| name | pick-abandoned-repository |
| description | Use this skill to pick exactly one GitHub repository
that needs a refresh: scan a given list of owners,
collect signals of neglect — long stretches without
commits, failing or absent CI runs on the default
branch, outdated or vulnerable dependencies — score
every candidate, and pick the single most neglected
repository. If every repository looks reasonably
fresh, still pick one — the least fresh of the
bunch — because the contract of this skill is to
always end with exactly one repository chosen. One
repository per run, then stop.
|
Treat the input as a list of GitHub account names —
the OWNERS — supplied by the user or read from the
current context; refuse to run if no owners are
given, and do not invent owners from memory.
Use the gh CLI for every read against GitHub, so
authentication, rate limits, and pagination are
handled by the official tool rather than by ad hoc
HTTP calls.
List the public, non-archived, non-fork repositories
of each owner (for example with
gh repo list <owner> --no-archived --source --visibility public --limit 1000 --json name,pushedAt,defaultBranchRef,isTemplate,description,repositoryTopics),
and discard mirrors, template repos, and repos
whose description or topics mark them as
deprecated, read-only, or moved.
Collect three independent staleness signals for
every surviving repository, and treat each missing
signal as zero rather than as a reason to abort —
the skill must still produce a pick.
Signal one — commit recency: read the timestamp of
the last commit on the default branch (for example
with gh api repos/<owner>/<repo>/commits?per_page=1)
and record the number of days since that commit.
Signal two — CI health: list the latest run on the
default branch for every workflow registered in
the repository (for example with
gh run list --repo <owner>/<repo> --branch <default> --limit 50 --json conclusion,status,workflowName,createdAt),
and record whether the latest run of each workflow
is success, failure, cancelled, timed_out,
or absent because no workflow has ever run.
Signal three — dependency staleness: detect the
primary package manifest in the repository
(package.json, pom.xml, Cargo.toml,
requirements.txt, pyproject.toml, go.mod,
Gemfile, composer.json, and similar), count
open Dependabot or Renovate pull requests older
than thirty days, and count open dependency
security advisories (for example via
gh api repos/<owner>/<repo>/dependabot/alerts).
Compute a neglect score for each repository by
summing the signals: one point per thirty days
since the last commit, five points if the latest
CI run on the default branch is failing, three
additional points per extra failing workflow, two
points per open Dependabot or Renovate PR older
than thirty days, and one point per open security
advisory.
Rank the repositories by descending neglect score,
so the most abandoned repository sits at the top
of the list.
Pick the single highest-scoring repository as the
result, and break ties by the longest interval
since the last commit, then by the highest count
of failing workflows, then by the lowest
alphabetical <owner>/<repo> name.
If every repository scores zero — recent commits,
green CI everywhere, no stale dependency PRs, no
advisories — still pick one repository: take the
one with the oldest last-commit timestamp among
the survivors, because the skill must always end
with exactly one pick.
If two or more repositories tie at zero on the
oldest commit as well, break the tie by the
fewest stars, then by the lowest alphabetical
<owner>/<repo> name, so the choice is
deterministic and the skill still ends with a
pick.
Stop the selection at exactly one repository — do
not shortlist, do not "queue up" several, do not
return a ranked list — the contract of this skill
is one pick per run.
Report the chosen repository as <owner>/<repo>
together with a short factual summary of the
signals that led to its selection: days since the
last commit, state of the latest CI run on the
default branch, count of open stale dependency
PRs, and count of open security advisories.
Do not open a pull request, do not create a branch,
do not edit any source file, do not post any
issue or comment, and do not run any build as
part of this skill — picking a repository is the
only output, and any follow-up refresh work
belongs in a separate run of a different skill.
Do not pick a second repository in the same run,
even if the first one turns out to be unsuitable
after inspection; re-run this skill from the top
instead.
