- Category
- Developer Tools
- Rank
- No. 1850Tools index
- Pricing
- Open Source
- Type
- TOOL
- Builder
- getagentseal
- Date
About
Instant PR contributor trust assessment. Know who is opening pull requests before you review.
What it does
FirstLook runs inside GitHub Actions, collects public account and contribution signals for a pull request author, checks the changed files and commit verification, then converts those observations into a tier, comment, label, and optional workflow failure.
Why it's ranked here
Its strongest idea is putting contributor context directly beside the pull request, where maintainers can act on it. The assessment combines history, external mergers, activity, signatures, and sensitive-file changes instead of relying on account age alone. Still, the result is a heuristic triage aid, not proof that a contributor or change is safe.
What's good
The output fits existing review operations: comments explain the signals, labels support filtering, and workflow outputs enable custom gates. Existing comments are updated instead of duplicated. Bulk scanning covers open pull requests, while skip controls exclude bots, collaborators, selected users, and members of trusted organizations.
Tradeoffs
The scoring rules use fixed thresholds and public GitHub metadata, so legitimate newcomers can receive extra scrutiny while established accounts can appear safer. Sensitive-file matching uses configurable substring checks. Commit verification only passes when every returned commit is verified. Commenting and labeling may fail for fork pull requests with read-only tokens.
How to use it well
Use it for repositories that regularly receive pull requests from unfamiliar accounts and need consistent first-pass triage. Let maintainers inspect the displayed evidence before making access or merge decisions, and tune skip lists, sensitive paths, and failure thresholds conservatively. It does not inspect code behavior, dependencies, vulnerabilities, or contributor identity beyond GitHub signals.
Technical notes+
src/index.ts handles pull_request and workflow_dispatch events, updates a marker-based comment, manages tier labels, exposes outputs, and can fail the check at a configured threshold. src/signals.ts gathers REST search totals alongside profile, file, commit, and GraphQL contribution data; its GraphQL query examines the latest 100 merged pull requests, while file and commit requests are not explicitly paginated. src/scorer.ts applies fixed point thresholds, sensitive-file penalties, and five cross-signal pattern rules. src/comment.ts renders badge-heavy Markdown with expandable details. action.yml declares a Node 24 GitHub Action, while package.json builds the TypeScript source with ncc and .github/workflows/ci.yml verifies that the committed build output remains current.
Observed
- License
- MIT, declared in LICENSE and package.json.
- Primary language
- TypeScript with strict compiler settings targeting ES2022.
- Interface
- GitHub Action triggered by pull request or manual workflow dispatch events.
- Runtime and packaging
- action.yml declares a Node 24 action; package.json marks the npm package private and uses ncc for bundling.
- Dependencies
- Runtime dependencies are the official GitHub Actions core and GitHub client packages.
- Automation
- .github/workflows/ci.yml installs dependencies, builds the action, and checks that committed build output is current.
Read from README.md, package.json, src/index.ts, src/types.ts, src/scorer.ts, src/comment.ts, src/signals.ts, LICENSE, action.yml, tsconfig.json, .github/workflows/ci.yml.
What it can do
Assess contributor trustworthiness
Pull request contributor information → Trust assessment score or rating
Analyze pull request author identity
GitHub user profile and pull request data → Contributor verification status
Display contributor history
GitHub username → Contribution history and reputation metrics
Flag suspicious pull requests
Pull request metadata and author information → Risk alerts or warnings
Generate contributor profiles
GitHub user activity and commit history → Detailed contributor trust profile
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.