MaintainerOps AI

MaintainerOps AI is a GitHub-aware CLI and GitHub Action for open-source maintainers. It turns pull requests, issues, and fixture-based security or release inputs into structured review packets that a maintainer can accept, edit, or ignore.

Try it in 30 seconds without an API key:

npm exec --yes --package maintainerops-ai@latest -- maintainerops demo

OSS ecosystems rely on a small number of maintainers making high-quality decisions under constant backlog pressure. MaintainerOps AI makes that work easier to audit and repeat: it converts noisy issues, PRs, dependency updates, and release tasks into review packets that preserve maintainer control while improving security, code quality, and response time.

The project is intentionally human-in-the-loop. It does not merge pull requests, close issues, publish releases, or run security scans against repositories you do not own or administer.

Current evidence snapshot

• Public npm package: maintainerops-ai, latest published v0.1.14 through npm Trusted Publishing with provenance; npm downloads API reported 506 downloads for 2026-06-30 through 2026-07-06; broken 0.1.8 is deprecated.
• GitHub Marketplace Action: MaintainerOps AI, public listing displays v0.1.14 as the latest Action release.
• Latest GitHub Release: v0.1.14, aligning package metadata and Marketplace-facing examples.
• GitHub releases: 14 public releases from v0.1.0 through v0.1.14, excluding intentionally withheld v0.1.8.
• Source, npm, GitHub Releases, and GitHub Marketplace are aligned on v0.1.14.
• Security evidence: initial reports plus the 2026-06-23 repository-wide Codex Security rescan, remediation report, and passing post-fix verification.
• Latest security evidence: the complete 2026-07-12 repository-wide scan covers 59/59 worklist rows and reports 1 High plus 2 Medium findings; the generated report, SARIF, detailed write-ups, and hardening portfolio are published under docs/codex-security/full-rescan-2026-07-12.md. The report is a pre-fix baseline and does not claim remediation.
• Workflow evidence: successful manual, pull-request-triggered, issue-triggered, Dependabot, CodeQL, OpenSSF Scorecard, and npm Trusted Publishing runs, including the v0.1.14 publication and 2026-07-07 dependency maintenance evidence.
• Supply-chain evidence: OpenSSF Scorecard workflow is active; latest successful manual run scored 7.1 after community-profile and workflow hardening improvements, documented in docs/openssf-scorecard-2026-07-02.md.
• Model-backed eval evidence: budget-gated live evals passed 2-case, 5-case, and 10-case runs with gpt-4o-mini; the 2026-07-05 10-case run cost estimate was $0.001724 and remains manual-only.
• Supply-chain release work: npm Trusted Publishing is active for v0.1.14 and published without NPM_TOKEN.
• Maintainer workflow evidence: issues #1-#4 triaged and closed, issue #6 open for Marketplace/external maintainer feedback, issue #11 tracks the v0.1.4 hardening release, and real repository review packets published.
• Release planning: docs/release-plan-v0.1.10.md, docs/releases/v0.1.10.md, docs/releases/v0.1.11.md, docs/releases/v0.1.12.md, docs/releases/v0.1.13.md, and docs/releases/v0.1.14.md track model-backed eval hardening, Trusted Publishing, provenance metadata repair, 10-case live eval publication, the no-key demo path, and package metadata consistency.
• External feedback: Discussion #17 provides a low-friction public test request in English and Japanese; results can also be recorded on Issue #6.
• Verification gate: npm run verify includes typecheck, lint, format, unit tests, UI smoke test, evals, package dry run, publint, and npm audit.

Why this exists

Open-source maintenance work is repetitive and high-stakes:

• Review pull requests for risk, test gaps, and security-sensitive changes.
• Triage issues into actionable labels and missing-information requests.
• Summarize dependency, CodeQL, Semgrep, and package audit output when maintainers provide those findings through issues or fixtures.
• Draft release notes from merged pull requests and breaking changes.

MaintainerOps AI uses the OpenAI API to reduce the reading and drafting load while keeping maintainers in control.

Quick start

Install from npm:

npm install -g maintainerops-ai
maintainerops demo

Run from source:

npm install
npm run build
npm run demo

Full local verification:

npm run verify

With the OpenAI API enabled:

set OPENAI_API_KEY=<your-openai-api-key>
set OPENAI_MODEL=<supported-openai-model>
npm run build
node dist/cli.js analyze --fixture examples/fixtures/pull_request.json --format markdown

If OPENAI_MODEL is omitted, the CLI uses its built-in default model. Set the variable explicitly when your organization has standardized on a specific supported OpenAI model.

Against GitHub:

set GITHUB_TOKEN=<your-github-token>
node dist/cli.js analyze --repo owner/project --pull 123 --authorized --format markdown
node dist/cli.js analyze --repo owner/project --issue 456 --authorized --format json

If OPENAI_API_KEY is not set, the CLI falls back to deterministic offline heuristics so maintainers can test the workflow without spending credits.

Manual model-backed evals:

set OPENAI_API_KEY=<your-openai-api-key>
set OPENAI_MODEL=<supported-openai-model>
npm run eval:model

npm run eval:model is intentionally not part of CI because it performs live API calls and may incur usage charges. For bounded manual runs, pass --budget-usd, --max-cases, and --max-output-tokens. List model-backed eval cases without an API key:

npm run eval:model:list

What the AI returns

The model is asked to return a strict structured object:

• summary: maintainer-ready summary
• riskLevel: low, medium, high, or critical
• labels: suggested labels
• recommendedAction: next maintainer action
• reviewChecklist: concrete review checks
• securityNotes: security-sensitive observations
• releaseNotes: release-note draft fragments
• commentDraft: optional GitHub comment draft

Safety posture

• Dry-run by default.
• Minimal GitHub permissions.
• Secret redaction before model calls and report serialization.
• Live GitHub analysis requires explicit authorization.
• Pull request CI runs in offline/no-secret mode by default.
• GitHub Actions stdout neutralizes workflow-command syntax from untrusted model text.
• No automatic merge, close, release, or external scan.
• Audit-friendly JSON output with redacted work-item content.
• Optional API use; offline mode works for CI validation.

Dashboard prototype

npm run dev

Open the printed local URL to review the Security Review Workbench UI.

Static preview: security-review-workbench.png

Security review evidence

• Codex Security scan report
• Codex Security HTML report
• Focused fix report
• Post-fix rescan report
• Full Codex Security rescan report
• Full Codex Security rescan HTML
• 2026-06-23 full Codex Security rescan report
• 2026-06-23 full Codex Security rescan HTML
• 2026-06-23 full rescan fix report
• 2026-07-12 complete repository-wide rescan report
• Publication exposure scan
• v0.1.3 Codex Security diff scan
• Action hardening Codex Security diff scan
• Release alignment Codex Security diff review
• v0.1.14 consistency diff review
• Maintenance quality gates diff review
• v0.1.15 quality hardening diff review
• Usage log
• Improvement history
• npm install evidence
• Publication audit
• Real repository review packets
• Application answers
• External feedback request
• Community outreach log
• Operator runbook
• v0.1.0 release
• v0.1.2 release
• v0.1.3 release
• v0.1.4 release
• v0.1.5 release
• v0.1.6 release
• v0.1.7 release and release notes
• v0.1.8 release candidate notes
• v0.1.9 package repair notes
• v0.1.10 model eval and Trusted Publishing release notes
• v0.1.11 provenance metadata repair notes
• v0.1.12 10-case live model-backed eval notes
• v0.1.13 no-key demo release notes
• v0.1.14 package metadata and Marketplace snapshot notes
• npm package

Application materials

• OpenAI alignment
• Evals
• Promotion kit
• Japanese promotion plan
• Japanese X post drafts
• Japanese note article draft
• Strategy roadmap
• Tooling roadmap

GitHub Action

Use MaintainerOps AI as a read-only GitHub Action to generate review packets during pull request and issue triage.

name: MaintainerOps AI

on:
  pull_request:
    types: [opened, synchronize, reopened]
  issues:
    types: [opened, edited]

permissions:
  contents: read
  pull-requests: read
  issues: read

jobs:
  review-packet:
    runs-on: ubuntu-latest
    steps:
      - id: maintainerops
        uses: rtonf/maintainerops-ai@v0.1.14
        with:
          mode: ${{ github.event_name == 'pull_request' && 'pull_request' || 'issue' }}
          repo: ${{ github.repository }}
          number: ${{ github.event.pull_request.number || github.event.issue.number }}
          format: markdown
          offline: true
          authorized: true

The current v0.1.14 Action prints the packet in the job log. The source implementation for the next Action release also writes it to the workflow Step Summary and exposes a redacted steps.maintainerops.outputs.report value for reviewed downstream processing; do not execute packet text as shell code.

Trying this from GitHub Marketplace? Please leave early maintainer feedback on Issue #6 after running either the Action or the npm CLI.

Marketplace listing summary:

MaintainerOps AI helps open-source maintainers turn pull requests and issues into human-reviewed triage packets with risk level, labels, review checklist, security notes, release-note hints, and a draft response. It is read-only by design, requires explicit authorization for live repository analysis, and does not merge, close, label, or publish anything automatically.

See action.yml, Marketplace listing notes, and the safe no-secret pull request workflow example at docs/github-workflows/maintainerops.yml.

OpenAI alignment

This project is designed for the exact OSS maintenance workflows that the Codex for Open Source program describes: pull request review, issue triage, release workflows, maintainer automation, and security/code-quality support.