@moku-labs/ci 1.5.0 → 1.5.2

package/README.md

@@ -119,6 +119,7 @@ flowchart LR
 | [`examples/package/publish.local-publish.yml`](examples/package/publish.local-publish.yml) | Fallback: publish from the project's own job. Use it only if the central publish fails npm auth. |
 | [`rulesets/main.json`](rulesets/main.json) | Branch ruleset for `main`: PR only, no force-push, the four `ci / …` checks required. |
 | [`examples/dependabot.yml`](examples/dependabot.yml) | Dependabot config: one grouped PR a day for `@moku-labs/*` only. `setup` writes it to `.github/dependabot.yml`. |
+| [`examples/org/fleet.yml`](examples/org/fleet.yml) | For the organization's `.github` repository. Every 15 minutes it runs `moku-release fleet --markdown` and puts the table between `<!-- fleet:start -->` and `<!-- fleet:end -->` of `profile/README.md`. |
 | [`examples/package/dependabot-automerge.yml`](examples/package/dependabot-automerge.yml) | Turns on auto-merge for a Dependabot PR; the ruleset checks stay the gate. After the merge it dispatches `publish.yml` with `patch`, because a merge made by `GITHUB_TOKEN` starts no push run. `setup` writes it and allows auto-merge on the repo. |
 
 > [!TIP]
@@ -208,6 +209,7 @@ Examples: `examples/package/ci-with-demos.yml` (label `demos:full`) and
 | `bun run release:setup` | once per project | Idempotent wizard: workflows, Dependabot, script contract, first publish, first tag, trusted publisher, branch ruleset, auto-merge, then `doctor`. `--dry-run` prints every action, changes nothing and asks nothing. `--yes` answers every confirmation for an agent or CI; a step that needs your npm OTP is then printed, not run. |
 | `bun run release:doctor` | any time | Changes nothing in the project; it only runs `git fetch --tags` first. Twelve checks, one line each, and the exact `fix:` command for every red line. `--json` for machines. |
 | `bun run release wait` | after each merge to `main` | Refuses unless `origin/main` holds `HEAD`. Waits for the first release tag that holds the commit, then for npm to serve that version. Stops on a failed run and prints the log command. |
+| `bun run release fleet` | any time | Read-only. One table for every repository of the organization: CI on `main`, the release of `main`, tag against npm, commits nobody released, open PRs, old `@moku-labs/*` pins. Then the list of what waits for a person. `--markdown` prints the public rows for the organization page, `--json` every row. |
 | `bun run release <patch\|minor\|major\|prerelease>` | a release a person asks for | Refuses unless the tree is clean and `HEAD == origin/main`. Dispatches `publish.yml`, watches the run, verifies the version and dist-tag on npm. |
 
 The scripts are plain aliases of the `moku-release` bin. Internals and the list of checks:

package/dist/release.mjs

@@ -833,7 +833,7 @@ const REQUIRED_SCRIPTS = {
 * @example
 * parseManifest('{"name":"x"}');
 */
-function parseManifest(text) {
+function parseManifest$1(text) {
 	if (text === void 0) return void 0;
 	try {
 		const parsed = JSON.parse(text);
@@ -852,7 +852,7 @@ function parseManifest(text) {
 * const manifest = await readManifest(ctx.files);
 */
 async function readManifest(files) {
-	return parseManifest(await files.read(MANIFEST_PATH));
+	return parseManifest$1(await files.read(MANIFEST_PATH));
 }
 /** Any character outside printable ASCII and the JSON whitespace. */
 const NON_ASCII = /[^\t\n\r -~]/;
@@ -2035,6 +2035,471 @@ async function runDoctor(options) {
 	};
 }
 //#endregion
+//#region src/lib/fleet.ts
+/**
+* @file `moku-release fleet` — one GraphQL query for every repository of the organization,
+* and the pure functions that turn its answer into a status table.
+*
+* Everything a row shows comes from that one answer, except the version npm serves. The
+* checks of the newest commit on the default branch hold both pipelines: a `release / …`
+* check belongs to `publish.yml`, every other check to CI. The newest `v*` tag sits on a
+* bump commit whose parent is the commit that was released, so the distance from that
+* parent to the head is the number of commits nobody released.
+*/
+/** Prefix GitHub puts on the jobs of `publish.yml`: the caller's job id, `release`. */
+const RELEASE_PREFIX = "release / ";
+/** The scope every family package is published under. */
+const FAMILY_SCOPE = "@moku-labs/";
+/** The organization's profile repository. It holds the table itself and is not a row of it. */
+const PROFILE_REPO = ".github";
+/** Matches a release tag, prereleases included: `v1.2.3`, `v1.2.3-rc.0`. Not the moving `v1`. */
+const RELEASE_TAG = /^v\d+\.\d+\.\d+/;
+/** Matches a dependency pinned to one exact version. A range is not a pin and is not judged. */
+const EXACT_VERSION = /^\d+\.\d+\.\d+/;
+/** The query `gh api graphql -F org=<org>` runs. One call answers the whole table. */
+const FLEET_QUERY = `query($org: String!) {
+  organization(login: $org) {
+    repositories(first: 100, isArchived: false, orderBy: { field: NAME, direction: ASC }) {
+      nodes {
+        name
+        isPrivate
+        manifest: object(expression: "HEAD:package.json") { ... on Blob { text } }
+        publish: object(expression: "HEAD:.github/workflows/publish.yml") { ... on Blob { byteSize } }
+        defaultBranchRef {
+          target {
+            ... on Commit {
+              oid
+              history(first: 30) { nodes { oid } }
+              statusCheckRollup { contexts(first: 100) { nodes { ... on CheckRun { name status conclusion } } } }
+            }
+          }
+        }
+        refs(refPrefix: "refs/tags/", first: 10, orderBy: { field: TAG_COMMIT_DATE, direction: DESC }) {
+          nodes {
+            name
+            target {
+              ... on Commit { parents(first: 1) { nodes { oid } } }
+              ... on Tag { target { ... on Commit { parents(first: 1) { nodes { oid } } } } }
+            }
+          }
+        }
+        pullRequests(states: OPEN, first: 50) {
+          nodes {
+            number
+            isDraft
+            author { login }
+            commits(last: 1) { nodes { commit { statusCheckRollup { state } } } }
+          }
+        }
+      }
+    }
+  }
+}`;
+/**
+* Fold the checks of one pipeline into one state. Red wins over running, running over green.
+*
+* @param checks - The checks that belong to the pipeline.
+* @returns The state of the pipeline.
+* @example
+* pipelineState([{ status: "COMPLETED", conclusion: "FAILURE" }]); // "red"
+*/
+function pipelineState(checks) {
+	if (checks.length === 0) return "none";
+	const done = checks.filter((check) => check.status === "COMPLETED");
+	const passed = /* @__PURE__ */ new Set([
+		"SUCCESS",
+		"SKIPPED",
+		"NEUTRAL"
+	]);
+	if (done.some((check) => !passed.has(check.conclusion ?? ""))) return "red";
+	return done.length === checks.length ? "green" : "running";
+}
+/**
+* The state of a pull request from the rollup state GitHub computes for its newest commit.
+*
+* @param state - `SUCCESS`, `FAILURE`, `ERROR`, `PENDING`, `EXPECTED`, or nothing.
+* @returns The matching pipeline state.
+* @example
+* rollupState("FAILURE"); // "red"
+*/
+function rollupState(state) {
+	if (state === "SUCCESS") return "green";
+	if (state === "FAILURE" || state === "ERROR") return "red";
+	return state === void 0 ? "none" : "running";
+}
+/**
+* Parse a manifest text, tolerating a missing or malformed file.
+*
+* @param text - The `package.json` text, when the repository has one.
+* @returns The manifest, or an empty one.
+* @example
+* parseManifest('{"name":"@moku-labs/core"}');
+*/
+function parseManifest(text) {
+	try {
+		const parsed = JSON.parse(text ?? "");
+		return typeof parsed === "object" && parsed !== null ? parsed : {};
+	} catch {
+		return {};
+	}
+}
+/**
+* The newest release tag of a repository and the commit it released.
+*
+* @param raw - The repository, as the query returns it.
+* @returns The tag and the released commit, or nothing when no release tag exists.
+* @example
+* const newest = newestRelease(raw);
+*/
+function newestRelease(raw) {
+	const [newest] = (raw.refs?.nodes ?? []).filter((node) => RELEASE_TAG.test(node.name ?? "")).toSorted((a, b) => compareSemver(b.name ?? "", a.name ?? ""));
+	if (newest?.name === void 0) return void 0;
+	const commit = newest.target?.parents === void 0 ? newest.target?.target : newest.target;
+	return {
+		tag: newest.name,
+		released: commit?.parents?.nodes?.[0]?.oid
+	};
+}
+/**
+* The exact family pins of a manifest, from `dependencies` and `devDependencies`.
+*
+* @param manifest - The parsed manifest.
+* @returns Dependency name to pinned version, for exact `@moku-labs/*` pins only.
+* @example
+* familyPins({ dependencies: { "@moku-labs/core": "1.7.1" } }); // { "@moku-labs/core": "1.7.1" }
+*/
+function familyPins(manifest) {
+	const all = {
+		...manifest.devDependencies,
+		...manifest.dependencies
+	};
+	return Object.fromEntries(Object.entries(all).filter(([name, spec]) => name.startsWith(FAMILY_SCOPE) && EXACT_VERSION.test(spec)));
+}
+/**
+* Whether a check belongs to `publish.yml`.
+*
+* @param check - One check of a commit.
+* @returns `true` for a `release / …` check.
+* @example
+* isRelease({ name: "release / publish" }); // true
+*/
+function isRelease(check) {
+	return (check.name ?? "").startsWith(RELEASE_PREFIX);
+}
+/**
+* The GitHub URL of a repository, or of a page inside it.
+*
+* @param org - The organization login.
+* @param repo - The row.
+* @param path - A path inside the repository, with the leading slash.
+* @returns The URL.
+* @example
+* repoUrl("moku-labs", row, "/pulls");
+*/
+function repoUrl(org, repo, path = "") {
+	return `https://github.com/${org}/${repo.name}${path}`;
+}
+/**
+* Turn one repository of the answer into a row. The pins are judged later, once the
+* newest version of every package is known.
+*
+* @param raw - The repository, as the query returns it.
+* @returns The row, with `pins` still empty and the manifest pins kept in `pinned`.
+* @example
+* const row = toRepo(raw);
+*/
+function toRepo(raw) {
+	const manifest = parseManifest(raw.manifest?.text ?? void 0);
+	const head = raw.defaultBranchRef?.target;
+	const checks = (head?.statusCheckRollup?.contexts?.nodes ?? []).filter((check) => check?.name !== void 0);
+	const publishes = raw.publish?.byteSize !== void 0 && manifest.private !== true && manifest.name !== void 0;
+	const newest = publishes ? newestRelease(raw) : void 0;
+	const distance = (head?.history?.nodes ?? []).findIndex((node) => node.oid === newest?.released);
+	return {
+		name: raw.name ?? "",
+		isPrivate: raw.isPrivate === true,
+		...publishes && manifest.name !== void 0 ? { packageName: manifest.name } : {},
+		ci: pipelineState(checks.filter((check) => !isRelease(check))),
+		release: pipelineState(checks.filter((check) => isRelease(check))),
+		...newest === void 0 ? {} : {
+			tag: newest.tag,
+			unreleased: distance === -1 ? 30 : distance
+		},
+		pullRequests: (raw.pullRequests?.nodes ?? []).map((pr) => ({
+			number: pr.number ?? 0,
+			bot: (pr.author?.login ?? "").endsWith("[bot]") || pr.author?.login === "dependabot",
+			draft: pr.isDraft === true,
+			state: rollupState(pr.commits?.nodes?.[0]?.commit?.statusCheckRollup?.state)
+		})),
+		pins: [],
+		pinned: familyPins(manifest)
+	};
+}
+/**
+* Parse the answer of {@link FLEET_QUERY} into rows, pins judged against the newest tags.
+*
+* @param stdout - The raw `gh api graphql` output.
+* @returns One row per repository, or `undefined` when the answer is not the expected shape.
+* @example
+* const rows = parseFleet(stdout);
+*/
+function parseFleet(stdout) {
+	let nodes;
+	try {
+		nodes = JSON.parse(stdout).data?.organization?.repositories?.nodes;
+	} catch {
+		return;
+	}
+	if (!Array.isArray(nodes)) return void 0;
+	const rows = nodes.filter((raw) => raw.name !== PROFILE_REPO).map((raw) => toRepo(raw));
+	const newest = new Map(rows.flatMap((row) => row.packageName !== void 0 && row.tag !== void 0 ? [[row.packageName, row.tag.slice(1)]] : []));
+	return rows.map(({ pinned = {}, ...row }) => ({
+		...row,
+		pins: Object.entries(pinned).flatMap(([name, version]) => {
+			const latest = newest.get(name);
+			return latest !== void 0 && compareSemver(version, latest) < 0 ? [{
+				name,
+				pinned: version,
+				latest
+			}] : [];
+		})
+	}));
+}
+/**
+* What waits for a person in one repository, most urgent first. An empty list is a quiet row.
+*
+* @param repo - The row.
+* @returns One short line per thing to look at.
+* @example
+* attention({ ...row, ci: "red" }); // ["CI is red on main"]
+*/
+function attention(repo) {
+	const lines = [];
+	const version = repo.tag?.slice(1);
+	if (repo.ci === "red") lines.push("CI is red on main");
+	if (repo.release === "red") lines.push("the release of main failed");
+	if ((repo.unreleased ?? 0) > 0 && repo.release !== "running" && repo.release !== "red") {
+		const count = repo.unreleased === 30 ? `30+` : `${repo.unreleased}`;
+		lines.push(`${count} commit(s) on main are not released`);
+	}
+	if (repo.npm !== void 0 && version !== void 0 && repo.npm !== version) lines.push(`npm serves ${repo.npm}, the tag is ${repo.tag}`);
+	for (const pr of repo.pullRequests.filter((open) => !open.draft)) {
+		if (pr.state === "red") lines.push(`PR #${pr.number} has red checks`);
+		if (pr.state === "green") lines.push(`PR #${pr.number} is green and not merged`);
+	}
+	return lines;
+}
+/** The mark of each state in the Markdown table. */
+const MARKS = {
+	green: "🟢",
+	red: "🔴",
+	running: "🟡",
+	none: "—"
+};
+/**
+* The open pull requests of a row as one short cell: the count, then what stands out.
+*
+* @param repo - The row.
+* @returns E.g. `3 (1 red, 2 bot)`, or `0`.
+* @example
+* pullRequestCell(row); // "3 (1 red, 2 bot)"
+*/
+function pullRequestCell(repo) {
+	const open = repo.pullRequests;
+	const red = open.filter((pr) => pr.state === "red").length;
+	const bot = open.filter((pr) => pr.bot).length;
+	const notes = [red > 0 ? `${red} red` : "", bot > 0 ? `${bot} bot` : ""].filter(Boolean);
+	return notes.length > 0 ? `${open.length} (${notes.join(", ")})` : `${open.length}`;
+}
+/**
+* The "not released" cell of a row.
+*
+* @param repo - The row.
+* @returns The number of commits after the released one, or a dash for a repository without releases.
+* @example
+* unreleasedCell(row); // "0"
+*/
+function unreleasedCell(repo) {
+	if (repo.unreleased === void 0) return "—";
+	return repo.unreleased === 30 ? `30+` : `${repo.unreleased}`;
+}
+/**
+* The "old pins" cell of a row: every family dependency pinned below its newest release.
+* It is a column and not a line of {@link attention}: Dependabot moves the pins by itself.
+*
+* @param repo - The row.
+* @returns E.g. `core 1.7.1, ci 1.3.0`, or a dash.
+* @example
+* pinsCell(row); // "core 1.7.1"
+*/
+function pinsCell(repo) {
+	if (repo.pins.length === 0) return "—";
+	return repo.pins.map((pin) => `${pin.name.slice(11)} ${pin.pinned}`).join(", ");
+}
+/**
+* Render the public rows as a Markdown table with links, and the list of what waits. A
+* private repository is left out: the page this lands on is public.
+*
+* @param org - The organization login, for the links.
+* @param repos - The rows.
+* @returns The Markdown block, without a trailing newline.
+* @example
+* renderFleetMarkdown("moku-labs", rows);
+*/
+function renderFleetMarkdown(org, repos) {
+	const shown = repos.filter((repo) => !repo.isPrivate);
+	const rows = shown.map((repo) => [
+		`[${repo.name}](${repoUrl(org, repo)})`,
+		`[${MARKS[repo.ci]}](${repoUrl(org, repo, "/actions")})`,
+		repo.packageName === void 0 ? "—" : `[${MARKS[repo.release]}](${repoUrl(org, repo, "/actions/workflows/publish.yml")})`,
+		repo.tag === void 0 ? "—" : `[${repo.tag}](${repoUrl(org, repo, "/releases/tag/")}${repo.tag})`,
+		repo.npm ?? "—",
+		unreleasedCell(repo),
+		`[${pullRequestCell(repo)}](${repoUrl(org, repo, "/pulls")})`,
+		pinsCell(repo)
+	].join(" | "));
+	const waiting = shown.flatMap((repo) => attention(repo).map((line) => `- [${repo.name}](${repoUrl(org, repo)}): ${line}`));
+	return [
+		"| Repo | CI | Release | Tag | npm | Not released | PRs | Old pins |",
+		"| --- | --- | --- | --- | --- | --- | --- | --- |",
+		...rows.map((row) => `| ${row} |`),
+		"",
+		waiting.length === 0 ? "Nothing waits." : "**Waits for a person**",
+		...waiting.length === 0 ? [] : ["", ...waiting]
+	].join("\n");
+}
+//#endregion
+//#region src/commands/fleet.ts
+/**
+* The organization the command reads: the owner of this checkout's remote, or of the
+* manifest's `repository` when there is no remote.
+*
+* @param ctx - The ports and flags.
+* @returns The organization login, or `undefined` when neither names a GitHub owner.
+* @example
+* const org = await organizationOf(ctx); // "moku-labs"
+*/
+async function organizationOf(ctx) {
+	const remote = await ctx.exec.capture("git", [
+		"remote",
+		"get-url",
+		"origin"
+	]);
+	const manifest = await readManifest(ctx.files);
+	const declared = manifest === void 0 ? void 0 : repositoryUrlOf(manifest);
+	const url = remote.code === 0 ? remote.stdout : declared;
+	return url === void 0 ? void 0 : ownerRepoFrom(url)?.split("/")[0];
+}
+/**
+* Add the version npm serves as `latest` to every row that publishes a package.
+*
+* @param ctx - The ports and flags.
+* @param repos - The rows from the query.
+* @returns The rows, with `npm` filled where the registry answered.
+* @example
+* const rows = await withRegistry(ctx, parsed);
+*/
+async function withRegistry(ctx, repos) {
+	return Promise.all(repos.map(async (repo) => {
+		if (repo.packageName === void 0) return repo;
+		const view = await ctx.exec.capture("npm", [
+			"view",
+			repo.packageName,
+			"dist-tags",
+			"--json"
+		]);
+		const latest = view.code === 0 ? parseDistTags(view.stdout)?.latest : void 0;
+		return latest === void 0 ? repo : {
+			...repo,
+			npm: latest
+		};
+	}));
+}
+/**
+* Lay one row of the terminal table out in fixed columns.
+*
+* @param row - The cells of the row.
+* @returns The padded line.
+* @example
+* cells(["core", "green"]);
+*/
+function cells(row) {
+	return row.map((cell, index) => cell.padEnd(index === 0 ? 10 : 9)).join(" ");
+}
+/**
+* Print the table and the list of what waits, for a person at a terminal.
+*
+* @param ui - The branded console.
+* @param repos - The rows.
+* @example
+* renderTerminal(ui, rows);
+*/
+function renderTerminal(ui, repos) {
+	ui.heading("Fleet");
+	ui.line(cells([
+		"repo",
+		"ci",
+		"release",
+		"tag",
+		"npm",
+		"ahead",
+		"prs",
+		"old pins"
+	]));
+	for (const repo of repos) ui.line(cells([
+		repo.name,
+		repo.ci,
+		repo.packageName === void 0 ? "—" : repo.release,
+		repo.tag ?? "—",
+		repo.npm ?? "—",
+		unreleasedCell(repo),
+		pullRequestCell(repo),
+		pinsCell(repo)
+	]));
+	ui.heading("Waits for a person");
+	const waiting = repos.flatMap((repo) => attention(repo).map((line) => `${repo.name}: ${line}`));
+	if (waiting.length === 0) ui.check(true, "nothing waits");
+	for (const line of waiting) ui.check(false, line);
+}
+/**
+* Read the state of every repository of the organization and print it.
+*
+* @param options - The ports, console and output flags.
+* @returns The process exit code: `1` only when the state could not be read.
+* @example
+* const code = await runFleet({ ctx, ui });
+*/
+async function runFleet(options) {
+	const { ctx, ui, json = false, markdown = false } = options;
+	if (!(json || markdown)) ui.lockup({
+		wordmark: "moku release",
+		label: "fleet"
+	});
+	const org = await organizationOf(ctx);
+	if (org === void 0) {
+		ui.error("no GitHub organization found", "run inside a checkout whose `origin` is on GitHub");
+		return 1;
+	}
+	const answer = await ctx.exec.capture("gh", [
+		"api",
+		"graphql",
+		"-F",
+		`org=${org}`,
+		"-f",
+		`query=${FLEET_QUERY}`
+	]);
+	const parsed = answer.code === 0 ? parseFleet(answer.stdout) : void 0;
+	if (parsed === void 0) {
+		ui.error(`could not read the repositories of ${org}`, answer.stderr.trim() || "gh auth login");
+		return 1;
+	}
+	const repos = await withRegistry(ctx, parsed);
+	if (json) ui.line(JSON.stringify(repos, void 0, 2));
+	else if (markdown) ui.line(renderFleetMarkdown(org, repos));
+	else renderTerminal(ui, repos);
+	return 0;
+}
+//#endregion
 //#region src/commands/release.ts
 /** Workflow file dispatched by name — the same name npm's trusted publisher is bound to. */
 const PUBLISH_WORKFLOW_FILE$1 = ".github/workflows/publish.yml".split("/").pop() ?? "publish.yml";
@@ -2899,7 +3364,7 @@ async function runWait(options) {
 * dispatcher.
 *
 * The grammar is deliberately tiny: one positional (a command name, or a semver bump that
-* implies the `release` command) plus four flags. Anything unrecognized resolves to
+* implies the `release` command) plus five flags. Anything unrecognized resolves to
 * `help` with an `error` set — the CLI never guesses what an operator meant.
 */
 /** The semver bumps `moku-release <type>` accepts, in menu order. */
@@ -2912,6 +3377,7 @@ const RELEASE_TYPES = [
 /** Every flag the CLI accepts, besides `--help`. */
 const KNOWN_FLAGS = /* @__PURE__ */ new Set([
 	"--json",
+	"--markdown",
 	"--dry-run",
 	"--yes",
 	"-y"
@@ -2981,6 +3447,13 @@ function parseArgv(argv) {
 		dryRun,
 		yes
 	};
+	if (first === "fleet") return {
+		command: first,
+		json,
+		dryRun,
+		yes,
+		markdown: flags.includes("--markdown")
+	};
 	if (first === "help") return {
 		command: "help",
 		json,
@@ -3176,6 +3649,8 @@ const USAGE = [
 	"  moku-release setup              one-time wizard: workflows, contract, first publish",
 	"  moku-release doctor [--json]    read-only diagnosis of the release setup",
 	"  moku-release wait               wait for the auto-release of HEAD, verify it on npm",
+	"  moku-release fleet [--json|--markdown]",
+	"                                  every repository of the organization in one table",
 	`  moku-release <${RELEASE_TYPES.join("|")}>`,
 	"",
 	"  A merge to main releases a patch by itself. A person releases minor,",
@@ -3240,6 +3715,12 @@ async function dispatch(parsed, ctx, ui) {
 		ctx,
 		ui
 	});
+	if (parsed.command === "fleet") return runFleet({
+		ctx,
+		ui,
+		json: parsed.json,
+		markdown: parsed.markdown === true
+	});
 	if (parsed.command === "release" && parsed.releaseType !== void 0) return runRelease({
 		ctx,
 		ui,

package/examples/org/fleet.yml

@@ -0,0 +1,51 @@
+name: Fleet status
+
+# For the organization's `.github` repository. Every 15 minutes it reads the state of every public
+# repository with `moku-release fleet` and puts the table into profile/README.md, the page
+# GitHub shows on the organization. It commits only when the table changed.
+#
+# No token is added: GITHUB_TOKEN reads the public repositories and writes this one.
+on:
+  schedule:
+    - cron: "*/15 * * * *"
+  workflow_dispatch:
+
+concurrency:
+  group: fleet
+  cancel-in-progress: true
+
+permissions:
+  contents: write # commit profile/README.md
+
+jobs:
+  fleet:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        with:
+          node-version: 24
+      - name: Read the fleet
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: npx --yes --package @moku-labs/ci@1 moku-release fleet --markdown > fleet.md
+      - name: Put the table between the markers of profile/README.md
+        run: |
+          set -euo pipefail
+          # An empty table means the read failed without an exit code; keep the old one.
+          [ -s fleet.md ] || { echo "fleet.md is empty"; exit 1; }
+          awk -v table=fleet.md '
+            /<!-- fleet:start -->/ { print; while ((getline line < table) > 0) print line; skip = 1; next }
+            /<!-- fleet:end -->/ { skip = 0 }
+            !skip
+          ' profile/README.md > README.next
+          mv README.next profile/README.md
+          rm fleet.md
+      - name: Commit when the table changed
+        run: |
+          set -euo pipefail
+          git diff --quiet && { echo "no change"; exit 0; }
+          git config user.name  "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git commit -qam "fleet: status"
+          git push

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moku-labs/ci",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "description": "Central CI and release for the moku family: reusable workflows, caller examples and the moku-release CLI.",
   "type": "module",
   "sideEffects": [