[vannt-dev]

What

repokeeper github status [--owner <name>] [--all] [--json] [--forks] [--exit-code] reports what
needs attention across every non-archived repository of a GitHub user or organization (forks only
with --forks). It runs from any folder and writes nothing.

Per repository:

• prs: open pull requests with the combined state of their check runs
• alerts: open Dependabot alerts by severity; off when GitHub answers 403 "disabled"
• ci: latest finished run of each active workflow on the default branch; dynamic runs
  (Dependabot updates, Pages), pull request runs and cancelled/skipped runs are ignored; none
  when nothing ran; failures are listed with date and link
• unreleased: commits since the latest release (or highest version tag), plus how many are
  feat/fix/perf/revert/breaking; only those count as attention; no tags otherwise
• graph: stale dependency graph. Compares the npm and NuGet versions of the SBOM with
  package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml (v5 to v9, pnpm 11's two documents)
  and packages.config on the default branch; flags a package the graph names at a version no
  lockfile contains while a lockfile has it at another one. The output says that a commit touching
  the manifest makes GitHub re-read it.

Default output: a table of the repositories that need attention, the details behind it, and
"N of M repositories clean". --all lists every repository, --json prints everything,
--exit-code exits 1 when something needs attention (for a scheduled workflow). Four repositories
are read at a time; a failing repository or the rate limit is reported under "could not check" and
the run carries on. Dependabot alerts follow the Link header (cursor pagination), so the REST
client now passes that header on.

Tests

12 new tests with the fake API (536 in total); typecheck, biome and build pass.

Real run

$ repokeeper github status --owner vannt-dev --exit-code    # exit 1
repo                        prs  alerts    ci      unreleased                    graph
aspnet                      0    0         none    no tags                       stale (2)
dynamic-field-kit           0    0         ok      6 since v1.12.0 (1 feat/fix)  ok
network-overrides-devtools  0    0         failed  1 since v2.6.0                ok
web-ban-hang                0    1 medium  none    no tags                       ok

stale dependency graph (GitHub still reads old versions; a commit touching the manifest makes GitHub re-read it):
  aspnet: nuget Microsoft.Owin 3.0.1 in the graph, 4.2.2 in OnlineShop/packages.config
  aspnet: nuget bootstrap 3.0.0 in the graph, 3.4.1 in OnlineShop/packages.config

54 of 58 repositories clean, 4 need attention

Limits

• yarn.lock and csproj PackageReference are not read
• the releasable count looks at the first 100 commits of the comparison
• PR checks come from check runs only, not legacy commit statuses
• for another user only public repositories are listed; a workflow's GITHUB_TOKEN cannot read
  other repositories' Dependabot alerts