ruby-repo-kit 0.1.0

data/lib/ruby_repo_kit/github/client.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require "json"
+require "open3"
+
+module RubyRepoKit
+  module GitHub
+    # HTTP status, including an allowed 404, is independent of gh's exit status.
+    # Pagination stays within this repository; credentials never enter argv or logs.
+    class Client
+      def initialize(project:, runner: nil)
+        @project = project
+        @runner = runner || method(:execute)
+      end
+
+      def request(path, method: "GET", body: nil, missing: false)
+        validate_request(path, method, missing)
+        result, following = fetch(path, method, body, missing)
+        seen = [path]
+        while following
+          raise Error, "GitHub returned pagination for a non-GET request" unless method == "GET"
+          raise Error, "GitHub pagination repeated a page" if seen.include?(following)
+
+          seen << following
+          page, following = fetch(following, "GET", nil, false)
+          result = Response.new(result.status, combine_pages(result.body, page.body))
+        end
+        result
+      end
+
+      private
+
+      def validate_request(path, method, missing)
+        unless path.is_a?(String) && (path.empty? || path.start_with?("/")) &&
+               !path.match?(/[\x00-\x20\\#]/) && !path.split(%r{[/?]}).include?("..")
+          raise Error, "Expected a repository-relative GitHub API path"
+        end
+        raise Error, "Unsupported GitHub method" unless %w[GET POST PUT PATCH DELETE].include?(method)
+        raise Error, "Only GET requests may allow missing resources" if missing && method != "GET"
+      end
+
+      def fetch(path, method, body, missing)
+        argv = ["gh", "api", "--hostname", "github.com", "--include", "--method", method,
+                "-H", "Accept: application/vnd.github+json", "repos/#{@project.repository}#{path}"]
+        argv += ["--input", "-"] unless body.nil?
+        output, status = @runner.call(argv, stdin_data: body.nil? ? nil : JSON.generate(body))
+        header, content = output.to_s.split(/\r?\n\r?\n/, 2)
+        code = header[%r{\AHTTP/\S+ (\d{3})\b}, 1].to_i
+        raise Error, "GitHub #{method} #{path}: unreadable HTTP response" if code.zero?
+        unless (status.success? && (200..299).cover?(code)) || (missing && code == 404)
+          raise Error, "GitHub #{method} #{path}: HTTP #{code}"
+        end
+
+        parsed = content.to_s.strip.empty? ? {} : JSON.parse(content)
+        [Response.new(code, parsed), next_path(header)]
+      rescue JSON::ParserError
+        raise Error, "GitHub #{method} #{path}: invalid JSON response"
+      end
+
+      def next_path(header)
+        link = header.lines.find { |line| line.match?(/\Alink:/i) }
+        url = link&.match(/<([^>]+)>;\s*rel="next"/)&.[](1)
+        return unless url
+
+        prefix = "https://api.github.com/repos/#{@project.repository}"
+        raise Error, "GitHub pagination points outside the configured repository" unless url.start_with?("#{prefix}/")
+
+        path = url.delete_prefix(prefix)
+        validate_request(path, "GET", false)
+        path
+      end
+
+      def combine_pages(first, following)
+        return first + following if first.is_a?(Array) && following.is_a?(Array)
+        if first.is_a?(Hash) && following.is_a?(Hash) &&
+           first["branch_policies"].is_a?(Array) && following["branch_policies"].is_a?(Array)
+          return first.merge("branch_policies" => first["branch_policies"] + following["branch_policies"])
+        end
+
+        raise Error, "GitHub returned an unsupported paginated response"
+      end
+
+      def execute(argv, stdin_data: nil)
+        output, _error, status = Open3.capture3(*argv, stdin_data: stdin_data, chdir: @project.root)
+        [output, status]
+      rescue Errno::ENOENT
+        raise Error, "GitHub CLI (gh) is not installed or the project directory is unavailable"
+      end
+    end
+  end
+end

data/lib/ruby_repo_kit/github/configuration.rb

@@ -0,0 +1,180 @@
+# frozen_string_literal: true
+
+module RubyRepoKit
+  module GitHub
+    class Configuration
+      def initialize(project:, client: nil, out: $stdout)
+        @project = project
+        @client = client || Client.new(project: project)
+        @policy = Policy.new(project: project)
+        @out = out
+      end
+
+      # A fresh GET-only plan on every invocation; no cached remote state is applied.
+      def plan
+        @changes = []
+        repository_settings
+        rulesets
+        environment
+        security_features
+        label
+        @changes.freeze
+      rescue KeyError, TypeError, NoMethodError => e
+        raise Error, "GitHub returned an incomplete configuration (#{e.class})"
+      end
+
+      def verify!
+        pending = plan
+        unless pending.empty?
+          descriptions = pending.map { |change| "- #{change.description}" }.join("\n")
+          raise Error, "Repository configuration needs attention:\n#{descriptions}\nRun github:plan, then github:apply."
+        end
+
+        @out.puts "GitHub repository policy verified for #{@project.repository}."
+        true
+      end
+
+      def apply!
+        pending = plan # Every read must succeed before the first write.
+        pending.each do |change|
+          @client.request(change.path, method: change.verb, body: change.body)
+          @out.puts "Configured #{change.description}."
+        end
+        verify!
+      end
+      alias setup apply!
+
+      private
+
+      def change(description, verb, path, body = nil)
+        @changes << Change.new(description, verb, path, body)
+      end
+
+      def get(path, **)
+        @client.request(path, **)
+      end
+
+      def object(value)
+        raise Error, "GitHub returned an object of an unexpected type" unless value.is_a?(Hash)
+
+        value
+      end
+
+      def list(value)
+        raise Error, "GitHub returned a list of an unexpected type" unless value.is_a?(Array) && value.all?(Hash)
+
+        value
+      end
+
+      # Order and extra server metadata are irrelevant; duplicates still count.
+      def matches?(actual, expected)
+        case expected
+        when Hash then actual.is_a?(Hash) && expected.all? { |key, value| matches?(actual[key], value) }
+        when Array
+          return false unless actual.is_a?(Array) && actual.length == expected.length
+
+          remaining = actual.dup
+          expected.all? do |value|
+            index = remaining.index { |item| matches?(item, value) }
+            index && remaining.delete_at(index)
+          end
+        else actual == expected
+        end
+      end
+
+      def repository_settings
+        current = object(get("").body)
+        raise Error, "Repository administrator access is required" unless current.dig("permissions", "admin") == true
+
+        change("merge settings", "PATCH", "", Policy::MERGE_SETTINGS) unless matches?(current, Policy::MERGE_SETTINGS)
+        scanning = %w[secret_scanning secret_scanning_push_protection].to_h { |key| [key, { "status" => "enabled" }] }
+        return if matches?(current["security_and_analysis"], scanning)
+
+        change("secret scanning and push protection", "PATCH", "", { "security_and_analysis" => scanning })
+      end
+
+      def rulesets
+        existing = list(get("/rulesets?includes_parents=false").body)
+        [@policy.main_ruleset, @policy.tags_ruleset].each do |desired|
+          found = existing.select { |ruleset| ruleset["name"] == desired["name"] }
+          raise Error, "Duplicate #{desired['name']} rulesets; reconcile them in GitHub first" if found.length > 1
+
+          if found.empty?
+            change("#{desired['name']} ruleset", "POST", "/rulesets", desired)
+            next
+          end
+          path = "/rulesets/#{identifier(found.first.fetch('id'))}"
+          current = object(get(path).body)
+          # Rules outside this policy remain project-owned when a managed rule changes.
+          managed = desired.fetch("rules").map { |rule| rule.fetch("type") }
+          extra = list(current.fetch("rules")).reject { |rule| managed.include?(rule.fetch("type")) }
+          replacement = desired.merge("rules" => desired.fetch("rules") + extra)
+          change("#{desired['name']} ruleset", "PUT", path, replacement) unless matches?(current, replacement)
+        end
+      end
+
+      def environment
+        path = "/environments/#{@project.environment}"
+        current = get(path, missing: true)
+        settings = object(current.body)
+        unless matches?(settings["deployment_branch_policy"], Policy::ENVIRONMENT)
+          body = preserved_protection(settings).merge("deployment_branch_policy" => Policy::ENVIRONMENT)
+          change("#{@project.environment} environment", "PUT", path, body)
+        end
+        policies = current.status == 404 ? [] : deployment_policies(path)
+        matching, extra = policies.partition { |policy| matches?(policy, Policy::TAG) }
+        # A duplicated matching policy is unnecessary and otherwise conceals drift.
+        (extra + matching.drop(1)).each do |policy|
+          change("remove extra #{@project.environment} deployment policy #{policy.fetch('name')}", "DELETE",
+                 "#{path}/deployment-branch-policies/#{identifier(policy.fetch('id'))}")
+        end
+        return unless matching.empty?
+
+        change("#{@project.environment} deployments restricted to v* tags", "POST",
+               "#{path}/deployment-branch-policies", Policy::TAG)
+      end
+
+      def deployment_policies(path)
+        list(object(get("#{path}/deployment-branch-policies").body).fetch("branch_policies"))
+      end
+
+      def preserved_protection(settings)
+        list(settings.fetch("protection_rules", [])).each_with_object({}) do |rule, body|
+          case rule.fetch("type")
+          when "wait_timer" then body["wait_timer"] = rule.fetch("wait_timer")
+          when "required_reviewers"
+            body["prevent_self_review"] = rule.fetch("prevent_self_review")
+            body["reviewers"] = list(rule.fetch("reviewers")).map do |reviewer|
+              { "type" => reviewer.fetch("type"), "id" => object(reviewer.fetch("reviewer")).fetch("id") }
+            end
+          when "branch_policy" then next
+          else raise Error,
+                     "Unknown environment protection #{rule['type'].inspect}; update its deployment policy manually"
+          end
+        end
+      end
+
+      def security_features
+        alerts = get("/vulnerability-alerts", missing: true)
+        change("vulnerability alerts", "PUT", "/vulnerability-alerts") if alerts.status == 404
+        %w[automated-security-fixes private-vulnerability-reporting immutable-releases].each do |feature|
+          enabled = object(get("/#{feature}").body).fetch("enabled")
+          raise Error, "GitHub returned an unknown #{feature} state" unless [true, false].include?(enabled)
+
+          change(feature.tr("-", " "), "PUT", "/#{feature}") unless enabled
+        end
+      end
+
+      def label
+        response = get("/labels/skip-changelog", missing: true)
+        change("skip-changelog label", "POST", "/labels", Policy::LABEL) if response.status == 404
+      end
+
+      def identifier(value)
+        raise Error, "GitHub returned an invalid resource identifier" unless value.is_a?(Integer) && value.positive?
+
+        value
+      end
+    end
+  end
+end

data/lib/ruby_repo_kit/github/policy.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module RubyRepoKit
+  module GitHub
+    # The initial personal-project policy is explicit, separate from reconciliation.
+    class Policy
+      ACTIONS_APP_ID = 15_368
+      MERGE_SETTINGS = {
+        "allow_merge_commit" => true, "allow_squash_merge" => false, "allow_rebase_merge" => false,
+        "merge_commit_title" => "PR_TITLE", "merge_commit_message" => "BLANK", "delete_branch_on_merge" => true
+      }.freeze
+      ENVIRONMENT = { "protected_branches" => false, "custom_branch_policies" => true }.freeze
+      TAG = { "name" => "v*", "type" => "tag" }.freeze
+      LABEL = { "name" => "skip-changelog", "color" => "ededed",
+                "description" => "No CHANGELOG.md entry: no user-visible change" }.freeze
+
+      def initialize(project:)
+        @project = project
+      end
+
+      def main_ruleset
+        {
+          "name" => "main", "target" => "branch", "enforcement" => "active", "bypass_actors" => [],
+          "conditions" => { "ref_name" => { "include" => %w[refs/heads/main refs/heads/hotfix/*], "exclude" => [] } },
+          "rules" => [
+            { "type" => "pull_request", "parameters" => {
+              "required_approving_review_count" => 0, "dismiss_stale_reviews_on_push" => false,
+              "require_code_owner_review" => false, "require_last_push_approval" => false,
+              "required_review_thread_resolution" => true, "allowed_merge_methods" => ["merge"]
+            } },
+            { "type" => "required_status_checks", "parameters" => {
+              "strict_required_status_checks_policy" => true, "do_not_enforce_on_create" => false,
+              "required_status_checks" => @project.required_checks.map do |name|
+                { "context" => name, "integration_id" => ACTIONS_APP_ID }
+              end
+            } },
+            { "type" => "required_signatures" }, { "type" => "non_fast_forward" }, { "type" => "deletion" }
+          ]
+        }
+      end
+
+      def tags_ruleset
+        {
+          "name" => "tags", "target" => "tag", "enforcement" => "active",
+          "bypass_actors" => [{ "actor_id" => 5, "actor_type" => "RepositoryRole", "bypass_mode" => "always" }],
+          "conditions" => { "ref_name" => { "include" => ["refs/tags/v*"], "exclude" => [] } },
+          "rules" => %w[creation update deletion].map { |type| { "type" => type } }
+        }
+      end
+    end
+  end
+end

data/lib/ruby_repo_kit/github.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module RubyRepoKit
+  module GitHub
+    class Error < RubyRepoKit::Error; end
+
+    Response = Data.define(:status, :body)
+    Change = Data.define(:description, :verb, :path, :body)
+  end
+end
+
+require_relative "github/client"
+require_relative "github/policy"
+require_relative "github/configuration"

data/lib/ruby_repo_kit/package.rb

@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+
+require "bundler"
+require "fileutils"
+require "open3"
+require "rubygems/package"
+require "tmpdir"
+require_relative "../ruby_repo_kit"
+require_relative "specification"
+
+module RubyRepoKit
+  # Builds the consumer and tests the installed artifact outside its bundle/checkout.
+  class Package
+    def initialize(project:, out: $stdout)
+      @project = project
+      @out = out
+    end
+
+    def build(output: nil)
+      spec = specification
+      target = output || @project.path("pkg/#{spec.name}-#{spec.version}.gem")
+      FileUtils.mkdir_p(File.dirname(target))
+      execute({}, [*gem_command, "build", @project.gemspec, "--output", target], chdir: @project.root)
+      verify(target)
+      target
+    end
+
+    def check(artifact: nil)
+      Dir.mktmpdir("ruby-repo-package-") do |dir|
+        package = artifact ? File.expand_path(artifact, @project.root) : build(output: File.join(dir, "package.gem"))
+        spec = verify(package)
+        home = File.join(dir, "gems")
+        cache_dependencies(dir)
+        Bundler.with_unbundled_env do
+          env = { "GEM_HOME" => home, "GEM_PATH" => home, "RUBYOPT" => nil, "RUBYLIB" => nil,
+                  "XDG_CONFIG_HOME" => File.join(dir, "config"), "NO_COLOR" => "1" }
+          # GEM_HOME selects the destination. --install-dir would make RubyGems
+          # ignore installed specifications, including Ruby's uncached default gems.
+          execute(env, [*gem_command, "install", "--local", "--no-document", "--norc",
+                        "--bindir", File.join(home, "bin"), package], chdir: dir)
+          spec.executables.each do |name|
+            executable = File.join(home, "bin", name)
+            version = execute(env, [executable, "--version"], chdir: dir)
+            unless version.match?(/(?<![\w.])#{Regexp.escape(spec.version.to_s)}(?![\w.])/)
+              raise Error, "Installed #{name} reports a different version"
+            end
+
+            help = execute(env, [executable, "--help"], chdir: dir)
+            raise Error, "Installed #{name} has empty help" if help.strip.empty?
+          end
+          yield env, home, dir if block_given?
+        end
+        @out.puts "Installed #{spec.name} #{spec.version} from the built gem in an isolated gem home."
+        spec
+      end
+    end
+
+    def verify(path)
+      package = Gem::Package.new(path)
+      package.verify
+      expected = specification
+      unless package.spec.name == expected.name && package.spec.version == expected.version
+        raise Error, "Package identity differs from #{@project.name} #{expected.version}"
+      end
+
+      package.spec
+    rescue Gem::Package::Error, Errno::ENOENT => e
+      raise Error, "Invalid gem artifact: #{e.message}"
+    end
+
+    private
+
+    def specification
+      spec = Specification.load(project: @project)
+      raise Error, "Gemspec name differs from project name" unless spec.name == @project.name
+
+      spec.files.each do |file|
+        raise Error, "Gemspec includes a missing file: #{file}" unless File.file?(@project.path(file))
+      end
+      spec
+    end
+
+    def gem_command
+      [RbConfig.ruby, "-rrubygems/gem_runner", "-e", "Gem::GemRunner.new.run(ARGV)", "--"]
+    end
+
+    def cache_dependencies(directory)
+      Bundler.load.specs.each do |spec|
+        FileUtils.cp(spec.cache_file, directory) if File.file?(spec.cache_file)
+      end
+    end
+
+    def execute(env, argv, chdir:)
+      output, status = Open3.capture2e(env, *argv, chdir: chdir)
+      raise Error, "#{argv.join(' ')} failed:\n#{output}" unless status.success?
+
+      output
+    end
+  end
+end

data/lib/ruby_repo_kit/project.rb

@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+
+require "pathname"
+require "psych"
+
+module RubyRepoKit
+  # Explicit consumer configuration; no paths are resolved relative to the gem.
+  class Project
+    CONFIG_FILE = ".ruby-repo.yml"
+    DEFAULT_CHECKS = ["quality", "commits", "audit", "fresh-dependencies", "test (ubuntu-latest, 3.4)",
+                      "test (ubuntu-latest, 4.0)", "test (macos-latest, 4.0)"].freeze
+    KEYS = %w[schema name repository version_file gemspec changelog generated_paths
+              generate_command check_command required_checks workflow environment].freeze
+    attr_reader :root, :name, :repository, :version_file, :gemspec, :changelog,
+                :generated_paths, :generate_command, :check_command, :required_checks,
+                :workflow, :environment
+
+    def self.load(root: Dir.pwd)
+      source = File.join(root, CONFIG_FILE)
+      new(root: root, settings: Psych.safe_load_file(source, permitted_classes: [], aliases: false))
+    rescue Errno::ENOENT => e
+      raise Error, "Cannot load project configuration: #{e.message}"
+    rescue Psych::Exception => e
+      raise Error, "Invalid #{CONFIG_FILE}: #{e.message}"
+    end
+
+    def initialize(root:, settings:)
+      raise Error, "Project configuration must be a mapping" unless settings.is_a?(Hash)
+      raise Error, "Unknown project settings: #{settings.keys - KEYS}" unless (settings.keys - KEYS).empty?
+      raise Error, "Unsupported configuration schema (expected 1)" unless settings.fetch("schema", nil) == 1
+
+      @root = File.realpath(root).freeze
+      @name = identifier(settings["name"], /\A[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*\z/, "gem name")
+      @repository = identifier(settings["repository"], %r{\A[A-Za-z0-9][A-Za-z0-9-]*/[A-Za-z0-9][A-Za-z0-9_.-]*\z},
+                               "repository")
+      @version_file = relative(settings.fetch("version_file", "lib/#{name.tr('-', '_')}/version.rb"))
+      @gemspec = relative(settings.fetch("gemspec", "#{name}.gemspec"))
+      @changelog = relative(settings.fetch("changelog", "CHANGELOG.md"))
+      @generated_paths = string_array(settings.fetch("generated_paths", [])).map { |entry| relative(entry) }.freeze
+      @generate_command = argv(settings.fetch("generate_command", %w[bundle exec rake generate]))
+      @check_command = argv(settings.fetch("check_command", %w[bundle exec rake check]))
+      @required_checks = string_array(settings.fetch("required_checks", DEFAULT_CHECKS)).freeze
+      @workflow = identifier(settings.fetch("workflow", "release.yml"), /\A[a-zA-Z0-9_-]+\.ya?ml\z/,
+                             "workflow filename")
+      @environment = identifier(settings.fetch("environment", "release"), /\A[a-zA-Z0-9_-]+\z/, "environment")
+      freeze
+    end
+
+    def url = "https://github.com/#{repository}"
+
+    def release_files = [version_file, changelog, "Gemfile.lock", *generated_paths].uniq
+
+    def path(relative_path)
+      value = relative(relative_path)
+      absolute = File.join(root, value)
+      ancestor = absolute
+      ancestor = File.dirname(ancestor) until File.exist?(ancestor) || File.symlink?(ancestor)
+      resolved = File.realpath(ancestor)
+      unless resolved == root || resolved.start_with?("#{root}/")
+        raise Error, "Project path escapes root through a symlink: #{value}"
+      end
+
+      absolute
+    rescue Errno::ENOENT
+      raise Error, "Project path contains a broken symlink: #{value}"
+    end
+
+    private
+
+    def identifier(value, pattern, description)
+      raise Error, "Invalid #{description}: #{value.inspect}" unless value.is_a?(String) && pattern.match?(value)
+
+      value.dup.freeze
+    end
+
+    def relative(value)
+      unless value.is_a?(String) && !value.empty? && !value.include?("\0") &&
+             !Pathname.new(value).absolute? && !value.split("/").intersect?(["..", ".", ""])
+        raise Error, "Expected a relative project path: #{value.inspect}"
+      end
+
+      value.dup.freeze
+    end
+
+    def string_array(value)
+      unless value.is_a?(Array) && value.all? { |entry| entry.is_a?(String) && !entry.empty? && !entry.include?("\0") }
+        raise Error, "Expected an array of nonempty strings"
+      end
+
+      value.map { |entry| entry.dup.freeze }
+    end
+
+    def argv(value)
+      result = string_array(value)
+      raise Error, "Commands require an executable and argv array" if result.empty?
+
+      result.freeze
+    end
+  end
+end

data/lib/ruby_repo_kit/rake_tasks.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+require "rake"
+require_relative "../ruby_repo_kit"
+require_relative "package"
+
+module RubyRepoKit
+  # Explicit installation avoids task registration merely by requiring the gem.
+  class RakeTasks
+    extend Rake::DSL
+
+    def self.install(project:)
+      if Rake::Task.task_defined?("release")
+        raise Error,
+              "A release task already exists; remove competing release tooling before installing RubyRepoKit tasks"
+      end
+
+      desc "Validate local repository maintenance contracts"
+      task "repo:check" do
+        require_relative "checks"
+        Checks.new(project: project).run
+      end
+
+      desc "Build the distributable gem"
+      task :build do
+        puts Package.new(project: project).build
+      end
+
+      desc "Install and smoke-test the built gem outside the checkout and bundle"
+      task "package:check", [:artifact] do |_task, args|
+        Package.new(project: project).check(artifact: args[:artifact])
+      end
+
+      desc "Check commit and pull-request message conventions"
+      task "lint:commits", [:range] do |_task, args|
+        require_relative "checks/commits"
+        Commits.new(project: project).check(range: args[:range] || ENV.fetch("COMMIT_RANGE", nil),
+                                            title: ENV.fetch("PR_TITLE", nil), body: ENV.fetch("PR_BODY", nil))
+      end
+
+      desc "Audit locked dependencies against the latest advisory database"
+      task :audit do
+        sh "bundle", "exec", "bundler-audit", "check", "--update"
+      end
+
+      install_release(project)
+      install_github(project)
+    end
+
+    def self.install_release(project)
+      require_relative "release"
+
+      desc "Verify the release tag, version and changelog"
+      task "release:verify" do
+        metadata = Release::Metadata.new(project: project)
+        tag = ENV["GITHUB_REF_TYPE"] == "tag" ? ENV.fetch("GITHUB_REF_NAME", nil) : ENV.fetch("TAG", nil)
+        puts "Verified #{project.name} #{metadata.verify(tag: tag)}"
+      end
+
+      desc "Verify release commit ancestry"
+      task "release:verify_ref" do
+        Release::Metadata.new(project: project).verify_ref(sha: ENV.fetch("GITHUB_SHA"))
+      end
+
+      desc "Build and record the release artifact checksum and notes"
+      task "release:artifact" => :build do
+        puts Release::Artifact.new(project: project).record
+      end
+
+      desc "Verify existing release bytes without rebuilding"
+      task "release:verify_artifact" do
+        puts Release::Artifact.new(project: project).verify
+      end
+
+      desc "Publish verified artifact in the configured GitHub release workflow only"
+      task :release do
+        Release::Publisher.new(project: project).publish
+      end
+    end
+
+    def self.install_github(project)
+      %w[plan verify apply].each do |operation|
+        desc "#{operation.capitalize} GitHub repository policy"
+        task "github:#{operation}" do
+          require_relative "github"
+          configuration = GitHub::Configuration.new(project: project)
+          case operation
+          when "plan" then configuration.plan.each do |change|
+            puts "#{change.verb} #{change.path}: #{change.description}"
+          end
+          when "verify" then configuration.verify!
+          when "apply" then configuration.apply!
+          end
+        end
+      end
+    end
+  end
+end