sponsor-finder

Name: sponsor-finder
Author: github

8.6kinstalls4.6kforks

How to install sponsor-finder?

github/awesome-copilot/sponsor-finder

$npx -y skills add github/awesome-copilot --skill sponsor-finder

Installs into the current project.

Summary

Find which of a GitHub repository's dependencies are sponsorable via GitHub Sponsors. Uses deps.dev API for dependency resolution across npm, PyPI, Cargo, Go, RubyGems, Maven, and NuGet. Checks npm funding metadata, FUNDING.yml files, and web search. Verifies every link. Shows di

Files · 1

View on GitHub

SKILL.md

1	# Sponsor Finder
2
3	Discover opportunities to support the open source maintainers behind your project's dependencies. Accepts a GitHub `owner/repo` (e.g. `/sponsor expressjs/express`), uses the deps.dev API for dependency resolution and project health data, and produces a friendly sponsorship report covering both direct and transitive dependencies.
4
5	## Your Workflow
6
7	When the user types `/sponsor {owner/repo}` or provides a repository in `owner/repo` format:
8
9	1. Parse the input — Extract `owner` and `repo`.
10	2. Detect the ecosystem — Fetch manifest to determine package name + version.
11	3. Get full dependency tree — deps.dev `GetDependencies` (one call).
12	4. Resolve repos — deps.dev `GetVersion` for each dep → `relatedProjects` gives GitHub repo.
13	5. Get project health — deps.dev `GetProject` for unique repos → OSSF Scorecard.
14	6. Find funding links — npm `funding` field, FUNDING.yml, web search fallback.
15	7. Verify every link — fetch each URL to confirm it's live.
16	8. Group and report — by funding destination, sorted by impact.
17
18	---
19
20	## Step 1: Detect Ecosystem and Package
21
22	Use `get_file_contents` to fetch the manifest from the target repo. Determine the ecosystem and extract the package name + latest version:
23
24	\| File \| Ecosystem \| Package name from \| Version from \|
25	\|------\|-----------\|-------------------\|--------------\|
26	\| `package.json` \| NPM \| `name` field \| `version` field \|
27	\| `requirements.txt` \| PYPI \| list of package names \| use latest (omit version in deps.dev call) \|
28	\| `pyproject.toml` \| PYPI \| `[project.dependencies]` \| use latest \|
29	\| `Cargo.toml` \| CARGO \| `[package] name` \| `[package] version` \|
30	\| `go.mod` \| GO \| `module` path \| extract from go.mod \|
31	\| `Gemfile` \| RUBYGEMS \| gem names \| use latest \|
32	\| `pom.xml` \| MAVEN \| `groupId:artifactId` \| `version` \|
33
34	---
35
36	## Step 2: Get Full Dependency Tree (deps.dev)
37
38	This is the key step. Use `web_fetch` to call the deps.dev API:
39
40	```
41	https://api.deps.dev/v3/systems/{ECOSYSTEM}/packages/{PACKAGE}/versions/{VERSION}:dependencies
42	```
43
44	For example:
45	```
46	https://api.deps.dev/v3/systems/npm/packages/express/versions/5.2.1:dependencies
47	```
48
49	This returns a `nodes` array where each node has:
50	- `versionKey.name` — package name
51	- `versionKey.version` — resolved version
52	- `relation` — `"SELF"`, `"DIRECT"`, or `"INDIRECT"`
53
54	This single call gives you the entire dependency tree — both direct and transitive — with exact resolved versions. No need to parse lockfiles.
55
56	### URL encoding
57	Package names containing special characters must be percent-encoded:
58	- `@colors/colors` → `%40colors%2Fcolors`
59	- Encode `@` as `%40`, `/` as `%2F`
60
61	### For repos without a single root package
62	If the repo doesn't publish a package (e.g., it's an app not a library), fall back to reading `package.json` dependencies directly and calling deps.dev `GetVersion` for each.
63
64	---
65
66	## Step 3: Resolve Each Dependency to a GitHub Repo (deps.dev)
67
68	For each dependency from the tree, call deps.dev `GetVersion`:
69
70	```
71	https://api.deps.dev/v3/systems/{ECOSYSTEM}/packages/{NAME}/versions/{VERSION}
72	```
73
74	From the response, extract:
75	- `relatedProjects` → look for `relationType: "SOURCE_REPO"` → `projectKey.id` gives `github.com/{owner}/{repo}`
76	- `links` → look for `label: "SOURCE_REPO"` → `url` field
77
78	This works across all ecosystems — npm, PyPI, Cargo, Go, RubyGems, Maven, NuGet — with the same field structure.
79
80	### Efficiency rules
81	- Process in batches of 10 at a time.
82	- Deduplicate — multiple packages may map to the same repo.
83	- Skip deps where no GitHub project is found (count as "unresolvable").
84
85	---
86
87	## Step 4: Get Project Health Data (deps.dev)
88
89	For each unique GitHub repo, call deps.dev `GetProject`:
90
91	```
92	https://api.deps.dev/v3/projects/github.com%2F{owner}%2F{repo}
93	```
94
95	From the response, extract:
96	- `scorecard.checks` → find the `"Maintained"` check → `score` (0–10)
97	- `starsCount` — popularity indicator
98	- `license` — project license
99	- `openIssuesCount` — activity indicator
100
101	Use the Maintained score to label project health:
102	- Score 7–10 → ⭐ Actively maintained
103	- Score 4–6 → ⚠️ Partially maintained
104	- Score 0–3 → 💤 Possibly unmaintained
105
106	### Efficiency rules
107	- Only fetch for unique repos (not per-package).
108	- Process in batches of 10 at a time.
109	- This step is optional — skip if rate-limited and note in output.
110
111	---
112
113	## Step 5: Find Funding Links
114
115	For each unique GitHub repo, check for funding information using three sources in order:
116
117	### 5a: npm `funding` field (npm

People who liked this also viewed

6 picks

Type

sponsor-finder

8.6kinstalls4.6kforks

View on GitHub

How to install sponsor-finder?

github/awesome-copilot/sponsor-finder

$npx -y skills add github/awesome-copilot --skill sponsor-finder

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Sponsor Finder
2
3	Discover opportunities to support the open source maintainers behind your project's dependencies. Accepts a GitHub `owner/repo` (e.g. `/sponsor expressjs/express`), uses the deps.dev API for dependency resolution and project health data, and produces a friendly sponsorship report covering both direct and transitive dependencies.
4
5	## Your Workflow
6
7	When the user types `/sponsor {owner/repo}` or provides a repository in `owner/repo` format:
8
9	1. Parse the input — Extract `owner` and `repo`.
10	2. Detect the ecosystem — Fetch manifest to determine package name + version.
11	3. Get full dependency tree — deps.dev `GetDependencies` (one call).
12	4. Resolve repos — deps.dev `GetVersion` for each dep → `relatedProjects` gives GitHub repo.
13	5. Get project health — deps.dev `GetProject` for unique repos → OSSF Scorecard.
14	6. Find funding links — npm `funding` field, FUNDING.yml, web search fallback.
15	7. Verify every link — fetch each URL to confirm it's live.
16	8. Group and report — by funding destination, sorted by impact.
17
18	---
19
20	## Step 1: Detect Ecosystem and Package
21
22	Use `get_file_contents` to fetch the manifest from the target repo. Determine the ecosystem and extract the package name + latest version:
23
24	\| File \| Ecosystem \| Package name from \| Version from \|
25	\|------\|-----------\|-------------------\|--------------\|
26	\| `package.json` \| NPM \| `name` field \| `version` field \|
27	\| `requirements.txt` \| PYPI \| list of package names \| use latest (omit version in deps.dev call) \|
28	\| `pyproject.toml` \| PYPI \| `[project.dependencies]` \| use latest \|
29	\| `Cargo.toml` \| CARGO \| `[package] name` \| `[package] version` \|
30	\| `go.mod` \| GO \| `module` path \| extract from go.mod \|
31	\| `Gemfile` \| RUBYGEMS \| gem names \| use latest \|
32	\| `pom.xml` \| MAVEN \| `groupId:artifactId` \| `version` \|
33
34	---
35
36	## Step 2: Get Full Dependency Tree (deps.dev)
37
38	This is the key step. Use `web_fetch` to call the deps.dev API:
39
40	```
41	https://api.deps.dev/v3/systems/{ECOSYSTEM}/packages/{PACKAGE}/versions/{VERSION}:dependencies
42	```
43
44	For example:
45	```
46	https://api.deps.dev/v3/systems/npm/packages/express/versions/5.2.1:dependencies
47	```
48
49	This returns a `nodes` array where each node has:
50	- `versionKey.name` — package name
51	- `versionKey.version` — resolved version
52	- `relation` — `"SELF"`, `"DIRECT"`, or `"INDIRECT"`
53
54	This single call gives you the entire dependency tree — both direct and transitive — with exact resolved versions. No need to parse lockfiles.
55
56	### URL encoding
57	Package names containing special characters must be percent-encoded:
58	- `@colors/colors` → `%40colors%2Fcolors`
59	- Encode `@` as `%40`, `/` as `%2F`
60
61	### For repos without a single root package
62	If the repo doesn't publish a package (e.g., it's an app not a library), fall back to reading `package.json` dependencies directly and calling deps.dev `GetVersion` for each.
63
64	---
65
66	## Step 3: Resolve Each Dependency to a GitHub Repo (deps.dev)
67
68	For each dependency from the tree, call deps.dev `GetVersion`:
69
70	```
71	https://api.deps.dev/v3/systems/{ECOSYSTEM}/packages/{NAME}/versions/{VERSION}
72	```
73
74	From the response, extract:
75	- `relatedProjects` → look for `relationType: "SOURCE_REPO"` → `projectKey.id` gives `github.com/{owner}/{repo}`
76	- `links` → look for `label: "SOURCE_REPO"` → `url` field
77
78	This works across all ecosystems — npm, PyPI, Cargo, Go, RubyGems, Maven, NuGet — with the same field structure.
79
80	### Efficiency rules
81	- Process in batches of 10 at a time.
82	- Deduplicate — multiple packages may map to the same repo.
83	- Skip deps where no GitHub project is found (count as "unresolvable").
84
85	---
86
87	## Step 4: Get Project Health Data (deps.dev)
88
89	For each unique GitHub repo, call deps.dev `GetProject`:
90
91	```
92	https://api.deps.dev/v3/projects/github.com%2F{owner}%2F{repo}
93	```
94
95	From the response, extract:
96	- `scorecard.checks` → find the `"Maintained"` check → `score` (0–10)
97	- `starsCount` — popularity indicator
98	- `license` — project license
99	- `openIssuesCount` — activity indicator
100
101	Use the Maintained score to label project health:
102	- Score 7–10 → ⭐ Actively maintained
103	- Score 4–6 → ⚠️ Partially maintained
104	- Score 0–3 → 💤 Possibly unmaintained
105
106	### Efficiency rules
107	- Only fetch for unique repos (not per-package).
108	- Process in batches of 10 at a time.
109	- This step is optional — skip if rate-limited and note in output.
110
111	---
112
113	## Step 5: Find Funding Links
114
115	For each unique GitHub repo, check for funding information using three sources in order:
116
117	### 5a: npm `funding` field (npm

People who liked this also viewed

6 picks

Type