A comprehensive utility for managing GitHub repository metadata, security, documentation, CI/CD pipelines, and overall repository health to ensure compliance with organization standards.
This enterprise-grade tool addresses comprehensive repository management needs:
- π Repository Health Scoring: Calculate overall repository health with weighted scoring
- π Security Management: Security audits, vulnerability detection, and policy enforcement
- π‘οΈ Branch Protection: Automated branch protection rule management
- π Documentation Standards: Quality analysis and auto-generation of documentation
- βοΈ CI/CD Pipeline Management: Workflow analysis and template generation
- π― Compliance Automation: Full compliance checking with auto-fix capabilities
- π€ AI Agent Mode: Zero-configuration automation for CI/CD and AI agents
- π Cross-Repository Automation: Organization-wide health monitoring and dependency tracking
- π Interactive Management: User-friendly CLI with guided workflows
- π§ MCP Server: Model Context Protocol server for AI assistants (GitHub Copilot, Claude) β¨ NEW
npm install --save-dev @alteriom/repository-metadata-managernpm install -g @alteriom/repository-metadata-managerCreate a metadata-config.json file:
{
"organizationTag": "myorg"
}{
"scripts": {
"health": "repository-manager health",
"security": "repository-manager security --audit",
"compliance": "repository-manager compliance"
}
}npm run health# View compliance report
npm run compliance
# Apply automatic fixes
npm run compliance --fixnpm run interactive# Generate comprehensive organization report
npm run analytics
# Export analytics to file
repository-manager analytics --save organization-report.json# List available templates
npm run template -- --list
# Generate IoT firmware project
npm run template -- --type iot-firmware --name my-sensor-project
# Generate AI agent project
npm run template -- --type ai-agent --name my-automation-agent# Run organization-wide health audit
npm run automation:org-health
# Detect missing workflows across all repos
npm run automation:detect-workflows
# Track dependencies across organization
npm run automation:track-deps
# Generate compliance report with auto-save
npm run automation:compliance
# Generate security vulnerability dashboard
npm run automation:security
# Run automated maintenance tasks
npm run automation:maintenance
# Auto-fix compliance issues (dry-run)
npm run automation:dry-run
# Auto-fix compliance issues (apply changes)
npm run automation:auto-fixUse repository management tools directly in GitHub Copilot, Claude, and other AI assistants via Model Context Protocol:
# Install MCP server dependencies
cd mcp-server && npm install
# Server automatically activates in VS Code
# Open GitHub Copilot Chat β Agent mode β Tools icon
# You'll see 13 repository management tools available
# Example prompts:
"Calculate health score for this repository"
"What documentation is missing?"
"Run security audit"
"Auto-fix compliance issues (dry-run first)"Features:
- 13 tools for health, security, docs, CI/CD, compliance
- Natural language interface through AI assistants
- Organization-wide operations
- Auto-fix capabilities with dry-run
- See
mcp-server/README.mdfor full documentation
Zero-configuration compliance automation for AI agents and CI/CD environments:
# Detect environment and token availability
repository-manager ai-agent --detect
# Run in local-only mode (no GitHub API required)
repository-manager ai-agent --local-only
# Dry-run mode - show what would be fixed
repository-manager ai-agent --dry-run
# Auto-fix compliance issues
repository-manager ai-agent --auto-fix
# Full automation (local fixes + API checks)
repository-manager ai-agent --auto-fixKey Features:
- π Automatic Token Detection: Hierarchical token detection (Environment β GitHub Actions β .env file)
- π€ GitHub Actions Integration: Automatic detection and configuration when running in CI/CD
- π Local File Fixes: Create missing documentation (SECURITY.md, CONTRIBUTING.md, etc.)
- π§ Auto-Fix Capabilities: Automated compliance fixes without manual intervention
- π‘οΈ Graceful Degradation: Works even without GitHub API access
Example: GitHub Actions Workflow
name: Compliance Check
on: [pull_request, push]
jobs:
compliance:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
- run: npm install -g @alteriom/repository-metadata-manager
- run: repository-manager ai-agent --auto-fix
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}See AI Agent Workflow for the complete automated workflow.
| Command | Description |
|---|---|
health |
Calculate overall repository health score (0-100) |
security |
Security audit and vulnerability detection |
branches |
Branch protection analysis and enforcement |
docs |
Documentation quality assessment and generation |
cicd |
CI/CD workflow analysis and template generation |
iot |
IoT-specific compliance and template generation |
compliance |
Full compliance check with auto-fix capabilities |
ai-agent |
AI agent mode with automatic token detection and local fixes β¨ NEW |
automation |
Cross-repository operations and organization-wide automation |
interactive |
Interactive wizard for guided repository management |
analytics |
Organization-wide analytics and insights |
template |
Generate new projects from comprehensive templates |
security-policy |
Generate and manage security policies |
The Repository Metadata Manager now includes a comprehensive template engine for rapid project scaffolding, specifically designed for Alteriom organization patterns.
| Template Type | Language | Description |
|---|---|---|
iot-firmware |
C++ | ESP32/ESP8266 firmware with sensors, LoRa, WiFi mesh |
ai-agent |
JavaScript | AI-powered automation and repository management |
iot-platform |
TypeScript | Multi-tenant IoT platform with React + FastAPI |
cli-tool |
JavaScript | Command-line tools with comprehensive features |
IoT Firmware Template:
- Complete PlatformIO configuration for ESP32/ESP8266
- Sensor management (DHT22, BMP280, custom sensors)
- WiFi connectivity with automatic reconnection
- MQTT communication for telemetry
- LoRa mesh networking support
- OTA update capabilities
- Hardware documentation templates
- Security and encryption modules
AI Agent Template:
- GitHub API integration with Octokit
- Automated compliance monitoring
- Issue and PR creation capabilities
- Configurable automation workflows
- Comprehensive test suite
- Docker deployment configuration
IoT Platform Template:
- React TypeScript frontend with modern UI
- FastAPI Python backend with async support
- MQTT integration for real-time data
- InfluxDB time-series data storage
- Redis caching and session management
- Multi-tenant architecture
- Grafana dashboard configurations
- Docker Compose for local development
# Interactive template generation
npm run interactive
# Select "π¨ Generate New Project"
# Command line usage
npm run template -- --type iot-firmware --name weather-station
npm run template -- --type ai-agent --name compliance-bot
npm run template -- --type iot-platform --name sensor-dashboard
# List all available templates
npm run template -- --list| iot | IoT-specific compliance and template generation |
| compliance | Full compliance check with auto-fix capabilities |
| interactive | Interactive wizard for guided repository management |
Specialized features for IoT/embedded systems development, designed for organizations like Alteriom with extensive IoT portfolios.
The tool automatically detects and handles four types of IoT repositories:
- π§ IoT Firmware (
iot-firmware): ESP32/ESP8266, Arduino, PlatformIO projects - π₯οΈ IoT Server (
iot-server): MQTT backends, sensor data processing, telemetry - π IoT Documentation (
iot-documentation): Hardware specs, API docs, setup guides - π³ IoT Infrastructure (
iot-infrastructure): Docker containers, deployment configs
# Run IoT-specific compliance audit
npm run iot
# Generate IoT project templates
repository-manager iot --template firmware # ESP32/Arduino firmware
repository-manager iot --template server # Python/FastAPI MQTT server
repository-manager iot --template infrastructure # Docker deployment
repository-manager iot --template documentation # IoT project docsIoT repositories get specialized scoring based on:
- Firmware Projects: PlatformIO config, security headers, OTA updates, hardware docs
- Server Projects: MQTT handlers, database schemas, API documentation, monitoring
- Documentation: Hardware specs, setup guides, troubleshooting, examples
- Infrastructure: Container configs, monitoring, security policies, deployment scripts
Firmware Template Features:
- PlatformIO configuration for ESP32/ESP8266
- Security and encryption modules
- WiFi and MQTT connectivity
- Sensor management and calibration
- OTA update mechanisms
- Hardware documentation templates
Server Template Features:
- FastAPI with MQTT integration
- InfluxDB time-series data storage
- Redis caching and session management
- Grafana dashboard configurations
- Docker containerization
- API documentation and testing
Example IoT Audit Output:
π Starting IoT-Specific Compliance Audit...
β
IoT repository detected
π IoT Compliance Score: 85/100
π― Repository Type: iot-firmware
π§ IoT Files Detected:
β’ platformio.ini
β’ src/main.cpp
β’ include/config.h
β’ lib/sensors/
β
Compliance Findings:
β
PlatformIO configuration found
β
Main firmware file found
β
Header files directory found
β
Documentation found
π‘ Recommendations:
β’ Add security header file (include/security.h)
β’ Add OTA update configuration
β’ Include hardware compatibility matrix
π Security Recommendations:
β’ Consider adding cryptographic functions
β’ Implement WiFi credential security
β’ Add MQTT authenticationComprehensive analytics and insights across all repositories in your organization, providing detailed visibility into health, compliance, and technology adoption patterns.
- Repository Health Overview: Aggregated health scores and grade distribution
- Language & Technology Analysis: Usage patterns and technology adoption
- IoT Portfolio Insights: Specialized analysis for IoT/embedded projects
- Security Posture Assessment: Organization-wide security metrics
- Compliance Trends: Tracking compliance improvements over time
- Actionable Recommendations: Prioritized suggestions for improvement
# Generate comprehensive organization report
npm run analytics
# Export analytics to JSON
repository-manager analytics --export json --save org-report.json
# Export analytics to CSV for spreadsheet analysis
repository-manager analytics --export csv --save org-metrics.csvπ’ ALTERIOM ORGANIZATION ANALYTICS REPORT
============================================================
π ORGANIZATION OVERVIEW
Total Repositories: 12
Private/Public: 8/4
Average Health Score: 87/100
Total Stars: 156
Total Forks: 23
Open Issues: 14
π» LANGUAGE DISTRIBUTION
JavaScript: 5 repositories (42%)
C++: 4 repositories (33%)
TypeScript: 2 repositories (17%)
Python: 1 repositories (8%)
π IOT PORTFOLIO ANALYSIS
Total IoT Repositories: 6
Average IoT Health: 92/100
Top IoT Technologies:
β’ esp32: 4 projects
β’ mqtt: 4 projects
β’ platformio: 3 projects
β’ sensors: 3 projects
π― KEY RECOMMENDATIONS
1. π΄ [Security] Implement organization-wide security policies
2. π‘ [Documentation] 3 repositories missing descriptions
3. π‘ [IoT] Consider creating shared IoT libraries
Powerful cross-repository automation features for organization-wide management and monitoring.
- Organization Health Monitoring: Daily automated health audits across all repositories
- Workflow Detection: Automatically detect repositories missing critical CI/CD workflows
- Dependency Tracking: Monitor and coordinate dependency versions across all repositories
- Compliance Reporting: Generate org-wide compliance reports with critical issue tracking β¨ NEW
- Security Dashboard: Track security vulnerabilities across all repositories β¨ NEW
- Automated Maintenance: Run scheduled maintenance tasks (stale issues, outdated deps, unused workflows) β¨ NEW
- Compliance Auto-Fix: Automatically fix common compliance issues
- Automated Reporting: Generate comprehensive reports and create GitHub issues for issues needing attention
# Run organization-wide health audit
npm run automation:org-health
# Detect missing workflows across all repositories
npm run automation:detect-workflows
# Track dependencies and identify version conflicts
npm run automation:track-deps
# Generate compliance report (saved to compliance-report-YYYY-MM-DD.json)
npm run automation:compliance
# Generate security vulnerability dashboard (saved to security-dashboard-YYYY-MM-DD.json)
npm run automation:security
# Run automated maintenance tasks (stale issues, outdated deps, unused workflows)
npm run automation:maintenance
# Auto-fix compliance issues (preview mode)
npm run automation:dry-run
# Auto-fix compliance issues (apply changes)
npm run automation:auto-fixGenerate comprehensive organization-wide compliance reports with:
- Health Score Analysis: Average health scores across all repositories
- Compliance Status: Count of compliant (β₯80) vs non-compliant (<80) repositories
- Critical Issue Tracking: Identifies repositories with critical security issues
- Auto-Save Reports: Reports saved to
compliance-report-YYYY-MM-DD.json
Example Output:
π Compliance Summary:
Total Repositories: 29
Compliant (β₯80): 1
Non-Compliant (<80): 28
Average Health Score: 38.7
Critical Security Issues: 25
Generate security vulnerability dashboards tracking:
- Security Scoring: Categorize repositories by security level (secure β₯80, critical <50)
- Vulnerability Count: Track total vulnerable repositories
- Priority Levels: High priority (<70) and critical (<50) repositories
- Actionable Recommendations: Specific security improvements needed
- Auto-Save Dashboards: Saved to
security-dashboard-YYYY-MM-DD.json
Example Output:
π Security Overview:
Total Repositories: 29
Secure (β₯80): 3
Vulnerable (<80): 26
Critical Issues (<50): 22
π‘ Recommendations:
1. Immediate action required for repositories with critical security issues
2. Review and update security policies for vulnerable repositories
Run scheduled maintenance tasks across all repositories:
- Stale Issue Detection: Find issues inactive for 90+ days
- Outdated Dependency Tracking: Identify repositories with outdated dependencies
- Unused Workflow Detection: Find unused or obsolete CI/CD workflows
- Configurable Tasks: Run specific tasks with
--tasksparameter
Task Options:
# Run all maintenance tasks (default)
npm run automation:maintenance
# Run specific tasks only
repository-manager automation --maintenance --tasks stale-issues,outdated-deps
repository-manager automation --maintenance --tasks unused-workflowsExample Output:
π Running task: stale-issues
Found 0 stale issues
π Running task: outdated-deps
Checked 5 repositories for outdated dependencies
π Running task: unused-workflows
Found 31 workflows across repositories
The organization health monitor runs automatically via GitHub Actions:
- Schedule: Daily at 6 AM UTC
- Monitors: All repositories in the organization
- Reports: Health scores, missing workflows, dependency conflicts, compliance status
- Alerts: Automatic GitHub issues for repositories below health threshold
π Running Organization-Wide Health Audit...
Found 27 repositories
[A] repository-metadata-manager: 96/100
[B] alteriom-mqtt-schema: 88/100
[C] alteriom-firmware: 72/100
[F] alteriom-data-analytics: 45/100
π Health Audit Summary:
Total Repositories: 27
Unhealthy (< 70): 5
Average Health Score: 82.3
β οΈ Unhealthy Repositories:
- alteriom-data-analytics (45/100): 8 issues
- alteriom-config-manager (52/100): 6 issues
For complete automation documentation, see AUTOMATION.md.
Comprehensive security policy generation and management for enterprise-grade security standards across all repository types.
| Policy Type | Description | Use Case |
|---|---|---|
organization |
Standard organizational security policy | All repositories |
iot |
Enhanced IoT device and firmware security | IoT/embedded projects |
ai-agent |
AI agent and automation security | AI/automation systems |
web-platform |
Web application security policy | Web applications |
Organization Policy:
- Vulnerability disclosure procedures
- Incident response planning
- Security contact information
- Compliance guidelines
- Supported versions matrix
IoT Policy:
- Hardware security requirements
- Firmware security standards
- Device authentication protocols
- Secure communication guidelines
- OTA update security
AI Agent Policy:
- API security standards
- Data privacy protection
- Automation security controls
- GitHub integration security
Web Platform Policy:
- Authentication and authorization
- Data protection standards
- Web application security
- HTTPS/TLS requirements
# Audit existing security policies
npm run security-policy -- --audit
# Generate organization security policy
npm run security-policy -- --generate --type organization
# Generate IoT-specific security policy
npm run security-policy -- --generate --type iot --contact security@yourorg.comStandard Organization Policy:
SECURITY.md- Main security policy.github/SECURITY.md- GitHub security integrationdocs/security/SECURITY_GUIDELINES.md- Detailed guidelinesdocs/security/VULNERABILITY_DISCLOSURE.md- Disclosure proceduresdocs/security/INCIDENT_RESPONSE.md- Response procedures
IoT-Specific Policy:
- Enhanced device security requirements
- Firmware security standards
- Hardware security guidelines
- Secure communication protocols
# Interactive security policy management
npm run interactive
# Select "π‘οΈ Security Policy Management"
# Command line usage
repository-manager security-policy --audit
repository-manager security-policy --generate --type iot
repository-manager security-policy --generate --type organization --contact security@alteriom.comπ Security Policy Score: 85/100
β
SECURITY.md file
β
GitHub security policy
β
Security documentation
β Security workflow
Fix: Add automated security scanning workflow
π‘ Recommendations:
1. Add vulnerability disclosure timeline section
2. Include emergency contact procedures
3. Implement automated security scanning
| Command | Description |
|---|---|
report |
Generate compliance report with recommendations |
validate |
Check if current metadata meets compliance requirements |
dry-run |
Preview what changes would be made |
apply |
Apply recommended changes (requires GitHub token) |
Create a .env file for local development:
# Copy the example file
cp .env.example .env
# Edit with your tokens
NPM_TOKEN=npm_your_token_here
GITHUB_TOKEN=ghp_your_github_token_here
ORGANIZATION_TAG=alteriomAll CLI commands will automatically load the .env file. See ENVIRONMENT.md for detailed setup instructions.
Create a metadata-config.json file:
{
"organizationTag": "myorg",
"organizationName": "My Organization",
"packagePath": "./package.json",
"repositoryType": "auto-detect",
"customTopics": {
"ai-agent": ["automation", "github-integration", "compliance"],
"api": ["api", "backend", "server"],
"frontend": ["frontend", "ui", "web"],
"cli-tool": ["cli", "tool", "command-line"],
"library": ["library", "package", "sdk"],
"general": ["utility"]
}
}# GitHub API access
GITHUB_TOKEN=ghp_your_token_here
# or
AGENT_ORG_TOKEN=ghp_your_token_here
# Repository identification (auto-detected from git if not set)
GITHUB_REPOSITORY_OWNER=your-org
GITHUB_REPOSITORY_NAME=your-repo-namerepository-metadata report --owner myorg --repo my-repo --org-tag myorg --token ghp_xxx| Option | Description | Default |
|---|---|---|
--owner |
Repository owner | Auto-detected from git remote |
--repo |
Repository name | Auto-detected from git remote |
--token |
GitHub API token | From environment variables |
--package-path |
Path to package.json | ./package.json |
--org-tag |
Organization tag for topics | REQUIRED |
--config |
Configuration file path | None |
- Reads your
package.jsonfor description and keywords - Analyzes repository type (ai-agent, api, frontend, library, etc.)
- Generates appropriate topics based on content and type
- Validates current GitHub repository metadata
- Provides exact values and instructions for fixes
$ npm run metadata:report
π Generating repository metadata compliance report...
π Current Repository Metadata:
Description: ""
Topics: []
π¦ Package.json Metadata:
Description: "AI-powered repository review agent"
Keywords: [ai-agent, automation, github]
β Compliance Issues Found:
β’ Missing repository description
β’ Missing repository topics/tags for discoverability
π― Recommended Changes:
Description: "AI-powered repository review agent"
Topics: [myorg, ai-agent, automation, github, github-integration, compliance]- ai-agent: automation, github-integration, compliance
- api: api, backend, server
- frontend: frontend, ui, web
- cli-tool: cli, tool, command-line
- library: library, package, sdk
- general: utility
If you can't use npm scripts, you can run the tool directly:
# Using npx
npx @alteriom/repository-metadata-manager report
# Using node (if files copied locally)
node scripts/utility/repository-metadata-manager.js report-
Add to package.json:
npm install --save-dev @alteriom/repository-metadata-manager
-
Add scripts:
{ "scripts": { "metadata:report": "alteriom-metadata report", "metadata:validate": "alteriom-metadata validate", "metadata:apply": "alteriom-metadata apply", "metadata:dry-run": "alteriom-metadata dry-run" } } -
Run compliance check:
npm run metadata:validate
- Create organization template with the tool pre-installed
- Add to CI/CD to automatically check compliance
- Use in GitHub Actions for automated compliance checking
name: Repository Compliance Check
on: [push, pull_request]
jobs:
metadata-compliance:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: '18'
- run: npm install
- run: npm run metadata:validate
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}This tool is designed to be extended and customized for your organization's needs:
- Fork or copy the package
- Modify the
generateRecommendedTopics()method for your topic strategy - Update the
organizationTagconfiguration - Customize validation rules in
validateMetadata()
The project includes comprehensive testing with different levels:
# Run all tests (including unstable ones)
npm test
# Run only stable core functionality tests (used for releases)
npm run test:core
# Run unstable tests that need infrastructure fixes
npm run test:unstable
# Run feature integration tests
npm run test:features- Core Tests (92 tests): Stable tests covering essential functionality
- Feature Manager Tests: Testing individual feature modules (may have infrastructure dependencies)
- CLI Integration Tests: End-to-end command-line interface testing
- Enhanced CLI Tests: Advanced CLI functionality testing
- Core functionality is thoroughly tested and stable
- Feature tests may require additional infrastructure setup
- Release process uses only stable core tests to ensure reliability
- All functionality works as demonstrated by working npm scripts
MIT License - feel free to use and modify for your organization.
For comprehensive documentation, guides, and organizational standards, visit the Alteriom Documentation Repository:
π Alteriom Central Documentation
Comprehensive documentation is available in the docs/ directory and .github/DOCUMENTATION.md:
- Documentation Index - Complete documentation hub with central links
- Local Documentation - Complete local documentation overview
- Environment Setup - Development environment configuration
- Organization Setup - Organization-wide setup guide
- CLI Reference - Command-line interface guide
- Automation Guide - Cross-repository automation features
- Implementation Details - Technical architecture
- API Reference - Detailed API documentation
- Versioning Guidelines - Release management
- Release Notes - Version history and changelogs
- Issues: Report bugs or request features via GitHub Issues
- Documentation: Check our comprehensive documentation
- Contributing: See CONTRIBUTING.md for contribution guidelines
- Organization Standards: Refer to Alteriom organization guidelines