cam-fleet-bundle

Diagnose and apply branch protection rules across a fleet. The standard pattern: require PR review, dismiss stale reviews, restrict who can push. Common issue: "Bypassed rule violations for refs/heads/main" — this happens when direct push is used despite protection. Use when CI builds keep failing on push branches that the user didn't intend to push to directly.

Add Dependabot config to a fleet of repos, triage auto-PRs that fail CI, and manage the auto-PR lifecycle. Covers: auto-detecting lockfile ecosystem (npm/pnpm/yarn/bun/composer/pip), writing `.github/dependabot.yml` per-repo, understanding why Dependabot PRs often fail CI (peer-dep conflicts, major version bumps), and the "billing cap vs Dependabot PR" classification trick. From a real 35-repo Dependabot rollout.

Upgrade a single repo from ESLint 8 + legacy `.eslintrc.*` config to ESLint 9 + flat config (`eslint.config.js` / `.mjs`). Handles all the v9 breaking changes: dropped `.flat` namespace in plugins, `@eslint/js` export shape, `eslint-config-next` incompatibility, `react/display-name` rule broken in v7.x. Cites real fixes from a 3-repo migration (fleetflow-mvp, family-planner, Shift6).

Audit all repos in the user's GitHub fleet for CI Build and Lint workflow health. Categorizes failures into billing-cap (spending limit), dependabot-PR, cancelled-superseded, and real-source-error buckets. Use as the first step in any "fix all known issues" task — it gives a precise inventory of what's actually broken vs what's just noise. Filters by default-branch and push/schedule events to ignore PR branches.

When a fleet-wide change breaks many repos at once, roll back across all affected repos in one sweep. The pattern: identify the breaking change, find every commit that introduced it, force-revert, push. Use after a bad fleet-wide migration (e.g., Prisma 7 broke something unexpected) or a config that was applied fleet-wide.

When a workflow keeps using a stale dep (e.g., after a package.json change), bust the GitHub Actions cache. The pattern: bump cache key (add a comment or unused var to a workflow file), commit, push; or use `cache: false` for one build. Use when a CI Build is using a wrong version despite the source being correct.

Force-regenerate a stale `package-lock.json` (or pnpm-lock.yaml, yarn.lock, bun.lockb). The pattern when: `npm ci` fails with `Invalid: lock file's pkg@x.y.z does not satisfy pkg@x.y.z` after a package.json bump, or when CI keeps installing the wrong dep version. Covers: `--save-exact` to pin versions, `--package-lock-only` to avoid disk-space issues, `--legacy-peer-deps` for @capacitor peer conflicts, and the common "npm resolves ^7.8.0 to 5.22.0" trap.

Add CI to a monorepo with sequential package builds and matrix/sequential app builds. Covers: detecting monorepo structure, writing matrix workflows for parallel package builds, sequencing app builds that depend on packages, the `tsc -b` project-references trap, smoke-test fallback for monorepos without project references, and the workspace-specific subdirectory trap. From a real fleet that added CI to 5 monorepos in one day.

Rename a workspace package (e.g., `@org/jw-types` → `@org/core-types`) across a monorepo without breaking consumers. The pattern: use codemod/IDE refactor across the monorepo, update root `package.json` workspaces + tsconfig paths, version-bump, publish to local registry, re-run full monorepo build. Use when consolidating packages or rebranding.

Migrate one or many repos from Prisma 5 to Prisma 7. The v7 change requires a driver adapter (e.g., `@prisma/adapter-pg`) for `new PrismaClient()`, which breaks build-time instantiation (Next.js page-data collection, monorepo CI). Solution: lazy Proxy pattern that defers `PrismaClient` construction until the first method call. Covers: schema datasource `url` removal → `prisma.config.ts`, lazy proxy per file role, lockfile regen with exact pinning (npm resolves `^7.8.0` to 5.22.0), `--legacy-peer-deps` for Capacitor repos, force-push for branch-protected repos. From a real 6-repo fleet migration.

Decide which repos in a fleet to archive, which to keep, what to do with archived repos (delete vs archive), and how to handle pull requests on archived repos. Use during fleet cleanup when the user has accumulated 50+ repos and many are stale. Cites real patterns: "10-day stale threshold", "Pareto by push recency", "archival vs deletion tradeoffs".

Grep the fleet for leaked API keys, tokens, .env files in git history, and accidentally committed secrets. Cites real patterns: `gh api` to find secrets in repo blobs, `git log -p` to find secrets in history, common false positives (test fixtures, example configs). Use before any major fleet work — the audit often surfaces secrets in archived repos that the user forgot existed.

Detect GitHub Pro spending limit (the "spending limit needs to be increased" annotation) before debugging code. The pattern: look for the specific annotation text in `gh run view` output. Use this skill to triage red CI Build runs quickly — saves hours of "fixing" code that was never broken.

Find the lowest-version repos in a fleet for Node, Next.js, React, Vite, Prisma, TypeScript, ESLint. Produces a prioritized upgrade queue. Use when planning fleet-wide version upgrades — you want to know "which 5 repos are on Next 14 and which 10 are on Next 15" before deciding where to spend the time. Cites real patterns from a fleet where the lowest repos were on Prisma 5.22.0 and Next 14.

Rotate webhooks, API keys, and shared secrets fleet-wide without breaking consumers. The pattern: list all consumers, add overlap (old key + new key valid for 7 days), migrate consumers to new key, revoke old key. Use when an integration is compromised or as a periodic security hygiene step.