Repo brief: stashapp/stash

Generated by RepoPilot · document generated 2026-09-16 · concise human review Evidence snapshot · analyzed 2026-09-16T09:20:37.158Z · commit 01a7583364b9

Verdict

Mixed — Evidence incomplete — review before adopting

• Last commit 2d ago
• 11 active contributors
• Distributed ownership (top contributor 29% of recent commits)
• AGPL-3.0 licensed
• 1 more receipt on the live page

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests

What it is

Stash is a self-hosted Go webapp that organizes, catalogs, and serves video/image collections with metadata enrichment from the internet via community-built plugins. It provides tagging, searching, performer/studio/tag statistics, and supports extensible scraping to automatically gather information about content from multiple sources. Monorepo: cmd/stash/ contains the main Go server entry point, cmd/phasher/ is the video hashing utility. Frontend is TypeScript in an unspecified ui/ directory (SCSS + TypeScript, 2.8M LOC). pkg/ likely contains shared Go libraries. Docker builds under docker/ with x86_64 and CUDA variants. Uses .gqlgenc.yml for GraphQL code generation and .mockery.yml for…

Start here

Open these first:

• cmd/stash/main.go — Application entry point that initializes the server, configuration, and all subsystems—every contributor must understand…
• graphql/schema/schema.graphql — Root GraphQL schema definition that defines the entire API surface; changes here ripple across code generation and client…
• go.mod — Dependency manifest with Go 1.25.0 requirement; critical for build reproducibility and understanding external library…
• internal/api/authentication.go — Core authentication logic that gates access to the API; foundational for security posture.
• .github/workflows/build.yml — CI/CD pipeline that defines how code is tested, built, and released; understand this to trust build outputs.

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

git clone https://github.com/stashapp/stash.git && cd stash && make (builds Go binary). For dev setup: review docs/DEVELOPMENT.md. Docker users: docker build -f docker/build/x86_64/Dockerfile . or use docker-compose fro…

Daily commands:

make (default target builds stash binary). Cross-compile: available via Makefile targets. Docker: docker build -f docker/build/x86_64/Dockerfile . then docker run. Dev server likely started via make run or ./stash once…

…shortened for this brief.

Key cautions & unknowns

• AGPL-3.0 is copyleft — check downstream compatibility
• Could not verify tests from the available repository evidence
• Database migrations: golang-migrate/migrate is required for schema changes; old migrations are immutable. GraphQL generation: changes to GraphQL schema (.graphql files, location inferred) require running gqlgen…
• Published-advisory coverage was unavailable for the captured dependencies.
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.