Starlark library

Helpers for the changes campaigns make most, built into gh fleet. They need no network and are versioned with the binary. Load them by module:

load("@fleet//files.star", "ensure_lines")

def change(repo):
    ensure_lines(repo, ".gitignore", [".env"])

Every helper:

• takes repo, the value passed to change(repo), as its first argument;
• is idempotent: run it on a repo that already has the change and it writes nothing, so the repo comes out as a no-op;
• edits files line by line where a parse and re-encode would lose comments or layout;
• returns what it changed, usually a list of paths, so the script can tell the PR about it with repo.set_var.

This reference is generated from the library's docstrings, and every example on these pages runs as a test, so it always matches the code. See Starlark changes for how scripts run.

Modules

Module	What it does	Functions
android.star	Raise Android SDK levels and the Android Gradle Plugin version.	3
ansible.star	Bump Ansible role and collection versions in requirements files.	2
argocd.star	Edit Argo CD Application manifests: move an application to a new revision or chart version.	2
azure_pipelines.star	Edit Azure Pipelines YAML: hosted agent images, task versions and template refs.	4
backstage.star	Edit Backstage catalog-info.yaml files: owners, annotations, tags and other entity fields.	7
bazel.star	Bump Bazel itself, Bzlmod module dependencies and http_archive downloads.	4
bitbucket.star	Edit Bitbucket Pipelines: step images and pipe versions.	3
buf.star	Bump Buf remote plugins, module dependencies and the buf.yaml format.	2
buildkite.star	Edit Buildkite pipelines: plugin versions, agent queues and step defaults.	6
cargo.star	Bump Rust crate dependencies and rust-version in Cargo.toml files.	4
cdk.star	Set AWS CDK context values, such as feature flags, in cdk.json.	2
changelog.star	Add entries to a Keep a Changelog style CHANGELOG.md.	2
circleci.star	Edit CircleCI configuration: orb versions, executor images, machine images and resource classes.	6
cmake.star	Bump CMake's minimum version and FetchContent dependency tags.	4
cocoapods.star	Bump CocoaPods pod versions and the platform version in Podfiles.	3
codeowners.star	Find and edit CODEOWNERS files.	3
codeql.star	Set up CodeQL code scanning: add a workflow, add languages and move the action.	5
dependabot.star	Detect package ecosystems, write a Dependabot configuration, and edit existing ones.	6
devcontainer.star	Edit Dev Container configs: images, feature versions and top-level settings.	7
docker.star	Find Dockerfiles, replace base images, and move images to a new tag in Dockerfiles, Compose files and Kubernetes manifests.	4
dotnet.star	.NET: bump NuGet packages, target frameworks and the SDK pinned in global.json.	5
drone.star	Move step and plugin images in Drone and Woodpecker CI pipelines.	2
editorconfig.star	Read and set properties in .editorconfig, line by line.	2
elixir.star	Bump Mix dependencies and the Elixir version requirement in mix.exs.	3
eslint.star	Set rules and presets in ESLint's JSON and YAML configs.	3
files.star	Keep lines in a file, replace text across the repo, and copy files from the campaign directory.	5
flux.star	Edit Flux HelmReleases and sources: chart versions and Git refs.	3
gha.star	Find GitHub Actions workflows, bump action versions, set inputs and add permissions.	8
gitattributes.star	Set attributes for path patterns in .gitattributes, such as line endings and Git LFS tracking.	2
github.star	Edit repository files under .github: issue template config, release note categories, labels and funding.	6
gitlab.star	Edit GitLab CI configuration: job and service images, included template refs, CI/CD component versions and defaults.	6
golangci.star	Edit golangci-lint configs: enable and disable linters and set linter settings.	5
gomod.star	Read and raise the go directive in go.mod files.	6
gradle.star	Bump Gradle dependencies, version catalog entries and the Gradle wrapper.	6
helm.star	Bump Helm chart versions, chart dependencies and image tags in values files.	5
helmfile.star	Bump chart versions of Helmfile releases.	2
jenkins.star	Edit Jenkinsfiles: shared library versions, agent images and tool versions.	5
jsonfile.star	Read and edit any JSON file, keeping key order and indentation.	5
k8s.star	Edit Kubernetes manifests: migrate removed API versions and set labels on every resource.	4
kustomize.star	Set image tags and names in kustomization files, the usual way to roll out a release with Kustomize.	2
license.star	Detect a repo's license, update its copyright year and set the license field in package manifests.	4
lintconfig.star	Set rules in markdownlint, yamllint and hadolint configs.	3
make.star	Read and set variables in Makefiles, such as GO_VERSION ?= 1.22.	3
markdown.star	Add or replace sections and badges in Markdown files such as README.md.	3
maven.star	Bump dependency, plugin and property versions in Maven pom.xml files.	3
npm.star	Find package.json files and edit them as data, keeping key order and indentation.	6
packer.star	Bump plugin versions in Packer templates.	2
php.star	Bump Composer package constraints and the PHP version in composer.json.	3
precommit.star	Read and bump hook revisions in .pre-commit-config.yaml.	2
prettier.star	Set Prettier options in whichever config a repo uses.	3
python.star	Bump pinned Python requirements and the supported Python version.	4
refs.star	Find, bump and pin versioned references in any file: name@ref, name#ref and source?ref=tag.	3
renovate.star	Edit Renovate configs: presets, package rules, schedules and other settings.	6
ruby.star	Bump gem versions, the Ruby version and Bundler, and set RuboCop's target Ruby.	6
runtime.star	Set language versions in version files: .nvmrc, .python-version, .tool-versions and friends.	2
sbt.star	Bump sbt, Scala, library dependencies and sbt plugins.	5
scanignore.star	Manage scanner ignore files: .trivyignore, .semgrepignore and .gitleaksignore.	4
scorecard.star	Set up OpenSSF Scorecard: add the workflow, move the action and add the README badge.	4
serverless.star	Move Serverless Framework services to a new Lambda runtime.	2
skaffold.star	Bump Helm chart versions deployed by Skaffold.	2
swift.star	Bump Swift Package Manager dependencies and the swift-tools-version.	3
terraform.star	Bump Terraform's required_version and provider version constraints.	3
terragrunt.star	Move Terragrunt and Terraform module sources to a new ?ref= tag.	2
toml.star	Read, set and delete keys in TOML files, such as pyproject.toml and Cargo.toml.	3
yamlpath.star	Read, set and delete keys in any YAML file by path, keeping comments and layout.	7

All functions

Function	What it does
gha.action_files	Lists the workflows and every local action's metadata file.
scanignore.add	Adds entries to a scanner's ignore file, creating it if needed.
scorecard.add_badge	Adds the OpenSSF Scorecard badge to the README, next to its other badges.
github.add_contact_link	Adds a contact link to the new-issue page, unless one with this URL exists.
changelog.add_entry	Adds a bullet under the Unreleased release, in a section such as Changed or Security.
eslint.add_extends	Adds a preset to extends unless it is already there.
devcontainer.add_feature	Adds a feature to a config that doesn't have it yet, in any version.
codeql.add_language	Adds a language to every CodeQL workflow that doesn't analyze it yet.
renovate.add_package_rule	Appends a rule to packageRules unless an identical rule is already there.
renovate.add_preset	Adds a preset to extends unless it is already there.
github.add_release_category	Adds a category to the release notes GitHub generates, unless one with this title exists.
backstage.add_tag	Adds a tag to metadata.tags, keeping the list's flow or block style.
dependabot.add_update	Adds an update entry to an existing Dependabot config, unless one covers that ecosystem and directory.
codeql.add_workflow	Writes a CodeQL workflow, unless the repo already runs CodeQL.
scorecard.add_workflow	Writes the Scorecard workflow, unless the repo already runs Scorecard.
argocd.applications	Lists the YAML files that define Argo CD Applications or ApplicationSets.
cdk.apps	Lists the repo's CDK apps.
gradle.build_files	Lists the build scripts and version catalogs.
sbt.build_files	Lists the sbt build files.
refs.bump	Moves every reference to name to a new ref.
gha.bump_action	Moves an action to a new version wherever a workflow or local action uses it.
docker.bump_base_image	Moves FROM lines of an image from one tag to another in every Dockerfile.
gitlab.bump_component	Moves an included CI/CD component to a new version.
bitbucket.bump_image	Moves the default or a step's image from one tag to another, keeping variants.
circleci.bump_image	Moves a Docker executor image from one tag to another.
devcontainer.bump_image	Moves the config's image from one tag to another.
docker.bump_image	Moves image: lines from one tag to another in YAML files.
drone.bump_image	Moves a step or plugin image from one tag to another, keeping variants.
gitlab.bump_image	Moves a job or service image from one tag to another.
jenkins.bump_image	Moves a container image used by an agent or step from one tag to another.
jenkins.bump_library	Moves a shared library to a new version in every Jenkinsfile.
circleci.bump_orb	Moves an orb to a new version in every config.
bitbucket.bump_pipe	Moves a pipe to a new version.
buildkite.bump_plugin	Moves a plugin to a new version in every pipeline.
azure_pipelines.bump_task	Moves a task to a new major version, such as Docker@1 to Docker@2.
helm.charts	Lists the repo's Helm charts.
gitlab.components	Lists the CI/CD components a config includes, with their versions.
dependabot.config	Builds the text of a dependabot.yml with one update entry per ecosystem.
golangci.config_version	Reads the config format version.
circleci.configs	Lists the repo's CircleCI configs.
gitlab.configs	Lists the repo's GitLab CI files.
jsonfile.delete	Removes a key by dotted key path.
toml.delete	Removes a key from a table.
yamlpath.delete	Removes a key and everything nested under it.
license.detect	Identifies the license from the license file's text.
golangci.disable_linter	Disables a linter, removing it from enable if it was there.
docker.dockerfiles	Lists the repo's Dockerfiles.
dependabot.ecosystems	Detects the package ecosystems a repo uses, from files at its root.
golangci.enable_linter	Enables a linter, removing it from disable if it was there.
backstage.ensure	Writes a Component catalog file, unless the repo already has one.
markdown.ensure_badge	Adds a badge to a Markdown file, next to the badges it already shows.
files.ensure_lines	Appends each of lines that a file does not already contain.
gha.ensure_permissions	Adds a top-level permissions block to each workflow that has none.
backstage.entities	Lists the entities in every catalog file.
scanignore.entries	Lists the entries in a scanner's ignore file.
devcontainer.features	Lists the features a config installs, with their versions.
backstage.files	Lists the repo's Backstage catalog files.
cmake.files	Lists the repo's CMake files.
devcontainer.files	Lists the repo's Dev Container configs.
helmfile.files	Lists the repo's Helmfiles.
kustomize.files	Lists the repo's kustomization files.
serverless.files	Lists the repo's Serverless configs.
skaffold.files	Lists the repo's Skaffold configs.
terraform.files	Lists the repo's Terraform files.
changelog.find	Finds the repo's changelog.
codeowners.find	Finds the CODEOWNERS file GitHub uses.
dependabot.find	Finds the repo's Dependabot configuration.
eslint.find	Finds the repo's ESLint config.
golangci.find	Finds the repo's golangci-lint config.
license.find	Finds the repo's license file.
prettier.find	Finds the repo's Prettier config.
refs.find	Lists every reference to name in the files matching files.
renovate.find	Finds the repo's Renovate config.
ruby.gemfiles	Lists the Gemfiles and gemspecs.
editorconfig.get	Reads a property.
jsonfile.get	Reads a value by dotted key path.
prettier.get	Reads an option from the Prettier config.
toml.get	Reads a key's value.
yamlpath.get	Reads a scalar value by key path.
yamlpath.get_in	Reads a scalar value by key path from YAML text rather than a file.
make.get_var	Reads the value of the first assignment to a variable.
gomod.go_version	Reads the version in a go.mod's go directive.
lintconfig.hadolint_ignore	Adds rules to the ignored list of .hadolint.yaml, creating the file if needed.
markdown.has_section	Reports whether a Markdown file has a heading with this text.
flux.helm_releases	Lists the YAML files that define Flux HelmReleases.
github.issue_templates	Lists the repo's issue templates and forms.
jenkins.jenkinsfiles	Lists the repo's Jenkinsfiles.
codeql.languages	Lists the languages CodeQL analyzes, across every CodeQL workflow.
jenkins.libraries	Lists the shared libraries Jenkinsfiles load, with their versions.
make.makefiles	Lists the repo's Makefiles.
cargo.manifests	Lists the repo's Cargo manifests.
k8s.manifests	Lists the YAML files that hold Kubernetes resources.
php.manifests	Lists the repo's composer.json files.
swift.manifests	Lists the repo's Package.swift files.
lintconfig.markdownlint_rule	Sets a markdownlint rule, such as MD013 (line length).
k8s.migrate_api_versions	Moves resources off API versions Kubernetes removed.
cmake.minimum_version	Reads the version from cmake_minimum_required.
gomod.modules	Lists the repo's Go modules.
circleci.orbs	Lists the orbs configs use, with their versions.
gomod.outdated	Finds the modules that require a dependency below a version.
codeowners.owners	Reads the owners of a CODEOWNERS pattern.
npm.packages	Lists the repo's package.json files.
gha.pin	Pins actions to commit SHAs, keeping the old ref as a comment.
refs.pin	Pins references to commit SHAs, keeping the old ref in a comment.
azure_pipelines.pipelines	Lists the repo's Azure Pipelines files.
buildkite.pipelines	Lists the repo's pipeline files.
drone.pipelines	Lists the repo's Drone and Woodpecker pipeline files.
bitbucket.pipes	Lists the pipes the pipeline uses, with their versions.
buildkite.plugins	Lists every plugin a pipeline uses, with its version.
cocoapods.podfiles	Lists the repo's Podfiles.
maven.poms	Lists the repo's pom.xml files.
dotnet.projects	Lists the project files and shared MSBuild props files.
elixir.projects	Lists the repo's mix.exs files.
scanignore.prune_expired	Removes .trivyignore entries whose expiry date has passed.
buildkite.queues	Lists the agent queues pipelines target.
devcontainer.read	Reads a Dev Container config, ignoring comments and trailing commas.
jsonfile.read	Reads a JSON file into a value whose dict keys keep the file's order.
npm.read_package	Reads a package.json as a dict whose keys keep the file's order.
scanignore.remove	Removes entries from a scanner's ignore file.
files.remove_lines	Removes every line equal to one of lines, after trimming whitespace.
renovate.remove_preset	Removes a preset from extends, such as a retired config:base.
gha.rename_branch	Renames a branch in workflow triggers and branch checks, as when master becomes main.
files.replace_all	Replaces every occurrence of a string with another, literally, in text files.
docker.replace_base_image	Replaces a whole image reference in the FROM lines of every Dockerfile.
renovate.replace_preset	Replaces a preset in extends where it is, such as config:base with config:recommended.
ansible.requirements	Lists the repo's Ansible Galaxy requirements files.
python.requirements_files	Lists the repo's requirements files.
gomod.requires	Reads every module a go.mod requires, in single-line and block form.
python.requires_python	Reads the requires-python of a pyproject.toml.
k8s.resources	Lists every resource in the repo's manifests.
precommit.revs	Reads the revision each hook repository is pinned to.
cargo.rust_version	Reads the rust-version of a Cargo.toml.
android.sdk_levels	Reads the SDK levels every module's build file sets.
dotnet.sdk_version	Reads the .NET SDK version pinned in global.json.
devcontainer.set	Sets a top-level setting, such as postCreateCommand or remoteUser.
editorconfig.set	Sets a property, adding it, or its section, when missing.
gitattributes.set	Gives a pattern attributes, merging with any it already has.
jsonfile.set	Sets a value by dotted key path, adding missing objects on the way.
toml.set	Sets a key, adding it, and its table, when missing.
yamlpath.set	Sets a key to a value, adding the key and any missing parents if needed.
android.set_agp_version	Moves the Android Gradle Plugin to a version.
backstage.set_annotation	Sets a metadata.annotations entry, such as backstage.io/techdocs-ref.
helm.set_app_version	Sets a chart's appVersion in its Chart.yaml, keeping its quotes.
bazel.set_archive	Points an http_archive at a new download, with its checksum.
github.set_blank_issues	Allows or disallows issues that don't use a template.
ruby.set_bundler	Sets the Bundler version a Gemfile.lock was BUNDLED WITH.
flux.set_chart_version	Sets the chart version of every HelmRelease that installs a chart.
helm.set_chart_version	Sets a chart's version in its Chart.yaml.
helmfile.set_chart_version	Sets the version of every release that installs a chart.
cdk.set_context	Sets a context value, such as a feature flag, in every cdk.json.
gitlab.set_default	Sets a key under default: in .gitlab-ci.yml, adding default: if needed.
bazel.set_dep	Sets the version of a bazel_dep in every MODULE.bazel that declares it.
elixir.set_dep	Sets a dependency's requirement wherever a mix.exs lists it with one.
buf.set_dep_ref	Pins a module dependency in buf.yaml to a label or commit, such as buf.build/googleapis/googleapis:<commit>.
cargo.set_dependency	Sets a crate's version wherever a Cargo.toml already depends on it.
gradle.set_dependency	Sets a library's version wherever the build declares it.
helm.set_dependency	Sets the version of a chart dependency in every Chart.yaml that lists it.
maven.set_dependency	Sets the version of a dependency or plugin wherever a pom.xml declares one.
npm.set_dependency	Sets a dependency's version range in every package.json that already lists it.
sbt.set_dependency	Sets the version of a library or sbt plugin wherever the build declares it.
elixir.set_elixir	Sets the elixir: requirement in each project definition.
devcontainer.set_feature_version	Moves a feature to a new major version, such as docker-in-docker:1 to :2.
cmake.set_fetchcontent_tag	Sets the GIT_TAG of a FetchContent_Declare dependency.
backstage.set_field	Sets any entity field by key path, such as spec.lifecycle or spec.system.
github.set_funding	Sets a sponsor link in .github/FUNDING.yml, such as github: [acme].
ruby.set_gem	Sets a gem's version requirement wherever a Gemfile or gemspec lists it.
flux.set_git_tag	Sets ref.tag of every GitRepository that points at a URL.
gomod.set_go_version	Raises the go directive in every go.mod, never lowering it.
skaffold.set_helm_release_version	Sets the version of every Helm release that installs a remote chart.
kustomize.set_image	Sets newTag, newName or digest for an image in every kustomization's images list.
helm.set_image_tag	Sets the tag next to repository: <repository> in values files.
yamlpath.set_in	Sets a key in YAML text rather than a file, the same way set does.
gitlab.set_include_ref	Sets the ref of every include that pulls templates from another project.
gha.set_input	Sets every <key>: <value> line in the workflows, such as an action input.
gradle.set_kotlin_version	Moves every Kotlin Gradle plugin, and the Kotlin standard library, to one version.
github.set_label	Adds or updates a label in a label sync file, such as .github/labels.yml.
k8s.set_label	Sets a label on every resource, and on the pods workloads create.
circleci.set_machine_image	Sets the image of every machine executor, such as when an Ubuntu image is retired.
cmake.set_minimum_version	Raises cmake_minimum_required to a version, never lowering it.
npm.set_npmrc	Sets a key=value setting in .npmrc, adding it, or the file, when missing.
dependabot.set_option	Sets an option on update entries, such as open-pull-requests-limit or rebase-strategy.
prettier.set_option	Sets an option in the Prettier config, keeping its format.
renovate.set_option	Sets a top-level or nested option, such as schedule or lockFileMaintenance.enabled.
backstage.set_owner	Sets spec.owner, such as after a team is renamed or a service changes hands.
codeowners.set_owners	Makes a list of users or teams the owners of a pattern.
dotnet.set_package	Sets a NuGet package's version wherever a project already references it.
swift.set_package	Sets the version of a package dependency wherever a manifest declares it.
npm.set_package_manager	Sets the packageManager field Corepack uses, such as pnpm@9.12.0, where a package already has one.
php.set_php	Sets the PHP version a project requires, and optionally its config.platform.php.
cocoapods.set_platform	Raises the deployment target in platform :ios, '13.0', never lowering it.
gradle.set_plugin	Sets the version of a Gradle plugin wherever the build applies or declares it.
buf.set_plugin_version	Moves a remote plugin to a new version in every buf.gen.yaml.
packer.set_plugin_version	Sets the version of a plugin in required_plugins, matched by its source.
cocoapods.set_pod	Sets a pod's version requirement wherever a Podfile lists it with one.
maven.set_property	Sets a <properties> entry, such as java.version, in every pom.xml that defines it.
terraform.set_provider_version	Sets the version constraint of a provider in required_providers.
buildkite.set_queue	Points agents: queue: at a new queue in every pipeline.
php.set_require	Sets a package's constraint wherever require or require-dev lists it.
ruby.set_required_ruby	Sets required_ruby_version in every gemspec that declares it.
terraform.set_required_version	Sets every required_version constraint.
python.set_requirement	Sets a package's version specifier wherever it is already required.
python.set_requires_python	Sets requires-python in a pyproject.toml that already has it.
circleci.set_resource_class	Sets resource_class on every job and executor that sets one.
precommit.set_rev	Pins a hook repository to a new revision, keeping quotes and comments.
ruby.set_rubocop_target	Sets AllCops: TargetRubyVersion in .rubocop.yml.
ruby.set_ruby	Sets the Ruby version a Gemfile pins with ruby "x".
eslint.set_rule	Sets a rule's level, and optionally its options.
serverless.set_runtime	Sets the Lambda runtime of the provider and of every function that overrides it.
cargo.set_rust_version	Raises rust-version in every Cargo.toml that sets it, never lowering it.
sbt.set_sbt_version	Sets sbt.version in project/build.properties.
sbt.set_scala_version	Sets scalaVersion, and matching entries of crossScalaVersions.
android.set_sdk	Raises the compile, target and min SDK levels, never lowering one.
dotnet.set_sdk_version	Sets the .NET SDK version in a global.json that already pins one.
markdown.set_section	Makes the section under a heading contain the given text.
golangci.set_setting	Sets a linter's setting, in linters-settings (v1) or linters.settings (v2).
yamlpath.set_sibling	Sets key in every mapping where match_key has the value match_value, list items included.
terragrunt.set_source_ref	Sets the ?ref= of every module source that matches.
license.set_spdx	Sets the license field in package manifests that already have one.
buildkite.set_step_defaults	Adds keys, such as timeout_in_minutes, to every command step that lacks them.
dotnet.set_target_framework	Sets the target framework of every project, such as net8.0.
argocd.set_target_revision	Sets targetRevision for every source that points at a repository.
azure_pipelines.set_template_ref	Sets the ref of a template repository under resources.repositories.
jenkins.set_tool	Sets the installation a tools block asks for, such as maven 'Maven 3.9'.
swift.set_tools_version	Raises the // swift-tools-version: line, never lowering it.
sbt.set_val	Sets a string val, such as val catsVersion = "2.9.0", wherever it is defined.
make.set_var	Sets every assignment to a variable, in every Makefile that has one.
ansible.set_version	Sets the version of a role or collection wherever a requirements file lists it.
bazel.set_version	Sets the Bazel version in .bazelversion, when the repo pins one.
codeql.set_version	Moves every github/codeql-action action (init, analyze, upload-sarif...) to a new version.
runtime.set_version	Sets a runtime's version in every version file the repo already has.
scorecard.set_version	Moves ossf/scorecard-action to a new version.
azure_pipelines.set_vm_image	Sets vmImage on every pool that uses a Microsoft-hosted image.
gomod.set_work_go_version	Raises the go directive in go.work, never lowering it.
gradle.set_wrapper_version	Points the Gradle wrapper at a new version, never lowering it.
license.set_year	Extends the copyright year in the license file to year.
terragrunt.sources	Lists every module source pinned with ?ref=.
files.sync	Copies every file under a directory next to the campaign file into the repo.
packer.templates	Lists the repo's Packer HCL templates.
gitattributes.track_lfs	Tracks a pattern with Git LFS, as git lfs track would.
gha.unpinned	Lists each remote action used at a tag or branch rather than a commit SHA.
yamlpath.values	Reads every scalar whose key path matches a pattern with * wildcards.
bazel.version	Reads the Bazel version pinned in .bazelversion.
runtime.version	Reads the version a repo pins for a runtime.
scorecard.workflow	Finds the workflow that runs Scorecard.
codeql.workflows	Lists the workflows that run CodeQL.
gha.workflows	Lists the repo's workflow files.
gradle.wrapper_version	Reads the Gradle version the wrapper downloads.
jsonfile.write	Writes a value as JSON in the layout the file already has.
dependabot.write_if_missing	Writes .github/dependabot.yml for the detected ecosystems unless a config exists.
files.write_if_missing	Writes a file unless it, or any of the alternative paths, already exists.
npm.write_package	Writes a dict as a package.json, keeping the file's indentation.
lintconfig.yamllint_rule	Sets a yamllint rule, such as turning off document-start.