What one repository is missing.
Point it at any repository and it tells you what is not there yet: tests, security checks, build setup, documentation and the rest.
A public repository needs nothing from you. Your own needs read access, or a zip upload if you would rather not give it.
Eight stages, not one linter.
A linter reads your syntax. This reads the shape of how you ship: what exists, what is switched on, what is enforced, and what is only true on one person's laptop.
Source
branching, history, ownership
Builds
pipelines, pinned actions, timeouts
Tests
coverage gates, type checking
Security
scanning, secrets, disclosure
Packaging
lockfiles, reproducible builds
Releases
versioning, rollback
Docs
readme, setup, environment
Review
routing, templates, conventions
It reads your dependencies alongside them: what is stale, how stale, and which of it has a known problem.
Install
One command, and it checks itself.
The installer checks the published fingerprint before it writes anything, and refuses to install a file that does not match. It installs somewhere you own, so updates never need an administrator.
curl -fsSL https://storage.googleapis.com/cleancode-cli-releases/0.1.5/install.sh | sh
irm https://storage.googleapis.com/cleancode-cli-releases/0.1.5/install.ps1 | iex
cleancode login cleancode scan owner/repo
Before you paste that
- These files are not signed yet. That is why the installer checks the fingerprint itself, and why we are telling you here rather than letting your laptop tell you.
- If your company blocks unsigned downloads, take the release and check it by hand. The fingerprints are published next to it.
- Signing is coming. Until it lands, this page will keep saying so.
What it does, and what it does not.
It does
- Read the code itself, not just the activity around it.
- Finish in seconds on a repository of a few thousand files.
- Run on its own in your pipeline and hand back markdown or JSON.
- Work on a public repository without being connected to anything.
- Take a zip file if you cannot give it access to your repositories.
It does not
- Rank your engineers. There is no score and no leaderboard, and there will not be one.
- Know what your team decided on purpose. If you solved something another way, it will still flag it.
- Look across repositories. One at a time is the whole scope of this tool.
- Write to your code. It only reads. Changes arrive as a pull request you approved.
That second one is worth reading twice. A wrong flag is not a difference of opinion, it is a bug, and we would rather hear about it than have you quietly stop running this. Send it to hello@cleancode.ai with the repository and what it got wrong.
One repository is the demo. All of them is the problem.
This tells you about the repository in front of you. It cannot tell you that four teams wrote the same thing this year. That is Fleet, and it is taking design partners now.