One command reads the GitHub Actions history of your repositories, public or private, and writes one HTML report: what is slow, what fails and why, which tests run twice, how fast you ship, how much AI is involved, and what to fix first.
$ curl -LsSf https://kirbac1.github.io/ci-observatory/install.sh | sh$ ci-observatory --org your-org --openmacOS and Linux. The installer adds uv if it is missing (it brings its own Python), then the ci-observatory command. No sudo. You also need the GitHub CLI, logged in with gh auth login.
$ uvx --from git+https://github.com/kirbac1/ci-observatory ci-observatory --org your-org --openRuns the latest version in a throwaway environment and leaves nothing installed. Use this on Windows, where the shell installer does not run. Inside a clone of any GitHub repository, leave out --org to analyse that repository.
$ pipx install git+https://github.com/kirbac1/ci-observatoryIf you already use pipx. Python 3.11 or newer. The tool has no dependencies outside the standard library.
# .github/workflows/ci-observatory.yml (excerpt)
permissions: { actions: read, contents: read, pull-requests: read }
steps:
- run: pipx run --spec git+https://github.com/kirbac1/ci-observatory ci-observatory --repo "${{ github.repository }}"
env: { GH_TOKEN: "${{ github.token }}" }A weekly report for one repository, private ones included, using the workflow's own read-only token. The full example uploads the report as an artifact.
Every chart answers one question in plain words. Click any repository to focus the whole page on it. The live demo is built from public data of 19 repositories in Aiven's public GitHub organisations.
Runs, pass rate, typical and slow run times, then one bubble per repository: higher passes more often, further left finishes sooner.
The four DORA measures, each rated Low to Elite: how often you ship, pull request to release, releases that needed a fix, and time to fix a broken main branch.
Pick any job: its time split into setup, dependencies, build, tests and scans, its steps in order with the silent stretches marked, and the log lines that matter.
Failures sorted by cause, code problems apart from timeouts, network errors and process checks. Then the safety basics per repository.
For one recent pull request per repository, every test from every job is matched. Repeats are sorted: another version (useful), or the same test again (waste).
Which AI tools and models are named in pull requests and commits, how much CI time involves AI, and whether AI-written changes run into more problems, with honest error bars.
Every problem found becomes a card: the problem in your numbers, the gain, and how to fix it, often with ready YAML. Ordered: remove waste, fix what breaks, speed up, prevent.
The command does not change. What matters is that your GitHub login, or the token you hand to gh, can read them. Pick one:
Add the scopes once. If your organisation uses SAML SSO, authorise the GitHub CLI for it.
gh auth refresh -s repo,read:org ci-observatory --org my-org \ --visibility private
Read-only Actions, Contents and Pull requests, on just the repositories you choose.
GH_TOKEN=github_pat_… \ ci-observatory --org my-org
The workflow's own token covers its repository. A GitHub App token covers a whole organisation.
env:
GH_TOKEN: ${{ github.token }}
Step by step, with SSO, token approval and GitHub Enterprise Server: the private repositories guide.
gh and never sees a token. Without it, GH_TOKEN goes to the GitHub API and nowhere else.| You want | Command |
|---|---|
| The repository you are in | ci-observatory --open |
| One or a few repositories | ci-observatory --repo my-org/api --repo my-org/web |
| The 12 busiest repositories of an organisation | ci-observatory --org my-org |
| The 25 busiest private ones | ci-observatory --org my-org --top 25 --visibility private |
| A fast first look | ci-observatory --org my-org --quick |
| The last 60 days | ci-observatory --org my-org --days 60 |
A dozen repositories take about 5 to 10 minutes and 1,000 to 2,000 API calls, well within GitHub's hourly limit. A second run reuses cached logs and is much faster.