devskill 2.0.7 → 2.0.8

package/skills/dependabot/references/example-configs.md

@@ -0,0 +1,409 @@
+# Dependabot Configuration Examples
+
+Real-world `dependabot.yml` configurations for common scenarios.
+
+---
+
+## 1. Basic Single Ecosystem
+
+Minimal configuration for a single npm project:
+
+```yaml
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+```
+
+---
+
+## 2. Monorepo with Glob Patterns
+
+Turborepo/pnpm monorepo with multiple workspace packages:
+
+```yaml
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directories:
+      - "/"
+      - "/apps/*"
+      - "/packages/*"
+      - "/services/*"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    groups:
+      dev-dependencies:
+        dependency-type: "development"
+        update-types: ["minor", "patch"]
+      production-dependencies:
+        dependency-type: "production"
+        update-types: ["minor", "patch"]
+    labels:
+      - "dependencies"
+      - "npm"
+    commit-message:
+      prefix: "deps"
+      include: "scope"
+```
+
+---
+
+## 3. Grouped Dev vs Production Dependencies
+
+Separate dev and production updates to prioritize review of production changes:
+
+```yaml
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      production-deps:
+        dependency-type: "production"
+      dev-deps:
+        dependency-type: "development"
+        exclude-patterns:
+          - "eslint*"
+      linting:
+        patterns:
+          - "eslint*"
+          - "prettier*"
+          - "@typescript-eslint*"
+```
+
+---
+
+## 4. Cross-Directory Grouping (Monorepo)
+
+Create one PR per shared dependency across directories:
+
+```yaml
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directories:
+      - "/frontend"
+      - "/admin-panel"
+      - "/mobile-app"
+    schedule:
+      interval: "weekly"
+    groups:
+      monorepo-dependencies:
+        group-by: dependency-name
+```
+
+When `lodash` updates in all three directories, Dependabot creates a single PR.
+
+---
+
+## 5. Multi-Ecosystem Group (Docker + Terraform)
+
+Consolidate infrastructure dependency updates into a single PR:
+
+```yaml
+version: 2
+
+multi-ecosystem-groups:
+  infrastructure:
+    schedule:
+      interval: "weekly"
+    labels: ["infrastructure", "dependencies"]
+    assignees: ["@platform-team"]
+
+updates:
+  - package-ecosystem: "docker"
+    directory: "/"
+    patterns: ["nginx", "redis", "postgres"]
+    multi-ecosystem-group: "infrastructure"
+
+  - package-ecosystem: "terraform"
+    directory: "/"
+    patterns: ["aws*", "terraform-*"]
+    multi-ecosystem-group: "infrastructure"
+```
+
+---
+
+## 6. Security Updates Only (Version Updates Disabled)
+
+Monitor for security vulnerabilities without version update PRs:
+
+```yaml
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 0  # disables version update PRs
+    groups:
+      security-all:
+        applies-to: security-updates
+        patterns: ["*"]
+        update-types: ["patch", "minor"]
+
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 0
+```
+
+---
+
+## 7. Private Registries
+
+Access private npm and Docker registries:
+
+```yaml
+version: 2
+
+registries:
+  npm-private:
+    type: npm-registry
+    url: https://npm.internal.example.com
+    token: ${{secrets.NPM_PRIVATE_TOKEN}}
+
+  docker-ghcr:
+    type: docker-registry
+    url: https://ghcr.io
+    username: ${{secrets.GHCR_USER}}
+    password: ${{secrets.GHCR_TOKEN}}
+
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    registries:
+      - npm-private
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    registries:
+      - docker-ghcr
+    schedule:
+      interval: "weekly"
+```
+
+---
+
+## 8. Cooldown Periods
+
+Delay updates for newly released versions to avoid early-adopter bugs:
+
+```yaml
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 5
+      semver-major-days: 30
+      semver-minor-days: 14
+      semver-patch-days: 3
+      include: ["*"]
+      exclude:
+        - "security-critical-lib"
+        - "@company/internal-*"
+```
+
+---
+
+## 9. Cron Scheduling
+
+Run updates at a specific time using cron expressions:
+
+```yaml
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "cron"
+      cronjob: "0 9 * * 1"  # Every Monday at 9:00 AM
+      timezone: "America/New_York"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "cron"
+      cronjob: "0 6 1 * *"  # First day of each month at 6:00 AM
+```
+
+---
+
+## 10. Full-Featured Configuration
+
+A comprehensive example combining multiple optimizations:
+
+```yaml
+version: 2
+
+registries:
+  npm-private:
+    type: npm-registry
+    url: https://npm.example.com
+    token: ${{secrets.NPM_TOKEN}}
+
+updates:
+  # npm — monorepo workspaces
+  - package-ecosystem: "npm"
+    directories:
+      - "/"
+      - "/apps/*"
+      - "/packages/*"
+      - "/services/*"
+    registries:
+      - npm-private
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "America/New_York"
+    groups:
+      dev-dependencies:
+        dependency-type: "development"
+        update-types: ["minor", "patch"]
+      production-dependencies:
+        dependency-type: "production"
+        update-types: ["minor", "patch"]
+      angular:
+        patterns: ["@angular*"]
+        update-types: ["minor", "patch"]
+      security-patches:
+        applies-to: security-updates
+        patterns: ["*"]
+        update-types: ["patch", "minor"]
+    ignore:
+      - dependency-name: "aws-sdk"
+        update-types: ["version-update:semver-major"]
+    cooldown:
+      default-days: 3
+      semver-major-days: 14
+    labels:
+      - "dependencies"
+      - "npm"
+    commit-message:
+      prefix: "deps"
+      prefix-development: "deps-dev"
+      include: "scope"
+    assignees:
+      - "security-lead"
+    open-pull-requests-limit: 15
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    groups:
+      actions:
+        patterns: ["*"]
+    labels:
+      - "dependencies"
+      - "ci"
+    commit-message:
+      prefix: "ci"
+
+  # Docker
+  - package-ecosystem: "docker"
+    directories:
+      - "/services/*"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "dependencies"
+      - "docker"
+    commit-message:
+      prefix: "deps"
+
+  # pip
+  - package-ecosystem: "pip"
+    directory: "/scripts"
+    schedule:
+      interval: "monthly"
+    labels:
+      - "dependencies"
+      - "python"
+    versioning-strategy: "increase-if-necessary"
+    commit-message:
+      prefix: "deps"
+
+  # Terraform
+  - package-ecosystem: "terraform"
+    directory: "/infra"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "dependencies"
+      - "terraform"
+    commit-message:
+      prefix: "infra"
+```
+
+---
+
+## 11. Ignore Patterns and Versioning Strategy
+
+Control exactly what gets updated and how:
+
+```yaml
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    versioning-strategy: "increase"
+    ignore:
+      # Never auto-update to Express 5.x (breaking changes)
+      - dependency-name: "express"
+        versions: ["5.x"]
+      # Skip patch updates for type definitions
+      - dependency-name: "@types/*"
+        update-types: ["version-update:semver-patch"]
+      # Ignore all updates for a vendored package
+      - dependency-name: "legacy-internal-lib"
+    allow:
+      - dependency-type: "all"
+    exclude-paths:
+      - "vendor/**"
+      - "test/fixtures/**"
+```
+
+---
+
+## 12. Target Non-Default Branch
+
+Test updates on a development branch before production:
+
+```yaml
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    target-branch: "develop"
+    labels:
+      - "dependencies"
+      - "staging"
+
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    target-branch: "develop"
+```
+
+Note: Security updates always target the default branch regardless of `target-branch`.

package/skills/dependabot/references/pr-commands.md

@@ -0,0 +1,91 @@
+# Dependabot PR Comment Commands
+
+Interact with Dependabot pull requests by commenting `@dependabot <command>`. Dependabot acknowledges commands with a thumbs-up reaction.
+
+> **Deprecation Notice (January 27, 2026):** The following commands have been removed:
+> `@dependabot merge`, `@dependabot squash and merge`, `@dependabot cancel merge`,
+> `@dependabot close`, and `@dependabot reopen`.
+> Use GitHub's native UI, CLI (`gh pr merge`), API, or auto-merge feature instead.
+
+## Commands for Individual PRs
+
+| Command | Description |
+|---|---|
+| `@dependabot rebase` | Rebase the PR against the target branch |
+| `@dependabot recreate` | Recreate the PR from scratch, overwriting any manual edits |
+| `@dependabot ignore this dependency` | Close the PR and stop all future updates for this dependency |
+| `@dependabot ignore this major version` | Close and stop updates for this major version |
+| `@dependabot ignore this minor version` | Close and stop updates for this minor version |
+| `@dependabot ignore this patch version` | Close and stop updates for this patch version |
+| `@dependabot show DEPENDENCY_NAME ignore conditions` | Display a table of all current ignore conditions for the dependency |
+
+## Commands for Grouped Updates
+
+These commands work on Dependabot PRs created by grouped version or security updates.
+
+| Command | Description |
+|---|---|
+| `@dependabot ignore DEPENDENCY_NAME` | Close the PR and stop updating this dependency in the group |
+| `@dependabot ignore DEPENDENCY_NAME major version` | Stop updating this dependency's major version |
+| `@dependabot ignore DEPENDENCY_NAME minor version` | Stop updating this dependency's minor version |
+| `@dependabot ignore DEPENDENCY_NAME patch version` | Stop updating this dependency's patch version |
+| `@dependabot unignore *` | Close current PR, clear ALL ignore conditions for ALL dependencies in the group, open a new PR |
+| `@dependabot unignore DEPENDENCY_NAME` | Close current PR, clear all ignores for a specific dependency, open a new PR with its updates |
+| `@dependabot unignore DEPENDENCY_NAME IGNORE_CONDITION` | Close current PR, clear a specific ignore condition, open a new PR |
+
+## Usage Examples
+
+### Merge After CI (Use Native GitHub Features)
+
+Auto-merge is the recommended replacement for the deprecated `@dependabot merge` command:
+
+```bash
+# Enable auto-merge via GitHub CLI
+gh pr merge <PR_NUMBER> --auto --squash
+
+# Or enable auto-merge via the GitHub UI:
+# PR → "Enable auto-merge" → select merge method → confirm
+```
+
+GitHub will automatically merge the PR once all required CI checks pass.
+
+### Ignore a Major Version Bump
+
+```
+@dependabot ignore this major version
+```
+
+Useful when a major version has breaking changes and migration is not yet planned.
+
+### Check Active Ignore Conditions
+
+```
+@dependabot show express ignore conditions
+```
+
+Displays a table showing all ignore conditions currently stored for the `express` dependency.
+
+### Unignore a Dependency in a Group
+
+```
+@dependabot unignore lodash
+```
+
+Closes the current grouped PR, clears all ignore conditions for `lodash`, and opens a new PR that includes available `lodash` updates.
+
+### Unignore a Specific Condition
+
+```
+@dependabot unignore express [< 1.9, > 1.8.0]
+```
+
+Clears only the specified version range ignore for `express`.
+
+## Tips
+
+- **Rebase vs Recreate**: Use `rebase` to resolve conflicts while keeping your review state. Use `recreate` to start fresh if the PR has diverged significantly.
+- **Force push over extra commits**: If you've pushed commits to a Dependabot branch and want Dependabot to rebase over them, include `[dependabot skip]` in your commit message.
+- **Persistent ignores**: Ignore commands via PR comments are stored centrally. For transparency in team repos, prefer using `ignore` in `dependabot.yml` instead.
+- **Merging Dependabot PRs**: Use GitHub's native auto-merge feature, the CLI (`gh pr merge`), or the web UI. The old `@dependabot merge` commands were deprecated in January 2026.
+- **Closing/Reopening**: Use the GitHub UI or CLI. The old `@dependabot close` and `@dependabot reopen` commands were deprecated in January 2026.
+- **Grouped commands**: When using `@dependabot unignore`, Dependabot closes the current PR and opens a fresh one with the updated dependency set.

package/skills/devops-rollout-plan/LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright GitHub, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/skills/devops-rollout-plan/SKILL.md

@@ -0,0 +1,117 @@
+---
+name: devops-rollout-plan
+description: 'Generate comprehensive rollout plans with preflight checks, step-by-step deployment, verification signals, rollback procedures, and communication plans for infrastructure and application changes'
+---
+
+# DevOps Rollout Plan Generator
+
+Your goal is to create a comprehensive, production-ready rollout plan for infrastructure or application changes.
+
+## Input Requirements
+
+Gather these details before generating the plan:
+
+### Change Description
+- What's changing (infrastructure, application, configuration)
+- Version or state transition (from/to)
+- Problem solved or feature added
+
+### Environment Details
+- Target environment (dev, staging, production, all)
+- Infrastructure type (Kubernetes, VMs, serverless, containers)
+- Affected services and dependencies
+- Current capacity and scale
+
+### Constraints & Requirements
+- Acceptable downtime window
+- Change window restrictions
+- Approval requirements
+- Regulatory or compliance considerations
+
+### Risk Assessment
+- Blast radius of change
+- Data migrations or schema changes
+- Rollback complexity and safety
+- Known risks
+
+## Output Format
+
+Generate a structured rollout plan with these sections:
+
+### 1. Executive Summary
+- What, why, when, duration
+- Risk level and rollback time
+- Affected systems and user impact
+- Expected downtime
+
+### 2. Prerequisites & Approvals
+- Required approvals (technical lead, security, compliance, business)
+- Required resources (capacity, backups, monitoring, rollback automation)
+- Pre-deployment backups
+
+### 3. Preflight Checks
+- Infrastructure health validation
+- Application health baseline
+- Dependency availability
+- Monitoring baseline metrics
+- Go/no-go decision checklist
+
+### 4. Step-by-Step Rollout Procedure
+**Phases**: Pre-deployment, deployment, progressive verification
+- Specific commands for each step
+- Validation after each step
+- Duration estimates
+
+### 5. Verification Signals
+**Immediate** (0-2 min): Deployment success, pods/containers started, health checks passing
+**Short-term** (2-5 min): Application responding, error rates acceptable, latency normal
+**Medium-term** (5-15 min): Sustained metrics, stable connections, integrations working
+**Long-term** (15+ min): No degradation, capacity healthy, business metrics normal
+
+### 6. Rollback Procedure
+**Decision Criteria**: When to initiate rollback
+**Rollback Steps**: Automated, infrastructure revert, or full restore
+**Post-Rollback Verification**: Confirm system health restored
+**Communication**: Stakeholder notification
+
+### 7. Communication Plan
+- Pre-deployment (T-24h): Schedule and impact notice
+- Deployment start: Commencement notice
+- Progress updates: Status every X minutes
+- Completion: Success confirmation
+- Rollback (if needed): Issue notification
+
+**Stakeholder Matrix**: Who to notify, when, via what method, with what content
+
+### 8. Post-Deployment Tasks
+- Immediate (1h): Verify criteria met, review logs
+- Short-term (24h): Monitor metrics, review errors
+- Medium-term (1 week): Post-deployment review, lessons learned
+
+### 9. Contingency Plans
+Scenarios: Partial failure, performance degradation, data inconsistency, dependency failure
+For each: Symptoms, response, timeline
+
+### 10. Contact Information
+- Primary and secondary on-call
+- Escalation path
+- Emergency contacts (infrastructure, security, database, networking)
+
+## Plan Customization
+
+Adapt based on:
+- **Infrastructure Type**: Kubernetes, VMs, serverless, databases
+- **Risk Level**: Low (simplified), medium (standard), high (additional gates)
+- **Change Type**: Code deployment, infrastructure, configuration, data migration
+- **Environment**: Production (full plan), staging (simplified), development (minimal)
+
+## Remember
+
+- Always have a tested rollback plan
+- Communicate early and often
+- Monitor metrics, not just logs
+- Document everything
+- Learn from each deployment
+- Never deploy on Friday afternoon (unless critical)
+- Never skip verification steps
+- Never assume "it should work"

package/skills/devops-rollout-plan/SYNC.md

@@ -0,0 +1,5 @@
+# Sync Info
+
+- **Source:** `vendor/awesome-copilot/skills/devops-rollout-plan`
+- **Git SHA:** `23fb7006c132a0bba75b0e5af7a35cab11272812`
+- **Synced:** 2026-03-24

package/skills/documentation-writer/LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright GitHub, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.