@goodandready/dsh-github-ops 0.1.0

package/lib/tools/register-ops.js

@@ -0,0 +1,283 @@
+// Workflow-run and repository-settings tool registrations.
+//
+// Reads are free; writes follow the plugin's model — an explicit confirm flag for the
+// destructive ones, and a clear refusal where one confirmation cannot make the call safe.
+
+import {
+  listRuns,
+  getRun,
+  listRunJobs,
+  rerunRun,
+  cancelRun,
+  getRunLogsUrl,
+} from './actions.js'
+import {
+  listVariables,
+  setVariable,
+  deleteVariable,
+  listSecrets,
+  setSecret,
+  deleteSecret,
+  listRulesets,
+  getRuleset,
+  applyRuleset,
+  deleteRuleset,
+  getBranchProtection,
+  setBranchProtection,
+  deleteBranchProtection,
+} from './repo-settings.js'
+
+const REPOSITORY = {
+  repository: { type: 'string', description: 'Repository as "owner/repo". Omit to use the default from settings.' },
+}
+
+export function registerOpsTools({ tool, asRepo, client, liveConfig }) {
+  const repoParams = (extra = {}) => ({ ...REPOSITORY, ...extra })
+  const withRepo = async (args, run) => {
+    const { owner, repo } = await asRepo(args, liveConfig())
+    return run({ owner, repo })
+  }
+
+  // ------------------------------------------------------------- workflow runs
+
+  tool(
+    'gh_run_list',
+    'List GitHub Actions workflow runs of a repository, newest first, optionally filtered by branch, workflow file or status. Read-only.',
+    repoParams({
+      branch: { type: 'string', description: 'Filter by head branch.' },
+      workflow: { type: 'string', description: 'Workflow file name or id, e.g. "ci.yml".' },
+      status: { type: 'string', description: 'Filter by status or conclusion, e.g. completed, failure, in_progress.' },
+      limit: { type: 'number', description: 'How many runs to return (max 100, default 20).' },
+    }),
+    async (args) => withRepo(args, async ({ owner, repo }) => listRuns(await client(), {
+      owner, repo, branch: args.branch, workflow: args.workflow, status: args.status, limit: args.limit,
+    })),
+  )
+
+  tool(
+    'gh_run_view',
+    'Read one GitHub Actions run: workflow, event, branch, status, conclusion and URL. Read-only.',
+    repoParams({ runId: { type: 'number', description: 'Run id from gh_run_list.' } }),
+    async (args) => withRepo(args, async ({ owner, repo }) => getRun(await client(), { owner, repo, runId: args.runId })),
+  )
+
+  tool(
+    'gh_run_jobs',
+    'List the jobs of a run with their steps and the steps that failed. Read-only, and usually enough to understand a failure without downloading logs.',
+    repoParams({ runId: { type: 'number', description: 'Run id.' } }),
+    async (args) => withRepo(args, async ({ owner, repo }) => listRunJobs(await client(), { owner, repo, runId: args.runId })),
+  )
+
+  tool(
+    'gh_run_rerun',
+    'Re-run a workflow run, or only its failed jobs (failedOnly: true).',
+    repoParams({
+      runId: { type: 'number', description: 'Run id.' },
+      failedOnly: { type: 'boolean', description: 'Re-run only the failed jobs.' },
+    }),
+    async (args) => withRepo(args, async ({ owner, repo }) => rerunRun(await client(), {
+      owner, repo, runId: args.runId, failedOnly: args.failedOnly,
+    })),
+  )
+
+  tool(
+    'gh_run_cancel',
+    'Cancel an in-progress workflow run. Requires confirm: true.',
+    repoParams({
+      runId: { type: 'number', description: 'Run id.' },
+      confirm: { type: 'boolean', description: 'Must be true to actually cancel.' },
+    }),
+    async (args) => {
+      if (args.confirm !== true) throw new Error('refusing to cancel a run without confirm: true')
+      return withRepo(args, async ({ owner, repo }) => cancelRun(await client(), { owner, repo, runId: args.runId }))
+    },
+  )
+
+  tool(
+    'gh_run_logs',
+    'Return the download URL of a run logs archive. GitHub answers with a redirect to a zip, so the archive is not pulled into the conversation: the URL needs the same token and is short-lived.',
+    repoParams({ runId: { type: 'number', description: 'Run id.' } }),
+    async (args) => withRepo(args, async ({ owner, repo }) => getRunLogsUrl(await client(), { owner, repo, runId: args.runId })),
+  )
+
+  // ---------------------------------------------------------------- variables
+
+  tool(
+    'gh_variable_list',
+    'List Actions variables of a repository (or of one environment). Values are shown; they are not secret material.',
+    repoParams({ environment: { type: 'string', description: 'Environment name, when the variable lives there.' } }),
+    async (args) => withRepo(args, async ({ owner, repo }) => listVariables(await client(), {
+      owner, repo, environment: args.environment,
+    })),
+  )
+
+  tool(
+    'gh_variable_set',
+    'Create or update an Actions variable (the tool decides between create and update).',
+    repoParams({
+      name: { type: 'string', description: 'Variable name.' },
+      value: { type: 'string', description: 'Variable value (not secret).' },
+      environment: { type: 'string', description: 'Environment name, when the variable lives there.' },
+    }),
+    async (args) => withRepo(args, async ({ owner, repo }) => setVariable(await client(), {
+      owner, repo, name: args.name, value: args.value, environment: args.environment,
+    })),
+  )
+
+  tool(
+    'gh_variable_delete',
+    'Delete an Actions variable. Requires confirm: true.',
+    repoParams({
+      name: { type: 'string', description: 'Variable name.' },
+      environment: { type: 'string', description: 'Environment name, when the variable lives there.' },
+      confirm: { type: 'boolean', description: 'Must be true to actually delete.' },
+    }),
+    async (args) => {
+      if (args.confirm !== true) throw new Error('refusing to delete a variable without confirm: true')
+      return withRepo(args, async ({ owner, repo }) => deleteVariable(await client(), {
+        owner, repo, name: args.name, environment: args.environment,
+      }))
+    },
+  )
+
+  // ------------------------------------------------------------------ secrets
+
+  tool(
+    'gh_secret_list',
+    'List Actions secrets of a repository (or of one environment): names and update times. GitHub never returns the values.',
+    repoParams({ environment: { type: 'string', description: 'Environment name, when the secret lives there.' } }),
+    async (args) => withRepo(args, async ({ owner, repo }) => listSecrets(await client(), {
+      owner, repo, environment: args.environment,
+    })),
+  )
+
+  tool(
+    'gh_secret_set',
+    'Create or update an Actions secret. The value is encrypted with GitHub sealed-box encryption, which needs the optional "tweetnacl" package; without it the tool explains what to install instead of writing a broken value.',
+    repoParams({
+      name: { type: 'string', description: 'Secret name.' },
+      value: { type: 'string', description: 'Secret value; it is never echoed back.' },
+      environment: { type: 'string', description: 'Environment name, when the secret lives there.' },
+    }),
+    async (args) => withRepo(args, async ({ owner, repo }) => setSecret(await client(), {
+      owner, repo, name: args.name, value: args.value, environment: args.environment,
+    })),
+  )
+
+  tool(
+    'gh_secret_delete',
+    'Delete an Actions secret. Requires confirm: true.',
+    repoParams({
+      name: { type: 'string', description: 'Secret name.' },
+      environment: { type: 'string', description: 'Environment name, when the secret lives there.' },
+      confirm: { type: 'boolean', description: 'Must be true to actually delete.' },
+    }),
+    async (args) => {
+      if (args.confirm !== true) throw new Error('refusing to delete a secret without confirm: true')
+      return withRepo(args, async ({ owner, repo }) => deleteSecret(await client(), {
+        owner, repo, name: args.name, environment: args.environment,
+      }))
+    },
+  )
+
+  // ------------------------------------------------------------------ rulesets
+
+  tool(
+    'gh_ruleset_list',
+    'List repository rulesets with their target and enforcement level. Read-only.',
+    repoParams(),
+    async (args) => withRepo(args, async ({ owner, repo }) => listRulesets(await client(), { owner, repo })),
+  )
+
+  tool(
+    'gh_ruleset_view',
+    'Read one ruleset in full: conditions, rules and enforcement. Read-only.',
+    repoParams({ rulesetId: { type: 'number', description: 'Ruleset id from gh_ruleset_list.' } }),
+    async (args) => withRepo(args, async ({ owner, repo }) => getRuleset(await client(), { owner, repo, rulesetId: args.rulesetId })),
+  )
+
+  tool(
+    'gh_ruleset_apply',
+    'Create a ruleset, or update it when rulesetId is given. Defaults target the default branch with active enforcement.',
+    repoParams({
+      rulesetId: { type: 'number', description: 'Update this ruleset instead of creating one.' },
+      name: { type: 'string', description: 'Ruleset name (required when creating).' },
+      target: { type: 'string', description: 'branch (default) or tag.' },
+      enforcement: { type: 'string', description: 'active (default), evaluate or disabled.' },
+      conditions: { type: 'object', additionalProperties: true, description: 'Ruleset conditions, e.g. { ref_name: { include: ["refs/heads/main"], exclude: [] } }.' },
+      rules: { type: 'array', items: { type: 'object', additionalProperties: true }, description: 'Ruleset rules, e.g. [{ type: "deletion" }].' },
+    }),
+    async (args) => withRepo(args, async ({ owner, repo }) => applyRuleset(await client(), {
+      owner, repo,
+      rulesetId: args.rulesetId,
+      name: args.name,
+      target: args.target,
+      enforcement: args.enforcement,
+      conditions: args.conditions,
+      rules: args.rules,
+    })),
+  )
+
+  tool(
+    'gh_ruleset_delete',
+    'Delete a ruleset. Requires confirm: true.',
+    repoParams({
+      rulesetId: { type: 'number', description: 'Ruleset id.' },
+      confirm: { type: 'boolean', description: 'Must be true to actually delete.' },
+    }),
+    async (args) => {
+      if (args.confirm !== true) throw new Error('refusing to delete a ruleset without confirm: true')
+      return withRepo(args, async ({ owner, repo }) => deleteRuleset(await client(), { owner, repo, rulesetId: args.rulesetId }))
+    },
+  )
+
+  // -------------------------------------------------------- branch protection
+
+  tool(
+    'gh_branch_protection_get',
+    'Read classic branch protection of a branch: required reviews, status checks, admin enforcement and force-push/deletion flags. Read-only.',
+    repoParams({ branch: { type: 'string', description: 'Branch name, e.g. main.' } }),
+    async (args) => withRepo(args, async ({ owner, repo }) => getBranchProtection(await client(), {
+      owner, repo, branch: args.branch,
+    })),
+  )
+
+  tool(
+    'gh_branch_protection_set',
+    'Apply classic branch protection: required approving reviews, strict status checks with contexts, admin enforcement, force-push and deletion flags. This replaces the whole protection object for the branch.',
+    repoParams({
+      branch: { type: 'string', description: 'Branch name.' },
+      approvals: { type: 'number', description: 'Required approving reviews (0 disables the review requirement).' },
+      dismissStale: { type: 'boolean', description: 'Dismiss stale approvals on new commits (default true).' },
+      strict: { type: 'boolean', description: 'Require branches to be up to date (default true).' },
+      contexts: { type: 'array', items: { type: 'string' }, description: 'Required status check contexts.' },
+      enforceAdmins: { type: 'boolean', description: 'Apply the rules to admins too.' },
+      allowForcePushes: { type: 'boolean', description: 'Allow force pushes.' },
+      allowDeletions: { type: 'boolean', description: 'Allow branch deletion.' },
+    }),
+    async (args) => withRepo(args, async ({ owner, repo }) => setBranchProtection(await client(), {
+      owner, repo,
+      branch: args.branch,
+      approvals: args.approvals,
+      dismissStale: args.dismissStale,
+      strict: args.strict,
+      contexts: args.contexts,
+      enforceAdmins: args.enforceAdmins,
+      allowForcePushes: args.allowForcePushes,
+      allowDeletions: args.allowDeletions,
+    })),
+  )
+
+  tool(
+    'gh_branch_protection_delete',
+    'Remove classic branch protection from a branch. Requires confirm: true.',
+    repoParams({
+      branch: { type: 'string', description: 'Branch name.' },
+      confirm: { type: 'boolean', description: 'Must be true to actually remove protection.' },
+    }),
+    async (args) => {
+      if (args.confirm !== true) throw new Error('refusing to remove branch protection without confirm: true')
+      return withRepo(args, async ({ owner, repo }) => deleteBranchProtection(await client(), { owner, repo, branch: args.branch }))
+    },
+  )
+}

package/lib/tools/releases.js

@@ -0,0 +1,111 @@
+// Release operations. Pure functions over a GitHub client: no harness imports here,
+// so they are testable with a fake fetch and reusable from the tool layer.
+
+const RELEASE_LIST_LIMIT = 30
+
+function ensureRepo({ owner, repo }) {
+  if (!owner || !repo) {
+    throw new Error('owner and repo are required (pass "repository": "owner/repo" or set defaults in settings)')
+  }
+}
+
+function normalizeRelease(data) {
+  if (!data || typeof data !== 'object') return data
+  return {
+    id: data.id,
+    tag: data.tag_name,
+    name: data.name || data.tag_name,
+    draft: Boolean(data.draft),
+    prerelease: Boolean(data.prerelease),
+    createdAt: data.created_at,
+    publishedAt: data.published_at,
+    author: data.author && data.author.login,
+    url: data.html_url,
+    tarball: data.tarball_url,
+    zipball: data.zipball_url,
+    assets: Array.isArray(data.assets)
+      ? data.assets.map((a) => ({ name: a.name, size: a.size, downloads: a.download_count, url: a.browser_download_url }))
+      : [],
+    body: typeof data.body === 'string' ? data.body : '',
+  }
+}
+
+export async function listReleases(client, { owner, repo, limit = RELEASE_LIST_LIMIT } = {}) {
+  ensureRepo({ owner, repo })
+  const capped = Math.max(1, Math.min(Number(limit) || RELEASE_LIST_LIMIT, 100))
+  const { data, rateLimit } = await client.get(`/repos/${owner}/${repo}/releases`, {
+    query: { per_page: capped },
+  })
+  const releases = Array.isArray(data) ? data.map(normalizeRelease) : []
+  return { releases, count: releases.length, rateLimit }
+}
+
+export async function getRelease(client, { owner, repo, tag }) {
+  ensureRepo({ owner, repo })
+  if (!tag) throw new Error('tag is required')
+  const { data } = await client.get(`/repos/${owner}/${repo}/releases/tags/${encodeURIComponent(tag)}`)
+  return normalizeRelease(data)
+}
+
+export async function createRelease(client, { owner, repo, tag, name, body, draft = false, prerelease = false, target, generateNotes = false }) {
+  ensureRepo({ owner, repo })
+  if (!tag) throw new Error('tag is required')
+  const payload = {
+    tag_name: tag,
+    name: name || tag,
+    draft: Boolean(draft),
+    prerelease: Boolean(prerelease),
+    generate_release_notes: Boolean(generateNotes),
+  }
+  if (body !== undefined) payload.body = body
+  if (target) payload.target_commitish = target
+  const { data } = await client.post(`/repos/${owner}/${repo}/releases`, payload)
+  return normalizeRelease(data)
+}
+
+/**
+ * Resolve a release id from a tag.
+ *
+ * The by-tag endpoint does not see draft releases — GitHub answers 404 for a draft even
+ * to the token that created it — so a miss falls back to scanning the list, which does
+ * include drafts for an authenticated caller.
+ */
+export async function resolveReleaseId(client, { owner, repo, tag, releaseId }) {
+  ensureRepo({ owner, repo })
+  if (releaseId) return releaseId
+  if (!tag) throw new Error('tag or releaseId is required')
+  try {
+    const existing = await getRelease(client, { owner, repo, tag })
+    if (existing && existing.id) return existing.id
+  } catch (err) {
+    if (!err || err.status !== 404) throw err
+  }
+  const { releases } = await listReleases(client, { owner, repo, limit: 100 })
+  const found = releases.find((r) => r.tag === tag)
+  if (found && found.id) return found.id
+  throw new Error(
+    `release not found for tag ${tag}. A draft release is invisible to the by-tag endpoint `
+    + '(GitHub answers 404 even to its creator) and may also be missing from the list: '
+    + 'pass releaseId — gh_release_create returns it — to edit or delete a draft',
+  )
+}
+
+export async function editRelease(client, { owner, repo, tag, releaseId, name, body, draft, prerelease, makeLatest }) {
+  ensureRepo({ owner, repo })
+  const id = await resolveReleaseId(client, { owner, repo, tag, releaseId })
+  const payload = {}
+  if (name !== undefined) payload.name = name
+  if (body !== undefined) payload.body = body
+  if (draft !== undefined) payload.draft = Boolean(draft)
+  if (prerelease !== undefined) payload.prerelease = Boolean(prerelease)
+  if (makeLatest !== undefined) payload.make_latest = makeLatest ? 'true' : 'false'
+  const { data } = await client.patch(`/repos/${owner}/${repo}/releases/${id}`, payload)
+  return normalizeRelease(data)
+}
+
+export async function deleteRelease(client, { owner, repo, tag, releaseId }) {
+  ensureRepo({ owner, repo })
+  const id = await resolveReleaseId(client, { owner, repo, tag, releaseId })
+  await client.del(`/repos/${owner}/${repo}/releases/${id}`)
+  return { deleted: true, id, tag: tag || '' }
+}

package/lib/tools/repo-settings.js

@@ -0,0 +1,207 @@
+// Repository settings: actions variables, actions secrets, rulesets and classic
+// branch protection.
+//
+// Secrets need the sealed-box encryption GitHub requires, which is not part of Node's
+// crypto. The optional `tweetnacl` package is used when it is installed; without it the
+// tool says exactly what is missing instead of writing a broken value.
+
+function ensureRepo({ owner, repo }) {
+  if (!owner || !repo) {
+    throw new Error('owner and repo are required (pass "repository": "owner/repo" or set defaults in settings)')
+  }
+}
+
+// ------------------------------------------------------------------- variables
+
+export async function listVariables(client, { owner, repo, environment }) {
+  ensureRepo({ owner, repo })
+  const path = environment
+    ? `/repos/${owner}/${repo}/environments/${environment}/variables`
+    : `/repos/${owner}/${repo}/actions/variables`
+  const { data } = await client.get(path, { query: { per_page: 100 } })
+  return { variables: ((data && data.variables) || []).map((v) => ({ name: v.name, value: v.value })) }
+}
+
+export async function setVariable(client, { owner, repo, name, value, environment }) {
+  ensureRepo({ owner, repo })
+  if (!name) throw new Error('name is required')
+  const listPath = environment
+    ? `/repos/${owner}/${repo}/environments/${environment}/variables`
+    : `/repos/${owner}/${repo}/actions/variables`
+  const existing = await listVariables(client, { owner, repo, environment })
+  const known = existing.variables.some((v) => v.name === name)
+  const payload = { name, value: String(value ?? '') }
+  if (known) {
+    await client.patch(`${listPath}/${name}`, payload)
+    return { updated: true, name }
+  }
+  await client.post(listPath, payload)
+  return { created: true, name }
+}
+
+export async function deleteVariable(client, { owner, repo, name, environment }) {
+  ensureRepo({ owner, repo })
+  if (!name) throw new Error('name is required')
+  const path = environment
+    ? `/repos/${owner}/${repo}/environments/${environment}/variables/${name}`
+    : `/repos/${owner}/${repo}/actions/variables/${name}`
+  await client.del(path)
+  return { deleted: true, name }
+}
+
+// ---------------------------------------------------------------------- secrets
+
+export async function listSecrets(client, { owner, repo, environment }) {
+  ensureRepo({ owner, repo })
+  const path = environment
+    ? `/repos/${owner}/${repo}/environments/${environment}/secrets`
+    : `/repos/${owner}/${repo}/actions/secrets`
+  const { data } = await client.get(path, { query: { per_page: 100 } })
+  return {
+    secrets: ((data && data.secrets) || []).map((s) => ({ name: s.name, updatedAt: s.updated_at })),
+    note: 'Values are never returned by GitHub.',
+  }
+}
+
+export async function deleteSecret(client, { owner, repo, name, environment }) {
+  ensureRepo({ owner, repo })
+  if (!name) throw new Error('name is required')
+  const path = environment
+    ? `/repos/${owner}/${repo}/environments/${environment}/secrets/${name}`
+    : `/repos/${owner}/${repo}/actions/secrets/${name}`
+  await client.del(path)
+  return { deleted: true, name }
+}
+
+/** Sealed-box encryption, performed only when the optional dependency is present. */
+export async function encryptSecretValue(value, publicKeyBase64) {
+  let nacl
+  try {
+    nacl = await import('tweetnacl')
+  } catch {
+    throw new Error(
+      'setting a secret needs the optional "tweetnacl" package for GitHub sealed-box encryption: '
+      + 'install it next to the plugin, or set the value through the GitHub UI and use gh_secret_list to verify it',
+    )
+  }
+  const lib = nacl && nacl.default ? nacl.default : nacl
+  const box = lib && lib.box
+  if (!box || typeof box.seal !== 'function') {
+    throw new Error('the installed "tweetnacl" package does not expose box.seal')
+  }
+  const publicKey = Buffer.from(publicKeyBase64, 'base64')
+  const message = Buffer.from(String(value), 'utf8')
+  return Buffer.from(box.seal(message, publicKey)).toString('base64')
+}
+
+export async function setSecret(client, { owner, repo, name, value, environment }) {
+  ensureRepo({ owner, repo })
+  if (!name) throw new Error('name is required')
+  if (value === undefined || value === null) throw new Error('value is required')
+  const keyPath = environment
+    ? `/repos/${owner}/${repo}/environments/${environment}/secrets/public-key`
+    : `/repos/${owner}/${repo}/actions/secrets/public-key`
+  const { data } = await client.get(keyPath)
+  if (!data || !data.key || !data.key_id) throw new Error('GitHub did not return a public key for sealed-box encryption')
+  const encrypted = await encryptSecretValue(value, data.key)
+  const putPath = environment
+    ? `/repos/${owner}/${repo}/environments/${environment}/secrets/${name}`
+    : `/repos/${owner}/${repo}/actions/secrets/${name}`
+  await client.put(putPath, { encrypted_value: encrypted, key_id: data.key_id })
+  return { written: true, name, keyId: data.key_id }
+}
+
+// ---------------------------------------------------------------------- rulesets
+
+export async function listRulesets(client, { owner, repo }) {
+  ensureRepo({ owner, repo })
+  const { data } = await client.get(`/repos/${owner}/${repo}/rulesets`)
+  return {
+    rulesets: (Array.isArray(data) ? data : []).map((r) => ({
+      id: r.id,
+      name: r.name,
+      target: r.target,
+      enforcement: r.enforcement,
+    })),
+  }
+}
+
+export async function getRuleset(client, { owner, repo, rulesetId }) {
+  ensureRepo({ owner, repo })
+  if (!rulesetId) throw new Error('rulesetId is required')
+  const { data } = await client.get(`/repos/${owner}/${repo}/rulesets/${rulesetId}`)
+  return data
+}
+
+export async function applyRuleset(client, { owner, repo, rulesetId, name, target = 'branch', enforcement = 'active', conditions, rules }) {
+  ensureRepo({ owner, repo })
+  if (!name && !rulesetId) throw new Error('name is required to create a ruleset (or rulesetId to update one)')
+  const payload = {
+    name,
+    target,
+    enforcement,
+    conditions: conditions || { ref_name: { include: ['~DEFAULT_BRANCH'], exclude: [] } },
+    rules: rules || [],
+  }
+  const { data } = rulesetId
+    ? await client.put(`/repos/${owner}/${repo}/rulesets/${rulesetId}`, payload)
+    : await client.post(`/repos/${owner}/${repo}/rulesets`, payload)
+  return { id: data && data.id, name: data && data.name, enforcement: data && data.enforcement, updated: Boolean(rulesetId) }
+}
+
+export async function deleteRuleset(client, { owner, repo, rulesetId }) {
+  ensureRepo({ owner, repo })
+  if (!rulesetId) throw new Error('rulesetId is required')
+  await client.del(`/repos/${owner}/${repo}/rulesets/${rulesetId}`)
+  return { deleted: true, rulesetId }
+}
+
+// ------------------------------------------------------------- branch protection
+
+export async function getBranchProtection(client, { owner, repo, branch }) {
+  ensureRepo({ owner, repo })
+  if (!branch) throw new Error('branch is required')
+  const { data } = await client.get(`/repos/${owner}/${repo}/branches/${branch}/protection`)
+  return {
+    branch,
+    requiredReviews: data && data.required_pull_request_reviews
+      ? {
+        approvals: data.required_pull_request_reviews.required_approving_review_count,
+        dismissStale: data.required_pull_request_reviews.dismiss_stale_reviews,
+      }
+      : null,
+    requiredStatusChecks: data && data.required_status_checks
+      ? { strict: data.required_status_checks.strict, contexts: data.required_status_checks.contexts }
+      : null,
+    enforceAdmins: Boolean(data && data.enforce_admins && data.enforce_admins.enabled),
+    allowForcePushes: Boolean(data && data.allow_force_pushes && data.allow_force_pushes.enabled),
+    allowDeletions: Boolean(data && data.allow_deletions && data.allow_deletions.enabled),
+  }
+}
+
+export async function setBranchProtection(client, {
+  owner, repo, branch, approvals = 0, dismissStale = true, strict = true, contexts = [],
+  enforceAdmins = false, allowForcePushes = false, allowDeletions = false,
+}) {
+  ensureRepo({ owner, repo })
+  if (!branch) throw new Error('branch is required')
+  const payload = {
+    required_status_checks: { strict: Boolean(strict), contexts: contexts || [] },
+    enforce_admins: Boolean(enforceAdmins),
+    required_pull_request_reviews: approvals
+      ? { required_approving_review_count: Number(approvals), dismiss_stale_reviews: Boolean(dismissStale) }
+      : null,
+    restrictions: null,
+    allow_force_pushes: Boolean(allowForcePushes),
+    allow_deletions: Boolean(allowDeletions),
+  }
+  const { data } = await client.put(`/repos/${owner}/${repo}/branches/${branch}/protection`, payload)
+  return { branch, applied: true, url: data && data.url }
+}
+
+export async function deleteBranchProtection(client, { owner, repo, branch }) {
+  ensureRepo({ owner, repo })
+  if (!branch) throw new Error('branch is required')
+  await client.del(`/repos/${owner}/${repo}/branches/${branch}/protection`)
+  return { deleted: true, branch }
+}