC token GitHub gives every workflow run (id-token: write), and coderot accepts it only for repos added to a coderot org, and only from the default branch.

On a pull request the Action uploads nothing. It comments on the PR with what it does to cognitive complexity, file by file, and the hotspots it touches, and updates that one comment on each push. A PR that changes no code file gets no comment. A PR from a fork gets a read-only token, so its numbers go to the run’s summary instead. A workflow made before November 2026 has only push: add the pull_request: and concurrency: lines and change pull-requests: read to write to get the comments.

Send PR titles on the repo’s page adds titles: true to the workflow. The dashboard then names each PR by its title rather than its number. Off by default: configuration.

4. The first run

Merging the workflow starts its first run. It measures the last 12 months, one snapshot a week, which takes a few minutes in your CI. The repo’s page fills in by itself: the weeks arrive newest first, and the charts appear after the oldest one, when the commits arrive.

After that, every push to the default branch runs again and analyzes only the commits since the last run.

Members

In Settings, add people by their GitHub login. They see your org’s repos the next time they sign in; every member sees all of them. Anyone who administers one of the org’s repos on GitHub can add or remove members, and any member but the last can leave.

Badge and public page

A public repo can have a public page and a README badge. In Settings, next to the repo, Turn on a public page and README badge. Anyone who manages the org can, and only while GitHub shows the repo as public. It’s off until you turn it on, and it turns itself off if the repo goes private.

The page, app.coderot.ai/r/<owner>/<repo>, shows the repo’s 12 months as your dashboard does, updated on every push: paths, function names, PR numbers, and PR titles if the workflow sends them (PR titles). It isn’t listed in search engines. Settings then shows the badge’s Markdown to copy into the README:

[![coderot](https://api.coderot.ai/v1/badge/<owner>/<repo>.svg)](https://app.coderot.ai/r/<owner>/<repo>)

The badge shows the share of merged PRs with an AI signal and the change in complexity per 1,000 lines over the 12 months. Turned off, it reads “not set up”.

Removing a repo

Settings → Remove deletes the repo’s data on coderot, including every report its CI uploaded. Delete .github/workflows/coderot.yml from the repo too: its runs would fail from then on, since coderot no longer accepts its reports.

When something goes wrong

coderot can’t see your workflow runs, only what they send. If the repo’s page still says Waiting for the first run after 15 minutes, open the repo’s Actions tab and look at the run’s log.

Anything else: [email protected].