Reusable workflows for organization-owned and personal repositories. Each
installation keeps its configuration and uses @v1 for automatic compatible
workflow updates. Full commit SHA pinning remains available. Supports GitHub.com.
| Workflow | Use it to | Get started |
|---|---|---|
| Node dependency maintenance | Attempt compatible security fixes, optionally propose routine upgrades, validate the project, and maintain grouped dependency PRs. | Setup guide |
| Node maintenance setup check | Check a list of maintenance installations for broken setup or configuration drift, and maintain one central issue per list. | Fleet setup guide |
The workflows are independent. Install maintenance in each Node repository you want to maintain. Run the fleet checker from one repository to monitor those installations. Fleet checks do not audit dependencies, install packages, or run project scripts. Nothing merges or repairs configuration automatically.
Supports standalone Node applications, libraries, and websites using npm or pnpm. A maintenance run validates its proposal with a frozen install and your project's checks. With the released two-job caller, all audit kinds maintain one open dependency PR per repository; reruns update that PR rather than opening one PR per dependency. Reports show proposed versions, validation, and blocked findings.
For separate security and routine-upgrade PRs, see the opt-in coordinated caller. It validates dependency-file pushes and refreshes existing proposals after either PR merges. This new caller requires a workflow revision containing that interface; existing callers keep their combined-PR behavior.
| Maintenance setup | Automatic security checks | Automatic routine upgrades |
|---|---|---|
| Basic setup in the guide | Weekly | Disabled; run upgrades manually |
| Follow this repository's shared defaults | Weekly | Every three months |
Both examples use a ten-day release cooldown. The basic setup follows your supported project toolchain. The shared defaults require Node 24 and pnpm 11.21.0 or npm 11.9.0. Local overrides remain valid; conflicting declarations fail preflight and update the repository's reusable configuration issue. See the setup guide and scheduling guide.
Keep an authoritative defaults file in any public GitHub repository. Optionally keep a repository inventory beside it. The inventory names the expected defaults source and the repositories that should follow it. You do not need to register either file here.
The fleet checker inspects each default branch, honors local overrides, and reports failed or unverifiable setup in the host repository. It keeps one issue per failure episode, closes it when every static check passes, and creates a new issue after a later regression. This repository checks Hydra and OmegaConf weekly on Mondays at 03:00 UTC. Keep private inventories and reports in a private host; other hosts choose their own caller schedule. Checks run five repositories at a time in one runner, with one combined report and issue.
- Node maintenance: setup, first run, updates, and troubleshooting
- Fleet setup checks: inventory, caller, results, and limits
- Maintenance schedules and manual audits
- Separate proposal channels and automatic refresh
- Shared defaults for multiple installations
- Maintenance behavior, reports, and permissions
- Migrate an earlier Docusaurus installation
- Workflow releases and immutable pins
- Maintenance caller template and integration contract
The Node implementation retains its BSD 3-Clause license.