cmd/

Command abbench runs two Go test binaries alternately, base then head, for N rounds with the same arguments, and appends each run's stdout to <out>/base.txt and <out>/head.txt, so that

blobpurge removes blobs from a repository's history BY ID, and proves what the rewrite did before anybody pushes it.

brandcheck says whether a brand repository carries everything it claims to.

Command brief runs a command, shows the end of what it said, and keeps its exit status.

Command buildscan answers two questions a green CI cannot: which build configurations does a repository's CI actually compile, and is there source in the tree that none of them reaches.

Command buildtag adds a build constraint to Go source files: it ANDs the given expression into each file's //go:build line, or writes that line when the file has none.

Command clonescan says, for each local git repository under the directories it is given, whether deleting it would lose anything:

Command covblocks counts the BLOCKS a Go coverage profile never entered, and fails when there are any.

Command cronscan asks whether an organisation's SCHEDULED workflows actually fire, by counting the firings their cron expressions ask for against the `schedule` runs GitHub recorded.

docscan reports every repository an organisation HAS but does not ADVERTISE — and every one it advertises and no longer has.

Command docscheck asks which GENERATOR a published documentation URL was built with, and whether a site's default entry point serves the same one as its development tip.

Command docsversions builds every published version of a versioned Hugo documentation site with ONE look, and puts the builds in a GitLab package registry:

docsym reports the Go identifiers a module's README names that its code does not have.

Command flagcensus says, for every command in a repository, HOW it reads its arguments and what a migration from the standard `flag` package to cobra would have to carry across.

Command glmerge merges a GitLab merge request only when it is safe to:

Command gofloor says, for every Go repository of one or more organisations, which Go toolchain it can be built with and whether CI would notice a vulnerable one.

Command gopin replaces `go-version: stable` in a repository's workflows with an explicit version, and raises go.mod to match.

gorequires answers "which of our modules require module X, and at which version?" -- the reverse question nothing in the fleet could answer.

gvlscan reports calls that BLOCK the operating-system thread but are not wrapped in a call that releases the interpreter lock first.

Command hostload says how busy a Linux host's CPUs are right now, from two readings of /proc/stat, and which CPUs are the idlest -- the check to run before a measurement, and the CPU to pin it to.

i18ncheck reports where a translated Hugo content tree has drifted from the language it was translated from, in the four ways a translation must not change a page:

judgescan reports every repository whose tests look for an external tool that its CI never installs — a foreign judge that exists in the source and has never once run.

Command landingmigrate moves an organisation's landing onto the landing kit (go-fleettools/landingkit), one repository at a time, and says what it changed.

langcheck reports where this fleet's own prose on GitHub is not in English.

Command mantracheck asks whether an organisation's repositories bear out the fleet's mantra, LICENSE=BSD-3-Clause and CGO_ENABLED=0, before a landing page says so.

Command mdpdf renders a Markdown report to PDF with the fleet's own tools: go-kramdown (Markdown to HTML, pipe tables included), then go-pdfkit/html2pdf (HTML laid out by go-webengine, written by go-pdfkit), styled for print.

Command mkdocs2hextra converts an MkDocs Material site to Hugo with this fleet's Hextra fork.

modrename gives a forked Go module its new module path, everywhere the path is a module path and nowhere it is not.

Command needread prints the DT_NEEDED entries of every ELF under a tree, and refuses to report unless a symbol it was told to expect is actually there.

pagescheck asks whether a GitHub Pages site serves what its repository builds.

Command pagespublish puts one documentation build into a checkout of a gh-pages branch, the way mike did it, so that every published version keeps its own path.

Command pagesretire removes the superseded MkDocs version directories from a documentation branch, so that `latest` names the Hugo build.

Command pagetext says whether a PUBLISHED page contains the text we wrote:

pinscan answers "which of our modules are pinned to an UNTAGGED commit of another of our modules that has since been released?"

Command pngeq says whether the PNG images of two trees hold the same pixels:

Merges dependency pull requests that are both mergeable and fully green.

Counts open pull requests across every org the account owns.

Command qemufix repairs the GitHub Actions lanes that run a Go test binary under qemu user-mode emulation, broken fleet-wide by Ubuntu 26.04.

Reports every organisation whose Renovate runner has stopped running, or runs and fails.

Reports every workflow whose most recent run on its repository's default branch failed.

relverify checks that a tagged release is what its tag says it is: every published file listed in SHA256SUMS and matching it, every file attested by the repository's own workflow, every Go binary built from the tag's commit with an unmodified tree, and the binary for this machine answering --version with the tag.

Command sitelinks says whether every local link of a BUILT static site leads to a file of that build:

Command sitemigrate moves one docs site checkout (a Hugo site on the tannevaled/hextra fork) to the fork's native version selector and Go page history generator.

Command symfind says whether an ELF file EXPORTS a dynamic symbol.

tagcells keeps the version a page states for each module equal to the module's latest release.

tagscan reports every tagged Go module whose default branch is AHEAD of its latest tag — work that is merged and that `go get` cannot reach.

testscan reports every repository whose CI runs `go test` on only part of what has tests — or on nothing at all.

Command treecmp says whether two directory trees hold the same files, byte for byte:

Command truncspill reports where Go 1.27's loong64 back end spills a float-to-integer conversion in a way that can reach the stack slots next to it -- the shape of golang.org/issue/81000.

Command unarc extracts the archives in a directory, each into its own subdirectory, and never deletes the archive it read.

Reports, for every tagged Go module whose default branch has moved past its latest tag, what the next version number should be -- DERIVED from the public API rather than guessed.

Command vulngate reads one govulncheck JSON stream and decides what to do about it.

vulnscan runs govulncheck over every repository of a list and says, for each, whether a known vulnerability is REACHABLE from its code -- and, as loudly, whether the scan could read the code at all.

Command wasmsize says where the bytes of a Go WebAssembly binary go: the code of each package (or module), measured from the module's own code section, plus the data and the other sections.

wfaudit reports GitHub Actions workflows that let somebody else's pull request reach this repository's secrets or write token.