Skip to content

Commit 4b8f1d9

Browse files
automation-nsheaps[bot]automation-nsheaps[bot]
authored
[sync] Create .github/settings.yml
1 parent 23d303b commit 4b8f1d9

1 file changed

Lines changed: 315 additions & 0 deletions

File tree

‎.github/settings.yml‎

Lines changed: 315 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,315 @@
1+
# ----------------------------------------------------------------
2+
# Auto-merged from nsheaps/.github on every sync.
3+
# Source: https://github.com/nsheaps/.github/blob/a42edbcc711fe08e6b79eb3bc42c6d1a19c8e426/.github/repo-settings.yaml
4+
# Edits to this file are KEPT on the next sync (deep merge).
5+
# To remove an org default, delete the key here — it will not come back.
6+
# ----------------------------------------------------------------
7+
# ----------------------------------------------------------------
8+
# nsheaps org-wide repository defaults
9+
#
10+
# Consumed by https://github.com/repository-settings/app
11+
# Deep-merged into each managed repo's .github/settings.yml by the
12+
# sync-repo-settings workflow:
13+
# https://github.com/nsheaps/.github/blob/main/.github/workflows/sync-repo-settings.yaml
14+
#
15+
# Merger script + tests:
16+
# https://github.com/nsheaps/.github/blob/main/scripts/repo_settings_merge.py
17+
#
18+
# Merge semantics — short version:
19+
# - scalars : target wins (repo's existing value preserved)
20+
# - mappings : recurse
21+
# - rulesets[] : matched by `name`, deep-merged per item
22+
# - rulesets[].rules[] : matched by `type`, deep-merged per item
23+
# - bypass_actors[] : matched by (actor_id, actor_type) — SOURCE wins on scalars
24+
# - enforcement omitted : normalized to `active` at write time
25+
#
26+
# Do not set per-repo identity (name/description/homepage/topics) here —
27+
# those belong to each repo.
28+
#
29+
# `# @default` convention: lines tagged `# @default` are uncommented ONLY
30+
# on a repo's FIRST sync (when it has no settings.yml yet). After that the
31+
# commented source line is invisible to deep-merge, so a later change to
32+
# the commented value can't accidentally overwrite the repo's value.
33+
# ----------------------------------------------------------------
34+
35+
# These settings affect the repository itself.
36+
# See https://docs.github.com/en/rest/repos/repos#update-a-repository
37+
repository:
38+
# NOTE: We deliberately do NOT set `name`, `description`, `homepage`,
39+
# or `topics` from the org defaults — those belong to each repo.
40+
# Edit them directly in your repo's .github/settings.yml.
41+
#
42+
# The booleans below are commented with `# @default` — they're set on
43+
# this repo's FIRST sync only. After that, your value wins; org changes
44+
# to the commented line are invisible to subsequent merges.
45+
46+
# A short description of the repository that will show up on GitHub
47+
# description: ...
48+
49+
# A URL with more information about the repository
50+
# homepage: https://example.github.io/
51+
52+
# A comma-separated list of topics to set on the repository
53+
# topics: ...
54+
55+
# Either `true` to make the repository private, or `false` to make it public.
56+
# NOTE: intentionally not set org-wide — public/private is a per-repo decision.
57+
# private: false
58+
59+
# Either `true` to enable issues for this repository, `false` to disable them.
60+
has_issues: true
61+
62+
# Either `true` to enable projects for this repository, or `false` to disable them.
63+
# NOTE: We use org-level projects, not repo-level.
64+
has_projects: false
65+
66+
# Either `true` to enable the wiki for this repository, `false` to disable it.
67+
has_wiki: false
68+
69+
# Either `true` to enable downloads for this repository, `false` to disable them.
70+
has_downloads: false
71+
72+
# Updates the default branch for this repository.
73+
default_branch: main
74+
75+
# Either `true` to allow squash-merging pull requests, or `false` to prevent
76+
# squash-merging.
77+
allow_squash_merge: true
78+
79+
# Either `true` to allow merging pull requests with a merge commit, or `false`
80+
# to prevent merging pull requests with merge commits.
81+
allow_merge_commit: false
82+
83+
# Either `true` to allow rebase-merging pull requests, or `false` to prevent
84+
# rebase-merging.
85+
allow_rebase_merge: true
86+
87+
# Either `true` to enable automatic deletion of branches on merge, or `false`
88+
# to disable.
89+
delete_branch_on_merge: true
90+
91+
# Either `true` to allow auto-merge on pull requests, or `false` to disallow.
92+
allow_auto_merge: true
93+
94+
# The default value for a squash merge commit title:
95+
# - PR_TITLE — default to the pull request's title
96+
# - COMMIT_OR_PR_TITLE — default to the commit's title (if only one commit)
97+
# or the pull request's title (when more than one commit)
98+
squash_merge_commit_title: PR_TITLE
99+
100+
# The default value for a squash merge commit message:
101+
# - PR_BODY — default to the pull request's body
102+
# - COMMIT_MESSAGES — default to the branch's commit messages
103+
# - BLANK — default to a blank commit message
104+
squash_merge_commit_message: PR_BODY
105+
106+
# Labels: managed centrally via .github/labels.yaml + sync-labels workflow.
107+
# Intentionally omitted here so the two sources don't fight.
108+
109+
# Rulesets — repository-level branch/tag rulesets.
110+
# Docs: https://github.com/repository-settings/app/blob/master/docs/plugins/rulesets.md
111+
# API : https://docs.github.com/en/rest/repos/rules
112+
#
113+
# enforcement values:
114+
# - active : rules are enforced
115+
# - disabled : ruleset exists but is not enforced (dormant)
116+
# - evaluate : rules are checked and reported but not enforced (preview)
117+
# NOTE: If `enforcement` is omitted on a ruleset, the sync writer fills it
118+
# with `active`. Each ruleset below either:
119+
# - sets `enforcement: active` (always-on org policy — overriding is discouraged), or
120+
# - sets `enforcement: disabled` plus a commented `# enforcement: 'active'`
121+
# sibling that a repo can uncomment (and delete the disabled line) to enable, or
122+
# - omits `enforcement` and provides a commented `# enforcement: 'active'`
123+
# hint that a repo can uncomment to lock the ruleset on explicitly.
124+
#
125+
# bypass_actors[].bypass_mode values:
126+
# - always : prompts the user to bypass at push/merge time (GitHub UI default)
127+
# - pull_request : bypass only allowed via a PR (push-time bypass blocked)
128+
# NOTE: omitting bypass_mode lets the merger fill `always`.
129+
#
130+
# Every ruleset seeds repo admins (RepositoryRole id 5) as bypass actors so
131+
# the org doesn't lock admins out. Repos can append more bypass_actors; for
132+
# the admin entry itself, source-wins (you can't silently widen admin bypass
133+
# to `always` if the org set `pull_request`).
134+
rulesets:
135+
# ---- 1. No delete / no force-push on the default branch ----
136+
- name: protect-default-branch
137+
target: branch
138+
enforcement: active # always enforced — overriding this is discouraged
139+
conditions:
140+
ref_name:
141+
include:
142+
- "~DEFAULT_BRANCH" # special selector: whatever the default branch is
143+
exclude: []
144+
bypass_actors:
145+
# Repo admins can bypass (always = prompts at push/merge time, not silent exempt).
146+
# Repos can add more actors (other teams, integrations).
147+
- actor_id: 5
148+
actor_type: RepositoryRole # 1=read 2=triage 3=write 4=maintain 5=admin
149+
bypass_mode: always
150+
- actor_id: 101490915
151+
actor_type: Integration
152+
bypass_mode: always
153+
- actor_id: -1
154+
actor_type: Integration
155+
bypass_mode: always
156+
- actor_id: 2549081
157+
actor_type: Integration
158+
bypass_mode: always
159+
rules:
160+
- type: deletion # block branch deletion
161+
- type: non_fast_forward # block force-push
162+
163+
# ---- 2. PR required (0 reviews) ----
164+
- name: require-pr
165+
target: branch
166+
enforcement: active
167+
conditions:
168+
ref_name:
169+
include: ["~DEFAULT_BRANCH"]
170+
exclude: []
171+
bypass_actors:
172+
# Repo admins can bypass (always = prompts at push/merge time, not silent exempt).
173+
# Repos can add more actors (other teams, integrations).
174+
- actor_id: 5
175+
actor_type: RepositoryRole # 1=read 2=triage 3=write 4=maintain 5=admin
176+
bypass_mode: always
177+
- actor_id: 101490915
178+
actor_type: Integration
179+
bypass_mode: always
180+
- actor_id: -1
181+
actor_type: Integration
182+
bypass_mode: always
183+
- actor_id: 2549081
184+
actor_type: Integration
185+
bypass_mode: always
186+
rules:
187+
- type: pull_request
188+
parameters:
189+
required_approving_review_count: 0
190+
# Possible additional parameters (commented for repos to opt in):
191+
# dismiss_stale_reviews_on_push: false
192+
# require_code_owner_review: false
193+
# require_last_push_approval: false
194+
# required_review_thread_resolution: false
195+
# allowed_merge_methods: [merge, squash, rebase]
196+
197+
# - # ---- 3. Checks required ----
198+
# # NOTE: shipped ACTIVE with an empty required_status_checks list — a valid
199+
# # GitHub config that's a no-op until a repo populates the list. Repos just
200+
# # add entries under required_status_checks below; no enforcement flip needed.
201+
# # The org doesn't mandate specific status checks (each repo has its own CI),
202+
# # which is why the list is empty here.
203+
# name: require-checks
204+
# target: branch
205+
# enforcement: active
206+
# conditions:
207+
# ref_name:
208+
# include: ["~DEFAULT_BRANCH"]
209+
# exclude: []
210+
# bypass_actors:
211+
# # Repo admins can bypass (always = prompts at push/merge time, not silent exempt).
212+
# # Repos can add more actors (other teams, integrations).
213+
# - actor_id: 5
214+
# actor_type: RepositoryRole # 1=read 2=triage 3=write 4=maintain 5=admin
215+
# bypass_mode: always
216+
# rules:
217+
# - type: required_status_checks
218+
# parameters:
219+
# strict_required_status_checks_policy: true
220+
# required_status_checks: [] # ← repos add { context, integration_id } entries
221+
222+
# ---- 4. Review required — 1 reviewer (active by default) ----
223+
- name: require-1-review
224+
target: branch
225+
enforcement: active
226+
conditions:
227+
ref_name:
228+
include: ["~DEFAULT_BRANCH"]
229+
exclude: []
230+
bypass_actors:
231+
# Repo admins can bypass (always = prompts at push/merge time, not silent exempt).
232+
# Repos can add more actors (other teams, integrations).
233+
- actor_id: 5
234+
actor_type: RepositoryRole # 1=read 2=triage 3=write 4=maintain 5=admin
235+
bypass_mode: always
236+
- actor_id: 101490915
237+
actor_type: Integration
238+
bypass_mode: always
239+
- actor_id: -1
240+
actor_type: Integration
241+
bypass_mode: always
242+
- actor_id: 2549081
243+
actor_type: Integration
244+
bypass_mode: always
245+
rules:
246+
- type: pull_request
247+
parameters:
248+
required_approving_review_count: 1
249+
dismiss_stale_reviews_on_push: true
250+
require_last_push_approval: false
251+
required_review_thread_resolution: true
252+
253+
# ---- 5. Review required — 1 reviewer from CODEOWNERS (disabled by default) ----
254+
# NOTE: shipped DISABLED. Repos with a meaningful CODEOWNERS file flip to
255+
# `enforcement: active` and likely set `require-1-review.enforcement: disabled`
256+
# so the two don't double up.
257+
- name: require-codeowner-review
258+
target: branch
259+
enforcement: disabled
260+
# enforcement: 'active' # uncomment (and remove the disabled line above) to enable
261+
conditions:
262+
ref_name:
263+
include: ["~DEFAULT_BRANCH"]
264+
exclude: []
265+
bypass_actors:
266+
# Repo admins can bypass (always = prompts at push/merge time, not silent exempt).
267+
# Repos can add more actors (other teams, integrations).
268+
- actor_id: 5
269+
actor_type: RepositoryRole # 1=read 2=triage 3=write 4=maintain 5=admin
270+
bypass_mode: always
271+
- actor_id: 101490915
272+
actor_type: Integration
273+
bypass_mode: always
274+
- actor_id: -1
275+
actor_type: Integration
276+
bypass_mode: always
277+
- actor_id: 2549081
278+
actor_type: Integration
279+
bypass_mode: always
280+
rules:
281+
- type: pull_request
282+
parameters:
283+
required_approving_review_count: 1
284+
require_code_owner_review: true
285+
dismiss_stale_reviews_on_push: true
286+
required_review_thread_resolution: true
287+
- name: require-checks
288+
target: branch
289+
enforcement: active
290+
conditions:
291+
ref_name:
292+
include: ["~DEFAULT_BRANCH"]
293+
exclude: []
294+
bypass_actors:
295+
# Repo admins can bypass (always = prompts at push/merge time, not silent exempt).
296+
# Repos can add more actors (other teams, integrations).
297+
- actor_id: 5
298+
actor_type: RepositoryRole # 1=read 2=triage 3=write 4=maintain 5=admin
299+
bypass_mode: always
300+
- actor_id: 101490915
301+
actor_type: Integration
302+
bypass_mode: always
303+
- actor_id: -1
304+
actor_type: Integration
305+
bypass_mode: always
306+
- actor_id: 2549081
307+
actor_type: Integration
308+
bypass_mode: always
309+
rules:
310+
- type: required_status_checks
311+
parameters:
312+
strict_required_status_checks_policy: true
313+
required_status_checks: [] # ← repos add { context, integration_id } entries
314+
315+
# ---- 4. Review required — 1 reviewer (active by default) ----

0 commit comments

Comments
 (0)