// Refresh the coverage badge in the root README by running the repo's coverage script and rewriting the `` line. Sibling of `updating-security` / `updating-lockstep` under the `updating` umbrella.
Propagate a wheelhouse template change to every fleet repo (or a registry-pin chain to every dependent repo). Packages the canonical fleet-repo list, the FLEET_SYNC=1 sentinel pattern, the worktree-per-repo loop, push-direct + PR-fallback, and worktree-cleanup that survives mid-loop crashes. Use when a wheelhouse template SHA needs to land in every fleet repo, when a registry pin chain needs propagation, or when batching multiple template SHAs into one cascade wave.
Sweeps a fleet repo (or every fleet repo) for redundant CI surface — orphan workflow YAML files (lint.yml / check.yml / type.yml / test.yml that the unified ci.yml replaced), GitHub-Dependabot auto-fix PRs that the fleet handles via /updating-security, and stale workflow run history in the Actions sidebar. Deletes the YAML files, disables Dependabot automated-security-fixes via gh api, and reports anything that needs a manual UI toggle. Once-and-never-again sweep — meant to leave a repo clean.
Scans the codebase for bugs, logic errors, cache races, workflow problems, insecure defaults, security regressions in the diff, and variant analysis on prior findings. Spawns specialized Task agents per scan type, deduplicates findings, and produces an A-F prioritized report. Use when preparing a release, investigating quality issues, running pre-merge checks, or whenever a recent diff touches security-sensitive code.
Resolve open GitHub Dependabot security alerts on a fleet repo. Fetches alerts via `gh api`, applies fixes (direct dep bump, pnpm override for transitives, or principled dismissal for unfixable), validates with `pnpm run check`, commits per-alert, and reports remaining advisories. Sibling of `updating-lockstep` under the `updating` umbrella.
Umbrella update skill for a Socket fleet repo. Runs `pnpm run update` (npm), validates `lockstep.json` via `pnpm run lockstep` (if present), optionally bumps submodules, checks workflow SHA pins, resolves open Dependabot security alerts, refreshes the README coverage badge when applicable, and audits GitHub repo + Actions settings drift via `scripts/lint-github-settings.mts`. Use when asked to update dependencies, sync upstreams, fix security advisories, refresh coverage, or prepare for a release.
Audits a repo's GitHub Actions permissions + allowlist against the fleet baseline. Reports drift only — fixes are manual in Settings → Actions because flipping these silently is unsafe. Use when a CI failure looks like "action X is not allowed to be used", when onboarding a new fleet repo, or as a periodic fleet-wide health check.
| name | updating-coverage |
| description | Refresh the coverage badge in the root README by running the repo's coverage script and rewriting the `` line. Sibling of `updating-security` / `updating-lockstep` under the `updating` umbrella. |
| user-invocable | true |
| allowed-tools | Read, Edit, Bash(pnpm run cover:*), Bash(pnpm run coverage:*), Bash(pnpm run test:cover:*), Bash(node:*), Bash(git:*), Bash(jq:*), Bash(cat:*) |
Runs the repo's coverage script and rewrites the README badge so the published number matches reality. Invoked directly via /update-coverage or as a phase of the updating umbrella.
updating umbrella flow when the repo declares a
coverage script.package.json, the skill reports that and exits.README.md is
rewritten. Nested READMEs under packages/* have their own
badges and lifecycles.| # | Phase | Outcome |
|---|---|---|
| 1 | Discovery | Find the coverage script in package.json (cover / coverage / test:cover, in that preference). |
| 2 | Run | pnpm run <script>. Capture stdout. Fail loudly if the run errors. |
| 3 | Parse | Extract the percentage. Two paths — read coverage/coverage-summary.json if present, otherwise scrape All files | ... line. |
| 4 | Rewrite | Replace the <PCT> in the README badge URL with the parsed value (two decimals). |
| 5 | Commit | docs(readme): refresh coverage badge to N.NN%. Direct-push per fleet norm. |
node -e '
const p = require("./package.json").scripts ?? {};
for (const name of ["cover", "coverage", "test:cover"]) {
if (p[name]) { console.log(name); process.exit(0); }
}
process.exit(1);'
If no matching script exists, the skill emits no coverage script found and exits cleanly (this is not a failure mode — many fleet repos don't track coverage).
pnpm run <SCRIPT>
Use the standard pnpm runner so we pick up the repo's own env config (catalog versions, etc.).
Preferred path — read coverage/coverage-summary.json (vitest / istanbul format):
jq -r '.total.lines.pct' coverage/coverage-summary.json
The number is a float with one decimal place. Two decimals is the canonical badge format — pad with .00 when needed.
Fallback path — scrape the All files | ... line from coverage stdout:
pnpm run cover | tee /tmp/cover-output.txt
awk -F '|' '/^All files/ { gsub(/ /, "", $2); print $2 }' /tmp/cover-output.txt
Whichever column the tool prints first (statements vs lines) is acceptable — the badge is approximate by design. Document the column choice in the commit message.
The canonical badge line in README.md is:
Use the Edit tool to replace the <PCT> placeholder with the actual percentage. The %25 is URL-encoded %; leave it alone.
If the README has been canonicalized but the badge still reads <PCT> (e.g. just-canonicalized by the readme-skeleton work), Phase 4 substitutes; otherwise the existing number is replaced.
git add README.md
git commit -m "docs(readme): refresh coverage badge to <N.NN>%"
git push origin <default-branch>
Direct-push per the fleet's Commits & PRs → Push policy rule; fall back to PR if the remote rejects.
When called via /update-coverage, emit a one-line summary:
updated coverage badge: 96.42% → 97.18% (source: coverage/coverage-summary.json)
When no coverage script exists or the percentage is unchanged, exit silently.
.claude/skills/updating/SKILL.md — umbrella that calls this skill when applicable..claude/skills/updating-security/SKILL.md — sibling under updating.template/README.md — canonical README skeleton ships the placeholder badge.