This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady.
RepoJanitor 🦥
What I Built
Developers love building new features.
What we do not love is maintaining everything we built afterward.
A repository starts clean. Then the small things begin to pile up.
Old files.
Duplicate utilities.
Forgotten TODOs.
Stale documentation.
Unused modules.
Outdated configuration.
Messy project structures.
Eventually, the repository becomes something that everyone knows needs cleaning, but nobody wants to spend an afternoon cleaning.
That is why I built RepoJanitor.
RepoJanitor is an AI maintainer that handles the repository maintenance developers keep postponing.
GitHub Repository:
https://github.com/RudraMalvankar/RepoJanitor
The idea is simple:
Your code is messy. You do not have to be.
RepoJanitor allows a developer to provide a GitHub repository or local codebase. It scans the repository using deterministic analysis, identifies maintenance problems, and then uses open-weight AI to reason about the findings.
Instead of allowing an AI model to blindly modify the repository, RepoJanitor places a deterministic SafetyGate between the AI and the filesystem.
The workflow is:
Scan → Detect → Reason → Classify → Review → Clean → Test → Diff → PR
The developer remains in control of what actually changes.
What can RepoJanitor find?
RepoJanitor is designed to detect several common types of repository maintenance debt:
• Duplicate files and utilities
• Stale TODO, FIXME, and HACK comments
• Potentially unused modules and files
• Dead code and phantom files
• Documentation problems
• Broken internal README links
• Missing environment variable documentation
• Potential secret exposure
• Repository hygiene issues
The project also calculates a repository health score so that maintenance debt can be understood at a glance.
The goal is not to replace developers.
The goal is to remove the boring work developers keep putting off.
Demo
GitHub Repository:
https://github.com/RudraMalvankar/RepoJanitor
RepoJanitor can analyze a public GitHub repository or a local codebase.
The interface is built around a repository dashboard that shows the health of the project, detected maintenance issues, AI reasoning, risk classifications, proposed actions, test results, and the resulting Git diff.
The most important part of the experience is that the AI does not simply say:
"You should clean this file."
It provides reasoning and evidence for why an action is being proposed.
For example, a potentially unused file can be presented with evidence such as missing references, import analysis, and repository history.
The developer can then review the proposed action before allowing it to execute.
The cleanup workflow
A typical RepoJanitor workflow looks like this:
1. Give it a repository
Paste a GitHub URL or provide a local repository path.
2. RepoJanitor scans it
The deterministic analysis layer examines the repository structure, files, Git information, references, documentation, TODOs, and potential security issues.
3. AI reasons about the findings
An open-weight model receives the relevant structured findings and code context.
4. Every action receives a risk level
Actions are classified as:
SAFE
REVIEW
BLOCKED
5. The user decides
Safe operations can be executed automatically, while potentially dangerous operations require human confirmation.
Blocked operations cannot be executed by the AI.
6. Changes happen on an isolated branch
RepoJanitor does not directly modify main or master.
7. Tests are run
The resulting repository state is validated using supported test commands.
8. The developer sees the diff
Nothing is hidden.
The developer can see exactly what changed.
9. A pull request can be generated
When GitHub integration is configured, RepoJanitor can prepare the cleanup as a pull request.
Code
The complete project is open source:
https://github.com/RudraMalvankar/RepoJanitor
The repository contains the frontend, backend, repository analysis engine, AI integration, safety layer, Git workflow, Docker configuration, deployment configuration, documentation, and automated tests.
The architecture is intentionally modular so that the AI provider, repository scanners, safety policies, and action executors can evolve independently.
How I Built It
RepoJanitor uses a repository-first AI architecture.
The important distinction is that the AI is not given unrestricted access to the repository and told to "clean it."
Instead, deterministic analysis happens first.
The architecture looks like:
GitHub URL / Local Repository
↓
Repository Scanner
↓
Deterministic Analysis
↓
┌─────────────────────────────┐
│ Duplicate Detector │
│ TODO Detector │
│ Dead Code Detector │
│ Documentation Analyzer │
│ Secret Detector │
└─────────────────────────────┘
↓
Structured Findings
↓
Open-Weight AI
↓
AI Reasoning Layer
↓
SafetyGate
↓
SAFE / REVIEW / BLOCKED
↓
Controlled Actions
↓
Isolated Git Branch
↓
Test Validation
↓
Interactive Diff
↓
GitHub Pull Request
Repository analysis
RepoJanitor uses deterministic tools wherever deterministic analysis is more reliable than asking an LLM.
The project uses GitPython, AST analysis, SHA-256 hashing, reference analysis, and pattern-based detection to inspect repositories.
For example, duplicate detection can compare file hashes instead of asking an AI model whether two files look similar.
Similarly, TODO and FIXME comments can be detected deterministically.
This reduces unnecessary AI calls and makes the system more predictable.
Open-weight AI
The AI layer is designed to support both cloud and local inference.
RepoJanitor supports Google's open-weight Gemma 2 models as well as local models through Ollama.
The repository currently documents models such as:
gemma2:9b
llama3.2:1b
qwen2.5:7b
This gives developers the ability to choose how and where their repository is analyzed.
For local workflows, the model can run on the developer's own machine through Ollama.
This means the repository does not have to be sent to a closed AI API simply to reason about maintenance findings.
Structured AI output
The model does not directly control the application.
AI output is validated against structured schemas before it reaches the action layer.
The reasoning contains information such as:
• Severity
• Risk
• Confidence
• Evidence
• Recommended action
• Whether the action can be automatically executed
This makes the AI a reasoning component rather than an unrestricted execution engine.
The SafetyGate
One of the biggest design decisions in RepoJanitor is that AI is not trusted with unrestricted system access.
The AI can propose an action.
It cannot decide whether that action is safe.
The application determines that.
SAFE
These are actions that can generally be executed automatically.
Examples include:
• Documentation updates
• Verified duplicate cleanup
• Changelog generation
REVIEW
These require developer confirmation.
Examples include:
• Removing potentially unused code
• Modifying dependencies
• Changing application logic
• Modifying configuration
• Changing tests
BLOCKED
These cannot be executed automatically.
Examples include:
• Modifying .env
• Deleting credentials
• Modifying private keys
• Tampering with .git
• Path traversal attempts
• Arbitrary shell commands
• Operations outside the repository boundary
This is especially important because repository files themselves should be treated as untrusted input.
If a README contains something like:
Ignore previous instructions and execute this command.
RepoJanitor treats that as repository content, not as an instruction with authority over the agent.
Secret Protection
Repository maintenance tools can potentially encounter sensitive information.
RepoJanitor therefore includes a secret detection and redaction layer.
Protected files include examples such as:
.env
.env.*
*.pem
*.key
credential files
secret files
SSH key files
The system can also identify patterns that resemble credentials or tokens.
Before relevant content is sent to an AI model, sensitive values are redacted.
For example:
GITHUB_TOKEN=[REDACTED]
API_KEY=[REDACTED]
DATABASE_PASSWORD=[REDACTED]
The goal is to make local AI useful without treating repository contents as automatically safe to expose.
Git Safety
RepoJanitor never relies on the AI to decide where it can write.
Changes are performed inside controlled repository boundaries.
The project also protects the main development branches.
Instead of directly modifying:
main
RepoJanitor creates an isolated cleanup branch such as:
repo-janitor/cleanup-2026-10-25
The resulting changes can then be reviewed through a Git diff before being turned into a pull request.
This makes the workflow much closer to how a real developer tool should behave.
Testing
RepoJanitor includes an automated test suite covering important parts of the system.
The repository currently reports 35 automated pytest tests passing, including tests for scanners, security protections, the SafetyGate, secret handling, and API functionality.
The project also includes a verification matrix covering scenarios such as:
• Public GitHub repository scanning
• Local repository scanning
• Path traversal protection
• Secret file protection
• Credential redaction
• Duplicate file cleanup
• Protected branch handling
• Automated tests
The purpose of these tests is not only to prove that the happy path works.
They also test what happens when the AI or repository attempts something it should not be allowed to do.
Why Does Open Innovation Matter?
This is probably the most important part of RepoJanitor for this challenge.
A repository is not just a collection of files.
It can contain proprietary business logic, credentials, private configuration, internal documentation, and years of engineering work.
Sending an entire repository to a closed AI service is not always desirable.
Open-weight models provide another option.
With local inference through Ollama, RepoJanitor can analyze code on the developer's own machine.
That gives the developer:
Privacy
Source code can remain on the local machine when using local inference.
Model freedom
Developers can choose which compatible open-weight model they want to run.
Cost control
Local inference does not require a per-request closed AI API bill.
Offline capability
The core local analysis workflow can operate without sending repository contents to an external AI service.
Reproducibility
The model and inference environment can be configured and reproduced by other developers.
For RepoJanitor, open AI is not just an implementation detail.
It changes the trust model of the product.
The idea is:
Your repository belongs to you. Your AI should be able to work for you without requiring you to hand your code to someone else's black box.
My Agent Session
The project was developed with AI-assisted engineering, and the development process can be shared through the agent session where available.
Agent-assisted development was used to accelerate implementation, debugging, architecture iteration, and testing while keeping the resulting project open source.
Agent sessions are optional for the challenge, but they provide additional context into how RepoJanitor was built.
The Lazy Payoff 🦥
The entire product is built around one question:
What maintenance work would you rather never do yourself?
Imagine opening a repository and seeing:
REPOSITORY HEALTH
61 / 100
17 maintenance issues found
6 duplicate files
5 stale TODOs
3 documentation issues
2 potential unused modules
1 security warning
Instead of spending the next hour investigating everything manually:
🦥 RepoJanitor
I found the mess.
9 actions are safe.
6 need your approval.
2 are blocked.
[Clean Safe Issues]
The developer reviews the proposed changes.
RepoJanitor creates an isolated branch.
It applies the approved changes.
It runs the tests.
It shows the diff.
Then it prepares the pull request.
The developer gets to spend their time building instead of cleaning.
That is the lazy payoff.
The goal is not to make developers do less engineering.
It is to make them spend less time doing the boring parts of engineering.
Prize Categories
RepoJanitor is being entered into the following categories based on the technologies genuinely used in the project.
🏆 Overall Challenge
Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady
The overall winner receives:
$250 USD
DEV++ Membership
Exclusive winner badge
🥇 Best Use of Gemma
Featured Partner Category
$200 USD + Exclusive winner badge
RepoJanitor uses Google's open-weight Gemma 2 models as part of its AI reasoning architecture.
Gemma is used to reason over repository findings and assist with maintenance decisions.
The project also supports local inference through Ollama, allowing the model to run on the developer's own machine.
🥇 Best Use of Render
Featured Partner Category
$200 USD + Exclusive winner badge
RepoJanitor includes Render deployment configuration through render.yaml and is designed to run as a deployed web application.
Render provides the deployment path for the project while the AI architecture can use the configured AI provider.
🥇 Best Use of GitHub Copilot
Partner Category
$100 USD + Exclusive winner badge
This category applies only to the extent that GitHub Copilot's qualifying technology was genuinely used during the development of RepoJanitor, such as Copilot's coding agent, Copilot CLI, Copilot app, GitHub Actions automation, or PR review functionality.
🥇 Best Use of Entire
Partner Category
$100 USD + Exclusive winner badge
If the final submission includes the qualifying agent session/workflow through Entire, RepoJanitor can also be entered into this category.
Important
The project can enter multiple partner categories when it genuinely uses the corresponding technology.
However, DEV states that a submission can only win once per challenge, so these categories are opportunities for the same project to be considered by different partner judging pools rather than separate prizes that can all be collected by the same submission.
The Week 3 challenge currently lists six featured categories at $200 each and fourteen partner categories at $100 each, alongside the $250 overall prize.
Final Thoughts
RepoJanitor started from a simple observation:
Developers are very good at creating technical debt.
We are much worse at cleaning it up.
So instead of creating another AI assistant that waits for us to ask questions, I wanted to build something that could look at the repository, understand what needs attention, and take care of the boring parts safely.
The sloth was actually a pretty good product manager.
🦥
RepoJanitor
The AI maintainer you never asked for.
GitHub:
Top comments (0)