fleettools

Sweeps across about 1800 repositories and about 320 organisations: which default branches are red, which runners stopped, which modules are ahead of their tag, which foreign judges the CI never installs, and which tests exist without ever running. Repository → Latest tag: v0.40.1 (which only adds the LICENSE to v0.40.0’s code); this page is written from the top of its README at v0.40.0, which is long (about 430 lines), and from the layout of the repository. Read the README for each command.

The sweeps were written to get every default branch green, and the README says why each one is built the way it is. It has one directory per sweep under cmd/; the module is github.com/go-fleettools/fleettools, and a command is installed as Go installs tools (the README’s example is go install .../cmd/vulngate@v0.18.1).

The commands

The directories under cmd/ at v0.40.0 are:

abbench blobpurge brandcheck brief buildscan buildtag clonescan covblocks cronscan
docscan docscheck docsversions docsym glmerge gopin gorequires gvlscan hostload
i18ncheck judgescan landingmigrate langcheck mantracheck mkdocs2hextra modrename
pagescheck pagespublish pagesretire pagetext pinscan pngeq prmerge prscan qemufix
quietscan redscan relverify sitelinks tagcells tagscan testscan treecmp truncspill
unarc vscan vulngate vulnscan wasmsize wfaudit

The README’s table, which opens with the sweeps written on 2026-08-30, describes some of them, for example:

The organisation’s profile README (the organisation’s own index of the commands, which it says “nothing else can find”) groups thirty of the 49 by the question they answer. It predates part of cmd/ (49 directories at v0.40.0, each with a main.go, counted on 2026-10-26), so the list is not complete:

• Is the fleet green? redscan, quietscan (organisations whose Renovate runner stopped: a runner that stops does not fail, it says nothing), prscan, prmerge, relverify (whether a tagged release is what its tag says).
• Is what is merged reachable, and is the version right? tagscan, vscan, tagcells, gorequires.
• Does the CI actually test it? testscan, judgescan (tests that look for an external tool the CI never installs), covblocks, buildscan, buildtag.
• Is it safe? vulnscan (which repositories reach a known vulnerability), vulngate (the per-repository half), wfaudit, blobpurge.
• Is it advertised, and is the page what it builds? docscan (every repository an organisation has and does not advertise), pagescheck, docsym, i18ncheck.
• What does it cost, and on what? wasmsize, hostload, truncspill, gvlscan, gopin.
• The small ones: brief (runs a command, shows the end of what it said, and keeps its exit status), unarc, modrename.

pagespublish publishes a documentation version in the workflows of every docs site, this one included.

What is built into them

• They say when they are not the code in this repository (a binary installed from an old tag is compared with what changed for that command).
• Every one answers -h with 0. redscan -h once ran a full sweep of every organisation, and a test now fails any command that cannot answer -h.
• A sweep asks for the hourly API budget before spending it and refuses to begin below a floor, because that budget is per user and shared with the fleet’s Renovate runners.
• A failed call must never become a verdict, and a budget stop is reported separately from “could not be read”.

quietscan

The README devotes sections to quietscan, the sweep for stopped Renovate runners: “What quietscan is, and the five rules it will not soften”, attribution (“the property belongs to whatever COVERS the repository”), “A failed call must never become a verdict”, “What one pass costs, and when not to run it”, and “Two things quietscan is not”. Read them there before scheduling it beside another sweep.