@codyswann/lisa 2.195.8 → 2.196.0

package/all/github-rulesets/base.json

@@ -0,0 +1,64 @@
+{
+  "name": "base",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "exclude": [],
+      "include": [
+        "~DEFAULT_BRANCH",
+        "refs/heads/dev",
+        "refs/heads/staging",
+        "refs/heads/main"
+      ]
+    }
+  },
+  "bypass_actors": [
+    {
+      "actor_id": null,
+      "actor_type": "DeployKey",
+      "bypass_mode": "always"
+    },
+    {
+      "actor_id": 5,
+      "actor_type": "RepositoryRole",
+      "bypass_mode": "always"
+    }
+  ],
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": false,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": true,
+        "allowed_merge_methods": ["merge"]
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": false,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [
+          {
+            "context": "CodeRabbit",
+            "integration_id": 347564
+          },
+          {
+            "context": "GitGuardian Security Checks",
+            "integration_id": 46505
+          }
+        ]
+      }
+    }
+  ]
+}

package/all/github-rulesets/prevent-delete.json

@@ -0,0 +1,25 @@
+{
+  "name": "prevent delete",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "exclude": [],
+      "include": [
+        "~DEFAULT_BRANCH",
+        "refs/heads/dev",
+        "refs/heads/staging",
+        "refs/heads/main"
+      ]
+    }
+  },
+  "bypass_actors": [],
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    }
+  ]
+}

package/all/github-rulesets/protect-tags.json

@@ -0,0 +1,31 @@
+{
+  "name": "protect tags",
+  "target": "tag",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "exclude": [],
+      "include": ["refs/tags/v*"]
+    }
+  },
+  "bypass_actors": [
+    {
+      "actor_id": null,
+      "actor_type": "DeployKey",
+      "bypass_mode": "always"
+    },
+    {
+      "actor_id": 5,
+      "actor_type": "RepositoryRole",
+      "bypass_mode": "always"
+    }
+  ],
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    }
+  ]
+}

package/cdk/github-rulesets/cdk-validation.json

@@ -0,0 +1,43 @@
+{
+  "name": "cdk validation",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "exclude": [],
+      "include": [
+        "~DEFAULT_BRANCH",
+        "refs/heads/dev",
+        "refs/heads/staging",
+        "refs/heads/main"
+      ]
+    }
+  },
+  "bypass_actors": [
+    {
+      "actor_id": null,
+      "actor_type": "DeployKey",
+      "bypass_mode": "always"
+    },
+    {
+      "actor_id": 5,
+      "actor_type": "RepositoryRole",
+      "bypass_mode": "always"
+    }
+  ],
+  "rules": [
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": false,
+        "do_not_enforce_on_create": true,
+        "required_status_checks": [
+          {
+            "context": "🏗️ CDK Validation",
+            "integration_id": 15368
+          }
+        ]
+      }
+    }
+  ]
+}

package/expo/github-rulesets/playwright.json

@@ -0,0 +1,38 @@
+{
+  "name": "playwright",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "exclude": [],
+      "include": ["refs/heads/staging"]
+    }
+  },
+  "bypass_actors": [
+    {
+      "actor_id": null,
+      "actor_type": "DeployKey",
+      "bypass_mode": "always"
+    },
+    {
+      "actor_id": 5,
+      "actor_type": "RepositoryRole",
+      "bypass_mode": "always"
+    }
+  ],
+  "rules": [
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": false,
+        "do_not_enforce_on_create": true,
+        "required_status_checks": [
+          {
+            "context": "🔍 Quality Checks / 🎭 Playwright E2E Tests",
+            "integration_id": 15368
+          }
+        ]
+      }
+    }
+  ]
+}

package/package.json

@@ -94,7 +94,7 @@
     "ws": ">=8.20.1"
   },
   "name": "@codyswann/lisa",
-  "version": "2.195.8",
+  "version": "2.196.0",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -217,7 +217,7 @@
     "vitest": "^4.1.9"
   },
   "devDependencies": {
-    "@codyswann/lisa": "^2.191.13",
+    "@codyswann/lisa": "^2.195.6",
     "@types/js-yaml": "^4.0.9",
     "@types/semver": "^7.7.1",
     "eslint-plugin-oxlint": "^1.62.0",

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.195.8",
+  "version": "2.196.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.195.8",
+  "version": "2.196.0",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-setup-github-repo/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: lisa-setup-github-repo
+description: "Apply Lisa's GitHub repository…"
+allowed-tools: ["Bash", "Read", "AskUserQuestion"]
+---
+
+# Setup GitHub Repository Governance
+
+Apply the fleet-standard GitHub repository configuration to this project's repo. The settings, rulesets, and deploy key that used to be clicked together by hand for every new repo are applied here as one scripted flow.
+
+## What gets applied
+
+1. **Repository settings** (`scripts/lisa-github-repo-settings.sh`)
+   - Merge commits on; squash and rebase merging **off** (merge-only policy)
+   - Merge commit title/message from the PR (`MERGE_MESSAGE` / `PR_TITLE`)
+   - Auto-merge **on** — per-repo opt-out via `.lisa.config.json`:
+     ```json
+     { "github": { "settings": { "allow_auto_merge": false } } }
+     ```
+     (any key under `github.settings` overrides the baseline)
+   - Delete head branches after merge (environment branches survive — the rulesets' `deletion` rule means GitHub refuses to delete them)
+   - "Always suggest updating pull request branches" on
+   - GitHub wiki tab off (Lisa projects use in-repo `wiki/`)
+   - Secret scanning + push protection enabled where the plan supports it
+2. **Rulesets** (`scripts/lisa-github-rulesets.sh`) from Lisa's `<type>/github-rulesets/` templates, matched by project type:
+   - `base` — deletion/force-push protection on `main`/`dev`/`staging` + default, PRs required (0 approvals, review-thread resolution required, merge method = merge only), required checks: CodeRabbit + GitGuardian
+   - `quality checks` — the stack's CI checks (TypeScript emoji names or Rails names)
+   - `prevent delete`, `protect tags` (`v*`), plus stack overlays (`cdk validation`, staging-only `playwright`)
+   - Repos without `.github/workflows/` get only app-based required checks — an Actions check that can never report would block every PR forever
+3. **Deploy key** (`scripts/setup-deploy-key.sh --yes`) — write-access deploy key + `DEPLOY_KEY` secret, skipped when already configured. The `base` ruleset's `DeployKey: always` bypass is what lets CI version-bump pushes through protected branches.
+
+## Workflow
+
+### Step 1 — Locate the scripts
+
+In the Lisa repo itself, use `scripts/` directly. In a downstream project, use the installed package:
+
+```bash
+LISA_SCRIPTS=$(ls -d node_modules/@codyswann/lisa/scripts 2>/dev/null || echo scripts)
+```
+
+### Step 2 — Dry-run and show the plan
+
+```bash
+bash "$LISA_SCRIPTS/lisa-github-repo-setup.sh" --dry-run .
+```
+
+Present what would change. If the repo already matches the baseline, say so and stop.
+
+### Step 3 — Apply
+
+```bash
+bash "$LISA_SCRIPTS/lisa-github-repo-setup.sh" .
+```
+
+Requires `gh` authenticated with **admin** permission on the repo. A 403 on rulesets means the plan doesn't support them (private repo on a free personal plan) — settings and deploy key still apply; the script skips rulesets gracefully.
+
+### Step 4 — Verify
+
+```bash
+gh api "repos/$(gh repo view --json nameWithOwner -q .nameWithOwner)" \
+  --jq '{allow_squash_merge, allow_auto_merge, delete_branch_on_merge, allow_update_branch}'
+gh api "repos/$(gh repo view --json nameWithOwner -q .nameWithOwner)/rulesets" --jq '[.[].name]'
+```
+
+Report the applied settings and ruleset names. If any step failed, surface the error — do not mark the setup complete.

package/plugins/lisa/.codex-plugin/skills/lisa-setup-github-repo/agents/openai.yaml

@@ -0,0 +1,4 @@
+display_name: "Setup Github Repo"
+short_description: "Apply Lisa's GitHub repository…"
+default_prompt:
+  - "Use $lisa-setup-github-repo: Apply Lisa's GitHub repository…."

package/plugins/lisa/commands/lisa/setup/github-repo.md

@@ -0,0 +1,7 @@
+---
+description: "Apply Lisa's GitHub repository governance baseline: merge-only settings with auto-merge and delete-branch-on-merge, branch + tag rulesets (CodeRabbit/GitGuardian/Quality Checks gates, prevent delete, protect tags), and a CI deploy key + DEPLOY_KEY secret. Idempotent; per-repo overrides via .lisa.config.json github.settings."
+allowed-tools: ["Skill"]
+argument-hint: ""
+---
+
+Use the /lisa-setup-github-repo skill to apply the GitHub repository governance baseline. $ARGUMENTS

package/plugins/lisa/skills/lisa-setup-github-repo/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: lisa-setup-github-repo
+description: "Apply Lisa's GitHub repository governance baseline to the current project's repo: repository settings (merge-only, auto-merge, delete-branch-on-merge, update-branch suggestions, wiki off, secret scanning where available), branch + tag rulesets from Lisa templates (base PR gate with CodeRabbit/GitGuardian/Quality Checks, prevent delete, protect tags, stack overlays), and a write-access deploy key + DEPLOY_KEY secret so release workflows can push version bumps through the rulesets' DeployKey bypass. Idempotent — re-running updates settings and rulesets in place and skips an already-configured deploy key."
+allowed-tools: ["Bash", "Read", "AskUserQuestion"]
+---
+
+# Setup GitHub Repository Governance
+
+Apply the fleet-standard GitHub repository configuration to this project's repo. The settings, rulesets, and deploy key that used to be clicked together by hand for every new repo are applied here as one scripted flow.
+
+## What gets applied
+
+1. **Repository settings** (`scripts/lisa-github-repo-settings.sh`)
+   - Merge commits on; squash and rebase merging **off** (merge-only policy)
+   - Merge commit title/message from the PR (`MERGE_MESSAGE` / `PR_TITLE`)
+   - Auto-merge **on** — per-repo opt-out via `.lisa.config.json`:
+     ```json
+     { "github": { "settings": { "allow_auto_merge": false } } }
+     ```
+     (any key under `github.settings` overrides the baseline)
+   - Delete head branches after merge (environment branches survive — the rulesets' `deletion` rule means GitHub refuses to delete them)
+   - "Always suggest updating pull request branches" on
+   - GitHub wiki tab off (Lisa projects use in-repo `wiki/`)
+   - Secret scanning + push protection enabled where the plan supports it
+2. **Rulesets** (`scripts/lisa-github-rulesets.sh`) from Lisa's `<type>/github-rulesets/` templates, matched by project type:
+   - `base` — deletion/force-push protection on `main`/`dev`/`staging` + default, PRs required (0 approvals, review-thread resolution required, merge method = merge only), required checks: CodeRabbit + GitGuardian
+   - `quality checks` — the stack's CI checks (TypeScript emoji names or Rails names)
+   - `prevent delete`, `protect tags` (`v*`), plus stack overlays (`cdk validation`, staging-only `playwright`)
+   - Repos without `.github/workflows/` get only app-based required checks — an Actions check that can never report would block every PR forever
+3. **Deploy key** (`scripts/setup-deploy-key.sh --yes`) — write-access deploy key + `DEPLOY_KEY` secret, skipped when already configured. The `base` ruleset's `DeployKey: always` bypass is what lets CI version-bump pushes through protected branches.
+
+## Workflow
+
+### Step 1 — Locate the scripts
+
+In the Lisa repo itself, use `scripts/` directly. In a downstream project, use the installed package:
+
+```bash
+LISA_SCRIPTS=$(ls -d node_modules/@codyswann/lisa/scripts 2>/dev/null || echo scripts)
+```
+
+### Step 2 — Dry-run and show the plan
+
+```bash
+bash "$LISA_SCRIPTS/lisa-github-repo-setup.sh" --dry-run .
+```
+
+Present what would change. If the repo already matches the baseline, say so and stop.
+
+### Step 3 — Apply
+
+```bash
+bash "$LISA_SCRIPTS/lisa-github-repo-setup.sh" .
+```
+
+Requires `gh` authenticated with **admin** permission on the repo. A 403 on rulesets means the plan doesn't support them (private repo on a free personal plan) — settings and deploy key still apply; the script skips rulesets gracefully.
+
+### Step 4 — Verify
+
+```bash
+gh api "repos/$(gh repo view --json nameWithOwner -q .nameWithOwner)" \
+  --jq '{allow_squash_merge, allow_auto_merge, delete_branch_on_merge, allow_update_branch}'
+gh api "repos/$(gh repo view --json nameWithOwner -q .nameWithOwner)/rulesets" --jq '[.[].name]'
+```
+
+Report the applied settings and ruleset names. If any step failed, surface the error — do not mark the setup complete.

package/plugins/lisa/skills/lisa-setup-github-repo/agents/openai.yaml

@@ -0,0 +1,4 @@
+display_name: "Setup Github Repo"
+short_description: "Apply Lisa's GitHub repository governance baseline to the current project's repo: repository settings (merge-only, auto-merge…"
+default_prompt:
+  - "Use $lisa-setup-github-repo: Apply Lisa's GitHub repository governance baseline to the current project's repo: repository settings (merge-only, auto-merge…."

package/plugins/lisa-agy/commands/lisa/setup/github-repo.md

@@ -0,0 +1,7 @@
+---
+description: "Apply Lisa's GitHub repository governance baseline: merge-only settings with auto-merge and delete-branch-on-merge, branch + tag rulesets (CodeRabbit/GitGuardian/Quality Checks gates, prevent delete, protect tags), and a CI deploy key + DEPLOY_KEY secret. Idempotent; per-repo overrides via .lisa.config.json github.settings."
+allowed-tools: ["Skill"]
+argument-hint: ""
+---
+
+Use the /lisa-setup-github-repo skill to apply the GitHub repository governance baseline. $ARGUMENTS

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.195.8",
+  "version": "2.196.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-setup-github-repo/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: lisa-setup-github-repo
+description: "Apply Lisa's GitHub repository governance baseline to the current project's repo: repository settings (merge-only, auto-merge, delete-branch-on-merge, update-branch suggestions, wiki off, secret scanning where available), branch + tag rulesets from Lisa templates (base PR gate with CodeRabbit/GitGuardian/Quality Checks, prevent delete, protect tags, stack overlays), and a write-access deploy key + DEPLOY_KEY secret so release workflows can push version bumps through the rulesets' DeployKey bypass. Idempotent — re-running updates settings and rulesets in place and skips an already-configured deploy key."
+allowed-tools: ["Bash", "Read", "AskUserQuestion"]
+---
+
+# Setup GitHub Repository Governance
+
+Apply the fleet-standard GitHub repository configuration to this project's repo. The settings, rulesets, and deploy key that used to be clicked together by hand for every new repo are applied here as one scripted flow.
+
+## What gets applied
+
+1. **Repository settings** (`scripts/lisa-github-repo-settings.sh`)
+   - Merge commits on; squash and rebase merging **off** (merge-only policy)
+   - Merge commit title/message from the PR (`MERGE_MESSAGE` / `PR_TITLE`)
+   - Auto-merge **on** — per-repo opt-out via `.lisa.config.json`:
+     ```json
+     { "github": { "settings": { "allow_auto_merge": false } } }
+     ```
+     (any key under `github.settings` overrides the baseline)
+   - Delete head branches after merge (environment branches survive — the rulesets' `deletion` rule means GitHub refuses to delete them)
+   - "Always suggest updating pull request branches" on
+   - GitHub wiki tab off (Lisa projects use in-repo `wiki/`)
+   - Secret scanning + push protection enabled where the plan supports it
+2. **Rulesets** (`scripts/lisa-github-rulesets.sh`) from Lisa's `<type>/github-rulesets/` templates, matched by project type:
+   - `base` — deletion/force-push protection on `main`/`dev`/`staging` + default, PRs required (0 approvals, review-thread resolution required, merge method = merge only), required checks: CodeRabbit + GitGuardian
+   - `quality checks` — the stack's CI checks (TypeScript emoji names or Rails names)
+   - `prevent delete`, `protect tags` (`v*`), plus stack overlays (`cdk validation`, staging-only `playwright`)
+   - Repos without `.github/workflows/` get only app-based required checks — an Actions check that can never report would block every PR forever
+3. **Deploy key** (`scripts/setup-deploy-key.sh --yes`) — write-access deploy key + `DEPLOY_KEY` secret, skipped when already configured. The `base` ruleset's `DeployKey: always` bypass is what lets CI version-bump pushes through protected branches.
+
+## Workflow
+
+### Step 1 — Locate the scripts
+
+In the Lisa repo itself, use `scripts/` directly. In a downstream project, use the installed package:
+
+```bash
+LISA_SCRIPTS=$(ls -d node_modules/@codyswann/lisa/scripts 2>/dev/null || echo scripts)
+```
+
+### Step 2 — Dry-run and show the plan
+
+```bash
+bash "$LISA_SCRIPTS/lisa-github-repo-setup.sh" --dry-run .
+```
+
+Present what would change. If the repo already matches the baseline, say so and stop.
+
+### Step 3 — Apply
+
+```bash
+bash "$LISA_SCRIPTS/lisa-github-repo-setup.sh" .
+```
+
+Requires `gh` authenticated with **admin** permission on the repo. A 403 on rulesets means the plan doesn't support them (private repo on a free personal plan) — settings and deploy key still apply; the script skips rulesets gracefully.
+
+### Step 4 — Verify
+
+```bash
+gh api "repos/$(gh repo view --json nameWithOwner -q .nameWithOwner)" \
+  --jq '{allow_squash_merge, allow_auto_merge, delete_branch_on_merge, allow_update_branch}'
+gh api "repos/$(gh repo view --json nameWithOwner -q .nameWithOwner)/rulesets" --jq '[.[].name]'
+```
+
+Report the applied settings and ruleset names. If any step failed, surface the error — do not mark the setup complete.

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.195.8",
+  "version": "2.196.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.195.8",
+  "version": "2.196.0",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.195.8",
+  "version": "2.196.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.195.8",
+  "version": "2.196.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.195.8",
+  "version": "2.196.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.195.8",
+  "version": "2.196.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/commands/lisa/setup/github-repo.md

@@ -0,0 +1,7 @@
+---
+description: "Apply Lisa's GitHub repository governance baseline: merge-only settings with auto-merge and delete-branch-on-merge, branch + tag rulesets (CodeRabbit/GitGuardian/Quality Checks gates, prevent delete, protect tags), and a CI deploy key + DEPLOY_KEY secret. Idempotent; per-repo overrides via .lisa.config.json github.settings."
+allowed-tools: ["Skill"]
+argument-hint: ""
+---
+
+Use the /lisa-setup-github-repo skill to apply the GitHub repository governance baseline. $ARGUMENTS

package/plugins/lisa-copilot/skills/lisa-setup-github-repo/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: lisa-setup-github-repo
+description: "Apply Lisa's GitHub repository governance baseline to the current project's repo: repository settings (merge-only, auto-merge, delete-branch-on-merge, update-branch suggestions, wiki off, secret scanning where available), branch + tag rulesets from Lisa templates (base PR gate with CodeRabbit/GitGuardian/Quality Checks, prevent delete, protect tags, stack overlays), and a write-access deploy key + DEPLOY_KEY secret so release workflows can push version bumps through the rulesets' DeployKey bypass. Idempotent — re-running updates settings and rulesets in place and skips an already-configured deploy key."
+allowed-tools: ["Bash", "Read", "AskUserQuestion"]
+---
+
+# Setup GitHub Repository Governance
+
+Apply the fleet-standard GitHub repository configuration to this project's repo. The settings, rulesets, and deploy key that used to be clicked together by hand for every new repo are applied here as one scripted flow.
+
+## What gets applied
+
+1. **Repository settings** (`scripts/lisa-github-repo-settings.sh`)
+   - Merge commits on; squash and rebase merging **off** (merge-only policy)
+   - Merge commit title/message from the PR (`MERGE_MESSAGE` / `PR_TITLE`)
+   - Auto-merge **on** — per-repo opt-out via `.lisa.config.json`:
+     ```json
+     { "github": { "settings": { "allow_auto_merge": false } } }
+     ```
+     (any key under `github.settings` overrides the baseline)
+   - Delete head branches after merge (environment branches survive — the rulesets' `deletion` rule means GitHub refuses to delete them)
+   - "Always suggest updating pull request branches" on
+   - GitHub wiki tab off (Lisa projects use in-repo `wiki/`)
+   - Secret scanning + push protection enabled where the plan supports it
+2. **Rulesets** (`scripts/lisa-github-rulesets.sh`) from Lisa's `<type>/github-rulesets/` templates, matched by project type:
+   - `base` — deletion/force-push protection on `main`/`dev`/`staging` + default, PRs required (0 approvals, review-thread resolution required, merge method = merge only), required checks: CodeRabbit + GitGuardian
+   - `quality checks` — the stack's CI checks (TypeScript emoji names or Rails names)
+   - `prevent delete`, `protect tags` (`v*`), plus stack overlays (`cdk validation`, staging-only `playwright`)
+   - Repos without `.github/workflows/` get only app-based required checks — an Actions check that can never report would block every PR forever
+3. **Deploy key** (`scripts/setup-deploy-key.sh --yes`) — write-access deploy key + `DEPLOY_KEY` secret, skipped when already configured. The `base` ruleset's `DeployKey: always` bypass is what lets CI version-bump pushes through protected branches.
+
+## Workflow
+
+### Step 1 — Locate the scripts
+
+In the Lisa repo itself, use `scripts/` directly. In a downstream project, use the installed package:
+
+```bash
+LISA_SCRIPTS=$(ls -d node_modules/@codyswann/lisa/scripts 2>/dev/null || echo scripts)
+```
+
+### Step 2 — Dry-run and show the plan
+
+```bash
+bash "$LISA_SCRIPTS/lisa-github-repo-setup.sh" --dry-run .
+```
+
+Present what would change. If the repo already matches the baseline, say so and stop.
+
+### Step 3 — Apply
+
+```bash
+bash "$LISA_SCRIPTS/lisa-github-repo-setup.sh" .
+```
+
+Requires `gh` authenticated with **admin** permission on the repo. A 403 on rulesets means the plan doesn't support them (private repo on a free personal plan) — settings and deploy key still apply; the script skips rulesets gracefully.
+
+### Step 4 — Verify
+
+```bash
+gh api "repos/$(gh repo view --json nameWithOwner -q .nameWithOwner)" \
+  --jq '{allow_squash_merge, allow_auto_merge, delete_branch_on_merge, allow_update_branch}'
+gh api "repos/$(gh repo view --json nameWithOwner -q .nameWithOwner)/rulesets" --jq '[.[].name]'
+```
+
+Report the applied settings and ruleset names. If any step failed, surface the error — do not mark the setup complete.

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.195.8",
+  "version": "2.196.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/commands/lisa/setup/github-repo.md

@@ -0,0 +1,7 @@
+---
+description: "Apply Lisa's GitHub repository governance baseline: merge-only settings with auto-merge and delete-branch-on-merge, branch + tag rulesets (CodeRabbit/GitGuardian/Quality Checks gates, prevent delete, protect tags), and a CI deploy key + DEPLOY_KEY secret. Idempotent; per-repo overrides via .lisa.config.json github.settings."
+allowed-tools: ["Skill"]
+argument-hint: ""
+---
+
+Use the /lisa-setup-github-repo skill to apply the GitHub repository governance baseline. $ARGUMENTS