Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

I Built a Tool to Track My Open Source Contributions

Github contributions graph is great at showing activity, but it does not answer the question: what open source projects I have contributed to. I wanted to display open source projects I have contributed to on my personal website. I can do…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

Github contributions graph is great at showing activity, but it does not answer the question: what open source projects I have contributed to.



I wanted to display open source projects I have contributed to on my personal website. I can do this manually. However, this can get annoying and add extra thing to remember.

I want to show projects I contributed to, how many PR’s merged, lines of code contributed. Github does not surface this easily, so i built a tool to do so.





The Problem



If you contribute to external repositories (projects you don’t own) Github buries this info. You can get it manually by searching your PR’s, but their is no API endpoint that says “give me all this user’s contributions to external repositories”



I wanted:




  • List of external projects contributed to

  • Number of merged PR’s per project

  • Commit count and number of lines added/removed (per project)

  • JSON output I can feed to my website



So I created gh-oss-stats





The Approach



The core insight is to use Github’s search query




author:USERNAME type:pr is:merged -user:USERNAME




This find all pull requets:




  • Authored by you (author:USERNAME)

  • That are PR’s not issues (type:pr)

  • That are merged (is:merged)

  • For repos you don’t own (-user:USERNAME)
    That's your OSS contribution history in one query.



Request looks like this:




https://api.github.com/search/issues?q=author:mabd-dev+type:pr+is:merged+-user:mabd-dev






output looks like this:




{
"total_count": 20,
"incomplete_results": false,
"items": [
{
{
"url": "https://api.github.com/repos/qamarelsafadi/JetpackComposeTracker/issues/9",
"repository_url": "https://api.github.com/repos/qamarelsafadi/JetpackComposeTracker",
"labels_url": "https://api.github.com/repos/qamarelsafadi/JetpackComposeTracker/issues/9/labels{/name}",
"comments_url": "https://api.github.com/repos/qamarelsafadi/JetpackComposeTracker/issues/9/comments",
"events_url": "https://api.github.com/repos/qamarelsafadi/JetpackComposeTracker/issues/9/events",
"html_url": "https://github.com/qamarelsafadi/JetpackComposeTracker/pull/9",
"id": 3204496021,
"node_id": "PR_kwDONQBujs6diLmP",
"number": 9,
"title": "🔧 Refactor: Add Global Theme Support for UI Customization",
"user": {...},
"labels": [...],
"state": "closed",
},
...
]
}






From there, it's a matter of:




  1. Fetching PR details (commits, additions, deletions)

  2. Enriching with repo metadata (stars, description)

  3. Aggregating into useful statistics









Architecture Decision: Library First



I built this as a Go library with a CLI wrapper, not just a CLI tool. The core logic lives in an importable package:




import "github.com/gh-oss-tools/gh-oss-stats/pkg/ossstats"

client := ossstats.New(
ossstats.WithToken(os.Getenv("GITHUB_TOKEN")),
ossstats.WithLOC(true), LOC: lines of code
)

stats, err := client.GetContributions(ctx, "mabd-dev")






This means I can use the same code in:




  • The CLI tool (for local use)

  • GitHub Actions (automated updates)

  • A future badge service (SVG generation)

  • Anywhere else I need this data
    The CLI is just a thin wrapper that parses flags and calls the library.






Handling GitHub's Rate Limits



GitHub's API has limits: 5,000 requests/hour for authenticated users, but only 60 requests/hour for the Search API. For someone with many contributions, you can burn through this quickly.



The tool implements:




  • Exponential backoff on rate limit errors

  • 2-second delays between search API calls

  • Controlled concurrency (5 parallel requests for PR details)

  • Partial results if rate limited mid-fetch









The Output



Running the tool produces JSON like this:




{
"username": "mabd-dev",
"generatedAt": "2025-12-21T06:46:57.823990311Z",
"summary": {
"totalProjects": 7,
"totalPRsMerged": 17,
"totalCommits": 58,
"totalAdditions": 1270,
"totalDeletions": 594
},
"contributions": [
{
"repo": "qamarelsafadi/JetpackComposeTracker",
"owner": "qamarelsafadi",
"repoName": "JetpackComposeTracker",
"description": "This is a tool to track you recomposition state in real-time !",
"repoURL": "https://github.com/qamarelsafadi/JetpackComposeTracker",
"stars": 94,
"prsMerged": 2,
"commits": 14,
"additions": 181,
"deletions": 78,
"firstContribution": "2025-06-14T20:55:24Z",
"lastContribution": "2025-07-21T21:39:53Z"
},
...
]
}






This feeds directly into my website's contributions section.









Using It






Installation






go install github.com/gh-oss-tools/gh-oss-stats/cmd/gh-oss-stats@latest









Basic Usage






# Set your GitHub token
export GITHUB_TOKEN=ghp_xxxxxxxxxxxx

# Run it
gh-oss-stats --user YOUR_USERNAME

# Save to file
gh-oss-stats --user YOUR_USERNAME -o contributions.json












Automating with GitHub Actions



I run this weekly via GitHub Actions to keep my website updated automatically:




name: Update OSS Contributions

on:
schedule:
- cron: '0 0 * * 0' # Weekly on Sunday
workflow_dispatch: # Manual trigger

permissions:
contents: write

jobs:
update-stats:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

- uses: actions/setup-go@v5
with:
go-version: '1.25'

- name: Install gh-oss-stats
run: go install github.com/gh-oss-tools/gh-oss-stats/cmd/gh-oss-stats@latest

- name: Fetch contributions
env:
GITHUB_TOKEN: ${{ secrets.GH_OSS_TOKEN }}
run: |
gh-oss-stats \
--user YOUR_USERNAME \
--exclude-orgs="your-org" \
-o data/contributions.json

- name: Commit changes
run: |
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git add data/contributions.json
if ! git diff --staged --quiet; then
git commit -m "Update OSS contributions"
git push
fi






Now my website always has fresh data without any manual work.






Displaying on My Website



On mabd.dev, I read the JSON file and render it. The exact implementation depends on your stack, but the data structure makes it straightforward:




  • Loop through contributions array

  • Display repo name, stars, PR count

  • Show totals from summary

  • Link to the actual repos



The JSON is the contract — however you want to display it is up to you.









What I Learned



GitHub's Search API is powerful but quirky. The -user: exclusion syntax does not exclude repos you own on your organization. I had to do custom logic to detect that.



Library-first design pays off. Building the core as an importable package meant the CLI came together in under an hour. It also means future tools (like a badge service) can reuse 100% of the logic.









What's Next



I'm planning to build a companion service gh-oss-badge that generates SVG badges you can embed in your GitHub profile README:



markdown




![OSS Stats](https://oss-badge.example.com/mabd-dev.svg)






Same data, different presentation. The library-first architecture means this service will just import gh-oss-stats/pkg/ossstats and add an HTTP layer on top.






If you want to track your own OSS contributions, give gh-oss-stats a try. It's open source (naturally), and contributions are welcome






Resources



1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - I Built a Tool to Track My Open Source Contributions
id: a4e54a9a-0b15-4fdc-a60b-d3d4df38bd29
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "I Built a Tool to Track My Ope" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("I Built a Tool to Track My Open Source C")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*I Built a Tool to Track My Open Source C*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "I Built a Tool to Track My Open Source C"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich I Built a Tool to Track My Open Source C.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten I Built a Tool to Track My Open Source Contributions

Thematisch verwandte Begriffe: Built, Tool, Track, Open · 6 Treffer

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-97818 | phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and i…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag