67 Repos, One Command

Microsoft OSS compliance on autopilot

The Stakes

Every ecosystem repo owes Microsoft the same OSS files — verbatim

CODE_OF_CONDUCT.md, SECURITY.md, SUPPORT.md and LICENSE must match microsoft/amplifier-core word for word — plus README Contributing and Trademarks sections and a MODULES.md listing.

Keeping dozens of repos honest by hand is a losing game. So how many repos are we really talking about?

1 Listed in MODULES.md
2 CODE_OF_CONDUCT.md
3 SECURITY.md
4 SUPPORT.md
5 LICENSE
6 README Contributing
7 README Trademarks
8 Issues status
9 Open PRs & activity

Proof

The catalog lists 67 repos — one command audits them all

MODULES.md, the discoverability catalog the recipe checks against, lists exactly 67 unique microsoft/amplifier* repository URLs. A single command runs the full ecosystem audit.

The number is verified. The pain is in what it takes to check even one repo by hand.

67

microsoft/amplifier* repos in the catalog snapshot (cache MODULES.md, sort -u | wc -l)

The Complication

By hand, one repo is six diffs — then you repeat, and drift creeps in

Each repo means opening it, diffing four boilerplate files with diff -q, then checking two README sections against the reference — and doing it again for the next one.

At 67 repos and growing, fixes drift and stay inconsistent. Someone built the way out.

Open the repoFetch its current files
Diff 4 boilerplate filesCODE_OF_CONDUCT, SECURITY, SUPPORT, LICENSE
Diff 2 README sectionsContributing & Trademarks vs reference
RepeatFor every repo — every time

The Fix Ships

Brian Krabach shipped the audit as an Amplifier recipe in PR #160

The amplifier-ecosystem-audit recipe (with a per-repo repo-audit.yaml) landed in commit 340a276 on 2026-01-12 — and the recipe was itself co-authored by Amplifier.

Its first job: find every repo without a hand-maintained list.

#160

PR that added the audit recipes

1,493

Lines across both recipe files

21

Steps in the per-repo audit

3

Orchestrator stages

Mechanism — Discovery

It auto-discovers every repo from the GitHub Search API — no hand-kept list

The discover-repos step queries the Microsoft org, skips archived repos, and falls back to gh repo list — so scope tracks the ecosystem as it grows.

Once every repo is found, each one gets the same rigorous check.

# Full ecosystem audit (discovery + audit all repos)
amplifier recipes execute amplifier-ecosystem-audit.yaml

# discover-repos step calls:
gh api "search/repositories?q=amplifier+in:name+org:microsoft+is:public&per_page=100"
# then: select(.archived == false)

Mechanism — Verification

9 checks run in parallel, diffed verbatim, into one graded report

Repos are audited two-at-a-time (parallel: 2), boilerplate is diffed verbatim against microsoft/amplifier-core, and results aggregate by status — consistent every run.

Finding the gaps is only half the job. The recipe can also close them.

PASS

Compliant with all checks

NEEDS ATTENTION

Warnings — content differs from template

CRITICAL

Required files missing or mismatched

The Payoff

Flip on create_fix_prs and it opens deduplicated fix PRs — preview first

With create_fix_prs: true, the recipe opens PRs titled "fix: Update Microsoft OSS compliance files", skips repos that already have one, and a dry-run mode previews everything before anything is created.

Finding problems and fixing them — from a single command.

# Preview only — no PRs created
amplifier recipes execute amplifier-ecosystem-audit.yaml \
  --context '{"dry_run": "true"}'
# prints: DRY-RUN: PR PREVIEW

# Open the fixes for real
  --context '{"create_fix_prs": "true"}'
# branch: fix/compliance-boilerplate-update
# check-existing-pr skips duplicates

The Takeaway

Compliance becomes one repeatable command

Ecosystem-wide compliance stops being a chore. It's one command that auto-discovers, audits in parallel, and opens the fixes — and it grows with the org.

Status: Implemented & committed — v1.2.0 in microsoft/amplifier

Sources

Research Methodology

Data as of: 2026-01-12 (PR #160 merge); catalog snapshot from dev-machine cache amplifier-d1dda27a16518560.

Repository: microsoft/amplifier — recipes/amplifier-ecosystem-audit.yaml (orchestrator, 590 lines) + recipes/repo-audit.yaml (per-repo, 903 lines).

Feature status: Implemented & committed (v1.2.0 git-tracked; v1.3.0 seen only in dev-machine cache).

Commands run:

grep -oE 'github.com/microsoft/amplifier[a-zA-Z0-9_-]*' docs/MODULES.md | sort -u | wc -l → 67
git log --format='%h|%ad|%an|%ae|%s' -- recipes/amplifier-ecosystem-audit.yaml recipes/repo-audit.yaml (author, PR #160 / commit 340a276)
git show --stat --no-patch 340a276 and 5cae6f1 (dates, max_repos 50→100)
wc -l both recipes (590 + 903 = 1493); grep -cE '^ - id:' repo-audit.yaml → 21 steps
grep -n 'search/repositories\|archived\|create_fix_prs\|dry_run\|parallel' across both recipe files

Gaps: The 67 count is from a cached MODULES.md snapshot, not a live gh org query. Popular framings of ~5.5 hours by hand and ~10 minutes automated are NOT stated in any source and were excluded.

Primary contributor: Brian Krabach (brkrabac@microsoft.com) — author of both audit recipes; commit trailers credit Co-Authored-By: Amplifier.