@i-santos/create-package-starter 1.2.0 → 1.3.0

package/README.md

@@ -79,7 +79,8 @@ All commands print a deterministic summary with:
 - delete branch on merge
 - auto-merge enabled
 - squash-only merge policy
-- create/update branch ruleset with required PR, 1 approval, stale review dismissal, resolved conversations, and deletion/force-push protection
+- set Actions workflow default permissions to `write` (with PR review approvals enabled for workflows)
+- create/update branch ruleset with required PR, 0 approvals by default, stale review dismissal, resolved conversations, and deletion/force-push protection
 
 If `gh` is missing or unauthenticated, command exits non-zero with actionable guidance.
 

package/lib/run.js

@@ -581,7 +581,7 @@ function createBaseRulesetPayload(defaultBranch) {
       {
         type: 'pull_request',
         parameters: {
-          required_approving_review_count: 1,
+          required_approving_review_count: 0,
           dismiss_stale_reviews_on_push: true,
           require_code_owner_review: false,
           require_last_push_approval: false,
@@ -663,6 +663,26 @@ function upsertRuleset(deps, repo, rulesetPayload) {
   return 'updated';
 }
 
+function updateWorkflowPermissions(deps, repo) {
+  const workflowPermissionsPayload = {
+    default_workflow_permissions: 'write',
+    can_approve_pull_request_reviews: true
+  };
+
+  const result = ghApi(
+    deps,
+    'PUT',
+    `/repos/${repo}/actions/permissions/workflow`,
+    workflowPermissionsPayload
+  );
+
+  if (result.status !== 0) {
+    throw new Error(
+      `Failed to update workflow permissions: ${result.stderr || result.stdout}`.trim()
+    );
+  }
+}
+
 function setupGithub(args, dependencies = {}) {
   const deps = {
     exec: dependencies.exec || execCommand
@@ -674,10 +694,17 @@ function setupGithub(args, dependencies = {}) {
   const rulesetPayload = createRulesetPayload(args);
   const summary = createSummary();
 
-  summary.updatedScriptKeys.push('repository.default_branch', 'repository.delete_branch_on_merge', 'repository.allow_auto_merge', 'repository.merge_policy');
+  summary.updatedScriptKeys.push(
+    'repository.default_branch',
+    'repository.delete_branch_on_merge',
+    'repository.allow_auto_merge',
+    'repository.merge_policy',
+    'actions.default_workflow_permissions'
+  );
 
   if (args.dryRun) {
     summary.warnings.push(`dry-run: would update repository settings for ${repo}`);
+    summary.warnings.push(`dry-run: would set actions workflow permissions to write for ${repo}`);
     summary.warnings.push(`dry-run: would upsert ruleset "${rulesetPayload.name}" for refs/heads/${args.defaultBranch}`);
     printSummary(`GitHub settings dry-run for ${repo}`, summary);
     return;
@@ -697,6 +724,8 @@ function setupGithub(args, dependencies = {}) {
     throw new Error(`Failed to update repository settings: ${patchRepo.stderr || patchRepo.stdout}`.trim());
   }
 
+  updateWorkflowPermissions(deps, repo);
+
   const upsertResult = upsertRuleset(deps, repo, rulesetPayload);
   summary.overwrittenFiles.push(`github-ruleset:${upsertResult}`);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@i-santos/create-package-starter",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Scaffold new npm packages with a standardized Changesets release workflow",
   "license": "MIT",
   "author": "Igor Santos",