@vivswan/github-settings-as-code 0.0.0 → 2.0.1-main.658.20260922.gdcb742f

package/lib/settings.schema.json

@@ -0,0 +1,4128 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$ref": "#/definitions/SettingsFile",
+  "$id": "https://raw.githubusercontent.com/Vivswan/github-settings-as-code/HEAD/lib/settings.schema.json",
+  "definitions": {
+    "ActionsConfig": {
+      "description": "GitHub Actions settings, routed to the right endpoint by key.",
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "description": "PUT /repos/{r}/actions/permissions: whether Actions runs at all.",
+          "type": "boolean"
+        },
+        "allowed_actions": {
+          "description": "Which actions may run; \"selected\" pairs with selected_actions below.",
+          "type": "string",
+          "enum": [
+            "all",
+            "local_only",
+            "selected"
+          ]
+        },
+        "sha_pinning_required": {
+          "description": "Whether actions must be pinned to a full-length commit SHA.",
+          "type": "boolean"
+        },
+        "selected_actions": {
+          "description": "PUT /repos/{r}/actions/permissions/selected-actions (allowed_actions: selected): the allowlist, e.g. { github_owned_allowed: true, patterns_allowed: [octocat/*] }. Only the three documented keys are accepted, so a misspelled one is refused instead of re-sent on every run.",
+          "type": "object",
+          "properties": {
+            "github_owned_allowed": {
+              "description": "Whether actions in GitHub's own organizations (such as actions/*) may run.",
+              "type": "boolean"
+            },
+            "verified_allowed": {
+              "description": "Whether actions by GitHub Marketplace verified creators may run.",
+              "type": "boolean"
+            },
+            "patterns_allowed": {
+              "description": "Patterns naming the actions and reusable workflows allowed to run, e.g. octocat/hello-world@v2 or octocat/*; GitHub applies them to public repositories only.",
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          "additionalProperties": false
+        },
+        "default_workflow_permissions": {
+          "description": "PUT /repos/{r}/actions/permissions/workflow: the default GITHUB_TOKEN grant.",
+          "type": "string",
+          "enum": [
+            "read",
+            "write"
+          ]
+        },
+        "can_approve_pull_request_reviews": {
+          "description": "Whether workflows may approve pull request reviews.",
+          "type": "boolean"
+        },
+        "access_level": {
+          "description": "PUT /repos/{r}/actions/permissions/access (private repositories only)",
+          "type": "string",
+          "enum": [
+            "none",
+            "user",
+            "organization"
+          ]
+        },
+        "artifact_and_log_retention": {
+          "description": "PUT /repos/{r}/actions/permissions/artifact-and-log-retention: how many days artifacts and workflow logs are kept, e.g. { days: 90 }. The body passes through verbatim, so future fields GitHub adds work unchanged, and a key the GET never echoes is noted at check time as never converging; maximum_allowed_days, which the GET reports and the PUT does not take, is refused.",
+          "type": "object",
+          "properties": {
+            "days": {
+              "description": "How many days artifacts and workflow logs are kept; a whole number of days within the plan's maximum.",
+              "type": "integer",
+              "exclusiveMinimum": 0
+            }
+          },
+          "required": [
+            "days"
+          ]
+        },
+        "cache": {
+          "description": "Actions cache limits, each key routed to its own endpoint: max_cache_retention_days -> PUT /repos/{r}/actions/cache/retention-limit, max_cache_size_gb -> PUT /repos/{r}/actions/cache/storage-limit. Keys other than these two are rejected (each limit has its own single-field endpoint, so an extra key could only be a typo).",
+          "type": "object",
+          "properties": {
+            "max_cache_retention_days": {
+              "description": "How many days an unused cache entry is kept before GitHub evicts it.",
+              "type": "integer",
+              "exclusiveMinimum": 0
+            },
+            "max_cache_size_gb": {
+              "description": "The total cache storage the repository may use, in GB.",
+              "type": "integer",
+              "exclusiveMinimum": 0
+            }
+          },
+          "additionalProperties": false
+        },
+        "oidc_customization_sub": {
+          "description": "PUT /repos/{r}/actions/oidc/customization/sub: the OIDC subject claim template for this repository's workflow tokens, e.g. { use_default: false, include_claim_keys: [repo, context] }, an endpoint pair that needs the \"Actions\" PAT permission rather than Administration. A list under use_default: true is refused, since GitHub ignores it; so is sub_claim_prefix, which only the GET reports. Other keys pass through verbatim, and one the GET never echoes is noted at check time as never converging.",
+          "oneOf": [
+            {
+              "type": "object",
+              "properties": {
+                "use_default": {
+                  "description": "true: GitHub's default subject claim format; this variant carries no claim-key list.",
+                  "type": "boolean",
+                  "const": true
+                },
+                "use_immutable_subject": {
+                  "description": "Switch the whole subject to the stable repository-ID-based format; omitted, the organization setting or the repository's creation date decides, and only a declared value is compared.",
+                  "type": "boolean"
+                }
+              },
+              "required": [
+                "use_default"
+              ]
+            },
+            {
+              "type": "object",
+              "properties": {
+                "use_default": {
+                  "description": "false: a custom template, joined from include_claim_keys.",
+                  "type": "boolean",
+                  "const": false
+                },
+                "include_claim_keys": {
+                  "description": "The claim keys the custom subject joins, in order (e.g. repo, context); each is unique and holds only letters, digits, and underscores. Claim-key ORDER defines the subject format, so check mode compares a declared list positionally; an omitted list opts into the organization template and is not compared.",
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "pattern": "^[A-Za-z0-9_]+$"
+                  }
+                },
+                "use_immutable_subject": {
+                  "description": "Switch the whole subject to the stable repository-ID-based format; omitted, the organization setting or the repository's creation date decides, and only a declared value is compared.",
+                  "type": "boolean"
+                }
+              },
+              "required": [
+                "use_default"
+              ]
+            }
+          ]
+        },
+        "fork_pr_contributor_approval": {
+          "description": "PUT /repos/{r}/actions/permissions/fork-pr-contributor-approval: when workflows triggered by fork pull requests need a maintainer's approval before they run, e.g. { approval_policy: first_time_contributors }. The policies GitHub accepts are first_time_contributors_new_to_github, first_time_contributors, and all_external_contributors; any other value is refused when the file is parsed. The body passes through verbatim, so future fields GitHub adds work unchanged, and a key the GET never echoes is noted at check time as never converging.",
+          "type": "object",
+          "properties": {
+            "approval_policy": {
+              "description": "Which fork contributors need a maintainer's approval before their workflows run: first_time_contributors_new_to_github, first_time_contributors, or all_external_contributors.",
+              "type": "string",
+              "enum": [
+                "first_time_contributors_new_to_github",
+                "first_time_contributors",
+                "all_external_contributors"
+              ]
+            }
+          },
+          "required": [
+            "approval_policy"
+          ]
+        },
+        "fork_pr_workflows_private_repos": {
+          "description": "PUT /repos/{r}/actions/permissions/fork-pr-workflows-private-repos: whether pull requests from forks may run workflows on this private repository, and what those workflows receive. Only run_workflows_from_fork_pull_requests is required; GitHub does not document whether the PUT preserves an omitted toggle, so declare all four. Other keys pass through verbatim, and one the GET never echoes is noted at check time as never converging.",
+          "type": "object",
+          "properties": {
+            "run_workflows_from_fork_pull_requests": {
+              "description": "Whether pull requests from forks may run workflows at all.",
+              "type": "boolean"
+            },
+            "send_write_tokens_to_workflows": {
+              "description": "Whether those workflows receive a GITHUB_TOKEN with write permissions.",
+              "type": "boolean"
+            },
+            "send_secrets_and_variables": {
+              "description": "Whether those workflows receive the repository's secrets and variables.",
+              "type": "boolean"
+            },
+            "require_approval_for_fork_pr_workflows": {
+              "description": "Whether a repository administrator must approve each fork workflow run before it starts.",
+              "type": "boolean"
+            }
+          },
+          "required": [
+            "run_workflows_from_fork_pull_requests"
+          ]
+        }
+      }
+    },
+    "ActionsSecretConfig": {
+      "description": "One repository Actions secret, matched by case-insensitive name (GitHub stores secret names uppercase). Keys other than name and value are rejected: the API body is built from the sealed value alone, so an extra key would silently do nothing.",
+      "type": "object",
+      "properties": {
+        "name": {
+          "description": "The secret name, the natural key; compared case-insensitively and written uppercase. GitHub's naming rule is checked when the file is parsed, before any API call: ASCII letters, digits, and underscores only, not starting with a digit, and not starting with the reserved `GITHUB_` prefix in any case (`github_token` is the reserved `GITHUB_TOKEN` once uppercased).",
+          "type": "string",
+          "pattern": "^(?![Gg][Ii][Tt][Hh][Uu][Bb]_)[A-Za-z_][A-Za-z0-9_]*$"
+        },
+        "value": {
+          "description": "A whole-value `$NAME` reference to an environment variable holding the secret - never a literal (settings files are committed plaintext). Resolved from the action step's env at run time and sealed client-side into the sealed box GitHub's secrets API expects (libsodium's crypto_box_seal format) before upload; GitHub cannot return the value, so check mode verifies existence only and apply re-seals it on every run.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name",
+        "value"
+      ]
+    },
+    "ActionsVariableConfig": {
+      "description": "One GitHub Actions repository variable, matched by case-insensitive name; workflows read it through the `vars` context.",
+      "type": "object",
+      "properties": {
+        "name": {
+          "description": "The variable name, the natural key; case-insensitive (stored uppercased by GitHub). GitHub's naming rule is checked when the file is parsed, before any API call: ASCII letters, digits, and underscores only, not starting with a digit, and not starting with the reserved `GITHUB_` prefix in any case.",
+          "type": "string",
+          "pattern": "^(?![Gg][Ii][Tt][Hh][Uu][Bb]_)[A-Za-z_][A-Za-z0-9_]*$"
+        },
+        "value": {
+          "description": "The plain-text value. GitHub caps one variable at 48 KB; a value over 49152 bytes of UTF-8 is refused when the file is parsed, before any API call.",
+          "type": "string",
+          "maxLength": 49152
+        }
+      },
+      "required": [
+        "name",
+        "value"
+      ]
+    },
+    "AgentsSecretConfig": {
+      "description": "One repository Copilot agents secret, matched by case-insensitive name (GitHub stores secret names uppercase). Keys other than name and value are rejected: the API body is built from the sealed value alone, so an extra key would silently do nothing.",
+      "type": "object",
+      "properties": {
+        "name": {
+          "description": "The secret name, the natural key; compared case-insensitively and written uppercase. GitHub's naming rule is checked when the file is parsed, before any API call: ASCII letters, digits, and underscores only, not starting with a digit, and not starting with the reserved `GITHUB_` prefix in any case (`github_token` is the reserved `GITHUB_TOKEN` once uppercased).",
+          "type": "string",
+          "pattern": "^(?![Gg][Ii][Tt][Hh][Uu][Bb]_)[A-Za-z_][A-Za-z0-9_]*$"
+        },
+        "value": {
+          "description": "A whole-value `$NAME` reference to an environment variable holding the secret - never a literal (settings files are committed plaintext). Resolved from the action step's env at run time and sealed client-side into the sealed box GitHub's secrets API expects (libsodium's crypto_box_seal format) before upload; GitHub cannot return the value, so check mode verifies existence only and apply re-seals it on every run.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name",
+        "value"
+      ]
+    },
+    "AgentsVariableConfig": {
+      "description": "One Copilot agents repository variable, matched by case-insensitive name.",
+      "type": "object",
+      "properties": {
+        "name": {
+          "description": "The variable name, the natural key; case-insensitive (stored uppercased by GitHub). GitHub's naming rule is checked when the file is parsed, before any API call: ASCII letters, digits, and underscores only, not starting with a digit, and not starting with the reserved `GITHUB_` prefix in any case.",
+          "type": "string",
+          "pattern": "^(?![Gg][Ii][Tt][Hh][Uu][Bb]_)[A-Za-z_][A-Za-z0-9_]*$"
+        },
+        "value": {
+          "description": "The plain-text value. GitHub caps one variable at 48 KB; a value over 49152 bytes of UTF-8 is refused when the file is parsed, before any API call.",
+          "type": "string",
+          "maxLength": 49152
+        }
+      },
+      "required": [
+        "name",
+        "value"
+      ]
+    },
+    "AutoTriggerCheckConfig": {
+      "description": "One per-app auto-trigger toggle. Extra fields pass through verbatim.",
+      "type": "object",
+      "properties": {
+        "app_id": {
+          "description": "The id of the GitHub App the preference applies to: a positive integer (the App's settings page shows it), declared once. 0, fractions, and a repeated app_id fail at parse time; GitHub has no app 0, rejects fractions, and would keep whichever duplicate it reads last with nothing to read it back.",
+          "type": "integer",
+          "exclusiveMinimum": 0
+        },
+        "setting": {
+          "description": "Whether pushes automatically create check suites for this app; GitHub defaults each app to true.",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "app_id",
+        "setting"
+      ]
+    },
+    "AutolinkConfig": {
+      "description": "One autolink reference, matched by key prefix.",
+      "type": "object",
+      "properties": {
+        "key_prefix": {
+          "description": "Text prefix that triggers the link (e.g. \"TICKET-\"), the natural key; letters, digits, and \". - _ + = : / #\" only, and no declared prefix may begin another.",
+          "type": "string",
+          "pattern": "^[A-Za-z0-9.\\-_+=:/#]+$"
+        },
+        "url_template": {
+          "description": "Target URL template containing \"<num>\".",
+          "type": "string",
+          "pattern": "<num>"
+        },
+        "is_alphanumeric": {
+          "description": "Whether <num> also matches letters; upstream default is true on a create, and a recreate re-sends the live value when undeclared.",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "key_prefix",
+        "url_template"
+      ]
+    },
+    "BranchConfig": {
+      "description": "Classic protection for one branch name or wildcard pattern.",
+      "type": "object",
+      "properties": {
+        "name": {
+          "description": "The branch name, or a wildcard pattern (any name containing `*`, `?`, or `[`, e.g. \"release/*\"). A literal name applies through the REST protection endpoints; a wildcard rule is REST-invisible, so it applies entirely through the GraphQL branch-protection-rule mutations and its protection accepts only the keys this action can round-trip through that surface (the validator names them; prefer rulesets for new pattern-based configuration).",
+          "type": "string"
+        },
+        "protection": {
+          "description": "PUT .../protection payload; null removes protection (Probot parity).",
+          "anyOf": [
+            {
+              "$ref": "#/definitions/BranchProtectionConfig"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        }
+      },
+      "required": [
+        "name",
+        "protection"
+      ]
+    },
+    "BranchProtectionConfig": {
+      "description": "The protection PUT payload, passed through verbatim except its routed keys; a key the GET never echoes is noted at check time as never converging. What the file alone shows wrong is refused upfront, naming the fix: the GET-only keys a copied GET response carries (`name`, `enabled`, `enforcement_level`, `url` and `*_url`, at any depth), a status-check requirement without `strict` or a check list, and a review count outside 0-6.",
+      "type": "object",
+      "properties": {
+        "required_status_checks": {
+          "description": "Require status checks to pass before merging; `null` turns the requirement off. A mapping carries `strict` and one of `contexts` or `checks`, since GitHub's protection PUT rejects the requirement without either.",
+          "anyOf": [
+            {
+              "type": "object",
+              "properties": {
+                "strict": {
+                  "description": "Whether the branch must also be up to date with its base before merging; `false` requires only the checks to pass.",
+                  "type": "boolean"
+                },
+                "contexts": {
+                  "description": "The required checks by name; `[]` keeps the requirement on while requiring none.",
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "checks": {
+                  "description": "The required checks as {context, app_id} pairs, the PUT's second spelling of the list; the names are derived into `contexts` for the PUT when the file declares only `checks`. GitHub's PUT takes no other field in an item, so any other key is refused upfront, named, with the fix.",
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "context": {
+                        "description": "The name of the required check.",
+                        "type": "string"
+                      },
+                      "app_id": {
+                        "description": "The id of the GitHub App that must report the check. `-1` lets any App report it (`null`, GitHub's read-back spelling of the same, is sent as `-1`); an omitted id pins whichever App reported it last.",
+                        "type": [
+                          "integer",
+                          "null"
+                        ]
+                      }
+                    },
+                    "required": [
+                      "context"
+                    ],
+                    "additionalProperties": false
+                  }
+                }
+              },
+              "required": [
+                "strict"
+              ],
+              "additionalProperties": {},
+              "anyOf": [
+                {
+                  "required": [
+                    "contexts"
+                  ]
+                },
+                {
+                  "required": [
+                    "checks"
+                  ]
+                }
+              ]
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "required_pull_request_reviews": {
+          "description": "Require pull request reviews before merging; `null` turns the requirement off. Every review setting beside the count and the two actor holders (`dismiss_stale_reviews`, `require_code_owner_reviews`, ...) passes through to the PUT.",
+          "anyOf": [
+            {
+              "type": "object",
+              "properties": {
+                "required_approving_review_count": {
+                  "description": "Approving reviews required before merging: 1 to 6, or 0 to require no approvals. GitHub accepts no other value, so the file is refused upfront instead of the PUT failing at apply.",
+                  "type": "integer",
+                  "minimum": 0,
+                  "maximum": 6
+                },
+                "dismissal_restrictions": {
+                  "description": "Who may dismiss pull request reviews, as `users`, `teams`, and `apps` lists of login/slug strings, each list optional; an empty mapping lets anyone with push access dismiss. GitHub's GET expands each actor into an object, which the PUT rejects, so a copied one is refused naming the string to write.",
+                  "type": "object",
+                  "properties": {
+                    "users": {
+                      "description": "User logins (\"octocat\").",
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    },
+                    "teams": {
+                      "description": "Team slugs (\"platform-team\").",
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    },
+                    "apps": {
+                      "description": "GitHub App slugs (\"deploy-gate\").",
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    }
+                  },
+                  "additionalProperties": {}
+                },
+                "bypass_pull_request_allowances": {
+                  "description": "Who may push without a pull request review, as `users`, `teams`, and `apps` lists of login/slug strings, each list optional. GitHub's GET expands each actor into an object, which the PUT rejects, so a copied one is refused naming the string to write.",
+                  "type": "object",
+                  "properties": {
+                    "users": {
+                      "description": "User logins (\"octocat\").",
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    },
+                    "teams": {
+                      "description": "Team slugs (\"platform-team\").",
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    },
+                    "apps": {
+                      "description": "GitHub App slugs (\"deploy-gate\").",
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      }
+                    }
+                  },
+                  "additionalProperties": {}
+                }
+              },
+              "additionalProperties": {}
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "restrictions": {
+          "description": "Who may push to the branch, as `users`, `teams`, and `apps` lists of login/slug strings; the PUT requires `users` and `teams` (`[]` when none) and takes `apps` as optional, so a mapping missing either is refused upfront. An all-empty mapping lets nobody push, `null` lifts the restriction, and a copied GET actor object is refused naming the string to write. Literal branches only; wildcard rules point at the rulesets section.",
+          "anyOf": [
+            {
+              "type": "object",
+              "properties": {
+                "users": {
+                  "description": "User logins (\"octocat\"); required, `[]` when none.",
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "teams": {
+                  "description": "Team slugs (\"platform-team\"); required, `[]` when none.",
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "apps": {
+                  "description": "GitHub App slugs (\"deploy-gate\"); optional.",
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              },
+              "required": [
+                "users",
+                "teams"
+              ],
+              "additionalProperties": {}
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "required_signatures": {
+          "description": "Require signed commits on the branch. On a literal branch this is a routed key the protection PUT silently drops, so it is applied through the POST/DELETE .../protection/required_signatures sub-endpoint: when it drifts, and again after any protection PUT (GitHub does not document whether the PUT preserves an existing requirement), so declare the toggle on any branch that carries one - a declared value is pinned either way. On a wildcard rule it rides the GraphQL rule mutation like every other key.",
+          "type": "boolean"
+        },
+        "force_push_bypassers": {
+          "description": "Who may force-push to the branch when \"allow force pushes\" is in its \"specify who\" mode. Each actor is one string: a bare login is a user (\"octocat\"), \"org/team-slug\" is a team, and \"app/slug\" is a GitHub App. A REST-invisible surface: on a literal branch this routed key is stripped from the protection PUT and applied through the updateBranchProtectionRule GraphQL mutation when it drifts, and again after any protection PUT; on a wildcard rule it rides the create or update mutation with the rest of the rule. The live list is read back through GraphQL. An empty list clears every allowance; an absent key leaves the live list untouched.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "required_deployments": {
+          "description": "Require deployments to succeed before merging (the checkbox and its environment list). REST-invisible like force_push_bypassers, so the routed key rides the same GraphQL mutation. Declaring `null` turns the requirement OFF; an absent key leaves the live state untouched. GitHub SILENTLY drops environment names that do not exist on the repository, so apply verifies the mutation's read-back and fails loudly naming any dropped name; the environments section runs before branches, so environments declared in the same settings file exist by the time this key applies.",
+          "anyOf": [
+            {
+              "type": "object",
+              "properties": {
+                "environments": {
+                  "description": "The environments whose deployments must succeed before merging.",
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              },
+              "required": [
+                "environments"
+              ],
+              "additionalProperties": false
+            },
+            {
+              "type": "null"
+            }
+          ]
+        }
+      },
+      "additionalProperties": {}
+    },
+    "BypassActorConfig": {
+      "description": "One actor that may bypass the ruleset. Integration, RepositoryRole, Team, and User need their numeric actor_id; DeployKey takes none (null); OrganizationAdmin ignores it.",
+      "type": "object",
+      "properties": {
+        "actor_id": {
+          "description": "The id GitHub assigns the app, role, team, or user. Required for Integration, RepositoryRole, Team, and User; refused for DeployKey (write null or omit it); ignored for OrganizationAdmin.",
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "actor_type": {
+          "description": "Integration, OrganizationAdmin, RepositoryRole, Team, DeployKey, or User, as GitHub spells them.",
+          "type": "string",
+          "enum": [
+            "Integration",
+            "OrganizationAdmin",
+            "RepositoryRole",
+            "Team",
+            "DeployKey",
+            "User"
+          ]
+        },
+        "bypass_mode": {
+          "description": "\"always\" (the default), \"pull_request\" (bypass only through a pull request; branch rulesets only, and never for a DeployKey), or \"exempt\" (rules are not run for the actor).",
+          "type": "string",
+          "enum": [
+            "always",
+            "pull_request",
+            "exempt"
+          ]
+        }
+      },
+      "required": [
+        "actor_type"
+      ],
+      "additionalProperties": {}
+    },
+    "CheckSuitePreferencesConfig": {
+      "description": "PATCH /repos/{r}/check-suites/preferences, sent verbatim. Write-only upstream: GitHub exposes no read endpoint for these preferences, so check mode cannot verify them and apply re-asserts the declared preferences on every run.",
+      "type": "object",
+      "properties": {
+        "auto_trigger_checks": {
+          "description": "Per-app toggles for whether pushes automatically create check suites, one entry per app_id.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/AutoTriggerCheckConfig"
+          }
+        }
+      },
+      "required": [
+        "auto_trigger_checks"
+      ],
+      "additionalProperties": {
+        "description": "Future preference fields pass through verbatim."
+      }
+    },
+    "CodeQualitySetupConfig": {
+      "description": "PATCH /repos/{r}/code-quality/setup, sent verbatim.",
+      "type": "object",
+      "properties": {
+        "state": {
+          "description": "Turn code quality analysis on (\"configured\") or off (\"not-configured\").",
+          "type": "string",
+          "enum": [
+            "configured",
+            "not-configured"
+          ]
+        },
+        "languages": {
+          "description": "Languages to analyze, in the PATCH's vocabulary (the GET's \"rust\" cannot be declared and stays as detected), compared as a set; GitHub auto-detects when omitted.",
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": [
+              "csharp",
+              "go",
+              "java-kotlin",
+              "javascript-typescript",
+              "python",
+              "ruby"
+            ]
+          }
+        },
+        "runner_type": {
+          "description": "Run on GitHub-hosted (\"standard\") or labeled self-hosted runners.",
+          "type": "string",
+          "enum": [
+            "standard",
+            "labeled"
+          ]
+        },
+        "runner_label": {
+          "description": "Runner label: a string needs runner_type: \"labeled\" and is refused under any other; null clears it under runner_type: \"standard\" or none.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "ai_findings_option": {
+          "description": "AI-powered findings: \"on_push\" runs them on every push, \"disabled\" turns them off.",
+          "type": "string",
+          "enum": [
+            "disabled",
+            "on_push"
+          ]
+        }
+      }
+    },
+    "CodeScanningDefaultSetupConfig": {
+      "description": "PATCH /repos/{r}/code-scanning/default-setup, sent verbatim.",
+      "type": "object",
+      "properties": {
+        "state": {
+          "description": "Turn default setup on (\"configured\") or off (\"not-configured\").",
+          "type": "string",
+          "enum": [
+            "configured",
+            "not-configured"
+          ]
+        },
+        "query_suite": {
+          "description": "CodeQL query suite to run.",
+          "type": "string",
+          "enum": [
+            "default",
+            "extended"
+          ]
+        },
+        "languages": {
+          "description": "Languages to scan, in the PATCH's vocabulary (\"javascript-typescript\", never the GET's separate \"javascript\" and \"typescript\"), compared as a set; GitHub auto-detects when omitted.",
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": [
+              "actions",
+              "c-cpp",
+              "csharp",
+              "go",
+              "java-kotlin",
+              "javascript-typescript",
+              "python",
+              "ruby",
+              "swift"
+            ]
+          }
+        },
+        "runner_type": {
+          "description": "Run on GitHub-hosted (\"standard\") or labeled self-hosted runners.",
+          "type": "string",
+          "enum": [
+            "standard",
+            "labeled"
+          ]
+        },
+        "runner_label": {
+          "description": "Runner label: a string needs runner_type: \"labeled\" and is refused under any other; null clears it under runner_type: \"standard\" or none.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "threat_model": {
+          "description": "Whether to model local sources as threats in addition to remote ones.",
+          "type": "string",
+          "enum": [
+            "remote",
+            "remote_and_local"
+          ]
+        }
+      }
+    },
+    "CodeScanningToolConfig": {
+      "description": "One tool that must provide code scanning results.",
+      "type": "object",
+      "properties": {
+        "alerts_threshold": {
+          "description": "The alert severity that blocks the update: none, errors, errors_and_warnings, or all.",
+          "type": "string",
+          "enum": [
+            "none",
+            "errors",
+            "errors_and_warnings",
+            "all"
+          ]
+        },
+        "security_alerts_threshold": {
+          "description": "The security severity that blocks the update: none, critical, high_or_higher, medium_or_higher, or all.",
+          "type": "string",
+          "enum": [
+            "none",
+            "critical",
+            "high_or_higher",
+            "medium_or_higher",
+            "all"
+          ]
+        },
+        "tool": {
+          "description": "The code scanning tool's name.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "alerts_threshold",
+        "security_alerts_threshold",
+        "tool"
+      ],
+      "additionalProperties": {}
+    },
+    "CodespacesSecretConfig": {
+      "description": "One repository Codespaces secret, matched by case-insensitive name (GitHub stores secret names uppercase). Keys other than name and value are rejected: the API body is built from the sealed value alone, so an extra key would silently do nothing.",
+      "type": "object",
+      "properties": {
+        "name": {
+          "description": "The secret name, the natural key; compared case-insensitively and written uppercase. GitHub's naming rule is checked when the file is parsed, before any API call: ASCII letters, digits, and underscores only, not starting with a digit, and not starting with the reserved `GITHUB_` prefix in any case (`github_token` is the reserved `GITHUB_TOKEN` once uppercased).",
+          "type": "string",
+          "pattern": "^(?![Gg][Ii][Tt][Hh][Uu][Bb]_)[A-Za-z_][A-Za-z0-9_]*$"
+        },
+        "value": {
+          "description": "A whole-value `$NAME` reference to an environment variable holding the secret - never a literal (settings files are committed plaintext). Resolved from the action step's env at run time and sealed client-side into the sealed box GitHub's secrets API expects (libsodium's crypto_box_seal format) before upload; GitHub cannot return the value, so check mode verifies existence only and apply re-seals it on every run.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name",
+        "value"
+      ]
+    },
+    "CollaboratorConfig": {
+      "description": "One direct collaborator, matched by username. Keys other than username and permission are rejected (a misspelled \"permission\" would otherwise silently grant the default role).",
+      "type": "object",
+      "properties": {
+        "username": {
+          "description": "GitHub login, the natural key.",
+          "type": "string"
+        },
+        "permission": {
+          "description": "\"pull\", \"triage\", \"push\", \"maintain\", \"admin\", or a custom org role name; defaults to \"push\". The grant's own vocabulary, lowercase: \"read\" and \"write\" are what GitHub reports a role as, not what a grant accepts, so they and a mis-cased standard permission fail at parse time, naming the form to declare.",
+          "type": "string",
+          "pattern": "^(?:pull|triage|push|maintain|admin|(?!(?:[Pp][Uu][Ll][Ll]|[Tt][Rr][Ii][Aa][Gg][Ee]|[Pp][Uu][Ss][Hh]|[Mm][Aa][Ii][Nn][Tt][Aa][Ii][Nn]|[Aa][Dd][Mm][Ii][Nn]|[Ww][Rr][Ii][Tt][Ee]|[Rr][Ee][Aa][Dd])$)\\S(?:.*\\S)?)$"
+        }
+      },
+      "required": [
+        "username"
+      ]
+    },
+    "CustomPropertyConfig": {
+      "description": "One custom property value, matched by the API's property_name verbatim. Keys other than property_name and value are rejected: the bulk PATCH body is built from exactly these two fields, so an extra key would have no destination.",
+      "type": "object",
+      "properties": {
+        "property_name": {
+          "description": "The organization-defined property's name, the natural key.",
+          "type": "string"
+        },
+        "value": {
+          "description": "The value to set: a string (single_select and string properties), a list of strings (multi_select, compared as a set - list each option once), or a boolean (true_false, normalized to the \"true\"/\"false\" string GitHub transports). Numbers are likewise sent as their string form - through YAML's parsed number, so quote any numeric value you want sent verbatim (unquoted, 1.10 arrives as \"1.1\" and 1e21 as \"1e+21\"). `null` unsets the property, reverting to the org default, if any.",
+          "anyOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            {
+              "type": "boolean"
+            },
+            {
+              "type": "number"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        }
+      },
+      "required": [
+        "property_name",
+        "value"
+      ]
+    },
+    "DependabotSecretConfig": {
+      "description": "One repository Dependabot secret, matched by case-insensitive name (GitHub stores secret names uppercase). Keys other than name and value are rejected: the API body is built from the sealed value alone, so an extra key would silently do nothing.",
+      "type": "object",
+      "properties": {
+        "name": {
+          "description": "The secret name, the natural key; compared case-insensitively and written uppercase. GitHub's naming rule is checked when the file is parsed, before any API call: ASCII letters, digits, and underscores only, not starting with a digit, and not starting with the reserved `GITHUB_` prefix in any case (`github_token` is the reserved `GITHUB_TOKEN` once uppercased).",
+          "type": "string",
+          "pattern": "^(?![Gg][Ii][Tt][Hh][Uu][Bb]_)[A-Za-z_][A-Za-z0-9_]*$"
+        },
+        "value": {
+          "description": "A whole-value `$NAME` reference to an environment variable holding the secret - never a literal (settings files are committed plaintext). Resolved from the action step's env at run time and sealed client-side into the sealed box GitHub's secrets API expects (libsodium's crypto_box_seal format) before upload; GitHub cannot return the value, so check mode verifies existence only and apply re-seals it on every run.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name",
+        "value"
+      ]
+    },
+    "DeployKeyConfig": {
+      "description": "One deploy key, matched by exact title (GitHub documents no case folding for titles). Extra fields pass through to the create call verbatim.",
+      "type": "object",
+      "properties": {
+        "title": {
+          "description": "The key title shown in the settings UI, the natural key.",
+          "type": "string"
+        },
+        "key": {
+          "description": "The PUBLIC key as one line, \"<algorithm> <base64> [comment]\" (the .pub file), the algorithm one of ssh-ed25519, ssh-rsa, ecdsa-sha2-nistp256/384/521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com (GitHub dropped DSA in 2022). Anything else, a line break included, is refused when the settings file is read; a private key is named, never echoed. Compared as algorithm + blob, comment ignored; immutable upstream, so a changed key is delete plus recreate.",
+          "type": "string",
+          "pattern": "^[ \\t]*(ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521|sk-ssh-ed25519@openssh\\.com|sk-ecdsa-sha2-nistp256@openssh\\.com)[ \\t]+((?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{4}|[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=))(?:[ \\t][^\\r\\n]*)?$"
+        },
+        "read_only": {
+          "description": "Whether the key is restricted to read-only access; GitHub defaults to false (read/write).",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "title",
+        "key"
+      ]
+    },
+    "DeploymentBranchPolicyConfig": {
+      "description": "One custom deployment branch-policy pattern, matched by exact name. Extra fields pass through to the create call verbatim.",
+      "type": "object",
+      "properties": {
+        "name": {
+          "description": "The name pattern branches or tags must match to deploy (e.g. \"release/*\"), the natural key.",
+          "type": "string"
+        },
+        "type": {
+          "description": "What the pattern matches: \"branch\" (the upstream default) or \"tag\". Immutable on GitHub, so changing it is applied as delete plus recreate.",
+          "type": "string",
+          "enum": [
+            "branch",
+            "tag"
+          ]
+        }
+      },
+      "required": [
+        "name"
+      ]
+    },
+    "DeploymentProtectionRuleConfig": {
+      "description": "One custom deployment protection rule, matched by the slug of the GitHub App that provides it. No other key is accepted: the enable call sends only the App's resolved integration id, so an extra key would have no destination.",
+      "type": "object",
+      "properties": {
+        "app": {
+          "description": "The slug of the GitHub App providing the gate (e.g. \"my-gate-app\"), the natural key.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "app"
+      ],
+      "additionalProperties": false
+    },
+    "EnvironmentConfig": {
+      "description": "One deployment environment, matched by name.",
+      "type": "object",
+      "properties": {
+        "name": {
+          "description": "The environment name, the natural key.",
+          "type": "string"
+        },
+        "pinned": {
+          "description": "Pin this environment on the repository home page's deployments sidebar (GraphQL-only; the REST environment PUT carries no pin field). Pin ORDER is the declaration order of the entries with `pinned: true` - together they must LEAD the repository's pinned list in that order, compared by rank (GitHub's live position numbers may carry holes after an unpin and are never read literally). `pinned: false` unpins; an entry without the key leaves its pin state untouched. Live pins on environments the settings file does not declare are never unpinned; when they sit among the declared ranks, apply moves them after the declared pins (surfaced as a note). GitHub allows at most 10 pinned environments, so more than 10 `pinned: true` entries are rejected upfront.",
+          "type": "boolean"
+        },
+        "wait_timer": {
+          "description": "Minutes to wait before deployments proceed, 0 to 43200 (30 days). 0 declares the wait timer off and matches a live environment without one.",
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 43200
+        },
+        "prevent_self_review": {
+          "description": "Whether to prevent the deployer from approving their own deployment. The flag lives on the required-reviewers rule, so `true` needs at least one reviewer; `false` declares it off and matches a live environment without the rule.",
+          "type": "boolean"
+        },
+        "reviewers": {
+          "description": "Required reviewers by numeric user/team id, at most 6. An empty list declares required reviewers off and matches a live environment without the rule.",
+          "maxItems": 6,
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "type": {
+                "description": "User or Team.",
+                "type": "string",
+                "enum": [
+                  "User",
+                  "Team"
+                ]
+              },
+              "id": {
+                "description": "The user's or team's numeric id.",
+                "type": "number"
+              }
+            },
+            "required": [
+              "type",
+              "id"
+            ]
+          }
+        },
+        "deployment_branch_policy": {
+          "description": "Which branches may deploy; null lets any branch deploy. As an object, exactly one of the two flags is true: both true is rejected by GitHub, and both false is spelled null.",
+          "anyOf": [
+            {
+              "type": "object",
+              "properties": {
+                "protected_branches": {
+                  "description": "Restrict to branches with protection rules.",
+                  "type": "boolean"
+                },
+                "custom_branch_policies": {
+                  "description": "Restrict to name patterns, declared under `deployment_branch_policies`.",
+                  "type": "boolean"
+                }
+              },
+              "required": [
+                "protected_branches",
+                "custom_branch_policies"
+              ],
+              "if": {
+                "properties": {
+                  "protected_branches": {
+                    "const": true
+                  }
+                }
+              },
+              "then": {
+                "properties": {
+                  "custom_branch_policies": {
+                    "const": false
+                  }
+                }
+              },
+              "else": {
+                "properties": {
+                  "custom_branch_policies": {
+                    "const": true
+                  }
+                }
+              }
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "deployment_branch_policies": {
+          "description": "Custom deployment branch-policy patterns for this environment, reconciled only when this key is declared (an absent key leaves the live patterns untouched). Declaring it requires the sibling `deployment_branch_policy` to set `custom_branch_policies: true`; without the flag GitHub rejects every pattern write. A pattern's `type` is immutable on GitHub, so a declared type that differs from the live one is applied as delete plus recreate. Within a declared key, live patterns the entries do not declare are DELETED by default; the wrapped `{_undeclared: keep, entries}` form keeps them as notes.",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/DeploymentBranchPolicyConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/UndeclaredPolicyList%3CDeploymentBranchPolicyConfig%3E"
+            }
+          ]
+        },
+        "deployment_protection_rules": {
+          "description": "Custom deployment protection rules for this environment, reconciled only when this key is declared (an absent key leaves the live rules untouched). Each rule is a GitHub App gate, declared by its App slug and resolved to the App's integration id at apply time; GitHub offers no update call, so the model is enable/disable only. Within a declared key, live rules the entries do not declare are KEPT by default - Apps can enable themselves as gates, and silently removing a deployment gate is security-relevant - and the wrapped `{_undeclared: delete, entries}` form opts into disabling them.",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/DeploymentProtectionRuleConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/UndeclaredPolicyList%3CDeploymentProtectionRuleConfig%3E"
+            }
+          ]
+        },
+        "variables": {
+          "description": "Actions variables for this environment, reconciled only when this key is declared (an absent key leaves the live variables untouched). Values are plain text by design - use environment secrets for anything sensitive. Within a declared `variables` key, live variables the entries do not declare are DELETED by default; the wrapped `{_undeclared: keep, entries}` form keeps them as notes. Names match case-insensitively, as GitHub treats them.",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/EnvironmentVariableConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/UndeclaredPolicyList%3CEnvironmentVariableConfig%3E"
+            }
+          ]
+        },
+        "secrets": {
+          "description": "Actions secrets for this environment, reconciled only when this key is declared (an absent key leaves the live secrets untouched). Each value is a whole-value `$NAME` reference to the action step's environment, never a literal, sealed client-side against the environment's public key; GitHub cannot return a value, so check mode verifies existence only and apply re-seals every declared value on each run. Within a declared `secrets` key, live secrets the entries do not declare are KEPT by default (their values are unrecoverable); the wrapped `{_undeclared: delete, entries}` form opts into deletion.",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/EnvironmentSecretConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/UndeclaredPolicyList%3CEnvironmentSecretConfig%3E"
+            }
+          ]
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "allOf": [
+        {
+          "if": {
+            "required": [
+              "deployment_branch_policies"
+            ]
+          },
+          "then": {
+            "required": [
+              "deployment_branch_policy"
+            ],
+            "properties": {
+              "deployment_branch_policy": {
+                "type": "object",
+                "required": [
+                  "custom_branch_policies"
+                ],
+                "properties": {
+                  "custom_branch_policies": {
+                    "const": true
+                  }
+                }
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "required": [
+              "prevent_self_review"
+            ],
+            "properties": {
+              "prevent_self_review": {
+                "const": true
+              }
+            }
+          },
+          "then": {
+            "required": [
+              "reviewers"
+            ],
+            "properties": {
+              "reviewers": {
+                "minItems": 1
+              }
+            }
+          }
+        }
+      ]
+    },
+    "EnvironmentSecretConfig": {
+      "description": "One per-environment Actions secret, matched by case-insensitive name (GitHub stores secret names uppercase). Keys other than name and value are rejected: the API body is built from the sealed value alone, so an extra key would silently do nothing.",
+      "type": "object",
+      "properties": {
+        "name": {
+          "description": "The secret name, the natural key; compared case-insensitively and written uppercase. GitHub's naming rule is checked when the file is parsed, before any API call: ASCII letters, digits, and underscores only, not starting with a digit, and not starting with the reserved `GITHUB_` prefix in any case (`github_token` is the reserved `GITHUB_TOKEN` once uppercased).",
+          "type": "string",
+          "pattern": "^(?![Gg][Ii][Tt][Hh][Uu][Bb]_)[A-Za-z_][A-Za-z0-9_]*$"
+        },
+        "value": {
+          "description": "A whole-value `$NAME` reference to an environment variable holding the secret - never a literal (settings files are committed plaintext). Resolved from the action step's env at run time and sealed client-side into the sealed box GitHub's secrets API expects (libsodium's crypto_box_seal format) before upload; GitHub cannot return the value, so check mode verifies existence only and apply re-seals it on every run.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name",
+        "value"
+      ],
+      "additionalProperties": false
+    },
+    "EnvironmentVariableConfig": {
+      "description": "One per-environment Actions variable, matched by case-insensitive name.",
+      "type": "object",
+      "properties": {
+        "name": {
+          "description": "The variable name, the natural key (case-insensitive on GitHub). GitHub's naming rule is checked when the file is parsed, before any API call: ASCII letters, digits, and underscores only, not starting with a digit, and not starting with the reserved `GITHUB_` prefix in any case.",
+          "type": "string",
+          "pattern": "^(?![Gg][Ii][Tt][Hh][Uu][Bb]_)[A-Za-z_][A-Za-z0-9_]*$"
+        },
+        "value": {
+          "description": "The plain-text value. GitHub caps one variable at 48 KB; a value over 49152 bytes of UTF-8 is refused when the file is parsed, before any API call.",
+          "type": "string",
+          "maxLength": 49152
+        }
+      },
+      "required": [
+        "name",
+        "value"
+      ]
+    },
+    "InteractionLimitsConfig": {
+      "description": "The `interaction_limits:` section, exactly four keys: `limit` and `expiry` are the body of PUT /repos/{r}/interaction-limits, and the two pull-request keys go to their own .../interaction-limits/pulls sub-endpoints. Any other key fails at parse time, origin and expires_at included: GitHub reports them on the GET but never accepts them. Declare at least one of `limit`, `pull_request_creation_cap`, or `pull_request_creation_bypass`.",
+      "type": "object",
+      "properties": {
+        "limit": {
+          "description": "Who may interact: \"existing_users\", \"contributors_only\", or \"collaborators_only\"; any other value fails at parse time (GitHub would 422 the PUT). Optional when only the pull-request keys below are declared; an omitted limit leaves the live base limit untouched.",
+          "type": "string",
+          "enum": [
+            "existing_users",
+            "contributors_only",
+            "collaborators_only"
+          ]
+        },
+        "expiry": {
+          "description": "How long the limit lasts: \"one_day\", \"three_days\", \"one_week\", \"one_month\", or \"six_months\"; GitHub defaults to one_day, and any other value fails at parse time. Write-only: GitHub reports back the computed expires_at, never the duration, so check mode cannot verify this field and apply re-arms it on every run. Requires a sibling `limit`.",
+          "type": "string",
+          "enum": [
+            "one_day",
+            "three_days",
+            "one_week",
+            "one_month",
+            "six_months"
+          ]
+        },
+        "pull_request_creation_cap": {
+          "description": "The pull request creation cap, routed to GET/PATCH /repos/{r}/interaction-limits/pulls/creation-cap. Unlike the base limit it is persistent desired state with no self-expiry and reads back verbatim, so check mode diffs it exactly and apply PATCHes only on divergence. max_open_pull_requests is 1-1000. On repositories where the cap is not available, the endpoints answer 405: apply surfaces that as a note, check mode as drift.",
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "description": "Whether the cap is enforced.",
+              "type": "boolean"
+            },
+            "max_open_pull_requests": {
+              "description": "The maximum number of open pull requests one user may have, a whole number from 1 to 1000 (GitHub's range); anything else fails at parse time.",
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 1000
+            }
+          },
+          "required": [
+            "enabled"
+          ]
+        },
+        "pull_request_creation_bypass": {
+          "description": "User logins exempt from the pull request creation cap, routed to GET/PUT/DELETE /repos/{r}/interaction-limits/pulls/bypass-list and reconciled: apply removes the undeclared logins and then adds the missing ones (removals first - the list holds at most 100 users); logins compare case-insensitively. An empty list removes everyone. At most 100 logins.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      },
+      "additionalProperties": false
+    },
+    "LabelConfig": {
+      "description": "One label, matched to the live repo by name.",
+      "type": "object",
+      "properties": {
+        "name": {
+          "description": "The label name, the natural key.",
+          "type": "string"
+        },
+        "color": {
+          "description": "Six hex digits, the leading \"#\" optional (\"#d73a4a\" or \"d73a4a\"). Color names and three-digit shorthand fail at parse time; GitHub rejects them.",
+          "type": "string",
+          "pattern": "^#?[0-9a-fA-F]{6}$"
+        },
+        "description": {
+          "description": "Short explanation shown in the label picker, at most 100 characters (GitHub's cap); longer ones fail at parse time.",
+          "type": "string",
+          "maxLength": 100
+        },
+        "new_name": {
+          "description": "Probot compat: rename an existing label.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "name"
+      ]
+    },
+    "LayeredList<BranchConfig>": {
+      "description": "The wrapped form of a list section that applies no undeclared policy (environments, branches, workflows): the plain array beside `{_layering, entries}`. The wrapper exists for the render directive alone, so the rendered document always holds the plain array, and with `_layering` omitted it behaves exactly like the plain array. Its keys are strict: anything besides `_layering` and `entries` (there is no `_undeclared` here, since the section keeps every live resource it does not declare) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_layering": {
+          "description": "A render-time directive: how this section combines with the layers BELOW it in a layered merge, by the section's key (an environment's name, a branch name or pattern, a workflow path). \"replace\" lets this layer's list win wholesale; \"shallow\" unions the entries by key and swaps a same-key entry for this layer's; \"deep\" unions by key and merges a same-key pair field by field, the entry's nested lists (an environment's variables, secrets, branch policies, protection rules, and reviewers, each by its own key) unioning the same way. Omitted, the file's `_layering` applies, else the run's layering. It has no effect on a single document, and the rendered document never carries it.",
+          "type": "string",
+          "enum": [
+            "replace",
+            "shallow",
+            "deep"
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/BranchConfig"
+          }
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "LayeredList<EnvironmentConfig>": {
+      "description": "The wrapped form of a list section that applies no undeclared policy (environments, branches, workflows): the plain array beside `{_layering, entries}`. The wrapper exists for the render directive alone, so the rendered document always holds the plain array, and with `_layering` omitted it behaves exactly like the plain array. Its keys are strict: anything besides `_layering` and `entries` (there is no `_undeclared` here, since the section keeps every live resource it does not declare) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_layering": {
+          "description": "A render-time directive: how this section combines with the layers BELOW it in a layered merge, by the section's key (an environment's name, a branch name or pattern, a workflow path). \"replace\" lets this layer's list win wholesale; \"shallow\" unions the entries by key and swaps a same-key entry for this layer's; \"deep\" unions by key and merges a same-key pair field by field, the entry's nested lists (an environment's variables, secrets, branch policies, protection rules, and reviewers, each by its own key) unioning the same way. Omitted, the file's `_layering` applies, else the run's layering. It has no effect on a single document, and the rendered document never carries it.",
+          "type": "string",
+          "enum": [
+            "replace",
+            "shallow",
+            "deep"
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/EnvironmentConfig"
+          }
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "LayeredList<WorkflowConfig>": {
+      "description": "The wrapped form of a list section that applies no undeclared policy (environments, branches, workflows): the plain array beside `{_layering, entries}`. The wrapper exists for the render directive alone, so the rendered document always holds the plain array, and with `_layering` omitted it behaves exactly like the plain array. Its keys are strict: anything besides `_layering` and `entries` (there is no `_undeclared` here, since the section keeps every live resource it does not declare) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_layering": {
+          "description": "A render-time directive: how this section combines with the layers BELOW it in a layered merge, by the section's key (an environment's name, a branch name or pattern, a workflow path). \"replace\" lets this layer's list win wholesale; \"shallow\" unions the entries by key and swaps a same-key entry for this layer's; \"deep\" unions by key and merges a same-key pair field by field, the entry's nested lists (an environment's variables, secrets, branch policies, protection rules, and reviewers, each by its own key) unioning the same way. Omitted, the file's `_layering` applies, else the run's layering. It has no effect on a single document, and the rendered document never carries it.",
+          "type": "string",
+          "enum": [
+            "replace",
+            "shallow",
+            "deep"
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/WorkflowConfig"
+          }
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "MilestoneConfig": {
+      "description": "One milestone, matched by title.",
+      "type": "object",
+      "properties": {
+        "title": {
+          "description": "The milestone title, the natural key.",
+          "type": "string"
+        },
+        "description": {
+          "description": "Longer explanation of the milestone.",
+          "type": "string"
+        },
+        "state": {
+          "description": "Open or closed; untouched unless declared.",
+          "type": "string",
+          "enum": [
+            "open",
+            "closed"
+          ]
+        },
+        "due_on": {
+          "description": "The due day as `YYYY-MM-DD`; GitHub keeps only the day, so only the day is compared, and a snapshot reads it back as the day. The day is sent as noon UTC, `YYYY-MM-DDT12:00:00Z`, which GitHub stores on the same calendar day in PST and PDT. A UTC timestamp `YYYY-MM-DDTHH:MM:SSZ` is accepted for its date part.",
+          "anyOf": [
+            {
+              "type": "string",
+              "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))$"
+            },
+            {
+              "type": "string",
+              "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
+            }
+          ]
+        }
+      },
+      "required": [
+        "title"
+      ]
+    },
+    "PagesConfig": {
+      "description": "GitHub Pages site configuration; use `pages: null` to disable the site.",
+      "type": "object",
+      "properties": {
+        "build_type": {
+          "description": "\"workflow\" (GitHub Actions) or \"legacy\" (branch).",
+          "type": "string",
+          "enum": [
+            "workflow",
+            "legacy"
+          ]
+        },
+        "source": {
+          "description": "The update PUT requires both branch and path when source is sent.",
+          "type": "object",
+          "properties": {
+            "branch": {
+              "description": "The branch Pages publishes from.",
+              "type": "string"
+            },
+            "path": {
+              "description": "The directory within the branch Pages publishes: / or /docs.",
+              "type": "string",
+              "enum": [
+                "/",
+                "/docs"
+              ]
+            }
+          },
+          "required": [
+            "branch"
+          ]
+        },
+        "cname": {
+          "description": "Custom domain; null removes it.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "https_enforced": {
+          "description": "Whether HTTPS is enforced for the site.",
+          "type": "boolean"
+        },
+        "public": {
+          "description": "Enterprise Cloud site visibility: true for public, false for repository members only. Only an organization on Enterprise Cloud can set it; everywhere else GitHub reports true and ignores the field, so false drifts on every run.",
+          "type": "boolean"
+        }
+      },
+      "not": {
+        "anyOf": [
+          {
+            "required": [
+              "url"
+            ]
+          },
+          {
+            "required": [
+              "html_url"
+            ]
+          },
+          {
+            "required": [
+              "status"
+            ]
+          },
+          {
+            "required": [
+              "custom_404"
+            ]
+          },
+          {
+            "required": [
+              "protected_domain_state"
+            ]
+          },
+          {
+            "required": [
+              "pending_domain_unverified_at"
+            ]
+          },
+          {
+            "required": [
+              "https_certificate"
+            ]
+          }
+        ]
+      }
+    },
+    "PatternRuleParameters": {
+      "description": "The pattern and operator the five *_pattern rule types share.",
+      "type": "object",
+      "properties": {
+        "name": {
+          "description": "How the rule appears when configuring it.",
+          "type": "string"
+        },
+        "negate": {
+          "description": "Whether the rule fails when the pattern matches.",
+          "type": "boolean"
+        },
+        "operator": {
+          "description": "starts_with, ends_with, contains, or regex, in that spelling.",
+          "type": "string",
+          "enum": [
+            "starts_with",
+            "ends_with",
+            "contains",
+            "regex"
+          ]
+        },
+        "pattern": {
+          "description": "The pattern to match.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "operator",
+        "pattern"
+      ],
+      "additionalProperties": {}
+    },
+    "RepositoryConfig": {
+      "description": "The `repository:` section, where only declared keys are ever applied or compared. A field not documented here is sent verbatim to PATCH /repos/{r}, so a field GitHub adds later works unchanged; the keys below carry GitHub's types (a toggle is true or false, never null or quoted) or route to their own endpoints. GET-only fields (ids, urls, counts, has_downloads, has_pages, custom_properties) are refused, since they would drift on every run.",
+      "type": "object",
+      "properties": {
+        "description": {
+          "description": "A short description of the repository; null clears it.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "homepage": {
+          "description": "A URL with more information about the repository; null clears it.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "private": {
+          "description": "Make the repository private (true) or public (false).",
+          "type": "boolean"
+        },
+        "visibility": {
+          "description": "public, private, or internal (Enterprise); a free string, since the spec omits internal.",
+          "type": "string"
+        },
+        "security_and_analysis": {
+          "description": "The security_and_analysis object of PATCH /repos/{r}: GitHub Advanced Security, secret scanning, push protection, and the other nested feature toggles.",
+          "anyOf": [
+            {
+              "$ref": "#/definitions/SecurityAndAnalysisConfig"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "has_issues": {
+          "description": "Enable issues (true) or disable them (false).",
+          "type": "boolean"
+        },
+        "has_projects": {
+          "description": "Enable projects (true) or disable them (false); an organization that disabled repository projects rejects true.",
+          "type": "boolean"
+        },
+        "has_wiki": {
+          "description": "Enable the wiki (true) or disable it (false).",
+          "type": "boolean"
+        },
+        "has_discussions": {
+          "description": "Enable discussions (true) or disable them (false); accepted by the PATCH though the descriptor omits it.",
+          "type": "boolean"
+        },
+        "has_pull_requests": {
+          "description": "Allow pull requests (true) or prevent them (false).",
+          "type": "boolean"
+        },
+        "pull_request_creation_policy": {
+          "description": "Who may create pull requests: \"all\" (everyone) or \"collaborators_only\".",
+          "type": "string",
+          "enum": [
+            "all",
+            "collaborators_only"
+          ]
+        },
+        "is_template": {
+          "description": "Offer the repository as a template (true) or not (false).",
+          "type": "boolean"
+        },
+        "default_branch": {
+          "description": "The default branch; an existing branch name.",
+          "type": "string"
+        },
+        "allow_squash_merge": {
+          "description": "Allow squash-merging pull requests (true) or not (false).",
+          "type": "boolean"
+        },
+        "allow_merge_commit": {
+          "description": "Allow merge commits on pull requests (true) or not (false).",
+          "type": "boolean"
+        },
+        "allow_rebase_merge": {
+          "description": "Allow rebase-merging pull requests (true) or not (false).",
+          "type": "boolean"
+        },
+        "allow_auto_merge": {
+          "description": "Allow auto-merge on pull requests (true) or not (false).",
+          "type": "boolean"
+        },
+        "delete_branch_on_merge": {
+          "description": "Delete head branches when pull requests merge (true) or keep them (false).",
+          "type": "boolean"
+        },
+        "allow_update_branch": {
+          "description": "Offer to update a pull request branch behind its base (true) or not (false).",
+          "type": "boolean"
+        },
+        "use_squash_pr_title_as_default": {
+          "description": "Deprecated by GitHub in favor of squash_merge_commit_title: use the PR title as the squash commit title (true) or not (false).",
+          "type": "boolean"
+        },
+        "squash_merge_commit_title": {
+          "description": "The default title of a squash merge commit: PR_TITLE or COMMIT_OR_PR_TITLE. Required beside squash_merge_commit_message; legal pairs are PR_TITLE with PR_BODY, BLANK, or COMMIT_MESSAGES, and COMMIT_OR_PR_TITLE with COMMIT_MESSAGES.",
+          "type": "string",
+          "enum": [
+            "PR_TITLE",
+            "COMMIT_OR_PR_TITLE"
+          ]
+        },
+        "squash_merge_commit_message": {
+          "description": "The default message of a squash merge commit: PR_BODY, BLANK, or COMMIT_MESSAGES. Needs squash_merge_commit_title declared beside it, in one of the legal pairs.",
+          "type": "string",
+          "enum": [
+            "PR_BODY",
+            "BLANK",
+            "COMMIT_MESSAGES"
+          ]
+        },
+        "merge_commit_title": {
+          "description": "The default title of a merge commit: PR_TITLE or MERGE_MESSAGE. Required beside merge_commit_message.",
+          "type": "string",
+          "enum": [
+            "PR_TITLE",
+            "MERGE_MESSAGE"
+          ]
+        },
+        "merge_commit_message": {
+          "description": "The default message of a merge commit: PR_BODY, PR_TITLE, or BLANK. Needs merge_commit_title declared beside it.",
+          "type": "string",
+          "enum": [
+            "PR_BODY",
+            "BLANK",
+            "PR_TITLE"
+          ]
+        },
+        "archived": {
+          "description": "Archive the repository (true) or unarchive it (false).",
+          "type": "boolean"
+        },
+        "allow_forking": {
+          "description": "Allow private forks (true) or not (false).",
+          "type": "boolean"
+        },
+        "web_commit_signoff_required": {
+          "description": "Require contributors to sign off on web-based commits (true) or not (false).",
+          "type": "boolean"
+        },
+        "topics": {
+          "description": "Repository topics, replaced wholesale via PUT /repos/{r}/topics; a comma-separated string or a list, lowercased and deduped. Each topic is 1 to 50 letters, digits, and hyphens, starting with a letter or digit (uppercase is lowercased on the wire); at most 20 distinct topics. An empty entry is refused; an empty list removes every topic.",
+          "anyOf": [
+            {
+              "type": "string",
+              "pattern": "^\\s*[A-Za-z0-9][A-Za-z0-9-]{0,49}\\s*(,\\s*[A-Za-z0-9][A-Za-z0-9-]{0,49}\\s*)*$"
+            },
+            {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "pattern": "^[A-Za-z0-9][A-Za-z0-9-]{0,49}$"
+              }
+            }
+          ]
+        },
+        "enable_vulnerability_alerts": {
+          "description": "Dependabot alerts, via PUT/DELETE /repos/{r}/vulnerability-alerts. On read, 404 means off.",
+          "type": "boolean"
+        },
+        "enable_automated_security_fixes": {
+          "description": "Dependabot security updates, via PUT/DELETE /repos/{r}/automated-security-fixes. On read, 404 means off, as does a 200 body with enabled: false.",
+          "type": "boolean"
+        },
+        "enable_private_vulnerability_reporting": {
+          "description": "Private vulnerability reporting, via PUT/DELETE /repos/{r}/private-vulnerability-reporting. Repositories where the feature does not apply (observed: private repos) read as off.",
+          "type": "boolean"
+        },
+        "enable_git_lfs": {
+          "description": "Git LFS, via PUT/DELETE /repos/{r}/lfs. Write-only upstream: check mode cannot verify it, and apply re-asserts it on every run.",
+          "type": "boolean"
+        },
+        "enable_immutable_releases": {
+          "description": "Immutable releases, via PUT/DELETE /repos/{r}/immutable-releases. On read, 404 means off. When the repository owner enforces immutable releases (enforced_by_owner in the GET body), writes answer 409 and the setting cannot be changed from the repository; apply reports that as a note instead of a change.",
+          "type": "boolean"
+        },
+        "enable_sponsorships": {
+          "description": "Display a Sponsor button on the repository, via the GraphQL updateRepository mutation (hasSponsorshipsEnabled) - GraphQL is the setting's only read and write surface (the REST repo PATCH and GET carry no such field). A stored repository toggle independent of any FUNDING.yml content.",
+          "type": "boolean"
+        },
+        "issue_creation_policy": {
+          "description": "Who may create issues: \"all\" (everyone) or \"collaborators_only\", mapped to GitHub's ALL/COLLABORATORS_ONLY GraphQL enum at the API boundary. GraphQL-only upstream (Repository.issueCreationPolicy and the updateRepository mutation): the REST repo PATCH accepts an issue_creation_policy field and silently ignores it, and no REST GET returns it.",
+          "type": "string",
+          "enum": [
+            "all",
+            "collaborators_only"
+          ]
+        }
+      },
+      "additionalProperties": {
+        "description": "Everything else passes through to PATCH /repos/{r} verbatim."
+      },
+      "allOf": [
+        {
+          "if": {
+            "required": [
+              "squash_merge_commit_message"
+            ]
+          },
+          "then": {
+            "required": [
+              "squash_merge_commit_title"
+            ]
+          }
+        },
+        {
+          "if": {
+            "required": [
+              "squash_merge_commit_title"
+            ],
+            "properties": {
+              "squash_merge_commit_title": {
+                "const": "PR_TITLE"
+              }
+            }
+          },
+          "then": {
+            "properties": {
+              "squash_merge_commit_message": {
+                "enum": [
+                  "PR_BODY",
+                  "BLANK",
+                  "COMMIT_MESSAGES"
+                ]
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "required": [
+              "squash_merge_commit_title"
+            ],
+            "properties": {
+              "squash_merge_commit_title": {
+                "const": "COMMIT_OR_PR_TITLE"
+              }
+            }
+          },
+          "then": {
+            "properties": {
+              "squash_merge_commit_message": {
+                "enum": [
+                  "COMMIT_MESSAGES"
+                ]
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "required": [
+              "merge_commit_message"
+            ]
+          },
+          "then": {
+            "required": [
+              "merge_commit_title"
+            ]
+          }
+        }
+      ]
+    },
+    "RequiredReviewerConfig": {
+      "description": "A team and the file patterns whose changes it must approve.",
+      "type": "object",
+      "properties": {
+        "file_patterns": {
+          "description": "fnmatch patterns of the files the team must review.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "minimum_approvals": {
+          "description": "Approvals required from the team; zero adds the team as a reviewer without requiring approval.",
+          "type": "integer"
+        },
+        "reviewer": {
+          "description": "The reviewing team.",
+          "type": "object",
+          "properties": {
+            "id": {
+              "description": "The team's id.",
+              "type": "integer"
+            },
+            "type": {
+              "description": "Always \"Team\".",
+              "type": "string",
+              "const": "Team"
+            }
+          },
+          "required": [
+            "id",
+            "type"
+          ],
+          "additionalProperties": {}
+        }
+      },
+      "required": [
+        "file_patterns",
+        "minimum_approvals",
+        "reviewer"
+      ],
+      "additionalProperties": {}
+    },
+    "ReviewDismissalActorConfig": {
+      "description": "One actor allowed to dismiss pull request reviews.",
+      "type": "object",
+      "properties": {
+        "id": {
+          "description": "The actor's id.",
+          "type": "integer"
+        },
+        "type": {
+          "description": "User, Team, IntegrationInstallation, or RepositoryRole.",
+          "type": "string",
+          "enum": [
+            "User",
+            "Team",
+            "IntegrationInstallation",
+            "RepositoryRole"
+          ]
+        }
+      },
+      "required": [
+        "id",
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<branch_name_pattern>": {
+      "description": "Branch names must match (or not match) a pattern.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "branch_name_pattern"
+        },
+        "parameters": {
+          "description": "The rule's parameters, typed as the spec types them; a field GitHub adds later passes through.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/PatternRuleParameters"
+            }
+          ]
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<code_scanning>": {
+      "description": "Named code scanning tools must report before the ref is updated.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "code_scanning"
+        },
+        "parameters": {
+          "description": "The rule's parameters, typed as the spec types them; a field GitHub adds later passes through.",
+          "type": "object",
+          "properties": {
+            "code_scanning_tools": {
+              "description": "The tools that must provide results.",
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/CodeScanningToolConfig"
+              }
+            }
+          },
+          "required": [
+            "code_scanning_tools"
+          ],
+          "additionalProperties": {}
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<commit_author_email_pattern>": {
+      "description": "Commit author emails must match (or not match) a pattern.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "commit_author_email_pattern"
+        },
+        "parameters": {
+          "description": "The rule's parameters, typed as the spec types them; a field GitHub adds later passes through.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/PatternRuleParameters"
+            }
+          ]
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<commit_message_pattern>": {
+      "description": "Commit messages must match (or not match) a pattern.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "commit_message_pattern"
+        },
+        "parameters": {
+          "description": "The rule's parameters, typed as the spec types them; a field GitHub adds later passes through.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/PatternRuleParameters"
+            }
+          ]
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<committer_email_pattern>": {
+      "description": "Committer emails must match (or not match) a pattern.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "committer_email_pattern"
+        },
+        "parameters": {
+          "description": "The rule's parameters, typed as the spec types them; a field GitHub adds later passes through.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/PatternRuleParameters"
+            }
+          ]
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<copilot_code_review>": {
+      "description": "Copilot code review is requested on new pull requests automatically.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "copilot_code_review"
+        },
+        "parameters": {
+          "description": "The rule's parameters, typed as the spec types them; a field GitHub adds later passes through.",
+          "type": "object",
+          "properties": {
+            "review_draft_pull_requests": {
+              "description": "Whether drafts are reviewed before they are marked ready.",
+              "type": "boolean"
+            },
+            "review_on_push": {
+              "description": "Whether each new push is reviewed.",
+              "type": "boolean"
+            }
+          },
+          "additionalProperties": {}
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<creation>": {
+      "description": "Only actors with bypass permission may create matching refs.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "creation"
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<deletion>": {
+      "description": "Only actors with bypass permission may delete matching refs.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "deletion"
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<file_extension_restriction>": {
+      "description": "Commits adding files with the listed extensions are refused.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "file_extension_restriction"
+        },
+        "parameters": {
+          "description": "The rule's parameters, typed as the spec types them; a field GitHub adds later passes through.",
+          "type": "object",
+          "properties": {
+            "restricted_file_extensions": {
+              "description": "The file extensions refused.",
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          "required": [
+            "restricted_file_extensions"
+          ],
+          "additionalProperties": {}
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<file_path_restriction>": {
+      "description": "Commits touching the listed paths are refused.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "file_path_restriction"
+        },
+        "parameters": {
+          "description": "The rule's parameters, typed as the spec types them; a field GitHub adds later passes through.",
+          "type": "object",
+          "properties": {
+            "restricted_file_paths": {
+              "description": "The file and folder paths refused.",
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          "required": [
+            "restricted_file_paths"
+          ],
+          "additionalProperties": {}
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<license_compliance_scanning>": {
+      "description": "Added or changed dependencies must comply with the organization's license policy.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "license_compliance_scanning"
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<max_file_path_length>": {
+      "description": "Commits with file paths over the length cap are refused.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "max_file_path_length"
+        },
+        "parameters": {
+          "description": "The rule's parameters, typed as the spec types them; a field GitHub adds later passes through.",
+          "type": "object",
+          "properties": {
+            "max_file_path_length": {
+              "description": "The most characters a file path may have (1 to 32767).",
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 32767
+            }
+          },
+          "required": [
+            "max_file_path_length"
+          ],
+          "additionalProperties": {}
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<max_file_size>": {
+      "description": "Commits with a file over the size cap are refused.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "max_file_size"
+        },
+        "parameters": {
+          "description": "The rule's parameters, typed as the spec types them; a field GitHub adds later passes through.",
+          "type": "object",
+          "properties": {
+            "max_file_size": {
+              "description": "The largest file allowed, in megabytes (1 to 100); Git LFS objects are exempt.",
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 100
+            }
+          },
+          "required": [
+            "max_file_size"
+          ],
+          "additionalProperties": {}
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<merge_queue>": {
+      "description": "Merges into matching branches go through a merge queue.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "merge_queue"
+        },
+        "parameters": {
+          "description": "The rule's parameters, typed as the spec types them; a field GitHub adds later passes through.",
+          "type": "object",
+          "properties": {
+            "check_response_timeout_minutes": {
+              "description": "Minutes a required status check may take before it counts as failed (1 to 360).",
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 360
+            },
+            "grouping_strategy": {
+              "description": "ALLGREEN (every PR's merge commit must pass all required checks) or HEADGREEN (only the head of the merge group must), in GitHub's upper-case spelling.",
+              "type": "string",
+              "enum": [
+                "ALLGREEN",
+                "HEADGREEN"
+              ]
+            },
+            "max_entries_to_build": {
+              "description": "Cap on queued pull requests building at the same time (0 to 100).",
+              "type": "integer",
+              "minimum": 0,
+              "maximum": 100
+            },
+            "max_entries_to_merge": {
+              "description": "Cap on pull requests merged as one group (0 to 100).",
+              "type": "integer",
+              "minimum": 0,
+              "maximum": 100
+            },
+            "merge_method": {
+              "description": "MERGE, SQUASH, or REBASE, in GitHub's upper-case spelling (the lower-case pull_request allowed_merge_methods spelling is refused here).",
+              "type": "string",
+              "enum": [
+                "MERGE",
+                "SQUASH",
+                "REBASE"
+              ]
+            },
+            "min_entries_to_merge": {
+              "description": "Minimum pull requests merged as one group (0 to 100).",
+              "type": "integer",
+              "minimum": 0,
+              "maximum": 100
+            },
+            "min_entries_to_merge_wait_minutes": {
+              "description": "Minutes the queue waits for the minimum group size before merging a smaller group (0 to 360).",
+              "type": "integer",
+              "minimum": 0,
+              "maximum": 360
+            }
+          },
+          "required": [
+            "check_response_timeout_minutes",
+            "grouping_strategy",
+            "max_entries_to_build",
+            "max_entries_to_merge",
+            "merge_method",
+            "min_entries_to_merge",
+            "min_entries_to_merge_wait_minutes"
+          ],
+          "additionalProperties": {}
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<non_fast_forward>": {
+      "description": "No force pushes to matching refs.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "non_fast_forward"
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<pull_request>": {
+      "description": "Changes reach matching branches through a pull request only.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "pull_request"
+        },
+        "parameters": {
+          "description": "The rule's parameters, typed as the spec types them; a field GitHub adds later passes through.",
+          "type": "object",
+          "properties": {
+            "allowed_merge_methods": {
+              "description": "The merge methods allowed, lower-case merge, squash, rebase (the upper-case merge_queue spelling is refused here); at least one.",
+              "minItems": 1,
+              "type": "array",
+              "items": {
+                "type": "string",
+                "enum": [
+                  "merge",
+                  "squash",
+                  "rebase"
+                ]
+              }
+            },
+            "dismiss_stale_reviews_on_push": {
+              "description": "Whether a new reviewable push dismisses earlier approvals.",
+              "type": "boolean"
+            },
+            "dismissal_restriction": {
+              "description": "Who may dismiss pull request reviews.",
+              "type": "object",
+              "properties": {
+                "allowed_actors": {
+                  "description": "The people, teams, or apps allowed to dismiss reviews.",
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/ReviewDismissalActorConfig"
+                  }
+                },
+                "enabled": {
+                  "description": "Whether review dismissal is restricted to the listed actors.",
+                  "type": "boolean"
+                }
+              },
+              "required": [
+                "enabled"
+              ],
+              "additionalProperties": {}
+            },
+            "require_code_owner_review": {
+              "description": "Whether files with a code owner need that owner's approving review.",
+              "type": "boolean"
+            },
+            "require_last_push_approval": {
+              "description": "Whether the most recent reviewable push must be approved by someone other than its pusher.",
+              "type": "boolean"
+            },
+            "required_approving_review_count": {
+              "description": "Approving reviews required (0 to 10).",
+              "type": "integer",
+              "minimum": 0,
+              "maximum": 10
+            },
+            "required_review_thread_resolution": {
+              "description": "Whether every review conversation must be resolved before merging.",
+              "type": "boolean"
+            },
+            "required_reviewers": {
+              "description": "Teams that must review changes to given file patterns (GitHub marks this beta).",
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/RequiredReviewerConfig"
+              }
+            }
+          },
+          "required": [
+            "dismiss_stale_reviews_on_push",
+            "require_code_owner_review",
+            "require_last_push_approval",
+            "required_approving_review_count",
+            "required_review_thread_resolution"
+          ],
+          "additionalProperties": {}
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<required_deployments>": {
+      "description": "Named environments must deploy successfully before a push lands.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "required_deployments"
+        },
+        "parameters": {
+          "description": "The rule's parameters, typed as the spec types them; a field GitHub adds later passes through.",
+          "type": "object",
+          "properties": {
+            "required_deployment_environments": {
+              "description": "The environment names that must be deployed to first.",
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          "required": [
+            "required_deployment_environments"
+          ],
+          "additionalProperties": {}
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<required_linear_history>": {
+      "description": "No merge commits may be pushed to matching refs.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "required_linear_history"
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<required_signatures>": {
+      "description": "Commits pushed to matching refs must carry verified signatures.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "required_signatures"
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<required_status_checks>": {
+      "description": "Named status checks must pass before the ref is updated.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "required_status_checks"
+        },
+        "parameters": {
+          "description": "The rule's parameters, typed as the spec types them; a field GitHub adds later passes through.",
+          "type": "object",
+          "properties": {
+            "do_not_enforce_on_create": {
+              "description": "Whether a new ref may be created even when a check would otherwise block it.",
+              "type": "boolean"
+            },
+            "required_status_checks": {
+              "description": "The checks that must pass.",
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/StatusCheckConfig"
+              }
+            },
+            "strict_required_status_checks_policy": {
+              "description": "Whether a pull request must be tested against the latest target commit.",
+              "type": "boolean"
+            }
+          },
+          "required": [
+            "required_status_checks",
+            "strict_required_status_checks_policy"
+          ],
+          "additionalProperties": {}
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<tag_name_pattern>": {
+      "description": "Tag names must match (or not match) a pattern.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "tag_name_pattern"
+        },
+        "parameters": {
+          "description": "The rule's parameters, typed as the spec types them; a field GitHub adds later passes through.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/PatternRuleParameters"
+            }
+          ]
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<update>": {
+      "description": "Only actors with bypass permission may update matching refs.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "update"
+        },
+        "parameters": {
+          "description": "The rule's parameters, typed as the spec types them; a field GitHub adds later passes through.",
+          "type": "object",
+          "properties": {
+            "update_allows_fetch_and_merge": {
+              "description": "Whether the branch may still pull changes from its upstream repository.",
+              "type": "boolean"
+            }
+          },
+          "required": [
+            "update_allows_fetch_and_merge"
+          ],
+          "additionalProperties": {}
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "Rule<workflows>": {
+      "description": "Named workflows must pass before changes merge into matching branches.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it.",
+          "type": "string",
+          "const": "workflows"
+        },
+        "parameters": {
+          "description": "The rule's parameters, typed as the spec types them; a field GitHub adds later passes through.",
+          "type": "object",
+          "properties": {
+            "do_not_enforce_on_create": {
+              "description": "Whether a new ref may be created even when a workflow would otherwise block it.",
+              "type": "boolean"
+            },
+            "workflows": {
+              "description": "The workflow files that must pass.",
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/WorkflowFileConfig"
+              }
+            }
+          },
+          "required": [
+            "workflows"
+          ],
+          "additionalProperties": {}
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "RuleConfig": {
+      "description": "One rule of the ruleset: a type the spec knows, with its parameters typed, or any other type, passed through as written.",
+      "anyOf": [
+        {
+          "oneOf": [
+            {
+              "$ref": "#/definitions/Rule%3Ccreation%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Cupdate%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Cdeletion%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Crequired_linear_history%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Cmerge_queue%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Crequired_deployments%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Crequired_signatures%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Cpull_request%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Crequired_status_checks%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Cnon_fast_forward%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Ccommit_message_pattern%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Ccommit_author_email_pattern%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Ccommitter_email_pattern%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Cbranch_name_pattern%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Ctag_name_pattern%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Cworkflows%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Ccode_scanning%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Ccopilot_code_review%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Clicense_compliance_scanning%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Cfile_path_restriction%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Cmax_file_path_length%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Cfile_extension_restriction%3E"
+            },
+            {
+              "$ref": "#/definitions/Rule%3Cmax_file_size%3E"
+            }
+          ]
+        },
+        {
+          "$ref": "#/definitions/UnknownRule"
+        }
+      ]
+    },
+    "RulesetConfig": {
+      "description": "One repository ruleset, matched to the live repo by name.",
+      "type": "object",
+      "properties": {
+        "name": {
+          "description": "The ruleset name, the natural key.",
+          "type": "string"
+        },
+        "target": {
+          "description": "What the ruleset applies to. Omitted, it is \"branch\", the default GitHub documents, so a live branch ruleset is not drift under an entry without the key.",
+          "default": "branch",
+          "type": "string",
+          "enum": [
+            "branch",
+            "tag",
+            "push"
+          ]
+        },
+        "enforcement": {
+          "description": "\"active\", \"evaluate\", or \"disabled\", in that spelling (\"enabled\" and \"Active\" are refused at parse). Omitted, it is \"active\" (GitHub requires a value on create; this is the one chosen), so a live active ruleset is not drift under an entry without the key.",
+          "default": "active",
+          "type": "string",
+          "enum": [
+            "active",
+            "evaluate",
+            "disabled"
+          ]
+        },
+        "conditions": {
+          "description": "Which refs the ruleset covers.",
+          "type": "object",
+          "properties": {
+            "ref_name": {
+              "description": "Short ref names are auto-prefixed (staging -> refs/heads/staging).",
+              "type": "object",
+              "properties": {
+                "include": {
+                  "description": "Ref patterns the ruleset targets (fnmatch). The tokens ~DEFAULT_BRANCH and ~ALL are accepted as written; any other value carrying \"~\", or one of \"^\", \":\", \"\\\\\", space, \"..\", \"@{\", or a control character, is refused at parse: git refuses these in a ref name and a ruleset pattern has no use for them. \"*\", \"?\", and \"[\" are pattern syntax and pass.",
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "pattern": "^(?:~ALL|~DEFAULT_BRANCH|(?:(?![~^:\\\\ \\x00-\\x1f\\x7f]|\\.\\.|@\\{)[\\s\\S])*)$"
+                  }
+                },
+                "exclude": {
+                  "description": "Ref patterns excluded from the ruleset; the same character rules apply.",
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "pattern": "^(?:~ALL|~DEFAULT_BRANCH|(?:(?![~^:\\\\ \\x00-\\x1f\\x7f]|\\.\\.|@\\{)[\\s\\S])*)$"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "rules": {
+          "description": "Rule list. A rule type the vendored spec knows has its parameters checked at parse; a type it does not know passes through verbatim, so a rule type GitHub ships tomorrow works today.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/RuleConfig"
+          }
+        },
+        "bypass_actors": {
+          "description": "Who may bypass the ruleset; each actor is one (actor_type, actor_id) pair, bypass_mode defaulting to always. An entry without the key leaves a live bypass list as drift and apply refuses the PUT; `[]` clears it on purpose. GitHub returns it only to a token with write access to the ruleset, so without Administration write check mode notes it instead of judging drift.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/BypassActorConfig"
+          }
+        }
+      },
+      "required": [
+        "name"
+      ]
+    },
+    "SecretScanningPatternConfig": {
+      "description": "One secret scanning custom pattern, matched by exact name. Only the fields below are accepted: `state` and `push_protection_enabled` are readable but NOT writable through the custom-pattern endpoints, so they cannot be declared. A delimiter, once set, cannot be cleared back to GitHub's default through the update PATCH (the endpoint updates provided fields only); remove the pattern and redeclare it without the field instead.",
+      "type": "object",
+      "properties": {
+        "name": {
+          "description": "The pattern name, the natural key; immutable upstream, so a rename creates the new name (the old one follows the undeclared policy).",
+          "type": "string"
+        },
+        "pattern": {
+          "description": "The regular expression the secret format must match. Like every regex field here it passes a syntax check at parse, or the file is refused naming the field: the PCRE-only forms Hyperscan accepts (`(?P<name>`, `(?#comment)`, `\\x{HH}`, `(?i)`, atomic and possessive forms, `\\Q...\\E`, a leading `(*UTF8)`, `(*UTF)` or `(*UCP)`) are translated, then the result must compile as a flagless JavaScript RegExp. GitHub can still refuse at apply what Hyperscan alone refuses (lookbehind, backreferences, option modifiers).",
+          "type": "string"
+        },
+        "start_delimiter": {
+          "description": "Regular expression for the characters that must come before the secret; it passes the syntax check, like `pattern`. An empty string is rejected: a delimiter cannot be cleared through the update call - remove the pattern and redeclare it without the field instead.",
+          "type": "string",
+          "minLength": 1
+        },
+        "end_delimiter": {
+          "description": "Regular expression for the characters that must come after the secret; it passes the syntax check, like `pattern`. An empty string is rejected, like start_delimiter.",
+          "type": "string",
+          "minLength": 1
+        },
+        "must_match": {
+          "description": "Additional regular expressions a match must also satisfy, compared in order; each passes the syntax check, like `pattern`.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "must_not_match": {
+          "description": "Regular expressions a match must NOT satisfy, compared in order; each passes the syntax check, like `pattern`.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      },
+      "required": [
+        "name",
+        "pattern"
+      ]
+    },
+    "SecurityAndAnalysisConfig": {
+      "description": "The nested security_and_analysis object, closed to the sub-keys the PATCH accepts (GitHub rejects any other with a 422). Each feature is {status: enabled/disabled}. dependabot_security_updates is not one of them: declare enable_automated_security_fixes instead.",
+      "type": "object",
+      "properties": {
+        "advanced_security": {
+          "description": "GitHub Advanced Security.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/SecurityFeatureToggle"
+            }
+          ]
+        },
+        "code_security": {
+          "description": "GitHub Code Security.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/SecurityFeatureToggle"
+            }
+          ]
+        },
+        "secret_scanning": {
+          "description": "Secret scanning.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/SecurityFeatureToggle"
+            }
+          ]
+        },
+        "secret_scanning_push_protection": {
+          "description": "Secret scanning push protection.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/SecurityFeatureToggle"
+            }
+          ]
+        },
+        "secret_scanning_ai_detection": {
+          "description": "AI detection of generic secrets.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/SecurityFeatureToggle"
+            }
+          ]
+        },
+        "secret_scanning_non_provider_patterns": {
+          "description": "Non-provider secret patterns.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/SecurityFeatureToggle"
+            }
+          ]
+        },
+        "secret_scanning_delegated_alert_dismissal": {
+          "description": "Delegated dismissal of secret scanning alerts.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/SecurityFeatureToggle"
+            }
+          ]
+        },
+        "secret_scanning_delegated_bypass": {
+          "description": "Delegated bypass of push protection; the reviewers live in secret_scanning_delegated_bypass_options.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/SecurityFeatureToggle"
+            }
+          ]
+        },
+        "secret_scanning_delegated_bypass_options": {
+          "description": "Who reviews push protection bypass requests; honored only while secret_scanning_delegated_bypass is enabled.",
+          "type": "object",
+          "properties": {
+            "reviewers": {
+              "description": "The bypass reviewers; left out, the existing set is unchanged.",
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "reviewer_id": {
+                    "description": "The id of the team or role selected as a reviewer.",
+                    "type": "integer"
+                  },
+                  "reviewer_type": {
+                    "description": "TEAM or ROLE.",
+                    "type": "string",
+                    "enum": [
+                      "TEAM",
+                      "ROLE"
+                    ]
+                  },
+                  "mode": {
+                    "description": "ALWAYS (the default: every bypass needs review) or EXEMPT (this reviewer's own pushes skip it).",
+                    "type": "string",
+                    "enum": [
+                      "ALWAYS",
+                      "EXEMPT"
+                    ]
+                  }
+                },
+                "required": [
+                  "reviewer_id",
+                  "reviewer_type"
+                ],
+                "additionalProperties": false
+              }
+            }
+          },
+          "additionalProperties": false
+        },
+        "secret_scanning_validity_checks": {
+          "description": "Validity checks for detected secrets (documented in the GHEC flavor of the spec).",
+          "allOf": [
+            {
+              "$ref": "#/definitions/SecurityFeatureToggle"
+            }
+          ]
+        }
+      },
+      "additionalProperties": false
+    },
+    "SecurityFeatureToggle": {
+      "description": "One security_and_analysis feature.",
+      "type": "object",
+      "properties": {
+        "status": {
+          "description": "\"enabled\" or \"disabled\".",
+          "type": "string",
+          "enum": [
+            "enabled",
+            "disabled"
+          ]
+        }
+      },
+      "additionalProperties": false
+    },
+    "SettingsFile": {
+      "description": "One settings.yml document: every top-level section is optional.",
+      "type": "object",
+      "properties": {
+        "repository": {
+          "description": "Repo fields sent verbatim to PATCH /repos/{r}, plus the special keys RepositoryConfig documents.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/RepositoryConfig"
+            }
+          ]
+        },
+        "labels": {
+          "description": "Issue/PR labels; undeclared labels are DELETED by default (Probot parity; the wrapped form can set `_undeclared: keep`).",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/LabelConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/UndeclaredPolicyList%3CLabelConfig%3E"
+            }
+          ]
+        },
+        "rulesets": {
+          "description": "Repository rulesets, upserted by name; undeclared ones are kept by default (the wrapped form can set `_undeclared: delete`).",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/RulesetConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/UndeclaredPolicyList%3CRulesetConfig%3E"
+            }
+          ]
+        },
+        "branches": {
+          "description": "Classic branch protection per branch.",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/BranchConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/LayeredList%3CBranchConfig%3E"
+            }
+          ]
+        },
+        "environments": {
+          "description": "Deployment environments, upserted by name.",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/EnvironmentConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/LayeredList%3CEnvironmentConfig%3E"
+            }
+          ]
+        },
+        "autolinks": {
+          "description": "Autolink references; undeclared ones are DELETED by default (the wrapped form can set `_undeclared: keep`).",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/AutolinkConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/UndeclaredPolicyList%3CAutolinkConfig%3E"
+            }
+          ]
+        },
+        "actions": {
+          "description": "GitHub Actions permissions for the repository.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/ActionsConfig"
+            }
+          ]
+        },
+        "actions_secrets": {
+          "description": "Repository Actions secrets, written by name with values sealed client-side; each value is a whole-value `$NAME` reference to the action step's environment, never a literal. Undeclared secrets are kept by default (the wrapped form can set `_undeclared: delete`; a deleted secret's value is unrecoverable).",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/ActionsSecretConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/UndeclaredPolicyList%3CActionsSecretConfig%3E"
+            }
+          ]
+        },
+        "dependabot_secrets": {
+          "description": "Repository Dependabot secrets (private-registry credentials Dependabot uses), written by name with values sealed client-side; each value is a whole-value `$NAME` reference to the action step's environment, never a literal. Undeclared secrets are kept by default (the wrapped form can set `_undeclared: delete`; a deleted secret's value is unrecoverable).",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/DependabotSecretConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/UndeclaredPolicyList%3CDependabotSecretConfig%3E"
+            }
+          ]
+        },
+        "codespaces_secrets": {
+          "description": "Repository Codespaces secrets (development environment secrets), written by name with values sealed client-side; each value is a whole-value `$NAME` reference to the action step's environment, never a literal. Undeclared secrets are kept by default (the wrapped form can set `_undeclared: delete`; a deleted secret's value is unrecoverable).",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/CodespacesSecretConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/UndeclaredPolicyList%3CCodespacesSecretConfig%3E"
+            }
+          ]
+        },
+        "agents_secrets": {
+          "description": "Repository Copilot agents secrets (the secret store Copilot coding agents read), written by name with values sealed client-side; each value is a whole-value `$NAME` reference to the action step's environment, never a literal. Undeclared secrets are kept by default (the wrapped form can set `_undeclared: delete`; a deleted secret's value is unrecoverable).",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/AgentsSecretConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/UndeclaredPolicyList%3CAgentsSecretConfig%3E"
+            }
+          ]
+        },
+        "workflows": {
+          "description": "Per-workflow enable/disable state; undeclared workflows are untouched.",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/WorkflowConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/LayeredList%3CWorkflowConfig%3E"
+            }
+          ]
+        },
+        "check_suite_preferences": {
+          "description": "Check suite preferences: per-GitHub-App `auto_trigger_checks` toggles controlling whether pushes automatically create check suites. Write-only upstream (GitHub exposes no read endpoint), so check mode cannot verify them and apply re-asserts the declared preferences on every run. The token owner must be a repository administrator.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/CheckSuitePreferencesConfig"
+            }
+          ]
+        },
+        "pages": {
+          "description": "GitHub Pages configuration; null disables Pages on the repository.",
+          "anyOf": [
+            {
+              "$ref": "#/definitions/PagesConfig"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "code_scanning_default_setup": {
+          "description": "Code scanning default setup (CodeQL).",
+          "allOf": [
+            {
+              "$ref": "#/definitions/CodeScanningDefaultSetupConfig"
+            }
+          ]
+        },
+        "code_quality_setup": {
+          "description": "Code quality analysis setup.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/CodeQualitySetupConfig"
+            }
+          ]
+        },
+        "collaborators": {
+          "description": "Direct collaborators, with pending invitations reconciled alongside; undeclared ones are REMOVED (pending invitations cancelled) by default (owner never touched; the wrapped form can set `_undeclared: keep`).",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/CollaboratorConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/UndeclaredPolicyList%3CCollaboratorConfig%3E"
+            }
+          ]
+        },
+        "teams": {
+          "description": "Org team access to the repo; skipped on personal accounts. Undeclared teams are kept by default and noted; the wrapped form can set `_undeclared: delete` to revoke their direct access (a grant made at the organization level is never touched). A declared child team can hold its access through an undeclared parent's grant, which `delete` revokes: declare the parent too, or keep.",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/TeamConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/UndeclaredPolicyList%3CTeamConfig%3E"
+            }
+          ]
+        },
+        "milestones": {
+          "description": "Milestones, upserted by title; undeclared ones are kept by default (the wrapped form can set `_undeclared: delete`, which detaches deleted milestones from their issues).",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/MilestoneConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/UndeclaredPolicyList%3CMilestoneConfig%3E"
+            }
+          ]
+        },
+        "interaction_limits": {
+          "description": "Temporary interaction limits; null clears an active repo-level limit, and an absent key leaves whatever is live untouched. Limits self-expire (GitHub's expiry tops out at six_months), so apply re-arms the declared limit on every run and check mode reports drift once it lapses. The pull_request_creation_cap and pull_request_creation_bypass keys manage the persistent pull request creation cap and its bypass list instead; `interaction_limits: null` clears the base limit only and never touches them.",
+          "anyOf": [
+            {
+              "$ref": "#/definitions/InteractionLimitsConfig"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "actions_variables": {
+          "description": "GitHub Actions repository variables, upserted by name; undeclared ones are DELETED by default (the wrapped form can set `_undeclared: keep`). Names are case-insensitive (GitHub stores them uppercased). Values are plain text BY DESIGN - variables are readable configuration, which is what makes check-mode diffing possible; secrets are write-only material and deliberately not this section.",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/ActionsVariableConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/UndeclaredPolicyList%3CActionsVariableConfig%3E"
+            }
+          ]
+        },
+        "agents_variables": {
+          "description": "Copilot agents repository variables (the plain-text configuration Copilot coding agents read), upserted by name; undeclared ones are DELETED by default (the wrapped form can set `_undeclared: keep`). Names are case-insensitive (GitHub stores them uppercased). Values are plain text BY DESIGN - variables are readable configuration, which is what makes check-mode diffing possible; secrets are write-only material and deliberately not this section.",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/AgentsVariableConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/UndeclaredPolicyList%3CAgentsVariableConfig%3E"
+            }
+          ]
+        },
+        "webhooks": {
+          "description": "Repository webhooks, managed one per config.url; undeclared hooks are kept by default and surfaced as notes, since integrations create their own hooks (the wrapped form can set `_undeclared: delete`).",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/WebhookConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/UndeclaredPolicyList%3CWebhookConfig%3E"
+            }
+          ]
+        },
+        "custom_properties": {
+          "description": "Values of organization-defined custom properties, set per repository (the property DEFINITIONS are organization-scoped and out of scope); organization repos only, skipped with a note on personal accounts. `value: null` unsets a property (reverting to the org default, if any), and booleans/numbers are normalized to their string form (GitHub transports true_false values as the strings \"true\"/\"false\"). Undeclared live values are kept by default - an unset can revert to an org default this action does not model, and a property whose values only org actors may edit would reject the write - and the wrapped form can set `_undeclared: delete` to opt into unsetting them.",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/CustomPropertyConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/UndeclaredPolicyList%3CCustomPropertyConfig%3E"
+            }
+          ]
+        },
+        "deploy_keys": {
+          "description": "Deploy keys, matched by title. The declared material is a PUBLIC key, safe in a committed settings file. Keys are immutable upstream, so any change is applied as delete plus recreate. Undeclared keys are kept by default - deleting a live deploy key breaks whatever service authenticates with it, and deployment tooling installs its own keys - and the wrapped form can set `_undeclared: delete`.",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/DeployKeyConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/UndeclaredPolicyList%3CDeployKeyConfig%3E"
+            }
+          ]
+        },
+        "secret_scanning_custom_patterns": {
+          "description": "Repository-level secret scanning custom patterns, matched by name. The name is immutable upstream (the update PATCH takes no name field), so a renamed entry is applied as a create of the new name - plus, under `_undeclared: delete`, deletion of the old one; under the default keep policy the old pattern stays live and is surfaced as a note. Undeclared patterns are kept by default: removing a pattern disposes of its alerts, so deletion stays a human opt-in (the wrapped form can set `_undeclared: delete`). When this action deletes a pattern it always asks GitHub to RESOLVE the pattern's alerts rather than delete them, keeping the audit trail.",
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/SecretScanningPatternConfig"
+              }
+            },
+            {
+              "$ref": "#/definitions/UndeclaredPolicyList%3CSecretScanningPatternConfig%3E"
+            }
+          ]
+        },
+        "_layering": {
+          "description": "mode: render only: a layer-level default for how this document's list sections combine with the layers below it, overriding the run's layering input; a section's own wrapper-level `_layering` overrides it again. `replace` lets each of this document's lists win wholesale; `shallow` unions the entries by the section's key and swaps a same-key entry for this document's; `deep` unions by key and merges a same-key pair field by field, a nested keyed list (a ruleset's rules, by type) unioning the same way. Consumed by the render, never applied: the rendered document carries no `_layering`, and apply and check ignore it like any `_` key.",
+          "type": "string",
+          "enum": [
+            "replace",
+            "shallow",
+            "deep"
+          ]
+        },
+        "_undeclared": {
+          "description": "The file-wide undeclared policy: what apply does to a live resource a list does not declare, for every list in this document that takes the `_undeclared` knob (the knobbed sections and an environment's variables, secrets, deployment branch policies, and deployment protection rules) and whose own wrapper sets none. A wrapper's `_undeclared` wins over it; it wins over the run's `undeclared` input; each list's own default applies when none of the three is set. Resolved into every list's wrapper, so the rendered document carries no `_undeclared` at its top. In a layered merge the highest layer that sets it steers the whole fold: a directive, not a merged value.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/UndeclaredPolicy"
+            }
+          ]
+        }
+      }
+    },
+    "StatusCheckConfig": {
+      "description": "One required status check.",
+      "type": "object",
+      "properties": {
+        "context": {
+          "description": "The status check context name that must be present on the commit.",
+          "type": "string"
+        },
+        "integration_id": {
+          "description": "The GitHub App the check must come from, when pinned.",
+          "type": "integer"
+        }
+      },
+      "required": [
+        "context"
+      ],
+      "additionalProperties": {}
+    },
+    "TeamConfig": {
+      "description": "One org team's access to the repository, matched by team slug. Keys other than name and permission are rejected (a misspelled \"permission\" would otherwise silently grant the default role).",
+      "type": "object",
+      "properties": {
+        "name": {
+          "description": "The team slug (the name in the team's URL), the natural key: letters, digits, \".\", \"_\", and \"-\". A display name with spaces fails at parse time, since the slug is what every API path takes and a wrong one reads as \"no access\".",
+          "type": "string",
+          "pattern": "^(?=.*[A-Za-z0-9])[A-Za-z0-9._-]+$"
+        },
+        "permission": {
+          "description": "Same vocabulary and parse rules as collaborators; defaults to \"push\".",
+          "type": "string",
+          "pattern": "^(?:pull|triage|push|maintain|admin|(?!(?:[Pp][Uu][Ll][Ll]|[Tt][Rr][Ii][Aa][Gg][Ee]|[Pp][Uu][Ss][Hh]|[Mm][Aa][Ii][Nn][Tt][Aa][Ii][Nn]|[Aa][Dd][Mm][Ii][Nn]|[Ww][Rr][Ii][Tt][Ee]|[Rr][Ee][Aa][Dd])$)\\S(?:.*\\S)?)$"
+        }
+      },
+      "required": [
+        "name"
+      ]
+    },
+    "UndeclaredPolicy": {
+      "description": "What apply does to live resources the settings file does not declare.",
+      "type": "string",
+      "enum": [
+        "keep",
+        "delete"
+      ]
+    },
+    "UndeclaredPolicyList<ActionsSecretConfig>": {
+      "description": "The wrapped form of a list, overriding what happens to live resources the file does not declare. The plain array form takes the file's top-level `_undeclared`, else the run's `undeclared` input, else the list's own default (the section default for a top-level section, a fixed default for a nested list such as environments[].variables); this wrapper can set it explicitly, and with `_undeclared` omitted it behaves exactly like the plain array. The wrapper is this action's own vocabulary (nothing here passes through to GitHub), so its keys are strict: anything besides `_undeclared`, `entries`, and `_layering` (the directives wear the underscore; a nested list's wrapper does not take `_layering`) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_undeclared": {
+          "description": "What apply does to live resources `entries` does not declare: \"delete\" removes them, \"keep\" leaves them alone and surfaces each as a note. Omitted, the file's top-level `_undeclared` applies, else the run's `undeclared` input, else the list's own default.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/UndeclaredPolicy"
+            }
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/ActionsSecretConfig"
+          }
+        },
+        "_layering": {
+          "description": "A render-time directive: how this section combines with the layers BELOW it in a layered merge, by the section's key (a label's name, a secret's name, a webhook's URL, ...). \"replace\" lets this layer's list win wholesale; \"shallow\" unions the entries by key and swaps a same-key entry for this layer's; \"deep\" unions by key and merges a same-key pair field by field, a nested keyed list (a ruleset's rules, by type) unioning the same way. To clear a list, write \"replace\" with an empty list: under \"shallow\" and \"deep\" an empty list adds nothing. Omitted, the file's `_layering` applies, else the run's layering. It has no effect on a single document, the rendered document never carries it, and a list nested inside a section entry does not take it.",
+          "type": "string",
+          "enum": [
+            "replace",
+            "shallow",
+            "deep"
+          ]
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "UndeclaredPolicyList<ActionsVariableConfig>": {
+      "description": "The wrapped form of a list, overriding what happens to live resources the file does not declare. The plain array form takes the file's top-level `_undeclared`, else the run's `undeclared` input, else the list's own default (the section default for a top-level section, a fixed default for a nested list such as environments[].variables); this wrapper can set it explicitly, and with `_undeclared` omitted it behaves exactly like the plain array. The wrapper is this action's own vocabulary (nothing here passes through to GitHub), so its keys are strict: anything besides `_undeclared`, `entries`, and `_layering` (the directives wear the underscore; a nested list's wrapper does not take `_layering`) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_undeclared": {
+          "description": "What apply does to live resources `entries` does not declare: \"delete\" removes them, \"keep\" leaves them alone and surfaces each as a note. Omitted, the file's top-level `_undeclared` applies, else the run's `undeclared` input, else the list's own default.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/UndeclaredPolicy"
+            }
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/ActionsVariableConfig"
+          }
+        },
+        "_layering": {
+          "description": "A render-time directive: how this section combines with the layers BELOW it in a layered merge, by the section's key (a label's name, a secret's name, a webhook's URL, ...). \"replace\" lets this layer's list win wholesale; \"shallow\" unions the entries by key and swaps a same-key entry for this layer's; \"deep\" unions by key and merges a same-key pair field by field, a nested keyed list (a ruleset's rules, by type) unioning the same way. To clear a list, write \"replace\" with an empty list: under \"shallow\" and \"deep\" an empty list adds nothing. Omitted, the file's `_layering` applies, else the run's layering. It has no effect on a single document, the rendered document never carries it, and a list nested inside a section entry does not take it.",
+          "type": "string",
+          "enum": [
+            "replace",
+            "shallow",
+            "deep"
+          ]
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "UndeclaredPolicyList<AgentsSecretConfig>": {
+      "description": "The wrapped form of a list, overriding what happens to live resources the file does not declare. The plain array form takes the file's top-level `_undeclared`, else the run's `undeclared` input, else the list's own default (the section default for a top-level section, a fixed default for a nested list such as environments[].variables); this wrapper can set it explicitly, and with `_undeclared` omitted it behaves exactly like the plain array. The wrapper is this action's own vocabulary (nothing here passes through to GitHub), so its keys are strict: anything besides `_undeclared`, `entries`, and `_layering` (the directives wear the underscore; a nested list's wrapper does not take `_layering`) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_undeclared": {
+          "description": "What apply does to live resources `entries` does not declare: \"delete\" removes them, \"keep\" leaves them alone and surfaces each as a note. Omitted, the file's top-level `_undeclared` applies, else the run's `undeclared` input, else the list's own default.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/UndeclaredPolicy"
+            }
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/AgentsSecretConfig"
+          }
+        },
+        "_layering": {
+          "description": "A render-time directive: how this section combines with the layers BELOW it in a layered merge, by the section's key (a label's name, a secret's name, a webhook's URL, ...). \"replace\" lets this layer's list win wholesale; \"shallow\" unions the entries by key and swaps a same-key entry for this layer's; \"deep\" unions by key and merges a same-key pair field by field, a nested keyed list (a ruleset's rules, by type) unioning the same way. To clear a list, write \"replace\" with an empty list: under \"shallow\" and \"deep\" an empty list adds nothing. Omitted, the file's `_layering` applies, else the run's layering. It has no effect on a single document, the rendered document never carries it, and a list nested inside a section entry does not take it.",
+          "type": "string",
+          "enum": [
+            "replace",
+            "shallow",
+            "deep"
+          ]
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "UndeclaredPolicyList<AgentsVariableConfig>": {
+      "description": "The wrapped form of a list, overriding what happens to live resources the file does not declare. The plain array form takes the file's top-level `_undeclared`, else the run's `undeclared` input, else the list's own default (the section default for a top-level section, a fixed default for a nested list such as environments[].variables); this wrapper can set it explicitly, and with `_undeclared` omitted it behaves exactly like the plain array. The wrapper is this action's own vocabulary (nothing here passes through to GitHub), so its keys are strict: anything besides `_undeclared`, `entries`, and `_layering` (the directives wear the underscore; a nested list's wrapper does not take `_layering`) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_undeclared": {
+          "description": "What apply does to live resources `entries` does not declare: \"delete\" removes them, \"keep\" leaves them alone and surfaces each as a note. Omitted, the file's top-level `_undeclared` applies, else the run's `undeclared` input, else the list's own default.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/UndeclaredPolicy"
+            }
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/AgentsVariableConfig"
+          }
+        },
+        "_layering": {
+          "description": "A render-time directive: how this section combines with the layers BELOW it in a layered merge, by the section's key (a label's name, a secret's name, a webhook's URL, ...). \"replace\" lets this layer's list win wholesale; \"shallow\" unions the entries by key and swaps a same-key entry for this layer's; \"deep\" unions by key and merges a same-key pair field by field, a nested keyed list (a ruleset's rules, by type) unioning the same way. To clear a list, write \"replace\" with an empty list: under \"shallow\" and \"deep\" an empty list adds nothing. Omitted, the file's `_layering` applies, else the run's layering. It has no effect on a single document, the rendered document never carries it, and a list nested inside a section entry does not take it.",
+          "type": "string",
+          "enum": [
+            "replace",
+            "shallow",
+            "deep"
+          ]
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "UndeclaredPolicyList<AutolinkConfig>": {
+      "description": "The wrapped form of a list, overriding what happens to live resources the file does not declare. The plain array form takes the file's top-level `_undeclared`, else the run's `undeclared` input, else the list's own default (the section default for a top-level section, a fixed default for a nested list such as environments[].variables); this wrapper can set it explicitly, and with `_undeclared` omitted it behaves exactly like the plain array. The wrapper is this action's own vocabulary (nothing here passes through to GitHub), so its keys are strict: anything besides `_undeclared`, `entries`, and `_layering` (the directives wear the underscore; a nested list's wrapper does not take `_layering`) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_undeclared": {
+          "description": "What apply does to live resources `entries` does not declare: \"delete\" removes them, \"keep\" leaves them alone and surfaces each as a note. Omitted, the file's top-level `_undeclared` applies, else the run's `undeclared` input, else the list's own default.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/UndeclaredPolicy"
+            }
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/AutolinkConfig"
+          }
+        },
+        "_layering": {
+          "description": "A render-time directive: how this section combines with the layers BELOW it in a layered merge, by the section's key (a label's name, a secret's name, a webhook's URL, ...). \"replace\" lets this layer's list win wholesale; \"shallow\" unions the entries by key and swaps a same-key entry for this layer's; \"deep\" unions by key and merges a same-key pair field by field, a nested keyed list (a ruleset's rules, by type) unioning the same way. To clear a list, write \"replace\" with an empty list: under \"shallow\" and \"deep\" an empty list adds nothing. Omitted, the file's `_layering` applies, else the run's layering. It has no effect on a single document, the rendered document never carries it, and a list nested inside a section entry does not take it.",
+          "type": "string",
+          "enum": [
+            "replace",
+            "shallow",
+            "deep"
+          ]
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "UndeclaredPolicyList<CodespacesSecretConfig>": {
+      "description": "The wrapped form of a list, overriding what happens to live resources the file does not declare. The plain array form takes the file's top-level `_undeclared`, else the run's `undeclared` input, else the list's own default (the section default for a top-level section, a fixed default for a nested list such as environments[].variables); this wrapper can set it explicitly, and with `_undeclared` omitted it behaves exactly like the plain array. The wrapper is this action's own vocabulary (nothing here passes through to GitHub), so its keys are strict: anything besides `_undeclared`, `entries`, and `_layering` (the directives wear the underscore; a nested list's wrapper does not take `_layering`) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_undeclared": {
+          "description": "What apply does to live resources `entries` does not declare: \"delete\" removes them, \"keep\" leaves them alone and surfaces each as a note. Omitted, the file's top-level `_undeclared` applies, else the run's `undeclared` input, else the list's own default.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/UndeclaredPolicy"
+            }
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/CodespacesSecretConfig"
+          }
+        },
+        "_layering": {
+          "description": "A render-time directive: how this section combines with the layers BELOW it in a layered merge, by the section's key (a label's name, a secret's name, a webhook's URL, ...). \"replace\" lets this layer's list win wholesale; \"shallow\" unions the entries by key and swaps a same-key entry for this layer's; \"deep\" unions by key and merges a same-key pair field by field, a nested keyed list (a ruleset's rules, by type) unioning the same way. To clear a list, write \"replace\" with an empty list: under \"shallow\" and \"deep\" an empty list adds nothing. Omitted, the file's `_layering` applies, else the run's layering. It has no effect on a single document, the rendered document never carries it, and a list nested inside a section entry does not take it.",
+          "type": "string",
+          "enum": [
+            "replace",
+            "shallow",
+            "deep"
+          ]
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "UndeclaredPolicyList<CollaboratorConfig>": {
+      "description": "The wrapped form of a list, overriding what happens to live resources the file does not declare. The plain array form takes the file's top-level `_undeclared`, else the run's `undeclared` input, else the list's own default (the section default for a top-level section, a fixed default for a nested list such as environments[].variables); this wrapper can set it explicitly, and with `_undeclared` omitted it behaves exactly like the plain array. The wrapper is this action's own vocabulary (nothing here passes through to GitHub), so its keys are strict: anything besides `_undeclared`, `entries`, and `_layering` (the directives wear the underscore; a nested list's wrapper does not take `_layering`) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_undeclared": {
+          "description": "What apply does to live resources `entries` does not declare: \"delete\" removes them, \"keep\" leaves them alone and surfaces each as a note. Omitted, the file's top-level `_undeclared` applies, else the run's `undeclared` input, else the list's own default.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/UndeclaredPolicy"
+            }
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/CollaboratorConfig"
+          }
+        },
+        "_layering": {
+          "description": "A render-time directive: how this section combines with the layers BELOW it in a layered merge, by the section's key (a label's name, a secret's name, a webhook's URL, ...). \"replace\" lets this layer's list win wholesale; \"shallow\" unions the entries by key and swaps a same-key entry for this layer's; \"deep\" unions by key and merges a same-key pair field by field, a nested keyed list (a ruleset's rules, by type) unioning the same way. To clear a list, write \"replace\" with an empty list: under \"shallow\" and \"deep\" an empty list adds nothing. Omitted, the file's `_layering` applies, else the run's layering. It has no effect on a single document, the rendered document never carries it, and a list nested inside a section entry does not take it.",
+          "type": "string",
+          "enum": [
+            "replace",
+            "shallow",
+            "deep"
+          ]
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "UndeclaredPolicyList<CustomPropertyConfig>": {
+      "description": "The wrapped form of a list, overriding what happens to live resources the file does not declare. The plain array form takes the file's top-level `_undeclared`, else the run's `undeclared` input, else the list's own default (the section default for a top-level section, a fixed default for a nested list such as environments[].variables); this wrapper can set it explicitly, and with `_undeclared` omitted it behaves exactly like the plain array. The wrapper is this action's own vocabulary (nothing here passes through to GitHub), so its keys are strict: anything besides `_undeclared`, `entries`, and `_layering` (the directives wear the underscore; a nested list's wrapper does not take `_layering`) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_undeclared": {
+          "description": "What apply does to live resources `entries` does not declare: \"delete\" removes them, \"keep\" leaves them alone and surfaces each as a note. Omitted, the file's top-level `_undeclared` applies, else the run's `undeclared` input, else the list's own default.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/UndeclaredPolicy"
+            }
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/CustomPropertyConfig"
+          }
+        },
+        "_layering": {
+          "description": "A render-time directive: how this section combines with the layers BELOW it in a layered merge, by the section's key (a label's name, a secret's name, a webhook's URL, ...). \"replace\" lets this layer's list win wholesale; \"shallow\" unions the entries by key and swaps a same-key entry for this layer's; \"deep\" unions by key and merges a same-key pair field by field, a nested keyed list (a ruleset's rules, by type) unioning the same way. To clear a list, write \"replace\" with an empty list: under \"shallow\" and \"deep\" an empty list adds nothing. Omitted, the file's `_layering` applies, else the run's layering. It has no effect on a single document, the rendered document never carries it, and a list nested inside a section entry does not take it.",
+          "type": "string",
+          "enum": [
+            "replace",
+            "shallow",
+            "deep"
+          ]
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "UndeclaredPolicyList<DependabotSecretConfig>": {
+      "description": "The wrapped form of a list, overriding what happens to live resources the file does not declare. The plain array form takes the file's top-level `_undeclared`, else the run's `undeclared` input, else the list's own default (the section default for a top-level section, a fixed default for a nested list such as environments[].variables); this wrapper can set it explicitly, and with `_undeclared` omitted it behaves exactly like the plain array. The wrapper is this action's own vocabulary (nothing here passes through to GitHub), so its keys are strict: anything besides `_undeclared`, `entries`, and `_layering` (the directives wear the underscore; a nested list's wrapper does not take `_layering`) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_undeclared": {
+          "description": "What apply does to live resources `entries` does not declare: \"delete\" removes them, \"keep\" leaves them alone and surfaces each as a note. Omitted, the file's top-level `_undeclared` applies, else the run's `undeclared` input, else the list's own default.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/UndeclaredPolicy"
+            }
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/DependabotSecretConfig"
+          }
+        },
+        "_layering": {
+          "description": "A render-time directive: how this section combines with the layers BELOW it in a layered merge, by the section's key (a label's name, a secret's name, a webhook's URL, ...). \"replace\" lets this layer's list win wholesale; \"shallow\" unions the entries by key and swaps a same-key entry for this layer's; \"deep\" unions by key and merges a same-key pair field by field, a nested keyed list (a ruleset's rules, by type) unioning the same way. To clear a list, write \"replace\" with an empty list: under \"shallow\" and \"deep\" an empty list adds nothing. Omitted, the file's `_layering` applies, else the run's layering. It has no effect on a single document, the rendered document never carries it, and a list nested inside a section entry does not take it.",
+          "type": "string",
+          "enum": [
+            "replace",
+            "shallow",
+            "deep"
+          ]
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "UndeclaredPolicyList<DeployKeyConfig>": {
+      "description": "The wrapped form of a list, overriding what happens to live resources the file does not declare. The plain array form takes the file's top-level `_undeclared`, else the run's `undeclared` input, else the list's own default (the section default for a top-level section, a fixed default for a nested list such as environments[].variables); this wrapper can set it explicitly, and with `_undeclared` omitted it behaves exactly like the plain array. The wrapper is this action's own vocabulary (nothing here passes through to GitHub), so its keys are strict: anything besides `_undeclared`, `entries`, and `_layering` (the directives wear the underscore; a nested list's wrapper does not take `_layering`) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_undeclared": {
+          "description": "What apply does to live resources `entries` does not declare: \"delete\" removes them, \"keep\" leaves them alone and surfaces each as a note. Omitted, the file's top-level `_undeclared` applies, else the run's `undeclared` input, else the list's own default.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/UndeclaredPolicy"
+            }
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/DeployKeyConfig"
+          }
+        },
+        "_layering": {
+          "description": "A render-time directive: how this section combines with the layers BELOW it in a layered merge, by the section's key (a label's name, a secret's name, a webhook's URL, ...). \"replace\" lets this layer's list win wholesale; \"shallow\" unions the entries by key and swaps a same-key entry for this layer's; \"deep\" unions by key and merges a same-key pair field by field, a nested keyed list (a ruleset's rules, by type) unioning the same way. To clear a list, write \"replace\" with an empty list: under \"shallow\" and \"deep\" an empty list adds nothing. Omitted, the file's `_layering` applies, else the run's layering. It has no effect on a single document, the rendered document never carries it, and a list nested inside a section entry does not take it.",
+          "type": "string",
+          "enum": [
+            "replace",
+            "shallow",
+            "deep"
+          ]
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "UndeclaredPolicyList<DeploymentBranchPolicyConfig>": {
+      "description": "The wrapped form of a list, overriding what happens to live resources the file does not declare. The plain array form takes the file's top-level `_undeclared`, else the run's `undeclared` input, else the list's own default (the section default for a top-level section, a fixed default for a nested list such as environments[].variables); this wrapper can set it explicitly, and with `_undeclared` omitted it behaves exactly like the plain array. The wrapper is this action's own vocabulary (nothing here passes through to GitHub), so its keys are strict: anything besides `_undeclared`, `entries`, and `_layering` (the directives wear the underscore; a nested list's wrapper does not take `_layering`) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_undeclared": {
+          "description": "What apply does to live resources `entries` does not declare: \"delete\" removes them, \"keep\" leaves them alone and surfaces each as a note. Omitted, the file's top-level `_undeclared` applies, else the run's `undeclared` input, else the list's own default.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/UndeclaredPolicy"
+            }
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/DeploymentBranchPolicyConfig"
+          }
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "UndeclaredPolicyList<DeploymentProtectionRuleConfig>": {
+      "description": "The wrapped form of a list, overriding what happens to live resources the file does not declare. The plain array form takes the file's top-level `_undeclared`, else the run's `undeclared` input, else the list's own default (the section default for a top-level section, a fixed default for a nested list such as environments[].variables); this wrapper can set it explicitly, and with `_undeclared` omitted it behaves exactly like the plain array. The wrapper is this action's own vocabulary (nothing here passes through to GitHub), so its keys are strict: anything besides `_undeclared`, `entries`, and `_layering` (the directives wear the underscore; a nested list's wrapper does not take `_layering`) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_undeclared": {
+          "description": "What apply does to live resources `entries` does not declare: \"delete\" removes them, \"keep\" leaves them alone and surfaces each as a note. Omitted, the file's top-level `_undeclared` applies, else the run's `undeclared` input, else the list's own default.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/UndeclaredPolicy"
+            }
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/DeploymentProtectionRuleConfig"
+          }
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "UndeclaredPolicyList<EnvironmentSecretConfig>": {
+      "description": "The wrapped form of a list, overriding what happens to live resources the file does not declare. The plain array form takes the file's top-level `_undeclared`, else the run's `undeclared` input, else the list's own default (the section default for a top-level section, a fixed default for a nested list such as environments[].variables); this wrapper can set it explicitly, and with `_undeclared` omitted it behaves exactly like the plain array. The wrapper is this action's own vocabulary (nothing here passes through to GitHub), so its keys are strict: anything besides `_undeclared`, `entries`, and `_layering` (the directives wear the underscore; a nested list's wrapper does not take `_layering`) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_undeclared": {
+          "description": "What apply does to live resources `entries` does not declare: \"delete\" removes them, \"keep\" leaves them alone and surfaces each as a note. Omitted, the file's top-level `_undeclared` applies, else the run's `undeclared` input, else the list's own default.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/UndeclaredPolicy"
+            }
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/EnvironmentSecretConfig"
+          }
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "UndeclaredPolicyList<EnvironmentVariableConfig>": {
+      "description": "The wrapped form of a list, overriding what happens to live resources the file does not declare. The plain array form takes the file's top-level `_undeclared`, else the run's `undeclared` input, else the list's own default (the section default for a top-level section, a fixed default for a nested list such as environments[].variables); this wrapper can set it explicitly, and with `_undeclared` omitted it behaves exactly like the plain array. The wrapper is this action's own vocabulary (nothing here passes through to GitHub), so its keys are strict: anything besides `_undeclared`, `entries`, and `_layering` (the directives wear the underscore; a nested list's wrapper does not take `_layering`) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_undeclared": {
+          "description": "What apply does to live resources `entries` does not declare: \"delete\" removes them, \"keep\" leaves them alone and surfaces each as a note. Omitted, the file's top-level `_undeclared` applies, else the run's `undeclared` input, else the list's own default.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/UndeclaredPolicy"
+            }
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/EnvironmentVariableConfig"
+          }
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "UndeclaredPolicyList<LabelConfig>": {
+      "description": "The wrapped form of a list, overriding what happens to live resources the file does not declare. The plain array form takes the file's top-level `_undeclared`, else the run's `undeclared` input, else the list's own default (the section default for a top-level section, a fixed default for a nested list such as environments[].variables); this wrapper can set it explicitly, and with `_undeclared` omitted it behaves exactly like the plain array. The wrapper is this action's own vocabulary (nothing here passes through to GitHub), so its keys are strict: anything besides `_undeclared`, `entries`, and `_layering` (the directives wear the underscore; a nested list's wrapper does not take `_layering`) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_undeclared": {
+          "description": "What apply does to live resources `entries` does not declare: \"delete\" removes them, \"keep\" leaves them alone and surfaces each as a note. Omitted, the file's top-level `_undeclared` applies, else the run's `undeclared` input, else the list's own default.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/UndeclaredPolicy"
+            }
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/LabelConfig"
+          }
+        },
+        "_layering": {
+          "description": "A render-time directive: how this section combines with the layers BELOW it in a layered merge, by the section's key (a label's name, a secret's name, a webhook's URL, ...). \"replace\" lets this layer's list win wholesale; \"shallow\" unions the entries by key and swaps a same-key entry for this layer's; \"deep\" unions by key and merges a same-key pair field by field, a nested keyed list (a ruleset's rules, by type) unioning the same way. To clear a list, write \"replace\" with an empty list: under \"shallow\" and \"deep\" an empty list adds nothing. Omitted, the file's `_layering` applies, else the run's layering. It has no effect on a single document, the rendered document never carries it, and a list nested inside a section entry does not take it.",
+          "type": "string",
+          "enum": [
+            "replace",
+            "shallow",
+            "deep"
+          ]
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "UndeclaredPolicyList<MilestoneConfig>": {
+      "description": "The wrapped form of a list, overriding what happens to live resources the file does not declare. The plain array form takes the file's top-level `_undeclared`, else the run's `undeclared` input, else the list's own default (the section default for a top-level section, a fixed default for a nested list such as environments[].variables); this wrapper can set it explicitly, and with `_undeclared` omitted it behaves exactly like the plain array. The wrapper is this action's own vocabulary (nothing here passes through to GitHub), so its keys are strict: anything besides `_undeclared`, `entries`, and `_layering` (the directives wear the underscore; a nested list's wrapper does not take `_layering`) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_undeclared": {
+          "description": "What apply does to live resources `entries` does not declare: \"delete\" removes them, \"keep\" leaves them alone and surfaces each as a note. Omitted, the file's top-level `_undeclared` applies, else the run's `undeclared` input, else the list's own default.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/UndeclaredPolicy"
+            }
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/MilestoneConfig"
+          }
+        },
+        "_layering": {
+          "description": "A render-time directive: how this section combines with the layers BELOW it in a layered merge, by the section's key (a label's name, a secret's name, a webhook's URL, ...). \"replace\" lets this layer's list win wholesale; \"shallow\" unions the entries by key and swaps a same-key entry for this layer's; \"deep\" unions by key and merges a same-key pair field by field, a nested keyed list (a ruleset's rules, by type) unioning the same way. To clear a list, write \"replace\" with an empty list: under \"shallow\" and \"deep\" an empty list adds nothing. Omitted, the file's `_layering` applies, else the run's layering. It has no effect on a single document, the rendered document never carries it, and a list nested inside a section entry does not take it.",
+          "type": "string",
+          "enum": [
+            "replace",
+            "shallow",
+            "deep"
+          ]
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "UndeclaredPolicyList<RulesetConfig>": {
+      "description": "The wrapped form of a list, overriding what happens to live resources the file does not declare. The plain array form takes the file's top-level `_undeclared`, else the run's `undeclared` input, else the list's own default (the section default for a top-level section, a fixed default for a nested list such as environments[].variables); this wrapper can set it explicitly, and with `_undeclared` omitted it behaves exactly like the plain array. The wrapper is this action's own vocabulary (nothing here passes through to GitHub), so its keys are strict: anything besides `_undeclared`, `entries`, and `_layering` (the directives wear the underscore; a nested list's wrapper does not take `_layering`) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_undeclared": {
+          "description": "What apply does to live resources `entries` does not declare: \"delete\" removes them, \"keep\" leaves them alone and surfaces each as a note. Omitted, the file's top-level `_undeclared` applies, else the run's `undeclared` input, else the list's own default.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/UndeclaredPolicy"
+            }
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/RulesetConfig"
+          }
+        },
+        "_layering": {
+          "description": "A render-time directive: how this section combines with the layers BELOW it in a layered merge, by the section's key (a label's name, a secret's name, a webhook's URL, ...). \"replace\" lets this layer's list win wholesale; \"shallow\" unions the entries by key and swaps a same-key entry for this layer's; \"deep\" unions by key and merges a same-key pair field by field, a nested keyed list (a ruleset's rules, by type) unioning the same way. To clear a list, write \"replace\" with an empty list: under \"shallow\" and \"deep\" an empty list adds nothing. Omitted, the file's `_layering` applies, else the run's layering. It has no effect on a single document, the rendered document never carries it, and a list nested inside a section entry does not take it.",
+          "type": "string",
+          "enum": [
+            "replace",
+            "shallow",
+            "deep"
+          ]
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "UndeclaredPolicyList<SecretScanningPatternConfig>": {
+      "description": "The wrapped form of a list, overriding what happens to live resources the file does not declare. The plain array form takes the file's top-level `_undeclared`, else the run's `undeclared` input, else the list's own default (the section default for a top-level section, a fixed default for a nested list such as environments[].variables); this wrapper can set it explicitly, and with `_undeclared` omitted it behaves exactly like the plain array. The wrapper is this action's own vocabulary (nothing here passes through to GitHub), so its keys are strict: anything besides `_undeclared`, `entries`, and `_layering` (the directives wear the underscore; a nested list's wrapper does not take `_layering`) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_undeclared": {
+          "description": "What apply does to live resources `entries` does not declare: \"delete\" removes them, \"keep\" leaves them alone and surfaces each as a note. Omitted, the file's top-level `_undeclared` applies, else the run's `undeclared` input, else the list's own default.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/UndeclaredPolicy"
+            }
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/SecretScanningPatternConfig"
+          }
+        },
+        "_layering": {
+          "description": "A render-time directive: how this section combines with the layers BELOW it in a layered merge, by the section's key (a label's name, a secret's name, a webhook's URL, ...). \"replace\" lets this layer's list win wholesale; \"shallow\" unions the entries by key and swaps a same-key entry for this layer's; \"deep\" unions by key and merges a same-key pair field by field, a nested keyed list (a ruleset's rules, by type) unioning the same way. To clear a list, write \"replace\" with an empty list: under \"shallow\" and \"deep\" an empty list adds nothing. Omitted, the file's `_layering` applies, else the run's layering. It has no effect on a single document, the rendered document never carries it, and a list nested inside a section entry does not take it.",
+          "type": "string",
+          "enum": [
+            "replace",
+            "shallow",
+            "deep"
+          ]
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "UndeclaredPolicyList<TeamConfig>": {
+      "description": "The wrapped form of a list, overriding what happens to live resources the file does not declare. The plain array form takes the file's top-level `_undeclared`, else the run's `undeclared` input, else the list's own default (the section default for a top-level section, a fixed default for a nested list such as environments[].variables); this wrapper can set it explicitly, and with `_undeclared` omitted it behaves exactly like the plain array. The wrapper is this action's own vocabulary (nothing here passes through to GitHub), so its keys are strict: anything besides `_undeclared`, `entries`, and `_layering` (the directives wear the underscore; a nested list's wrapper does not take `_layering`) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_undeclared": {
+          "description": "What apply does to live resources `entries` does not declare: \"delete\" removes them, \"keep\" leaves them alone and surfaces each as a note. Omitted, the file's top-level `_undeclared` applies, else the run's `undeclared` input, else the list's own default.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/UndeclaredPolicy"
+            }
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/TeamConfig"
+          }
+        },
+        "_layering": {
+          "description": "A render-time directive: how this section combines with the layers BELOW it in a layered merge, by the section's key (a label's name, a secret's name, a webhook's URL, ...). \"replace\" lets this layer's list win wholesale; \"shallow\" unions the entries by key and swaps a same-key entry for this layer's; \"deep\" unions by key and merges a same-key pair field by field, a nested keyed list (a ruleset's rules, by type) unioning the same way. To clear a list, write \"replace\" with an empty list: under \"shallow\" and \"deep\" an empty list adds nothing. Omitted, the file's `_layering` applies, else the run's layering. It has no effect on a single document, the rendered document never carries it, and a list nested inside a section entry does not take it.",
+          "type": "string",
+          "enum": [
+            "replace",
+            "shallow",
+            "deep"
+          ]
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "UndeclaredPolicyList<WebhookConfig>": {
+      "description": "The wrapped form of a list, overriding what happens to live resources the file does not declare. The plain array form takes the file's top-level `_undeclared`, else the run's `undeclared` input, else the list's own default (the section default for a top-level section, a fixed default for a nested list such as environments[].variables); this wrapper can set it explicitly, and with `_undeclared` omitted it behaves exactly like the plain array. The wrapper is this action's own vocabulary (nothing here passes through to GitHub), so its keys are strict: anything besides `_undeclared`, `entries`, and `_layering` (the directives wear the underscore; a nested list's wrapper does not take `_layering`) is rejected upfront as a typo.",
+      "type": "object",
+      "properties": {
+        "_undeclared": {
+          "description": "What apply does to live resources `entries` does not declare: \"delete\" removes them, \"keep\" leaves them alone and surfaces each as a note. Omitted, the file's top-level `_undeclared` applies, else the run's `undeclared` input, else the list's own default.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/UndeclaredPolicy"
+            }
+          ]
+        },
+        "entries": {
+          "description": "The declared entries, exactly as the plain array form lists them.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/WebhookConfig"
+          }
+        },
+        "_layering": {
+          "description": "A render-time directive: how this section combines with the layers BELOW it in a layered merge, by the section's key (a label's name, a secret's name, a webhook's URL, ...). \"replace\" lets this layer's list win wholesale; \"shallow\" unions the entries by key and swaps a same-key entry for this layer's; \"deep\" unions by key and merges a same-key pair field by field, a nested keyed list (a ruleset's rules, by type) unioning the same way. To clear a list, write \"replace\" with an empty list: under \"shallow\" and \"deep\" an empty list adds nothing. Omitted, the file's `_layering` applies, else the run's layering. It has no effect on a single document, the rendered document never carries it, and a list nested inside a section entry does not take it.",
+          "type": "string",
+          "enum": [
+            "replace",
+            "shallow",
+            "deep"
+          ]
+        }
+      },
+      "required": [
+        "entries"
+      ],
+      "additionalProperties": false
+    },
+    "UnknownRule": {
+      "description": "A rule type the vendored spec does not know, passed through verbatim so a type GitHub ships tomorrow reaches it the day it ships; a typo comes back as GitHub's own 422 naming it.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "description": "The rule type, as the rulesets API names it; none of the types the spec knows.",
+          "type": "string",
+          "not": {
+            "enum": [
+              "creation",
+              "update",
+              "deletion",
+              "required_linear_history",
+              "merge_queue",
+              "required_deployments",
+              "required_signatures",
+              "pull_request",
+              "required_status_checks",
+              "non_fast_forward",
+              "commit_message_pattern",
+              "commit_author_email_pattern",
+              "committer_email_pattern",
+              "branch_name_pattern",
+              "tag_name_pattern",
+              "workflows",
+              "code_scanning",
+              "copilot_code_review",
+              "license_compliance_scanning",
+              "file_path_restriction",
+              "max_file_path_length",
+              "file_extension_restriction",
+              "max_file_size"
+            ]
+          }
+        },
+        "parameters": {
+          "description": "The rule's parameters, as the API documents them for its type.",
+          "type": "object",
+          "additionalProperties": {}
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": {}
+    },
+    "WebhookConfig": {
+      "description": "One repository webhook, matched to the live repo by config.url. Hook URLs are configuration, not credentials: they appear in drift lines and notes on purpose. The secret never does.",
+      "type": "object",
+      "properties": {
+        "name": {
+          "description": "GitHub's hook name; \"web\" is the only value modern hooks take, so anything else is rejected.",
+          "type": "string",
+          "const": "web"
+        },
+        "config": {
+          "description": "The delivery settings; config.url is the natural key.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/WebhookDeliveryConfig"
+            }
+          ]
+        },
+        "events": {
+          "description": "Events that trigger deliveries, compared order-insensitively; GitHub defaults a new hook to [\"push\"]. Each name is one GitHub delivers to repository webhooks, or \"*\" for every event; anything else is refused at parse time, since GitHub would 422 it at apply time. The accepted names come from GitHub's webhooks OpenAPI description, pinned through the @octokit/openapi-webhooks package, so an event GitHub adds is accepted once a release bumps that package.",
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": [
+              "branch_protection_configuration",
+              "branch_protection_rule",
+              "check_run",
+              "check_suite",
+              "code_scanning_alert",
+              "commit_comment",
+              "create",
+              "custom_property_values",
+              "delete",
+              "dependabot_alert",
+              "deploy_key",
+              "deployment",
+              "deployment_status",
+              "discussion",
+              "discussion_comment",
+              "fork",
+              "gollum",
+              "issue_comment",
+              "issue_dependencies",
+              "issues",
+              "label",
+              "member",
+              "meta",
+              "milestone",
+              "package",
+              "page_build",
+              "ping",
+              "project",
+              "project_card",
+              "project_column",
+              "public",
+              "pull_request",
+              "pull_request_review",
+              "pull_request_review_comment",
+              "pull_request_review_thread",
+              "push",
+              "registry_package",
+              "release",
+              "repository",
+              "repository_advisory",
+              "repository_import",
+              "repository_ruleset",
+              "repository_vulnerability_alert",
+              "secret_scanning_alert",
+              "secret_scanning_alert_location",
+              "secret_scanning_scan",
+              "security_and_analysis",
+              "star",
+              "status",
+              "sub_issues",
+              "team_add",
+              "watch",
+              "workflow_job",
+              "workflow_run",
+              "*"
+            ]
+          }
+        },
+        "active": {
+          "description": "Whether deliveries fire; GitHub defaults a new hook to true.",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "config"
+      ]
+    },
+    "WebhookDeliveryConfig": {
+      "description": "A webhook's `config` mapping, sent to the config sub-endpoint on update.",
+      "type": "object",
+      "properties": {
+        "url": {
+          "description": "The delivery URL, the natural key: a changed url declares a NEW hook (the old one becomes undeclared). Must be an absolute URL; GitHub refuses anything else.",
+          "type": "string"
+        },
+        "content_type": {
+          "description": "Payload encoding: exactly \"json\" or \"form\" (GitHub's default); other spellings such as \"JSON\" or a MIME type are refused at parse time.",
+          "type": "string",
+          "enum": [
+            "json",
+            "form"
+          ]
+        },
+        "secret": {
+          "description": "The shared delivery secret, as a whole-value `$NAME` reference to an environment variable on the action step (never a literal: settings files are committed plaintext). Resolved at apply time; GitHub echoes it back as \"********\", so check mode cannot verify it and apply re-sends it on every run so rotations propagate.",
+          "type": "string"
+        },
+        "insecure_ssl": {
+          "description": "Whether to skip TLS verification: \"0\" (verify) or \"1\" (skip), as the string or the number; GitHub stores the string, and any other spelling is refused at parse time.",
+          "anyOf": [
+            {
+              "type": "string",
+              "enum": [
+                "0",
+                "1"
+              ]
+            },
+            {
+              "type": "number",
+              "const": 0
+            },
+            {
+              "type": "number",
+              "const": 1
+            }
+          ]
+        }
+      },
+      "required": [
+        "url"
+      ],
+      "additionalProperties": {
+        "description": "Future config fields pass through verbatim."
+      }
+    },
+    "WorkflowConfig": {
+      "description": "One workflow's enable/disable state, keyed by its file path. Keys other than path and state are rejected (the enable/disable calls carry no payload, so an extra key could only be a typo).",
+      "type": "object",
+      "properties": {
+        "path": {
+          "description": "Full \".github/workflows/ci.yml\" or the bare \"ci.yml\" file name.",
+          "type": "string"
+        },
+        "state": {
+          "description": "Desired state; every live disabled_* variant counts as \"disabled\".",
+          "type": "string",
+          "enum": [
+            "active",
+            "disabled"
+          ]
+        }
+      },
+      "required": [
+        "path",
+        "state"
+      ]
+    },
+    "WorkflowFileConfig": {
+      "description": "One workflow that must run for the rule to pass.",
+      "type": "object",
+      "properties": {
+        "path": {
+          "description": "The path to the workflow file.",
+          "type": "string"
+        },
+        "ref": {
+          "description": "The branch or tag of the workflow file to use.",
+          "type": "string"
+        },
+        "repository_id": {
+          "description": "The id of the repository that holds the workflow.",
+          "type": "integer"
+        },
+        "sha": {
+          "description": "The commit of the workflow file to use.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "path",
+        "repository_id"
+      ],
+      "additionalProperties": {}
+    }
+  }
+}