feat: add GitHub repository dashboard with Prometheus metrics

ghtracker authenticates as a GitHub App and scans a configured list of repositories on a schedule. It serves a dashboard, a JSON state endpoint, a health probe and Prometheus metrics.

The dashboard lists only items that need attention: failing workflows, pull requests that wait too long or fail their checks, stale issues and projects that failed to scan. It has search, dynamic filters and a button that rescans on demand. The Vue app is embedded in the Go binary.

The client protects the GitHub rate limit with conditional requests, a request reserve and Retry-After handling.

deploy/kubernetes/configmap.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ghtracker
+data:
+  config.yaml: |
+    listen: ":8080"
+    refresh_interval: 6h
+    github:
+      app_id: 123456 # your GitHub App ID
+      installation_id: 0
+    thresholds:
+      pr_warn_after: 48h
+      pr_crit_after: 168h
+      issue_stale_after: 720h
+      workflow_stuck_after: 6h
+    repos:
+      - lukaszraczylo/kubemirror
+      - lukaszraczylo/semver-generator
+      - lukaszraczylo/traefikoidc

deploy/kubernetes/deployment.yaml

@@ -0,0 +1,52 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ghtracker
+spec:
+  replicas: 1 # one replica: each replica refreshes on its own and spends GitHub API budget
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: ghtracker
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: ghtracker
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: ghtracker
+          image: ghcr.io/lukaszraczylo/ghtracker:latest # replace with the image you push
+          args: ['-config', '/config/config.yaml']
+          envFrom:
+            - secretRef:
+                name: ghtracker-github-app
+          ports:
+            - name: http
+              containerPort: 8080
+          readinessProbe:
+            httpGet: { path: /healthz, port: http }
+            periodSeconds: 10
+          livenessProbe:
+            httpGet: { path: /metrics, port: http }
+            periodSeconds: 30
+          resources:
+            requests: { cpu: 10m, memory: 32Mi }
+            limits: { memory: 128Mi }
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: [ALL]
+          volumeMounts:
+            - name: config
+              mountPath: /config
+              readOnly: true
+      volumes:
+        - name: config
+          configMap:
+            name: ghtracker

deploy/kubernetes/externalsecret.yaml

@@ -0,0 +1,16 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: ghtracker-github-app
+spec:
+  refreshInterval: 24h
+  secretStoreRef:
+    name: secrets # your ClusterSecretStore
+    kind: ClusterSecretStore
+  target:
+    name: ghtracker-github-app
+    creationPolicy: Owner
+  data:
+    - secretKey: GHTRACKER_PRIVATE_KEY
+      remoteRef:
+        key: ghtracker/app_private_key # where you keep the App private key

deploy/kubernetes/ingressroute.yaml

@@ -0,0 +1,16 @@
+# Replace the host. The dashboard has no authentication: keep it on an internal entrypoint
+# or add a Traefik auth middleware before exposing it.
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ghtracker
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`ghtracker.example.com`)
+      kind: Rule
+      services:
+        - name: ghtracker
+          port: 80
+  tls: {}

deploy/kubernetes/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: ghtracker
+resources:
+  - namespace.yaml
+  - externalsecret.yaml
+  - configmap.yaml
+  - deployment.yaml
+  - service.yaml
+  - servicemonitor.yaml
+  - prometheusrule.yaml
+  - ingressroute.yaml

deploy/kubernetes/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ghtracker

deploy/kubernetes/prometheusrule.yaml

@@ -0,0 +1,35 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: ghtracker
+spec:
+  groups:
+    - name: ghtracker
+      rules:
+        - alert: GhtrackerWorkflowFailing
+          expr: ghtracker_workflow_failing == 1
+          for: 10m
+          labels: { severity: warning }
+          annotations:
+            summary: 'Workflow {{ $labels.workflow }} failing in {{ $labels.repo }}'
+        - alert: GhtrackerPullRequestWaiting
+          expr: ghtracker_pr_age_seconds > 3 * 86400
+          labels: { severity: warning }
+          annotations:
+            summary: 'PR #{{ $labels.number }} in {{ $labels.repo }} waiting over 3 days'
+        - alert: GhtrackerRepoDown
+          expr: ghtracker_repo_up == 0
+          for: 30m
+          labels: { severity: warning }
+          annotations:
+            summary: 'ghtracker cannot refresh {{ $labels.repo }}'
+        - alert: GhtrackerDataStale
+          expr: time() - ghtracker_last_refresh_timestamp_seconds > 13 * 3600
+          labels: { severity: warning }
+          annotations:
+            summary: 'ghtracker has not refreshed for over 13 hours'
+        - alert: GhtrackerRateLimitLow
+          expr: ghtracker_github_rate_limit_remaining < 500
+          labels: { severity: warning }
+          annotations:
+            summary: 'GitHub rate limit budget below 500'

deploy/kubernetes/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ghtracker
+  labels:
+    app.kubernetes.io/name: ghtracker
+spec:
+  selector:
+    app.kubernetes.io/name: ghtracker
+  ports:
+    - name: http
+      port: 80
+      targetPort: http

deploy/kubernetes/servicemonitor.yaml

@@ -0,0 +1,12 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: ghtracker
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: ghtracker
+  endpoints:
+    - port: http
+      path: /metrics
+      interval: 5m # series are computed from cached data; scraping faster adds nothing