GitHub Trending Top 10: Code review pipelines, worktree isolation, and plugin provenance (Sep. 13–20, 2026)

The GitHub Trending board for September 13–20 asks one question ten times. Now that a model writes the code, who checks it, where does it run, and under what terms may you take the tool that does either? Three of this week's ten repositories package the instructions an agent follows, three put a boundary around the machine it works on, two gate what it produces, one is the agent itself, and one — a browser globe built from public feeds — belongs to none of those groups.

The ranking below is GitHub's own weekly Trending view, captured on September 20, 2026 at 8:01 p.m. ET. "Stars this week" is the gain GitHub attributes to the trailing seven days, and "stars captured" is the running total at that same moment. Both measure attention, and production readiness is a separate question. Each entry closes on the adoption boundary that decides the star: a license, a provider key, a harness, or a backlog. 1

Current signal: Rank 1 with 15,504 stars this week and 38,392 captured, the largest gain on the board. v1.12.7 was tagged on September 19, against 108 open issues and 136 open pull requests. 123

Problem solved: An agent reviewing a large changeset covers some files and skips others, reports findings against line numbers that have moved, and changes its standards when the prompt is reworded. 2

Implementation: The Go CLI ocr splits the job between a deterministic pipeline and a model. The pipeline selects files, bundles related ones into one review unit, matches rules per file, and re-checks every comment through positioning and reflection modules. The model reads whole files, searches the repository, and writes the finding. ocr review covers workspace diffs, branch ranges, and single commits, and a delegation mode hands the reviewing to an agent you already pay for. 2

Differentiation: The published benchmark covers 50 repositories, 200 real pull requests, 10 languages, and 1,505 issues annotated by more than 80 engineers. On that set the project reports higher precision and F1 than a general-purpose agent at roughly one-ninth the tokens. 4

Verdict: Star it for review output that behaves the same way twice. The lower recall leaves defects for a human reviewer, and the tool needs a model endpoint of its own or delegation to an agent. Apache-2.0 makes a CI trial cheap. 5

Current signal: Rank 2 with 2,342 stars this week and 147,128 captured. Three releases landed inside the window, ending with v2.1.278 on September 18, against more than 5,000 open issues and 704 open pull requests. 167

Problem solved: Terminal-first coding work with an agent that reads a repository, runs commands, and handles git operations on request. This repository holds the tool's releases, plugins, and bug reports. 6

Implementation: The CLI installs from a shell script, Homebrew, or WinGet, and npm installation is now marked deprecated. Thirteen plugins sit in plugins/, among them code-review, pr-review-toolkit, security-guidance, feature-dev, and hookify. The README discloses that Anthropic collects usage data, including acceptance decisions and /bug feedback. 68

Differentiation: Claude Code competes with IDE agents such as Cursor and GitHub Copilot on the terminal and on pull-request mentions. The repository works as a distribution channel: the compiled binary is what a developer runs, and the plugin folder is the extension surface. The license file reads "© Anthropic PBC. All rights reserved." 69

Verdict: Star it to follow releases and to lift plugin patterns into agents of your own. Nothing here can be forked or self-hosted, and a five-thousand-issue backlog is where support arrives from. 9

Current signal: Rank 3 with 6,453 stars this week and 263,742 captured, the largest total on the board. The README documents the 2.2 line; the release feed's newest tag is v2.2.1 from September 8, with commits through September 20. This project also appeared on this list for the week of September 6–13. 11011

Problem solved: The harness around a coding agent accumulates subagents, skills, hooks, and rules until nobody can say which configuration is installed or whether a given check still runs. 10

Implementation: Setup is manifest-driven across Claude Code, Codex, and Kimi Code, with a doctor, repair, and uninstall cycle. The 2.2 line added Plan Canvas for reviewing plans in the browser, a memory vault behind ecc memory, Antigravity support, and a packed-artifact release gate. Inside sit 68 subagents, 292 skills, and 94 command shims, with hooks that enforce checks outside the prompt and AgentShield, which scans the harness itself as an attack surface. 10

Differentiation: ECC's comparison table sets its artifacts — editable plans, a memory vault, gate evidence — against the chat history most harness setups rely on. The README also warns that third-party mirrors may carry malware. 10

Verdict: Star it if you run more than one harness and want the setup reproducible. Parity runs deepest on Claude Code, and install-channel hygiene has become part of using this project at all. 1011

Current signal: Rank 4 with 5,242 stars this week and 28,000 captured. v0.8.0 shipped on September 3, with commits through September 20 against 316 open issues and 313 open pull requests. 11213

Problem solved: A company's documents sit in Office files, chat threads, and wiki spaces, and making them queryable by an agent usually means a hosted service that holds the data or a retrieval stack of four components. 12

Implementation: WeKnora is a Go platform with swappable model, vector-store, and storage backends. It parses Office files, PDFs, images, audio, and XMind, connects to WeCom, Feishu, Slack, Telegram, Notion, and GitLab, and exposes an MCP server. Version 0.8.0 added a skill sandbox runtime on Docker, E2B, or Cube with per-tenant network policy, a tenant skill catalog, and memory that persists across sessions. 1213

Differentiation: Its answer to the self-hosted retrieval field is governance furniture: four-tier workspace roles, per-knowledge-base audit trails, scoped API keys, and private-cloud deployment that keeps data inside the tenant. Version 0.8.0 removed the local host-process sandbox backend outright. 13

Verdict: Star it if you need retrieval over company documents that stays on your own infrastructure. Operationally, 313 open pull requests mean upgrade tracking and sandbox backends that change between minor versions. The license is MIT, with third-party notices listed separately. 14

Current signal: Rank 5 with 3,986 stars this week and 97,697 captured. 0.6.10 shipped on September 17, the newest commit landed on September 20, and the repository holds 55 open issues and 55 open pull requests. It last appeared on this list in June. 11516

Problem solved: Coding agents take the shortest path to a working diff, which means skipping the spec, the tests, and the review that keep a codebase maintainable. 15

Implementation: The pack carries 25 skills — 24 across the software lifecycle plus a meta-skill that routes work to the right one — behind nine slash commands from /spec to /ship. Every skill ships steps, verification gates, and anti-rationalization tables built on published engineering practice. A /build auto mode runs every task after a single approval while keeping the test-first loop, and installation runs through npx skills add, which writes into more than 70 agents. 15

Differentiation: A published comparison sets it against the two collections developers bring up most: agent-skills covers the whole lifecycle with a human checkpoint per phase, Superpowers goes deeper on autonomous runs, and Matt Pocock's set distills one expert's daily loop. 17

Verdict: Star it to put a process behind each phase of the work. The value tracks how reliably your agent routes to the skills, which is why the project ships routing and behavioral evals alongside the catalog. 17

Current signal: Rank 6 with 1,298 stars this week and 25,283 captured. The repository carries no tagged releases, its newest commit landed on September 18, and it holds 70 open issues under Apache-2.0. 11819

Problem solved: A general assistant gives inconsistent answers to role-specific work — pipeline reviews, contract triage, journal entries — because it knows neither which tools a team uses nor how that team likes the work done. 18

Implementation: Eleven plugins cover productivity, sales, customer support, product management, marketing, legal, finance, data, enterprise search, bio-research, and plugin management itself. Each plugin is a folder of markdown and JSON: a manifest, an .mcp.json for connectors, slash commands, and skills. Teams install from Cowork or with claude plugin marketplace add. 18

Differentiation: These are Anthropic's own role-shaped packages, and the repository positions them as starting points a company edits: swap the connectors, add local terminology and process, adjust the workflows. They complement the developer-facing plugins in the Claude Code repository. 18

Verdict: Star it if you are rolling these assistants out to teams whose work is writing, review, and reporting. Two boundaries: generic plugins only get useful once a team tailors them, and every connector needs its own account and scopes. 19

Current signal: Rank 7 with 8,111 stars this week and 39,645 captured. v0.1.1 shipped on September 1, commits ran through September 20, and the repository holds 75 open issues and 140 open pull requests. It also appeared on this list for the week of September 6–13. 12021

Problem solved: Flight transponders, ship beacons, orbital elements, seismographs, and public cameras all publish data, and each arrives in its own viewer. God's Eye View fuses them onto one globe a reader can fly through, click into, and ask questions about. 20

Implementation: Vanilla JavaScript, CesiumJS, and Vite render the scene on Google's photorealistic 3D tiles. Fifteen layers, thirteen with a keyless path. Satellites propagate from SGP4 elements, aircraft and ships render one interval behind real time and interpolate between fixes, and a server-side proxy brokers every private key, so the browser holds only short-lived tokens. Twenty-eight voice tools drive the camera, annotations, and layer queries. 20

Differentiation: One-click installation through Pinokio, a keyless first boot, and in-app provider settings arrived with the 0.1.x releases. The README also states what the data cannot carry: road traffic is simulated over real geometry, camera poses and rocket trajectories are coarse estimates, and the project warns against using the globe for navigation or emergency response. 2022

Verdict: Star it as a reference for fusing public feeds into one inspectable client. The maintainers describe it as an evolving client, and each bundled feed keeps its own terms. 2223

Current signal: Rank 8 with 1,242 stars this week and 23,773 captured, after appearing on this list last week. The GitHub release feed stops at v1.0.169 from June 29 while commits continued to September 20, so npm carries the current build; 132 issues and pull requests stay open. 124

Problem solved: A coding session burns its context window four ways: raw tool output, compaction that erases the memory of what was being edited, tokens spent on filler, and brevity prompts that damage reasoning while fixing the third problem. 24

Implementation: Context Mode is an MCP server with a routing block installed across 17 clients plus the OpenClaw gateway. Sandbox tools run analysis code and return only the result, which the README illustrates as 315 KB of raw data becoming 5.4 KB. A SQLite database with FTS5 indexes every file edit, git operation, task, error, and decision, and BM25 retrieval brings back what matters after a compaction. 24

Differentiation: The README refuses to police how the model writes its answer and points at a benchmark where aggressive brevity prompts degraded coding results — a contrast with the output-shaping skills that topped this list last week. 24

Verdict: Star it for the sandbox pattern: run the analysis locally and return only the answer. The adoption boundary is the license — Elastic License 2.0 permits use but bars offering the software as a hosted service, so a product team needs a closer look than an internal rollout does. 25

Current signal: Rank 9 with 822 stars this week and 8,208 captured. Releases arrived weekly through September: 0.77.0 on September 8 and 0.78.0 on September 16, with 0.79.0 tagged an hour after this window closed. 32 open issues and 8 open pull requests, under dual MIT and Apache-2.0 licensing. 12627

Problem solved: Git worktrees give each parallel agent its own working directory, and managing them from the command line still means typing a branch name three times to create one. Five agents in one repository quickly turn into guessing which directory holds which branch. 26

Implementation: Worktrunk is a Rust CLI that addresses worktrees by branch name. wt switch -c -x claude feature-auth creates the branch, the worktree, and the agent session together; wt list prints per-branch status; wt remove cleans up. Hooks run on create, pre-merge, and post-merge, wt step commit writes commit messages from the diff, and a plugin creates worktrees from inside Claude Code sessions. 2628

Differentiation: Most worktree helpers stop at wrapping git commands; Worktrunk is built around the agent workflow, with per-branch status in the picker, hooks that cover the merge path, and a Claude Code integration so a session can create its own isolated directory. 28

Verdict: Star it if you run several agents against one repository. Two boundaries: version 0.78.0 renamed the JSON keys its hooks receive, breaking scripts that read them, and shell integration is what makes directory switching work. 27

Current signal: Rank 10 with 480 stars this week and 90,894 captured — the smallest weekly gain on the board, on the largest codebase, at 117,158 commits. 2026.9.3 shipped on September 18 inside this window, against 2,642 open issues and 969 open pull requests. 12930

Problem solved: Home automation that keeps control and data on the user's own hardware. A second problem arrived with AI contributors: how a project of this size accepts work a model helped write without spending maintainer time on unreviewed output. 2931

Implementation: A Python and asyncio monorepo with a modular integration model and strict typing. The September release modernized Modbus, so users pick a device in the UI instead of writing a register map in YAML; it added cloud speech-to-text for accents and background noise, and delivered a security dashboard, a Matter network map, and 13 new integrations. The repository also now carries .claude, .gemini, and .agent directories alongside AGENTS.md and CLAUDE.md. 2932

Differentiation: The project's answer to AI-assisted contribution is a published policy: autonomous agents may not contribute, unreviewed AI output gets closed, and anyone opening a pull request must be able to explain it in their own words. Maintainers use AI for triage and review, and the policy tells contributors to treat those comments as ordinary review comments. 31

Verdict: Star it for the integration ecosystem and for the policy as a reusable pattern. A busy project wrote down where the human stays in the loop and put enforcement behind it, while the rest of this list automates that step away. 31

Verification is becoming a pipeline instead of a request. Alibaba's reviewer separates file selection from the model's judgment, ECC runs hooks and a fresh-context reviewer outside the prompt, Agent Skills gives each phase an exit criterion, and Home Assistant closes pull requests it believes were written autonomously. A check that lives inside a prompt is a check an agent can argue its way past.

Isolation has become a product surface. Context Mode sandboxes what reaches the context window, WeKnora sandboxes the skills its agents run, Worktrunk gives each agent its own worktree, and God's Eye View brokers private keys server-side so the browser holds only short-lived tokens.

License terms and install channels now weigh as much as the feature list. Context Mode ships under Elastic License 2.0, Claude Code restricts use under commercial terms, ECC warns that third-party mirrors may carry malware, WeKnora deleted its host-process sandbox backend in 0.8.0, and Home Assistant writes contribution rules into the repository. Four of those five are visible only in a license file, a changelog, or a policy document.

The artifact each project exposes is what makes its pattern reusable: a review session that exports as JSON, a path template, a skill or plugin manifest, a policy file. That artifact is usually the last thing a repository documents and the first thing worth taking.