Master Bot & Repository Supervisor
A centralized Master Bot that supervises, secures, watermarks, and auto-triages every repository across the GitHub account.
- 01Checked from outside
- 02Automated Fix PRs
- 03Secret & hygiene scanning
- 04Automated PR tagging
- 05Issue classification & triage
- 06Consolidated status dashboard
- 07Reusable Composite Action
Architecture Overview
A centralized Master Bot and supervisor that continuously audits, maintains, and enforces repository standards across every repo in the account. Beyond checking for valid @authormark watermarks and tamper-evident HMAC fingerprints, it acts as an autonomous repo maintainer: auto-fixing unmarked files via isolated pull requests, scanning for exposed tokens and secrets, detecting dirty pycache/build artifacts, validating licensing and manifest hygiene, automatically calculating PR size tags (XS through XL), and triaging incoming issues. Operating as an external supervisor, it can never be bypassed or tampered with from inside the repository under test.
How it works
Core mechanics, failure recovery paths, and system design decisions.
Checked from outside
Runs standalone supervisor logic outside target repositories, ensuring a tampered workflow or compromised repository configuration cannot falsely declare itself clean.
Automated Fix PRs
In fix mode, checks out an isolated authormark branch, stamps unmarked or drifted source files with keyed HMAC signatures, and opens a clean, automated pull request without touching the default branch.
Secret & hygiene scanning
Scans commits and trees for leaked PATs, cloud API keys, AWS credentials, JWT tokens, committed .env files, and tracked metadata artifacts before they become liabilities.
Automated PR tagging
Calculates line-change deltas to assign size badges (size/XS to size/XL), detects language footprints, and classifies pull request types (type/feat, type/fix, type/ci) with pre-provisioned label palettes.
Issue classification & triage
Analyzes issue context, keywords, and priority signals to assign severity and category labels automatically, ensuring new issues are categorized on arrival.
Consolidated status dashboard
All account-wide findings are consolidated into a single GitHub issue that updates in place each day and closes automatically once every repo passes, preventing alert fatigue.
Reusable Composite Action
Provides Srinivasan-78/authormark-watch@main, a reusable GitHub Action that external workflows invoke with zero setup to verify watermarks or enforce repository security gates on CI.
Engineering Highlights
- •Autonomous fix mode opens ready-to-merge pull requests with intact watermarks
- •Full secret scanner catches exposed tokens and private keys across all branches
- •Automated PR size and category labeler maintains clean review queues across repos
- •Reusable composite action enables one-line integration across any repository
- •Single persistent status issue prevents alert fatigue by updating in place
- •Zero third-party dependencies: built with pure Node.js standard libraries and GitHub APIs