pphatdev/github-stats

GitHub Stats delivers a broad, working service rather than a collection of static card templates. The code separates stats, languages, graphs, badges, icons, health checks, rendering, caching, database access, and GitHub communication into clear modules. It uses both GitHub REST and GraphQL APIs, coalesces repeated requests, validates environment configuration with Zod, handles errors centrally, and supports memory caching with optional Redis availability checks. The repository includes SQLite and Cloudflare D1 paths, Drizzle migrations, Docker Compose, graceful cluster shutdown, health checks, extensive route examples, more than 150 bundled icons, multiple rendering styles, an MIT license, contribution guidance, and a live hosted service.
The main reliability gap is the absence of tests and CI. package.json defines npm test as Jest, but Jest is not installed and the repository contains no test files or configuration. The TypeScript build, Docker image, database migrations, renderers, cache behavior, GitHub error handling, and public endpoints therefore receive no automated verification. A focused suite should test SVG escaping, query validation, missing users, GitHub rate limits, cache expiration, database concurrency, and each export format. GitHub Actions should build the project, run tests, scan dependencies, build the container, and exercise several HTTP routes.

Several production claims also do not match the active server. Rate limiting, Helmet headers, request coalescing, and the broader performance stack are implemented in a separate middleware file but are not exported or mounted by createApp. Redis is initialized, yet the route services receive the process-local Map, while the Redis-backed service is passed only to the health module. This falls short of the documented memory-to-Redis caching design and gives each cluster worker an independent cache. The README says visitor counts use hashed IP addresses and cooldowns, but the active badge service increments the database counter on every request without consulting an IP hash. The unused visitor_logs table does not change that behavior. Documentation links also point to missing development files, and the API reports version 2.0.0 while the package declares 2.1.1. Wiring the existing middleware and Redis layer into the application, adding truthful privacy documentation, and enforcing visitor deduplication would materially improve a feature-rich service.