Reportz: who builds the digital commons, live from GitHub

Public administrations have started publishing serious open-source software. France’s La Suite numérique, created and operated by DINUM, is used by more than 500,000 public servants “dans 15 ministères et de nombreuses administrations” every month, by its own count. Much of it is built in the open at github.com/suitenumerique — Docs, Visio, Messagerie and Fichiers are all there. Others sit elsewhere: Tchap has its own organisation, FranceTransfert lives under numerique-gouv, and Grist is a third-party upstream the suite adopts rather than writes.

Which raises a question the repositories are unusually well placed to answer: who is actually building it?

Reportz answers it, continuously, from the record the work itself leaves behind.

What it does

Reportz syncs a set of repositories from the public GitHub API on a schedule and turns them into a contribution board: organisations, projects and people, ranked, with a live event feed and embeddable cards.

The site states its own rule on its method page:

Every number on this site comes from the public GitHub API and can be checked against it.

That sentence is the product. Everything else is a consequence of taking it seriously.

What it counts, and what it refuses to

The score is deliberately dull: merged pull requests ×10, reviews ×5, commits ×1, issues opened ×0.5.

Four decisions are worth pulling out, because each one is a refusal:

Merged pull requests only. An open PR is not work delivered. It may become work delivered; it is not yet.

Reviews are worth half a merged PR. The method page puts it better than a summary would: “A review is worth half of one, because reviewing is how the work gets in.” Weighting it at 5 — above a commit, below a merge — is a statement that reading other people’s code is contribution.

Bots are excluded at three levels. Dependabot moving a version number is not a contributor, however many commits it lands.

Employer is never inferred from a commit e-mail address. Organisation attribution comes from a curated file, falling back to the GitHub profile’s own company field. This is the one that matters most: a personal address does not mean “independent”, and a corporate one does not mean “on the clock”. Guessing produces a chart that is confidently wrong about people’s lives.

There is also a ten-rung ladder — signal, patch, commit, branch, merge, pipeline, builder, maintainer, core, kernel — computed on a rolling 30-day score, so it measures what someone is doing now rather than what they once did.

Where it came from

Reportz is a fork of Gnolove, the contribution tracker we built for the Gno.land ecosystem. Its method page says so plainly: the current weights “replaced the ones inherited from Gnolove, the project this site was forked from” — under which, it goes on, “a single commit outweighed five merged pull requests”.

The interesting part of that lineage is that almost nothing had to change. A tool that measures who builds a decentralised protocol turns out to be the same tool that measures who builds a government’s open-source suite, because the underlying question is identical — where does the work actually come from, and does the answer match the story? Only the repository list moved.

Why a cooperative builds this

Our own Governance Research Lab works on how groups govern themselves — cooperatives, DAOs, open-source projects — and one theme keeps returning: governance without measurement is a story people tell about themselves.

You cannot run contribution-weighted governance if nobody can say what a contribution was. Gno.land’s Proof of Contribution consensus is one answer to that at the protocol layer. Reportz is a much smaller answer at the social layer: publish the counts, publish the method, and let anyone check both.

The site’s own footer puts it less formally: “This experimental project explores the concept of governance based on proof-of-work and contributions.”

What it does not claim

Three honest limits, stated because a measurement tool that hides its edges is worse than no tool.

It measures GitHub activity, not value. A one-line fix that unblocks forty people scores 10. A thousand-line refactor scores 10. Nobody should read the ladder as a ranking of usefulness, and the weights exist to be argued with — which is why they are published rather than buried.

The repository list is a choice. Thirteen repositories, named in a configuration file, out of the forty-nine the organisation publishes. Change the list and you change every number. That is unavoidable in any scoped measurement; the mitigation is saying so.

The repository is not open yet. The method page admits it of the organisation list: it “lives in a file in the repository, which is not public yet”. For a project whose entire argument is verifiability, that is the obvious gap, and it is the next thing to close.

Try it

reportz.dev is live in English and French. The boards are public, the embed cards work in a README, and the counts can be walked back to the GitHub API. What you cannot reproduce from outside is what the private repository holds: which thirteen repositories are synced, the organisation mapping, and the opt-out list, of which the method page says “the list itself is never published”. That is the gap named above.

If you run an open-source programme — public administration, foundation, cooperative — and you want to know who is really building it, the method is more portable than the instance. Take the weights, argue with them, publish yours.