Diagnose and apply branch protection rules across a fleet. The standard pattern: require PR review, dismiss stale reviews, restrict who can push. Common issue: "Bypassed rule violations for refs/heads/main" — this happens when direct push is used despite protection. Use when CI builds keep failing on push branches that the user didn't intend to push to directly.
Add Dependabot config to a fleet of repos, triage auto-PRs that fail CI, and manage the auto-PR lifecycle. Covers: auto-detecting lockfile ecosystem (npm/pnpm/yarn/bun/composer/pip), writing `.github/dependabot.yml` per-repo, understanding why Dependabot PRs often fail CI (peer-dep conflicts, major version bumps), and the "billing cap vs Dependabot PR" classification trick. From a real 35-repo Dependabot rollout.
Upgrade a single repo from ESLint 8 + legacy `.eslintrc.*` config to ESLint 9 + flat config (`eslint.config.js` / `.mjs`). Handles all the v9 breaking changes: dropped `.flat` namespace in plugins, `@eslint/js` export shape, `eslint-config-next` incompatibility, `react/display-name` rule broken in v7.x. Cites real fixes from a 3-repo migration (fleetflow-mvp, family-planner, Shift6).
Audit all repos in the user's GitHub fleet for CI Build and Lint workflow health. Categorizes failures into billing-cap (spending limit), dependabot-PR, cancelled-superseded, and real-source-error buckets. Use as the first step in any "fix all known issues" task — it gives a precise inventory of what's actually broken vs what's just noise. Filters by default-branch and push/schedule events to ignore PR branches.
When a fleet-wide change breaks many repos at once, roll back across all affected repos in one sweep. The pattern: identify the breaking change, find every commit that introduced it, force-revert, push. Use after a bad fleet-wide migration (e.g., Prisma 7 broke something unexpected) or a config that was applied fleet-wide.
When a workflow keeps using a stale dep (e.g., after a package.json change), bust the GitHub Actions cache. The pattern: bump cache key (add a comment or unused var to a workflow file), commit, push; or use `cache: false` for one build. Use when a CI Build is using a wrong version despite the source being correct.
Force-regenerate a stale `package-lock.json` (or pnpm-lock.yaml, yarn.lock, bun.lockb). The pattern when: `npm ci` fails with `Invalid: lock file's pkg@x.y.z does not satisfy pkg@x.y.z` after a package.json bump, or when CI keeps installing the wrong dep version. Covers: `--save-exact` to pin versions, `--package-lock-only` to avoid disk-space issues, `--legacy-peer-deps` for @capacitor peer conflicts, and the common "npm resolves ^7.8.0 to 5.22.0" trap.
Add CI to a monorepo with sequential package builds and matrix/sequential app builds. Covers: detecting monorepo structure, writing matrix workflows for parallel package builds, sequencing app builds that depend on packages, the `tsc -b` project-references trap, smoke-test fallback for monorepos without project references, and the workspace-specific subdirectory trap. From a real fleet that added CI to 5 monorepos in one day.