github-settings-as-code 1.0.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,11 @@
+# Github Settings as Code
+
+Commands to provide:
+
+- `gh:apply-all`
+- `gh:apply-repository-settings`
+- `gh:apply-rulesets`
+- `gh:apply-variables`
+- `gh:backup-all`
+- `gh:backup-repository-settings`
+- `gh:backup-rulesets`

package/package.json

@@ -0,0 +1,105 @@
+{
+  "name": "github-settings-as-code",
+  "version": "1.0.0",
+  "private": false,
+  "keywords": [
+    "github",
+    "octokit"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/noshiro-pf/github-settings-as-code.git"
+  },
+  "license": "Apache-2.0",
+  "author": "noshiro-pf <noshiro.pf@gmail.com>",
+  "sideEffects": false,
+  "type": "module",
+  "bin": {
+    "gh:apply-all": "run-s gh:apply-variables gh:apply-rulesets gh:apply-repository-settings",
+    "gh:apply-repository-settings": "tsx --env-file=.env src/github/repository/apply.mts",
+    "gh:apply-rulesets": "tsx --env-file=.env src/github/ruleset/apply.mts",
+    "gh:apply-variables": "tsx --env-file=.env src/github/variables/apply.mts",
+    "gh:backup-all": "run-s gh:backup-rulesets gh:backup-repository-settings",
+    "gh:backup-repository-settings": "tsx --env-file=.env src/github/repository/backup.mts",
+    "gh:backup-rulesets": "tsx --env-file=.env src/github/ruleset/backup.mts"
+  },
+  "files": [
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "check-all": "tsx ./scripts/cmd/check-all.mts",
+    "check:ext": "tsx ./scripts/cmd/check-ext.mts",
+    "cspell": "cspell \"**\" --gitignore --gitignore-root ./ --no-progress",
+    "fmt": "format-uncommitted",
+    "fmt:diff": "format-diff-from origin/main",
+    "fmt:full": "prettier --write .",
+    "gh:apply-all": "run-s gh:apply-variables gh:apply-rulesets gh:apply-repository-settings",
+    "gh:apply-repository-settings": "tsx --env-file=.env src/github/repository/apply.mts",
+    "gh:apply-rulesets": "tsx --env-file=.env src/github/ruleset/apply.mts",
+    "gh:apply-variables": "tsx --env-file=.env src/github/variables/apply.mts",
+    "gh:backup-all": "run-s gh:backup-rulesets gh:backup-repository-settings",
+    "gh:backup-repository-settings": "tsx --env-file=.env src/github/repository/backup.mts",
+    "gh:backup-rulesets": "tsx --env-file=.env src/github/ruleset/backup.mts",
+    "gi": "run-s gi:scripts gi:src fmt",
+    "gi:scripts": "gen-index-ts ./src/github --index-ext .mts --export-ext .mjs --target-ext .mts --exclude cmd --exclude apply.mts --exclude octokit.mts",
+    "gi:src": "gen-index-ts ./src --index-ext .mts --export-ext .mjs --target-ext .mts --target-ext .tsx --exclude apply.mts",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "md": "markdownlint-cli2",
+    "test": "pnpm run z:vitest run",
+    "test:cov": "pnpm run z:vitest run --coverage",
+    "test:cov:ui": "vite preview --outDir ./coverage",
+    "test:ui": "pnpm run z:vitest --ui",
+    "testw": "pnpm run z:vitest watch",
+    "tsc": "tsc --noEmit",
+    "tscw": "tsc --noEmit --watch -p ./tsconfig.json",
+    "type-check": "tsc --noEmit",
+    "update-packages": "pnpm update --latest",
+    "z:vitest": "vitest --config ./configs/vitest.config.ts"
+  },
+  "dependencies": {
+    "npm-run-all2": "^8.0.4",
+    "tsx": "^4.20.6"
+  },
+  "devDependencies": {
+    "@octokit/core": "7.0.6",
+    "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/commit-analyzer": "^13.0.1",
+    "@semantic-release/exec": "^7.1.0",
+    "@semantic-release/git": "^10.0.1",
+    "@semantic-release/github": "^12.0.2",
+    "@semantic-release/npm": "^13.1.1",
+    "@semantic-release/release-notes-generator": "^14.1.0",
+    "@types/node": "^24.10.0",
+    "@vitest/coverage-v8": "^4.0.8",
+    "@vitest/ui": "^4.0.8",
+    "conventional-changelog-conventionalcommits": "^9.1.0",
+    "cspell": "^9.3.0",
+    "eslint": "9.39.1",
+    "eslint-config-typed": "^3.5.1",
+    "fast-glob": "^3.3.3",
+    "jiti": "^2.6.1",
+    "markdownlint": "^0.39.0",
+    "markdownlint-cli2": "^0.18.1",
+    "octokit-safe-types": "^1.2.0",
+    "prettier": "^3.6.2",
+    "prettier-plugin-organize-imports": "^4.3.0",
+    "prettier-plugin-packagejson": "^2.5.19",
+    "semantic-release": "^25.0.2",
+    "ts-data-forge": "^5.0.0",
+    "ts-fortress": "^6.0.0",
+    "ts-repo-utils": "^7.8.1",
+    "ts-type-forge": "^2.3.0",
+    "tslib": "^2.8.1",
+    "typedoc": "^0.28.14",
+    "typedoc-plugin-markdown": "^4.9.0",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.8"
+  },
+  "volta": {
+    "node": "25.0.0",
+    "npm": "11.6.2"
+  }
+}

package/src/github/constants.mts

@@ -0,0 +1,19 @@
+import packageJson from '../../package.json' with { type: 'json' };
+
+export const OWNER = 'noshiro-pf';
+export const REPO = packageJson.name;
+
+const githubDir = path.resolve(process.cwd(), './github');
+
+export const repositorySettingsDir = path.resolve(
+  githubDir,
+  './repository-settings',
+);
+
+export const repositorySettingsJsonName = 'settings.json';
+
+export const rulesetsDir = path.resolve(githubDir, './rulesets');
+
+export const octokitHeaders = {
+  'X-GitHub-Api-Version': '2022-11-28',
+} as const;

package/src/github/index.mts

@@ -0,0 +1,5 @@
+export * from './constants.mjs';
+export * from './octokit.mjs';
+export * from './repository/index.mjs';
+export * from './ruleset/index.mjs';
+export * from './variables/index.mjs';

package/src/github/octokit.mts

@@ -0,0 +1,5 @@
+import { Octokit } from '@octokit/core';
+
+export const octokit = new Octokit({
+  auth: process.env['PERSONAL_ACCESS_TOKEN'],
+});

package/src/github/repository/api/get-repository.mts

@@ -0,0 +1,27 @@
+import { GetRepositoryResponse, type EndpointKeys } from 'octokit-safe-types';
+import { validationErrorsToMessages } from 'ts-fortress';
+import { Result } from 'ts-repo-utils';
+import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
+import { octokit } from '../../octokit.mjs';
+
+export const getRepositorySettings =
+  async (): Promise<GetRepositoryResponse> => {
+    // https://docs.github.com/ja/rest/repos/repos?apiVersion=2022-11-28#get-a-repository
+    const getRepositoryResult = await octokit.request(
+      'GET /repos/{owner}/{repo}' satisfies EndpointKeys,
+      {
+        owner: OWNER,
+        repo: REPO,
+        headers: octokitHeaders,
+      },
+    );
+
+    {
+      const res = GetRepositoryResponse.validate(getRepositoryResult.data);
+      if (Result.isErr(res)) {
+        console.warn(validationErrorsToMessages(res.value));
+      }
+    }
+
+    return GetRepositoryResponse.fill(getRepositoryResult.data);
+  };

package/src/github/repository/api/index.mts

@@ -0,0 +1,2 @@
+export * from './get-repository.mjs';
+export * from './update-repository.mjs';

package/src/github/repository/api/update-repository.mts

@@ -0,0 +1,71 @@
+import {
+  type EndpointKeys,
+  type UpdateRepositoryRequest,
+} from 'octokit-safe-types';
+import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
+import { octokit } from '../../octokit.mjs';
+
+export const updateRepository = async ({
+  payload: {
+    name,
+    description,
+    homepage,
+    private: private_,
+    visibility,
+    security_and_analysis,
+    has_issues,
+    has_projects,
+    has_wiki,
+    is_template,
+    default_branch,
+    allow_squash_merge,
+    allow_merge_commit,
+    allow_rebase_merge,
+    allow_auto_merge,
+    delete_branch_on_merge,
+    allow_update_branch,
+    use_squash_pr_title_as_default,
+    squash_merge_commit_title,
+    squash_merge_commit_message,
+    merge_commit_title,
+    merge_commit_message,
+    archived,
+    allow_forking,
+    web_commit_signoff_required,
+  },
+}: Readonly<{
+  payload: UpdateRepositoryRequest;
+}>): Promise<void> => {
+  // https://docs.github.com/ja/rest/repos/repos?apiVersion=2022-11-28#update-a-repository
+  await octokit.request('PATCH /repos/{owner}/{repo}' satisfies EndpointKeys, {
+    owner: OWNER,
+    repo: REPO,
+    headers: octokitHeaders,
+
+    name,
+    description,
+    homepage,
+    private: private_,
+    visibility,
+    security_and_analysis,
+    has_issues,
+    has_projects,
+    has_wiki,
+    is_template,
+    default_branch,
+    allow_squash_merge,
+    allow_merge_commit,
+    allow_rebase_merge,
+    allow_auto_merge,
+    delete_branch_on_merge,
+    allow_update_branch,
+    use_squash_pr_title_as_default,
+    squash_merge_commit_title,
+    squash_merge_commit_message,
+    merge_commit_title,
+    merge_commit_message,
+    archived,
+    allow_forking,
+    web_commit_signoff_required,
+  });
+};

package/src/github/repository/apply.mts

@@ -0,0 +1,92 @@
+import { type UpdateRepositoryRequest } from 'octokit-safe-types';
+import { Obj } from 'ts-data-forge';
+import { validationErrorsToMessages } from 'ts-fortress';
+import { Result } from 'ts-repo-utils';
+import {
+  repositorySettingsDir,
+  repositorySettingsJsonName,
+} from '../constants.mjs';
+import { getRepositorySettings, updateRepository } from './api/index.mjs';
+import { backupRepositorySettings } from './backup.mjs';
+import {
+  type RepositoryKeysToPick,
+  repositoryKeysToPick,
+  RepositoryPicked,
+} from './constants.mjs';
+
+const readSettings = async (): Promise<RepositoryPicked> => {
+  const settingsText = await fs.readFile(
+    path.resolve(repositorySettingsDir, repositorySettingsJsonName),
+    {
+      encoding: 'utf8',
+    },
+  );
+
+  const validationResult = RepositoryPicked.validate(JSON.parse(settingsText));
+
+  if (Result.isErr(validationResult)) {
+    throw new Error(
+      validationErrorsToMessages(validationResult.value).join('\n'),
+    );
+  }
+
+  return validationResult.value;
+};
+
+await backupRepositorySettings(false);
+
+const settings = await readSettings();
+
+await updateRepository({
+  payload: {
+    // name: settings.name,
+    // description: settings.description ?? undefined,
+    // homepage: settings.homepage ?? undefined,
+    // private: settings.private,
+    // visibility: settings.visibility === 'public' ? 'public' : 'private',
+    security_and_analysis: settings.security_and_analysis,
+    has_issues: settings.has_issues,
+    has_projects: settings.has_projects,
+    has_wiki: settings.has_wiki,
+    // is_template: settings.is_template,
+    // default_branch: settings.default_branch,
+    allow_squash_merge: settings.allow_squash_merge,
+    allow_merge_commit: settings.allow_merge_commit,
+    allow_rebase_merge: settings.allow_rebase_merge,
+    allow_auto_merge: settings.allow_auto_merge,
+    delete_branch_on_merge: settings.delete_branch_on_merge,
+    allow_update_branch: settings.allow_update_branch,
+    use_squash_pr_title_as_default: settings.use_squash_pr_title_as_default,
+    squash_merge_commit_title: settings.squash_merge_commit_title,
+    squash_merge_commit_message: settings.squash_merge_commit_message,
+    merge_commit_title: settings.merge_commit_title,
+    merge_commit_message: settings.merge_commit_message,
+    // archived: settings.archived,
+    // NOTE: "RequestError [HttpError]: Allow forks can only be changed on org-owned repositories"
+    // allow_forking: settings.allow_forking,
+    web_commit_signoff_required: settings.web_commit_signoff_required,
+  } satisfies Pick<UpdateRepositoryRequest, RepositoryKeysToPick>,
+});
+
+// update local setting file
+{
+  const repositorySettings = await getRepositorySettings();
+
+  const str = JSON.stringify(
+    Obj.pick(repositorySettings, repositoryKeysToPick),
+    undefined,
+    2,
+  );
+
+  await fs.writeFile(
+    path.resolve(repositorySettingsDir, repositorySettingsJsonName),
+    str,
+  );
+
+  await fs.writeFile(
+    path.resolve(repositorySettingsDir, 'bk', repositorySettingsJsonName),
+    str,
+  );
+
+  await $('pnpm run fmt');
+}

package/src/github/repository/backup.mts

@@ -0,0 +1,35 @@
+import { Obj } from 'ts-data-forge';
+import { makeEmptyDir } from 'ts-repo-utils';
+import {
+  repositorySettingsDir,
+  repositorySettingsJsonName,
+} from '../constants.mjs';
+import { getRepositorySettings } from './api/index.mjs';
+import { repositoryKeysToPick } from './constants.mjs';
+
+const backupDir = path.resolve(repositorySettingsDir, './bk');
+
+export const backupRepositorySettings = async (
+  fmt: boolean = true,
+): Promise<void> => {
+  await makeEmptyDir(backupDir);
+
+  const repositorySettings = await getRepositorySettings();
+
+  await fs.writeFile(
+    path.resolve(backupDir, repositorySettingsJsonName),
+    JSON.stringify(
+      Obj.pick(repositorySettings, repositoryKeysToPick),
+      undefined,
+      2,
+    ),
+  );
+
+  if (fmt) {
+    await $('pnpm run fmt');
+  }
+};
+
+if (isDirectlyExecuted(import.meta.url)) {
+  await backupRepositorySettings();
+}

package/src/github/repository/constants.mts

@@ -0,0 +1,67 @@
+import {
+  FullRepository,
+  type UpdateRepositoryRequest,
+} from 'octokit-safe-types';
+import { expectType } from 'ts-data-forge';
+import * as t from 'ts-fortress';
+
+const keysToPickBase = [
+  'allow_auto_merge',
+  'allow_forking',
+  'allow_merge_commit',
+  'allow_rebase_merge',
+  'allow_squash_merge',
+  'allow_update_branch',
+  'archived',
+  'default_branch',
+  'delete_branch_on_merge',
+  'description',
+  'has_issues',
+  'has_projects',
+  'has_wiki',
+  'homepage',
+  'is_template',
+  'merge_commit_message',
+  'merge_commit_title',
+  'name',
+  'private',
+  'security_and_analysis',
+  'squash_merge_commit_message',
+  'squash_merge_commit_title',
+  'use_squash_pr_title_as_default',
+  'visibility',
+  'web_commit_signoff_required',
+] as const satisfies readonly (keyof FullRepository)[];
+
+const keysToDropList = [
+  'name',
+  'private',
+  'description',
+  'homepage',
+  'default_branch',
+  'is_template',
+  'archived',
+  'visibility',
+
+  // NOTE: "RequestError [HttpError]: Allow forks can only be changed on org-owned repositories"
+  'allow_forking',
+] as const;
+
+const keysToDrop: ReadonlySet<(typeof keysToPickBase)[number]> = new Set(
+  keysToDropList satisfies readonly (typeof keysToPickBase)[number][],
+);
+
+export const repositoryKeysToPick = keysToPickBase.filter(
+  (k) => !keysToDrop.has(k),
+);
+
+export type RepositoryKeysToPick = StrictExclude<
+  (typeof keysToPickBase)[number],
+  (typeof keysToDropList)[number]
+>;
+
+expectType<keyof UpdateRepositoryRequest, RepositoryKeysToPick>('>=');
+
+export const RepositoryPicked = t.pick(FullRepository, repositoryKeysToPick);
+
+export type RepositoryPicked = t.TypeOf<typeof RepositoryPicked>;

package/src/github/repository/index.mts

@@ -0,0 +1,3 @@
+export * from './api/index.mjs';
+export * from './backup.mjs';
+export * from './constants.mjs';

package/src/github/ruleset/api/create-ruleset.mts

@@ -0,0 +1,34 @@
+import {
+  type components,
+  type CreateRulesetRequest,
+  type EndpointKeys,
+} from 'octokit-safe-types';
+import { castDeepMutable } from 'ts-data-forge';
+import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
+import { octokit } from '../../octokit.mjs';
+
+export const createRuleset = async ({
+  payload: { name, target, enforcement, bypass_actors, conditions, rules },
+}: Readonly<{
+  payload: CreateRulesetRequest;
+}>): Promise<void> => {
+  // https://docs.github.com/ja/rest/repos/rules?apiVersion=2022-11-28#create-a-repository-ruleset
+  await octokit.request(
+    'POST /repos/{owner}/{repo}/rulesets' satisfies EndpointKeys,
+    {
+      owner: OWNER,
+      repo: REPO,
+      headers: octokitHeaders,
+
+      name,
+      target,
+      enforcement,
+      bypass_actors: castDeepMutable(bypass_actors),
+      conditions: castDeepMutable(conditions),
+      // eslint-disable-next-line total-functions/no-unsafe-type-assertion
+      rules: castDeepMutable(
+        rules,
+      ) as components['schemas']['repository-rule'][],
+    },
+  );
+};

package/src/github/ruleset/api/get-all-rulesets.mts

@@ -0,0 +1,73 @@
+import {
+  GetAllRulesetsResponse,
+  type components,
+  type EndpointKeys,
+  type OctokitResponse,
+} from 'octokit-safe-types';
+import { expectType } from 'ts-data-forge';
+import { validationErrorsToMessages } from 'ts-fortress';
+import { Result } from 'ts-repo-utils';
+import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
+import { octokit } from '../../octokit.mjs';
+
+export const getAllRulesets = async (): Promise<GetAllRulesetsResponse> => {
+  // https://docs.github.com/ja/rest/repos/rules?apiVersion=2022-11-28#get-all-repository-rulesets
+  const getAllRulesetsResponse = (await octokit.request(
+    'GET /repos/{owner}/{repo}/rulesets' satisfies EndpointKeys,
+    {
+      owner: OWNER,
+      repo: REPO,
+      headers: octokitHeaders,
+    },
+  )) satisfies OctokitResponse<GetAllRulesetsResponse, 200>;
+
+  expectType<
+    DeepReadonly<typeof getAllRulesetsResponse>,
+    DeepReadonly<
+      OctokitResponse<
+        {
+          id: number;
+          name: string;
+          target?: 'branch' | 'tag' | 'push' | 'repository';
+          source_type?: 'Repository' | 'Organization' | 'Enterprise';
+          source: string;
+          enforcement: components['schemas']['repository-rule-enforcement'];
+          bypass_actors?: components['schemas']['repository-ruleset-bypass-actor'][];
+          current_user_can_bypass?:
+            | 'always'
+            | 'pull_requests_only'
+            | 'never'
+            | 'exempt';
+          node_id?: string;
+          _links?: {
+            self?: {
+              href?: string;
+            };
+            html?: {
+              href?: string;
+            } | null;
+          };
+          conditions?:
+            | (
+                | components['schemas']['repository-ruleset-conditions']
+                | components['schemas']['org-ruleset-conditions']
+              )
+            | null;
+          rules?: components['schemas']['repository-rule'][];
+          created_at?: string;
+          updated_at?: string;
+        }[],
+        200
+      >
+    >
+  >('=');
+
+  {
+    const res = GetAllRulesetsResponse.validate(getAllRulesetsResponse.data);
+    if (Result.isErr(res)) {
+      console.warn(validationErrorsToMessages(res.value));
+    }
+  }
+
+  return GetAllRulesetsResponse.fill(getAllRulesetsResponse.data);
+};

package/src/github/ruleset/api/get-ruleset.mts

@@ -0,0 +1,29 @@
+import { GetRulesetResponse, type EndpointKeys } from 'octokit-safe-types';
+import { validationErrorsToMessages } from 'ts-fortress';
+import { Result } from 'ts-repo-utils';
+import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
+import { octokit } from '../../octokit.mjs';
+
+export const getRuleset = async (
+  rulesetId: number,
+): Promise<GetRulesetResponse> => {
+  // https://docs.github.com/ja/rest/repos/rules?apiVersion=2022-11-28#get-a-repository-ruleset
+  const getRulesetResult = await octokit.request(
+    'GET /repos/{owner}/{repo}/rulesets/{ruleset_id}' satisfies EndpointKeys,
+    {
+      owner: OWNER,
+      repo: REPO,
+      ruleset_id: rulesetId,
+      headers: octokitHeaders,
+    },
+  );
+
+  {
+    const res = GetRulesetResponse.validate(getRulesetResult.data);
+    if (Result.isErr(res)) {
+      console.warn(validationErrorsToMessages(res.value));
+    }
+  }
+
+  return GetRulesetResponse.fill(getRulesetResult.data);
+};

package/src/github/ruleset/api/index.mts

@@ -0,0 +1,4 @@
+export * from './create-ruleset.mjs';
+export * from './get-all-rulesets.mjs';
+export * from './get-ruleset.mjs';
+export * from './update-ruleset.mjs';

package/src/github/ruleset/api/update-ruleset.mts

@@ -0,0 +1,37 @@
+import {
+  type components,
+  type EndpointKeys,
+  type UpdateRulesetRequest,
+} from 'octokit-safe-types';
+import { castDeepMutable } from 'ts-data-forge';
+import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
+import { octokit } from '../../octokit.mjs';
+
+export const updateRuleset = async ({
+  rulesetId,
+  payload: { name, target, enforcement, bypass_actors, conditions, rules },
+}: Readonly<{
+  rulesetId: number;
+  payload: UpdateRulesetRequest;
+}>): Promise<void> => {
+  // https://docs.github.com/ja/rest/repos/rules?apiVersion=2022-11-28#update-a-repository-ruleset
+  await octokit.request(
+    'PUT /repos/{owner}/{repo}/rulesets/{ruleset_id}' satisfies EndpointKeys,
+    {
+      owner: OWNER,
+      repo: REPO,
+      ruleset_id: rulesetId,
+      headers: octokitHeaders,
+
+      name,
+      target,
+      enforcement,
+      bypass_actors: castDeepMutable(bypass_actors),
+      conditions: castDeepMutable(conditions),
+      // eslint-disable-next-line total-functions/no-unsafe-type-assertion
+      rules: castDeepMutable(
+        rules,
+      ) as components['schemas']['repository-rule'][],
+    },
+  );
+};

package/src/github/ruleset/apply.mts

@@ -0,0 +1,77 @@
+import { Obj } from 'ts-data-forge';
+import 'ts-repo-utils';
+import { rulesetsDir } from '../constants.mjs';
+import {
+  createRuleset,
+  getAllRulesets,
+  getRuleset,
+  updateRuleset,
+} from './api/index.mjs';
+import { backupRulesets } from './backup.mjs';
+import { rulesetKeysToPick } from './constants.mjs';
+import {
+  readRulesetBackupFiles,
+  readRulesetFiles,
+} from './read-rule-set-contents.mjs';
+
+await backupRulesets(false);
+
+const rulesets = await readRulesetFiles();
+
+const backupIds: ReadonlySet<number> = await readRulesetBackupFiles().then(
+  (rs) => new Set(rs.map((r) => r.id)),
+);
+
+const rulesetsToUpdate = rulesets.filter((r) => backupIds.has(r.id));
+const rulesetsToCreate = rulesets.filter((r) => !backupIds.has(r.id));
+
+for (const ruleset of rulesetsToUpdate) {
+  await updateRuleset({
+    rulesetId: ruleset.id,
+    payload: {
+      bypass_actors: ruleset.bypass_actors,
+      conditions: ruleset.conditions ?? undefined,
+      enforcement: ruleset.enforcement,
+      name: ruleset.name,
+      rules: ruleset.rules,
+      target: ruleset.target === 'repository' ? undefined : ruleset.target,
+    },
+  });
+}
+
+for (const ruleset of rulesetsToCreate) {
+  await createRuleset({
+    payload: {
+      bypass_actors: ruleset.bypass_actors,
+      conditions: ruleset.conditions ?? undefined,
+      enforcement: ruleset.enforcement,
+      name: ruleset.name,
+      rules: ruleset.rules,
+      target: ruleset.target === 'repository' ? undefined : ruleset.target,
+    },
+  });
+}
+
+// update local ruleset files
+{
+  const rulesetsResult = await getAllRulesets();
+
+  for (const rule of rulesetsResult) {
+    const content = await getRuleset(rule.id);
+
+    const str = JSON.stringify(
+      Obj.pick(content, rulesetKeysToPick),
+      undefined,
+      2,
+    );
+
+    await fs.writeFile(path.resolve(rulesetsDir, `${rule.name}.json`), str);
+
+    await fs.writeFile(
+      path.resolve(rulesetsDir, `./bk/${rule.name}.json`),
+      str,
+    );
+  }
+
+  await $('pnpm run fmt');
+}

package/src/github/ruleset/backup.mts

@@ -0,0 +1,30 @@
+import { Obj } from 'ts-data-forge';
+import { makeEmptyDir } from 'ts-repo-utils';
+import { rulesetsDir } from '../constants.mjs';
+import { getAllRulesets, getRuleset } from './api/index.mjs';
+import { rulesetKeysToPick } from './constants.mjs';
+
+const backupDir = path.resolve(rulesetsDir, './bk');
+
+export const backupRulesets = async (fmt: boolean = true): Promise<void> => {
+  await makeEmptyDir(backupDir);
+
+  const rulesetsResult = await getAllRulesets();
+
+  for (const rule of rulesetsResult) {
+    const content = await getRuleset(rule.id);
+
+    await fs.writeFile(
+      path.resolve(backupDir, `${rule.name}.json`),
+      JSON.stringify(Obj.pick(content, rulesetKeysToPick), undefined, 2),
+    );
+  }
+
+  if (fmt) {
+    await $('pnpm run fmt');
+  }
+};
+
+if (isDirectlyExecuted(import.meta.url)) {
+  await backupRulesets();
+}

package/src/github/ruleset/constants.mts

@@ -0,0 +1,26 @@
+import {
+  RepositoryRuleset,
+  type CreateRulesetRequest,
+  type UpdateRulesetRequest,
+} from 'octokit-safe-types';
+import { expectType } from 'ts-data-forge';
+import * as t from 'ts-fortress';
+
+export const rulesetKeysToPick = [
+  'id',
+  'name',
+  'target',
+  'enforcement',
+  'bypass_actors',
+  'conditions',
+  'rules',
+] as const satisfies readonly (keyof RepositoryRuleset)[];
+
+type KeysToPick = (typeof rulesetKeysToPick)[number];
+
+expectType<keyof UpdateRulesetRequest | 'id', KeysToPick>('=');
+expectType<keyof CreateRulesetRequest, keyof UpdateRulesetRequest>('=');
+
+export const RulesetPicked = t.pick(RepositoryRuleset, rulesetKeysToPick);
+
+export type RulesetPicked = t.TypeOf<typeof RulesetPicked>;

package/src/github/ruleset/index.mts

@@ -0,0 +1,4 @@
+export * from './api/index.mjs';
+export * from './backup.mjs';
+export * from './constants.mjs';
+export * from './read-rule-set-contents.mjs';

package/src/github/ruleset/read-rule-set-contents.mts

@@ -0,0 +1,45 @@
+import { type Dirent } from 'node:fs';
+import * as t from 'ts-fortress';
+import { Result } from 'ts-repo-utils';
+import { rulesetsDir } from '../constants.mjs';
+import { RulesetPicked } from './constants.mjs';
+
+export const readRulesetFiles = async (): Promise<readonly RulesetPicked[]> =>
+  readFilesIn(rulesetsDir);
+
+export const readRulesetBackupFiles = async (): Promise<
+  readonly RulesetPicked[]
+> => readFilesIn(path.resolve(rulesetsDir, './bk'));
+
+const readFilesIn = async (dir: string): Promise<readonly RulesetPicked[]> => {
+  const files: readonly Dirent<string>[] = await fs.readdir(dir, {
+    withFileTypes: true,
+  });
+
+  const rulesetFileContents: readonly string[] = await Promise.all(
+    files
+      .filter((d) => d.isFile())
+      .map((d) =>
+        fs.readFile(path.resolve(dir, d.name), {
+          encoding: 'utf8',
+        }),
+      ),
+  );
+
+  const validationResults = rulesetFileContents.map((rule) =>
+    RulesetPicked.validate(JSON.parse(rule)),
+  );
+
+  if (validationResults.every(Result.isOk)) {
+    return validationResults.map((r) => r.value);
+  }
+
+  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+  const error = validationResults.find(Result.isErr)!;
+
+  throw new Error(t.validationErrorsToMessages(error.value).join('\n'));
+};
+
+if (isDirectlyExecuted(import.meta.url)) {
+  await readRulesetFiles();
+}

package/src/github/variables/api/create-repo-variable.mts

@@ -0,0 +1,24 @@
+import { type EndpointKeys } from 'octokit-safe-types';
+import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
+import { octokit } from '../../octokit.mjs';
+
+export const createRepoVariable = async ({
+  name,
+  value,
+}: Readonly<{
+  name: string;
+  value: string;
+}>): Promise<void> => {
+  // https://docs.github.com/ja/rest/actions/variables?apiVersion=2022-11-28#create-a-repository-variable
+  await octokit.request(
+    'POST /repos/{owner}/{repo}/actions/variables' satisfies EndpointKeys,
+    {
+      owner: OWNER,
+      repo: REPO,
+      headers: octokitHeaders,
+
+      name,
+      value,
+    },
+  );
+};

package/src/github/variables/api/index.mts

@@ -0,0 +1,3 @@
+export * from './create-repo-variable.mjs';
+export * from './list-repo-variables.mjs';
+export * from './update-repo-variable.mjs';

package/src/github/variables/api/list-repo-variables.mts

@@ -0,0 +1,25 @@
+import { type EndpointKeys } from 'octokit-safe-types';
+import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
+import { octokit } from '../../octokit.mjs';
+
+export const listRepoVariables = async (): Promise<
+  DeepReadonly<
+    {
+      name: string;
+      value: string;
+      created_at: string;
+      updated_at: string;
+    }[]
+  >
+> => {
+  // https://docs.github.com/ja/rest/actions/variables?apiVersion=2022-11-28#list-repository-variables
+  const result = await octokit.request(
+    'GET /repos/{owner}/{repo}/actions/variables' satisfies EndpointKeys,
+    {
+      owner: OWNER,
+      repo: REPO,
+      headers: octokitHeaders,
+    },
+  );
+  return result.data.variables;
+};

package/src/github/variables/api/update-repo-variable.mts

@@ -0,0 +1,24 @@
+import { type EndpointKeys } from 'octokit-safe-types';
+import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
+import { octokit } from '../../octokit.mjs';
+
+export const updateRepoVariable = async ({
+  name,
+  value,
+}: Readonly<{
+  name: string;
+  value: string;
+}>): Promise<void> => {
+  // https://docs.github.com/en/rest/actions/variables#update-a-repository-variable
+  await octokit.request(
+    'PATCH /repos/{owner}/{repo}/actions/variables/{name}' satisfies EndpointKeys,
+    {
+      owner: OWNER,
+      repo: REPO,
+      headers: octokitHeaders,
+
+      name,
+      value,
+    },
+  );
+};

package/src/github/variables/apply.mts

@@ -0,0 +1,28 @@
+import 'ts-repo-utils';
+import {
+  createRepoVariable,
+  listRepoVariables,
+  updateRepoVariable,
+} from './api/index.mjs';
+
+const variables = [
+  {
+    name: 'DEPENDABOT_AUTO_MERGE_BOT_APP_ID',
+    value: '1442916',
+  },
+  {
+    name: 'SEMANTIC_RELEASE_GIT_PERMISSION_BOT_APP_ID',
+    value: '1442563',
+  },
+] as const;
+
+const variableListSaved = await listRepoVariables();
+const variablesSaved: ReadonlySet<string> = new Set(
+  variableListSaved.map((v) => v.name),
+);
+
+for (const variable of variables) {
+  const found = variablesSaved.has(variable.name);
+
+  await (found ? updateRepoVariable(variable) : createRepoVariable(variable));
+}

package/src/github/variables/index.mts

@@ -0,0 +1 @@
+export * from './api/index.mjs';

package/src/globals.d.mts

@@ -0,0 +1 @@
+/// <reference types="ts-type-forge" />

package/src/index.mts

@@ -0,0 +1 @@
+export * from './github/index.mjs';