@aspruyt/xfg 3.9.8 → 3.9.9

package/dist/settings/repo-settings/github-repo-settings-strategy.js

@@ -78,7 +78,10 @@ export class GitHubRepoSettingsStrategy {
         const github = repoInfo;
         const endpoint = `/repos/${github.owner}/${github.repo}`;
         const result = await this.ghApi("GET", endpoint, undefined, options);
-        const settings = JSON.parse(result);
+        const parsed = JSON.parse(result);
+        const settings = parsed;
+        // Extract owner type from nested API response
+        settings.owner_type = parsed.owner?.type;
         // Fetch security settings from separate endpoints
         settings.vulnerability_alerts = await this.getVulnerabilityAlerts(github, options);
         // Pass vulnerability_alerts state - automated security fixes requires it enabled

package/dist/settings/repo-settings/processor.d.ts

@@ -28,6 +28,11 @@ export declare class RepoSettingsProcessor implements IRepoSettingsProcessor {
     constructor(strategy?: IRepoSettingsStrategy);
     process(repoConfig: RepoConfig, repoInfo: RepoInfo, options: RepoSettingsProcessorOptions): Promise<RepoSettingsProcessorResult>;
     private applyChanges;
+    /**
+     * Validates that desired security settings are compatible with the repo's
+     * visibility and owner type. Returns error messages for incompatible settings.
+     */
+    private validateSecuritySettings;
     /**
      * Resolves a GitHub App installation token for the given repo.
      * Returns undefined if no token manager or token resolution fails.

package/dist/settings/repo-settings/processor.js

@@ -45,6 +45,15 @@ export class RepoSettingsProcessor {
             const strategyOptions = { token: effectiveToken, host: githubRepo.host };
             // Fetch current settings
             const currentSettings = await this.strategy.getSettings(githubRepo, strategyOptions);
+            // Validate security settings compatibility
+            const securityErrors = this.validateSecuritySettings(desiredSettings, currentSettings);
+            if (securityErrors.length > 0) {
+                return {
+                    success: false,
+                    repoName,
+                    message: `Failed: ${securityErrors.join("; ")}`,
+                };
+            }
             // Compute diff
             const changes = diffRepoSettings(currentSettings, desiredSettings);
             if (!hasChanges(changes)) {
@@ -117,6 +126,35 @@ export class RepoSettingsProcessor {
             await this.strategy.setAutomatedSecurityFixes(repoInfo, automatedSecurityFixes, options);
         }
     }
+    /**
+     * Validates that desired security settings are compatible with the repo's
+     * visibility and owner type. Returns error messages for incompatible settings.
+     */
+    validateSecuritySettings(desiredSettings, currentSettings) {
+        const errors = [];
+        const isPublic = currentSettings.visibility === "public";
+        // privateVulnerabilityReporting is only available on public repos
+        if (desiredSettings.privateVulnerabilityReporting === true && !isPublic) {
+            errors.push("privateVulnerabilityReporting is only available for public repositories");
+        }
+        // secretScanning and secretScanningPushProtection:
+        // - Available on public repos (free)
+        // - Available on org private/internal repos with GHAS (security_and_analysis is populated)
+        // - NOT available on user private repos or org private/internal repos without GHAS
+        if (!isPublic) {
+            const isUserOwned = currentSettings.owner_type === "User";
+            const hasGHAS = currentSettings.security_and_analysis != null;
+            if (desiredSettings.secretScanning === true &&
+                (isUserOwned || !hasGHAS)) {
+                errors.push("secretScanning requires GitHub Advanced Security (not available for this repository)");
+            }
+            if (desiredSettings.secretScanningPushProtection === true &&
+                (isUserOwned || !hasGHAS)) {
+                errors.push("secretScanningPushProtection requires GitHub Advanced Security (not available for this repository)");
+            }
+        }
+        return errors;
+    }
     /**
      * Resolves a GitHub App installation token for the given repo.
      * Returns undefined if no token manager or token resolution fails.

package/dist/settings/repo-settings/types.d.ts

@@ -39,6 +39,7 @@ export interface CurrentRepoSettings {
             status: string;
         };
     };
+    owner_type?: "User" | "Organization";
     vulnerability_alerts?: boolean;
     automated_security_fixes?: boolean;
     private_vulnerability_reporting?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aspruyt/xfg",
-  "version": "3.9.8",
+  "version": "3.9.9",
   "description": "Manage files, settings, and repositories across GitHub, Azure DevOps, and GitLab — declaratively, from a single YAML config",
   "type": "module",
   "main": "dist/index.js",