How to Check a Development Team's GitHub Activity

An agency’s sales deck is written by its most senior people. Its commit history is written by the people who will actually build your product. The distance between those two authors is where most outsourcing projects go wrong, and it is why learning how to check developer github activity belongs in every serious vendor evaluation.

Portfolios can be curated in an afternoon. Case studies can be rewritten, logos borrowed, and team pages padded with contractors. A repository is much harder to dress up, because commits carry timestamps, authors, messages, and a sequence of decisions that either reflects disciplined engineering or doesn’t.

The problem is that most buyers look at the wrong things. They count green squares, glance at star counts, and assume a busy profile means a capable team. Neither metric tells you whether the engineers pitched on the sales call are the ones writing the code, or whether that code is reviewed before it ships.

This guide covers a practical method: reading commit cadence, judging message quality, assessing branch protection and hygiene, and verifying who actually commits versus who was sold to you. It also covers the limits. For anyone working out how to check developer github activity across a shortlist of agencies, the most important caveat comes first: most professional work never appears in public.

GitHub’s page is dated June 2026 and cites Gartner’s updated forecast. Gartner’s own press release from 2024 used an earlier figure: by 2028, 75% of enterprise software engineers will use AI code assistants, up from less than 10% in early 2023. If your editor requires linking directly to gartner.com, use that version instead. 

That single number reframes the exercise. A thin public profile is not a red flag on its own, because an agency doing client work under NDA will naturally show little. What matters is the quality of whatever is visible, and whether the agency can grant you controlled access to more.

What Is Developer GitHub Activity Review?

Developer GitHub activity review is the process of examining a team’s commits, pull requests, branches, and contributor records on GitHub to assess engineering discipline, verify who writes the code, and identify delivery risks. It is a technical due diligence step used when vetting software agencies, freelancers, or in-house candidates before signing a contract.

It is not a full code audit. In practice, knowing how to check developer github activity means reading patterns rather than totals, and tying those patterns to specific people.

The Core Problem: Buyers Are Sold One Team and Handed Another

Agency sales cycles are built around senior talent. A principal engineer or solutions architect joins the discovery call, answers architecture questions well, and signs off on the estimate. Once the contract is signed, delivery often moves to a mid-level or junior team the buyer has never met.

This pattern, commonly called bait-and-switch staffing, rarely shows up in the first sprint. It tends to surface 6–10 weeks in, when velocity drops, pull requests pile up unreviewed, and estimates slip by 30–50%. By then a buyer has typically spent 25–40% of a $40,000–$120,000 build budget, and switching vendors means paying for onboarding and code comprehension all over again.

References and portfolios rarely catch this. A technical reference check speaks for a project that may have been staffed differently, and a portfolio shows outcomes, not the people who produced them. That is the practical case for learning how to check developer github activity: it is one of the few places where actual contributors leave a verifiable trail.

The second problem is misreading that trail. A dense activity grid can come from automated commits, dependency bots, or one engineer pushing to 12 repositories. Anyone researching how to check developer github activity should treat raw volume as noise until it is tied to specific people, repositories, and patterns.

How to Check Developer GitHub Activity: A Practical Walkthrough

The process below works whether you are assessing an agency, a staff augmentation vendor, or a shortlisted freelancer. Each step takes 10–30 minutes. A full review, done properly, needs about 2–3 hours per vendor, which is why learning how to check developer github activity efficiently matters when you have four or five finalists.

1. Request the right access. Agree upfront on which repositories, samples, or pilots you can review.
2. Map contributors to the proposed team. Confirm the pitched engineers actually appear in the history.
3. Read cadence over 60–90 days. Look for steady, small commits rather than bursts.
4. Judge commit message quality. Specific, scoped messages signal disciplined engineering.
5. Inspect branches and pull requests. Check for protected main branches and real review threads.
6. Check CI and test signals. Confirm automated tests run on every pull request.
7. Weigh open source work as a bonus. Treat it as supporting evidence, not proof.
8. Convert anomalies into questions. Use every oddity as a direct question in the next call.

Start With Access, Not Assumptions

Most agencies will not hand over client code, and they should not. Before you review commit history vendor teams offer, agree on what you can actually see: a public GitHub organization account, a sanitized internal project, open source libraries the team maintains, or a screen-shared walkthrough of a past repository with client permission.

If none of these exist, ask for a paid pilot of 1–2 weeks in a repository you own. At $2,000–$6,000 for most teams, it is the cheapest vetting spend available. Knowing how to check developer github activity pays off most here, because you are watching the team work in real time rather than reading history.

How to Verify Who Actually Writes an Agency’s Code

The Contributors view under a repository’s Insights tab lists every account that has committed, with commit counts and activity over time. Cross-reference those usernames against the names on the proposal. If three of the five pitched engineers have no presence in any sample repository, ask about it directly.

Look at the proportion of commits, too. When one account authors 70% or more of the work, the team lacks distributed code ownership, and the “team of six” may effectively be one senior developer plus support. Check account age, other organizations each contributor belongs to, and whether commit timestamps match the agency’s stated time zone.

Also scan for Co-authored-by trailers and commits where author and committer differ. These can indicate pair programming, but they can also reveal subcontracted work pushed through an employee’s account. Part of understanding how to check developer github activity is accepting that the name on a commit and the person who wrote it are not always the same.

What Does a Healthy Commit History Look Like?

Context changes everything here. The commit frequency meaning for a five-person product team differs from that of a solo library maintainer, so judge cadence against team size and project phase.

A healthy active team typically commits 4–5 days a week, clustered around working hours for its stated location, with most individual commits changing fewer than 300 lines. Pull up the contribution graph and commit list for the last 60–90 days rather than the last week. Anyone applying how to check developer github activity to a single sprint will be fooled, because any team can look busy for two weeks.

Watch for three distortions. Long silences followed by 5,000-line commits before a demo suggest work happening elsewhere. Perfectly uniform daily commits, including weekends and holidays, often point to automation or padding. Saturday-only bursts can mean the repository is a side project, not the team’s main work.

Commit Messages, Branches, and Review Quality

Commit messages are a team’s running explanation of its own decisions. Strong ones are specific and scoped, such as “fix: handle expired token in refresh flow (#142),” and many teams follow conventional commits formatting that ties changes to tickets. Weak histories are full of “update,” “changes,” “wip,” and “final fix 2.”

Branch structure tells a similar story. Look for a protected main branch, feature branches that live 1–5 days, and merges only after review. A repository with 40+ stale branches untouched for 6 months, or regular force-pushes to main, points to informal code management.

Open several merged pull requests and read the threads. Substantive comments about edge cases, naming, and test gaps signal genuine pull request review. Approvals within 2 minutes on 800-line changes signal the opposite. For many buyers, this becomes the most revealing part of how to check developer github activity, since review quality predicts defect rates better than commit volume.

CI, Tests, and Open Source Signals

Check the Actions tab or workflow files for a CI/CD pipeline that runs tests on every pull request. Green checks on most merged PRs, dependency updates handled within weeks rather than months, and a visible test directory are baseline expectations for any team billing $40–$80 per hour.

Treat the open source contributions agency engineers have made as supporting evidence, not proof. A merged pull request to a React Native or Django library in your stack shows an engineer can meet an external maintainer’s standards. Fifty typo fixes in documentation repositories show far less. Knowing how to check developer github activity includes knowing which public work actually carries weight.

Warning Signs Worth a Direct Question

Anomalies are not verdicts. The repo activity red flags below do not disqualify a vendor on their own, but each deserves a direct question before contract signature:

• Proposed team members with no commits in any shared repository
• One contributor responsible for 70% or more of all commits
• Large, infrequent code dumps paired with vague messages
• No pull requests at all, or PRs approved without a single comment
• Commit timestamps inconsistent with the agency’s stated location
• Sample repositories created only 2–4 weeks before the pitch

A vendor with good answers usually explains these quickly and specifically. Vague or defensive responses are more informative than the anomaly itself. Teams that have mastered how to check developer github activity use these questions to test candor as much as code, alongside the broader red flags in a software development company.

Case Studies: How to Check Developer GitHub Activity in Vendor Selection

Series A fintech, three-agency shortlist. A payments startup evaluating partners for a $90,000 mobile rebuild asked each finalist for a sanitized sample project. In one repository, 81% of commits came from a single account not listed on the proposal. The agency confirmed the work had been subcontracted, and the startup chose another finalist, avoiding a staffing dispute likely to surface 2–3 months into the build.

Mid-market logistics enterprise, no public code. The procurement team knew how to check developer github activity but found its preferred agency had almost no public repositories. Rather than disqualifying it, the team funded a 2-week pilot in its own repository for $4,500. The review showed daily pull requests, peer review on every merge, and commits from all four proposed engineers; the full engagement closed its first milestone 9 days early.

Decision Framework: Ranking GitHub Signals Hiring Developers Should Trust

Not every signal deserves equal weight. The table below ranks the github signals hiring developers most often rely on by how much they should influence a decision, which keeps a review from turning into a count of green squares.

Weight contributor mapping and review quality highest, since they speak directly to who builds your product and how carefully. Buyers applying how to check developer github activity to a shortlist should score each agency on these five rows and compare totals, not impressions, as part of a practical buyer framework.

This works best as one layer of vendor vetting, not the whole process. Marketplaces such as GetProjects verify an agency’s website, email domain, reviews, and team details before its profile goes live, which narrows the field first. The repository check then tests what profile verification cannot: how the team actually works.

What Most Teams Get Wrong

The most common mistake is treating GitHub as a scoreboard. Buyers reward agencies with large public profiles, high star counts, and busy activity grids, then feel misled when delivery disappoints. Public popularity measures marketing effort as much as engineering quality.

The second mistake runs the opposite way: disqualifying agencies with thin public profiles. With most contributions happening in private repositories, a strong team doing NDA-bound client work may show almost nothing. Understanding how to check developer github activity includes knowing when absence is normal and asking for a pilot instead.

The third mistake is reviewing the repository once and never again. Often the most valuable moment to apply how to check developer github activity comes after signing, during the first 30 days, when you can confirm the pitched engineers are committing to your codebase. Make repository access and weekly contributor visibility a contract term, not a favor.

Finally, buyers overweight code and underweight conversation. A code review culture is visible in PR threads, but a team’s willingness to explain its anomalies is visible only when you ask. The buyers who get the most from knowing how to check developer github activity pair every finding with a direct question, added to their standard list of questions to ask a software development company.

Before You Sign, Look at the Commits

Reviewing a team’s repository takes 2–3 hours. Recovering from a mis-staffed engagement takes months and a meaningful share of your budget. 

If you are shortlisting development partners and want to start from agencies that have already passed website, domain, review, and team verification, you can post your project on GetProjects in under two minutes, get AI-matched with vetted agencies, and connect directly with no bidding and 0% commission. 

Then put what you now know about how to check developer github activity to work on your finalists before any contract is signed.

Frequently Asked Questions

Can GitHub activity be faked?

Partly. Commit dates can be backdated, scripts can generate daily commits, and profiles can be padded with forks and trivial changes. What is hard to fake is substantive review discussion, consistent contributor mapping across 3–6 months, and live behavior during a paid pilot. A reliable approach to how to check developer github activity focuses on those harder-to-manufacture signals rather than on graph density or follower counts.

How many commits per week is normal for a development team?

For active product work, 5–15 commits per engineer per week is a common range, spread across 4–5 working days. A four-person team would therefore show roughly 20–60 commits weekly. Numbers drop during architecture or discovery phases and rise during bug-fix cycles, so compare cadence against the project phase. Far more important than the count is whether commits are small, reviewed, and clearly described.

How do you review a vendor’s GitHub if all their client work is private?

Ask for alternatives: a sanitized internal project, open source libraries the team maintains, or a screen-shared walkthrough of a past repository with client consent. If none exist, a 1–2 week paid pilot in your own repository is the strongest option. Anyone learning how to check developer github activity should expect this situation often, since most professional work sits in private repositories.

How do I see who contributed to a GitHub repository?

Open the repository, go to the Insights tab, and select Contributors to see each account’s commit count and activity timeline. For a cloned repository, running git shortlog -sne lists every author by commit count and email. Compare those names and email domains against the proposal, and note any heavy contributors who were never introduced during the sales process.

Is a GitHub profile important when hiring developers or agencies?

It is one useful signal, not a deciding one. A GitHub review shows engineering habits, while references show client relationships and a pilot shows real delivery. Treat how to check developer github activity as part of a broader evaluation that also includes technical interviews, contract terms, and team continuity commitments. Overweighting any single source, public profiles included, tends to reward presentation over capability.

What should I do if a GitHub review raises concerns?

Turn each concern into a specific question and give the vendor a chance to explain. If answers are vague, request a short paid pilot or move to the next finalist. Buyers who apply how to check developer github activity early usually keep 3–4 verified options in play, so one weak result does not stall the project. Starting from a pool of pre-verified agencies makes replacing a finalist much faster.