My GitHub profile says 4,099. I shipped more.

One account is not your year.

GitHub shows one account. It counts only commits that land on the default branch. A squash-merged pull request collapses into a single commit. If your week is split across a work account and a personal one, a big chunk of it is invisible.

Here is the whole gap.

4,268 verified commits from 26 repos. 182 active days. Busiest day: 737.

A bigger number means nothing if it can be faked.

everycommit counts verified commits only, and every rule that keeps the number honest is built in. A typo in the policy is an error, not a silent loosening.

Verified, not faked. Never productivity. It proves the squares are real. It says nothing about whether the work was good.

Signing above describes the publish workflow. The first production signed run is still in progress; see the note under Publish a signed graph.

GitHub will credit you with commits you did not write.

GitHub links a commit to any account that has added the email on it. Adding an email needs no mailbox proof. So a naive tool can be gamed by claiming a stranger's email and pulling in their commits. everycommit only counts a commit as verified if GitHub links it to one of your accounts and the email is verified on that account, or is that account's own noreply address. Everything else is self-reported, on its own line, never added to the verified total.

1. XAdd any email, no proof needed.GitHub links commits with that email to the account.
2. XClaim a stranger's history.A naive tool counts those commits as yours.
3. ✓The fix: prove the account, verify the email.Each account is proven by its own token, and the token's owner has to match the login.

Read the full honesty rules in the README

Two commands. Your real graph.

$ npx everycommit init
$ npx everycommit collect --use-gh-cli --svg activity.svg

Requires Node 22+ and the GitHub CLI logged in to each account (gh auth login), with the user:email scope so everycommit can see which emails each account has verified (gh auth refresh -s user:email).

Put it on your profile.

Drop the static SVG in your README, or embed the web component with the same 3-step reveal from the video.

![My contributions](https://<you>.github.io/activity/activity.svg)

<script type="module" src="https://<you>.github.io/activity/every-commit.js"></script>
<every-commit src="https://<you>.github.io/activity/activity.json" attestation-repo="<you>/activity"></every-commit>

Publish it so anyone can check it.

First production signed run in progress. Until it passes end to end, treat signing as the publish workflow, not a verified result.

The publish workflow signs activity.json and the SVG with GitHub artifact attestations, so anyone can check a published graph instead of taking a screenshot on trust. It is the workflow, described here; the first live run has not been verified yet.

1. 1. Create a public repo.For example <you>/activity. It only ever holds per-day counts.
2. 2. Add the config and the workflow.Add everycommit.config.json and copy examples/caller.yml to .github/workflows/everycommit.yml.
3. 3. Add one read-only token per account, enable Pages, run it.Save them as repo secrets EVERYCOMMIT_TOKEN_1, EVERYCOMMIT_TOKEN_2, and so on.

$ npx everycommit verify activity.json --repo <you>/activity

Publish a signed graph, in the README

Give this to your agent.

Most people will not run the commands themselves. They will paste a prompt into their AI coding agent and let it do the setup. Copy this one, replace <you> with your GitHub username, and paste it in.

Set up everycommit for me. everycommit is an open-source CLI (MIT, zero dependencies, Node 22+) that builds one honest contribution graph across all my GitHub accounts: every branch, deduplicated by SHA, with faked commits filtered out.

Do this:

1. Install and run it locally first. Run `npx everycommit init`, then `npx everycommit collect --use-gh-cli --svg activity.svg`. It reads my existing gh logins on this machine. It needs read-only tokens only and never writes to any repository.

2. Include every GitHub account I own. A commit counts as verified only when GitHub links it to an account I proved with that account's own token, and its email is verified on that account (or is that account's own noreply address). Everything else is self-reported and must stay on its own line, never added to the verified total.

3. If one of my accounts is a work account whose employer restricts third-party tools, use `scanRepos: false` for that account. That proves I own the account and counts its GitHub calendar without listing or reading its repositories.

4. Publish a signed graph so anyone can check it. Create a public repo `<you>/activity`, add `everycommit.config.json`, copy `examples/caller.yml` from the everycommit repo to `.github/workflows/everycommit.yml`, save one read-only token per account as repo secrets `EVERYCOMMIT_TOKEN_1`, `EVERYCOMMIT_TOKEN_2`, and so on, enable GitHub Pages, and run the workflow.

5. Verify it before you claim it works. Run `npx everycommit verify activity.json --repo <you>/activity` and show me the result. Do not tell me the graph is signed or verified until that command passes. If it fails, show me the exact error and stop.

6. Put it on my profile. Add the static SVG to my profile README with `![My contributions](https://<you>.github.io/activity/activity.svg)`, or embed the web component with the same 3-step reveal:
   `<script type="module" src="https://<you>.github.io/activity/every-commit.js"></script>` and `<every-commit src="https://<you>.github.io/activity/activity.json" attestation-repo="<you>/activity"></every-commit>`

Rules for the whole job:

- The output is per-day counts only. It must never contain repo names, logins, emails, commit messages, or file contents. Private repo names never leak.
- Do not invent numbers. Use only the totals the tool itself outputs. Never claim a star count, download count, or trending rank.
- The claim is narrow: verified, not faked. Never describe it as a productivity metric. It proves the squares are real. It says nothing about whether the work was good.
- Report back with the verified total, how many accounts were included, and the `verify` result. If anything is unverified, say so plainly instead of filling the gap.

What the other options do.

Will this leak my work repos?

No. The output is per-day counts. Private repo names never appear in the output.

For a work account whose employer restricts third-party tools, scanRepos: false proves you own the account and counts its GitHub calendar, without listing or reading its repositories.

Try to fake it.

Found a way to fake a graph that gets past these checks? Report it privately. See SECURITY.md in the repo. That is the feedback I want most.