@biffo/cli 0.206.1 → 0.207.0

package/dist/index.js

@@ -8921,7 +8921,7 @@ function deriveRequiredContexts(observed) {
 function protectionParamsFor(contexts, options = {}) {
   return {
     required_status_checks: { strict: options.strict ?? true, contexts: [...contexts].sort() },
-    enforce_admins: false,
+    enforce_admins: options.enforceAdmins ?? true,
     required_pull_request_reviews: {
       required_approving_review_count: 0,
       dismiss_stale_reviews: false
@@ -9054,6 +9054,7 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
   const findings = [];
   const audited = [];
   const observedStrict = /* @__PURE__ */ new Map();
+  const observedEnforceAdmins = /* @__PURE__ */ new Map();
   for (const branch of BRANCHES) {
     try {
       await octokit.repos.getBranch({ owner, repo, branch });
@@ -9066,6 +9067,7 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
       const { data } = await octokit.repos.getBranchProtection({ owner, repo, branch });
       findings.push(...auditBranch(branch, data));
       observedStrict.set(branch, data.required_status_checks?.strict ?? false);
+      observedEnforceAdmins.set(branch, data.enforce_admins?.enabled ?? false);
     } catch (err) {
       if (err.status === 404) {
         findings.push(...auditBranch(branch, null));
@@ -9098,22 +9100,33 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
 `);
     console.log(formatPlans(plans));
     let applied = 0;
-    let preserved = 0;
+    let preservedStrict = 0;
+    let preservedAdmins = 0;
     for (const plan of plans.filter((p) => p.action === "apply")) {
       const existing = observedStrict.get(plan.branch);
       const strict = existing ?? true;
       if (existing === false) {
-        preserved += 1;
+        preservedStrict += 1;
         console.log(
           `  ${plan.branch}: keeping strict=false \u2014 already set on this branch, so it is a
       decision rather than a gap. Change it deliberately with \`gh api\`, not here.`
         );
       }
+      const existingAdmins = observedEnforceAdmins.get(plan.branch);
+      const enforceAdmins = existingAdmins ?? true;
+      if (existingAdmins === false) {
+        preservedAdmins += 1;
+        console.log(
+          `  ${plan.branch}: keeping enforce_admins=false \u2014 already set on this branch, so it
+      is a decision rather than a gap. Note that protection which does not bind an
+      admin is advisory for whoever merges; scripts/protection-audit.sh fails on it.`
+        );
+      }
       await octokit.repos.updateBranchProtection({
         owner,
         repo,
         branch: plan.branch,
-        ...protectionParamsFor(plan.contexts, { strict })
+        ...protectionParamsFor(plan.contexts, { strict, enforceAdmins })
       });
       applied += 1;
     }
@@ -9125,7 +9138,7 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
     }
     console.log(
       `
-\u2713 protection applied to ${applied} branch(es)` + (preserved > 0 ? `, ${preserved} keeping an existing strict=false` : "") + ". Re-run without --fix to verify."
+\u2713 protection applied to ${applied} branch(es)` + (preservedStrict > 0 ? `, ${preservedStrict} keeping an existing strict=false` : "") + (preservedAdmins > 0 ? `, ${preservedAdmins} keeping an existing enforce_admins=false` : "") + ". Re-run without --fix to verify."
     );
     return;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.206.1",
+  "version": "0.207.0",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",