Get your dead code valued, without uploading it.

What happens when you run it

1. Double-click the app.

   Your browser opens with a list of your repositories, found automatically.

   Your repositories

   Found 3 repositories on this machine

   acme-app · main · 214 commitsFingerprint this repo

   billing-service · main · 892 commits

   legacy-site · master · 3,401 commits

2. Pick one.

   It fingerprints the repository locally; big histories take about a minute.

   ── galena-fingerprint v0.4.0 ─────────────────────────────────
   repo        main @ c53aa0cce23a
   commits     12 over 1877 days · 2 authors · 1 merges (1 PR merges)
   head        21 files · 11.9 KB · 125 LOC raw · test ratio 0.10
   source      94 LOC in 7 files (75% of raw) · 31 LOC excluded: data 8, snapshot 5, vendored 4, asset 3, …
   languages   JavaScript (6.1 KB), Text/Other (4.8 KB), Binary/Other (528 B), JSON (152 B)
   deps        npm: 3 direct · 33% pinned · lockfile ✓
   deps        pip: 3 direct · 33% pinned · NO LOCKFILE
   licenses    GPL-3.0×1, MIT×1
     ⚠ copyleft license inside a vendored tree
   secrets     ⚠ 3 potential credential hits across 3 rule classes (counts only — values not recorded)
                 aws_access_key_id                head:0 hist:1
                 connection_string_with_creds     head:0 hist:1
                 stripe_key                       head:0 hist:1
   risk paths  ⚠ env:1 sql-dumps:1 sqlite:1 keys:0 cred-files:0
   vendored    node_modules files:1 vendor files:2 committed at HEAD
   churn       +128/-3 lines · median commit 3 · p90 13 · 0% huge · 1.0x rework
   messages    0% conventional · 0% one-word · 0 reverts · mean 23 chars
   tickets     forge-issues · 1 distinct refs · 8% of commits reference one · 0% claim a fix
   provenance  75% of commits and 98% of added lines predate 2023-01-01
               signatures not checked (-verify-signatures) · 2 timezones · dates are self-reported (verify via SWHIDs)
   ai assist   2 commits (17%) carry an AI co-author trailer: Claude 1, GitHub Copilot 1
               first 2024-03-04 · +2 lines on those commits · a floor, not a share:
               trailers are optional, so untagged commits may also be assisted
   blobs       21 at HEAD (3 historical-only) — hashes usable as SWHIDs
   minhash     2 file sketches + repo sketch
   output      galena-manifest.json (106 ms)

   "head:0 hist:1" means a credential was committed and later deleted: it still lives in git history, and the tool catches that without ever reading the value.

3. Review, then upload.

   The summary is a JSON file on your disk. Look inside if you like, then upload it at the valuation page. Upload it for a valuation →

My code is only on GitHub

1. In your repository on github.com: Add file, then Create new file.
2. Name it .github/workflows/galena-fingerprint.yml.
3. Paste the workflow below and commit.
4. Go to the Actions tab, open "Galena Fingerprint", and press Run workflow.
5. When it finishes, download the galena-manifest artifact and upload it at the valuation page.

# Galena Fingerprint — run entirely inside YOUR GitHub account.
# Your code never leaves GitHub's runners; only the summary manifest
# is produced, and it lands as a downloadable artifact on this run.
#
# To use (no local install needed):
#   1. In your repo on github.com: Add file → Create new file
#   2. Name it:  .github/workflows/galena-fingerprint.yml
#   3. Paste this file's contents, commit.
#   4. Actions tab → "Galena Fingerprint" → Run workflow.
#   5. When it finishes, download the "galena-manifest" artifact and
#      upload it at https://galenadata.com/valuation

name: Galena Fingerprint

on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  fingerprint:
    runs-on: ubuntu-latest
    steps:
      - name: Check out full history
        uses: actions/checkout@v4
        with:
          # CRITICAL: the default shallow clone would gut every history
          # metric (commits, authors, deleted-secret detection).
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.22'

      - name: Build fingerprint tool from public source
        run: |
          git clone --depth 1 https://github.com/galenadata/fingerprint /tmp/fp
          cd /tmp/fp && go build -o /tmp/galena-fingerprint .

      - name: Run fingerprint (zero network calls; counts only, never values)
        run: /tmp/galena-fingerprint -o galena-manifest.json .

      - name: Upload manifest as artifact
        uses: actions/upload-artifact@v4
        with:
          name: galena-manifest
          path: galena-manifest.json

      # Optional: submit automatically instead of downloading the artifact.
      # Create a repository secret GALENA_SUBMIT_TOKEN (from your valuation
      # page) and uncomment:
      #
      # - name: Submit manifest to Galena
      #   run: |
      #     curl -fsS -X POST https://galenadata.com/api/valuation \
      #       -H "Authorization: Bearer ${{ secrets.GALENA_SUBMIT_TOKEN }}" \
      #       -F "[email protected]"

The workflow checks out with fetch-depth: 0 on purpose: a shallow checkout would make history metrics incomplete, and the manifest flags itself if that happens. Everything runs inside your GitHub account; your code never touches our servers.

What's in the manifest

Repo shape

Branches, size, and file counts at HEAD

Commit history

Activity over time and authors, with emails hashed

Languages & tests

Language mix by bytes and the test-to-code ratio

Real source lines

Lines you actually wrote, with vendored code, lockfiles, bundles and generated files counted separately

Dependencies

Direct dependencies, version pinning, lockfile presence

Licenses

Detected licenses, including copyleft flags

Secrets

Credential hit counts per rule class; values never recorded

Risky files

.env files, SQL dumps, databases, and key material, by count

File hashes

Content hashes usable to check public exposure (SWHIDs)

Commit quality

Line churn per commit, rework ratio, commit-message discipline

Tickets

Issue references mined from commit messages, and what they claim to close

Provenance

How much was written before 2023, per-year activity, date-tampering signals

AI assistance

Commits signed by a coding assistant, per year; a floor, since those trailers are optional

See a sample manifest →See a large one: 1.2M raw lines, 269k real source, snapshot mode (1.6 MB) →

The large example is a public open-source repository (BBC simorgh, Apache-2.0, no affiliation), fingerprinted from a ZIP download: that is why it runs in snapshot mode with no commit history.

File paths feel sensitive too? Run with --redact-paths and paths are hashed as well.