ado-exporter

Prometheus exporter for Azure DevOps work items, pull requests and branches — plus, optionally, the same for a GitHub repo. Useful if you want an ADO board watched from Grafana alongside everything else, or want a single cross-project view that an ADO board itself can't give you (a board can only ever show its own project).

Why branches are here

The board tracks work items. It never tracks the other place work hides: a branch. A merged branch nobody deleted and an unmerged branch nobody finished look identical in any repo listing, and neither is a work item.

merged is the label the cleanup decision turns on. merged="true" means every commit on the branch is already in the default branch — it has landed, and deleting it loses nothing. merged="false" means it still holds work the default branch doesn't have. ahead="-1" with status="unknown" means the comparison failed — that branch is deliberately never counted as merged, since that's the direction that would talk someone into deleting unfinished work.

Metrics

ado_work_item_info carries the title as a label on purpose — that's what makes a sortable, clickable table panel possible in Grafana, and it's safe at ~100 items. If your board holds thousands, drop the title label and join on id in Grafana instead.

Forks and archived GitHub repos are skipped by default (a fork carries its upstream project's whole branch list, which isn't your work and drowns out what is) — set SKIP_FORKS=0 to include them.

Config

Both the ADO PAT and the GitHub token arrive as read-only bind mounts, never environment variables — anything in a container's env is readable via docker inspect.

The failure mode worth knowing about

A GitHub token that can list repos but not read their contents does not fail loudly. The listing looks healthy and every private repo reads as zero branches and zero PRs — "0 unmerged branches" looks like good news and actually means blindness. This exporter checks a contradiction instead: a repo that has ever been pushed to has at least one branch, so pushedAt set with no readable branches means github_read_ok 0 / github_read_problem rather than silently reporting zero. If you hit it, your token needs the whole repo scope (classic) or Contents+Pull requests+Metadata:Read (fine-grained) over the repos in question.

Tests

python3 test_exporter.py

Offline, no network. Covers label escaping, Done exclusion from the open table while still counting in totals, tag counts not being inflated by closed items, parentless issues rolling up as (no epic), age-in-days as the series value, and the GitHub half: forks excluded, merged/unmerged branch classification, and every GitHub failure mode reporting github_read_ok 0 rather than raising.

Build

docker build -t ado-exporter:latest .

Run

docker run -d --name ado-exporter --restart unless-stopped \
  -p 9823:9823 \
  -v /path/to/ado-pat:/run/secrets/ado-pat:ro \
  -e ADO_ORG=https://dev.azure.com/your-org \
  ado-exporter:latest

Scrape :9823/metrics with Prometheus.