Cross-platform GUI for managing, scanning, and batch-updating multiple GitHub and GitLab repositories at scale.
Git Flotilla is a desktop application for DevOps engineers and agencies who manage many repositories and need a single interface to:
- Scan repos for runtime versions, package managers, dependency files, and workflow health — monorepo-aware, incremental, rate-limit-safe
- Monitor CVEs automatically — with incident timelines, blast radius analysis, and one-click patching
- Patch at scale — pin/bump packages with version maps, sync workflows, push dotfiles across hundreds of repos in one resumable operation
- Audit dependencies — cross-repo package matrix with changelog aggregation, version drift, licence compliance, and secret exposure scanning
- Manage PRs — merge queue with batch merge, divergence detection, multi-branch targeting, and rollback alerts
- Run scripts — execute arbitrary commands across repos with live output and preset library
- Track operations — dry run everything, validate fixes, download operation logs, roll back commits
Built with Tauri, Rust, Vue 3, TypeScript, and Tailwind CSS.
- Connect GitHub and GitLab accounts (PAT or OAuth)
- Auto-discover repos from orgs/groups
- Organise repos into nested lists (Client → Project → Repos)
- Tag repos with arbitrary labels for dynamic filtering
- Import/export repo lists as YAML for team sharing
- Detect: Node version (with source tracking —
.nvmrc,.node-version,.tool-versions,engines.node), PHP version, package manager + version - Monorepo-aware: discovers all manifest files in a repo, not just root
- Parse:
package.json,composer.json,requirements.txt,Cargo.toml,go.mod - Inventory workflow files, detect floating Action tags
- Check for required files:
.env.example,CODEOWNERS,SECURITY.md,.editorconfig - Health score (0–100) per repo based on configurable rules
- Incremental scan: only re-check repos pushed since last scan (planned)
- Rate limit awareness: shows remaining API quota, auto-pauses when low
- Auto-exclude: skips repos without relevant manifests (with reason)
- Scheduled background scans
- Automatically checks CVEs after every scan
- Hourly background polling (configurable: off / 15min / 1hr / 6hr / daily)
- Source: OSV.dev (covers npm, composer, pip, cargo, go)
- Matches CVEs against all detected packages across all repos
- One-click "Patch affected repos" — creates a pin operation to lock the vulnerable package immediately
- Incident timeline: unified view per CVE showing detection, PRs created, merge status across all repos
- Blast radius analysis: dependency graph showing direct + transitive exposure to prioritise patching
- Rollback detection: alerts if someone reverts a Flotilla security PR (planned)
- CVE watchlist: subscribe to packages not yet in your repos
- Severity badges: critical / high / medium / low
- Cross-repo package matrix: see every package used across selected repos with versions side by side
- Highlight version drift across repos
- Show latest available version from registries
- Identify orphan packages (used in only one repo)
- Changelog aggregation: when bumping a package, see the changelog entries between current and target version with breaking changes highlighted
- Repo similarity clustering: auto-group repos by tech stack fingerprint (e.g. "42 repos use Laravel + Vue")
- "Standardise to version" — bump a package to a target version across all selected repos via PR
- Package pin: lock to exact version + add
overrides/resolutions/pnpm.overrides— for active security incidents - Package bump: update to version range + remove overrides — for after upstream fix lands
- Pin-then-bump lifecycle: tracks which repos are still pinned so you know when to bump back
- Version map: target different safe versions per major version (e.g. major 0 → 0.30.3, major 1 → 1.13.6)
- Monorepo-aware: patches all matching manifest files within a repo, overrides only at root
- File update: push any file (with variable injection) to N repos via commit or PR
- Workflow sync: dedicated mode for pushing GitHub Actions workflows,
.nvmrcupdates, andpackage.jsonfield updates across repos - Validate mode: audit whether a fix is already applied across all repos without making changes
- Dry run mode: always preview diffs before writing anything
- Configurable parallelism: default 5 concurrent repos
- Resumable: saves per-repo progress; resumes from where it left off after crash or abort
- PR builder: title/body templates with
{{PACKAGE}},{{VERSION}},{{CVE}},{{SEVERITY}}variables and conditional sections - Multi-branch PRs: target develop, staging, or other branches; auto-detect diverged branches
- Idempotent: re-running an operation cleanly replaces stale PRs instead of creating duplicates
- Skip CI: toggle to append
[skip ci]to commits when pushing to many repos at once - Rollback: revert any Flotilla-initiated commit via a PR
- Dedicated view for all open Flotilla-created PRs across repos
- Per-PR: CI status, merge conflicts, review status
- Batch merge: "merge all green" — merge all PRs where CI passes and no conflicts
- One-click merge for individual PRs
- Run arbitrary shell commands across N repos (clone → execute → collect output)
- Aggregate results view per repo
- Preset command library (e.g.
npx depcheck,npm outdated --json) - Save custom commands as reusable presets
- Secret exposure scanner: detect accidentally committed secrets (API keys, tokens, credentials) using pattern-based detection
- Licence compliance matrix: scan transitive dependencies, flag non-permissive licences (GPL, AGPL), generate compliance reports
- Branch protection audit: scan protection rules across all repos, flag inconsistencies, batch-enforce a standard ruleset
- Drift dashboard: see where repos diverge from each other — Node versions, CI workflows, config files — spot snowflake repos instantly
- Repo archival assistant: identify stale repos (no pushes, no PRs, no CI runs), batch-archive via API
- Command palette (
Ctrl+K/Cmd+K) for instant navigation - API rate limit indicator in top bar (remaining requests, reset time)
- Full audit log of every action + downloadable per-operation logs
- Webhook support: Slack, Teams, Discord (planned)
- Weekly digest export (JSON/CSV)
- CLI companion:
git-flotillabinary for CI/scripting use
- macOS 10.15+, Windows 10+, or Ubuntu 20.04+ / Debian 11+ / Fedora 38+
- On Linux (
.deb): install withsudo apt install ./Git\ Flotilla_0.2.0_amd64.deb— dependencies (libwebkit2gtk-4.1-0,libgtk-3-0) are pulled in automatically - On Linux (building from source):
sudo apt install libwebkit2gtk-4.1-dev libgtk-3-dev(Debian/Ubuntu)
Download the latest release from the Releases page.
| Platform | Format |
|---|---|
| macOS | .dmg |
| Windows | .exe (NSIS installer) / .msi |
| Linux | .deb / .rpm |
Prerequisites: Rust 1.78+, Node.js 20+, pnpm 9+
git clone https://github.com/immersedone/git-flotilla.git
cd git-flotilla
# Install frontend dependencies
pnpm install
# Run in development
pnpm tauri dev
# Build for production
pnpm tauri build- Connect an account — go to Settings → Accounts, add a GitHub or GitLab Personal Access Token
- Discover repos — Flotilla will list all repos accessible to your token
- Create a repo list — group repos by client, project, or whatever makes sense for you
- Run a scan — select your repo list and click Scan. Flotilla will parse all dependency files and check for CVEs immediately
- Review CVE alerts — the CVE panel shows any vulnerabilities found, matched to the exact repos and versions affected
- Patch — click "Patch affected repos" on any CVE to open a pre-filled batch operation ready to bump the package and open PRs
Flotilla stores configuration in .flotilla/ in your home directory (or a location you configure in Settings).
~/.flotilla/
├── config.yaml # App settings (scan intervals, health score weights, webhook URLs)
└── repo-lists/
├── client-acme.yaml # Repo list definitions (committable, shareable)
└── internal.yaml
Auth tokens are stored in your OS keychain — never in config files.
Commit your .flotilla/repo-lists/ directory (and config.yaml if appropriate) to a shared repository. Team members pull it to sync repo lists and settings. Each person provides their own auth tokens.
| Layer | Technology |
|---|---|
| Desktop shell | Tauri v2 |
| Backend / logic | Rust |
| Async runtime | Tokio |
| HTTP client | reqwest |
| Git operations | git2 (libgit2) |
| Local database | SQLite via sqlx |
| Secret storage | OS keychain via keyring |
| Frontend | Vue 3 + TypeScript |
| State | Pinia |
| Routing | Vue Router |
| Styling | Tailwind CSS v4 |
| Build tool | Vite |
| Source | Usage |
|---|---|
| OSV.dev | Primary — covers npm, composer, pip, cargo, go, and more |
| GitHub Advisory Database | Secondary — additional coverage for GitHub-hosted packages |
| NVD NIST | Tertiary — comprehensive CVE database |
Dashboard
Repository Management
Scanner
Package Intelligence
CVE Alerts
Batch Operations
PR Merge Queue
Script Runner
Compliance
Settings
Contributions welcome once the project has been battle-tested further. In the meantime, please read CLAUDE.md if using AI assistance on this codebase.
MIT — see LICENSE