github-settings-as-code 3.0.2 → 3.1.0

package/dist/github/actions-settings/api/get-actions-settings.d.mts

@@ -2,7 +2,7 @@ import { ActionsSettings } from '../constants.mjs';
 /**
  * Settings > Actions > General の現在値を取得する。
  *
- * 2 つのエンドポイントの結果を 1 つのオブジェクトにまとめる。
+ * 3 つのエンドポイントの結果を 1 つのオブジェクトにまとめる。
  */
 export declare const getActionsSettings: () => Promise<ActionsSettings>;
 //# sourceMappingURL=get-actions-settings.d.mts.map

package/dist/github/actions-settings/api/get-actions-settings.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"get-actions-settings.d.mts","sourceRoot":"","sources":["../../../../src/github/actions-settings/api/get-actions-settings.mts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,QAAa,OAAO,CAAC,eAAe,CAmBlE,CAAC"}
+{"version":3,"file":"get-actions-settings.d.mts","sourceRoot":"","sources":["../../../../src/github/actions-settings/api/get-actions-settings.mts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,QAAa,OAAO,CAAC,eAAe,CA6BlE,CAAC"}

package/dist/github/actions-settings/api/get-actions-settings.mjs

@@ -10,11 +10,15 @@ export const getActionsSettings = async () => {
 
     const permissions = await octokit.request('GET /repos/{owner}/{repo}/actions/permissions', { owner: OWNER, repo: REPO, headers: octokitHeaders });
 
+    const workflowPermissions = await octokit.request('GET /repos/{owner}/{repo}/actions/permissions/workflow', { owner: OWNER, repo: REPO, headers: octokitHeaders });
+
     const forkPrApproval = await octokit.request('GET /repos/{owner}/{repo}/actions/permissions/fork-pr-contributor-approval', { owner: OWNER, repo: REPO, headers: octokitHeaders });
     return ActionsSettings.fill({
         enabled: permissions.data.enabled,
         allowed_actions: permissions.data.allowed_actions,
         sha_pinning_required: permissions.data.sha_pinning_required,
+        default_workflow_permissions: workflowPermissions.data.default_workflow_permissions,
+        can_approve_pull_request_reviews: workflowPermissions.data.can_approve_pull_request_reviews,
         fork_pr_contributor_approval_policy: forkPrApproval.data.approval_policy,
     });
 };

package/dist/github/actions-settings/api/get-actions-settings.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"get-actions-settings.mjs","sourceRoot":"","sources":["../../../../src/github/actions-settings/api/get-actions-settings.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,IAA8B,EAAE;IACrE,mGAAmG;IACnG,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,OAAO,CACvC,+CAAsE,EACtE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CACtD,CAAC;IAEF,iHAAiH;IACjH,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,OAAO,CAC1C,4EAAmG,EACnG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CACtD,CAAC;IAEF,OAAO,eAAe,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO;QACjC,eAAe,EAAE,WAAW,CAAC,IAAI,CAAC,eAAe;QACjD,oBAAoB,EAAE,WAAW,CAAC,IAAI,CAAC,oBAAoB;QAC3D,mCAAmC,EAAE,cAAc,CAAC,IAAI,CAAC,eAAe;KACzE,CAAC,CAAC;AACL,CAAC,CAAC"}
+{"version":3,"file":"get-actions-settings.mjs","sourceRoot":"","sources":["../../../../src/github/actions-settings/api/get-actions-settings.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,IAA8B,EAAE;IACrE,mGAAmG;IACnG,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,OAAO,CACvC,+CAAsE,EACtE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CACtD,CAAC;IAEF,qGAAqG;IACrG,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,OAAO,CAC/C,wDAA+E,EAC/E,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CACtD,CAAC;IAEF,iHAAiH;IACjH,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,OAAO,CAC1C,4EAAmG,EACnG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CACtD,CAAC;IAEF,OAAO,eAAe,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO;QACjC,eAAe,EAAE,WAAW,CAAC,IAAI,CAAC,eAAe;QACjD,oBAAoB,EAAE,WAAW,CAAC,IAAI,CAAC,oBAAoB;QAC3D,4BAA4B,EAC1B,mBAAmB,CAAC,IAAI,CAAC,4BAA4B;QACvD,gCAAgC,EAC9B,mBAAmB,CAAC,IAAI,CAAC,gCAAgC;QAC3D,mCAAmC,EAAE,cAAc,CAAC,IAAI,CAAC,eAAe;KACzE,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/github/actions-settings/api/set-actions-settings.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"set-actions-settings.d.mts","sourceRoot":"","sources":["../../../../src/github/actions-settings/api/set-actions-settings.mts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,oDAAoD;AACpD,eAAO,MAAM,kBAAkB,aACnB,eAAe,KACxB,OAAO,CAAC,IAAI,CA8Bd,CAAC"}
+{"version":3,"file":"set-actions-settings.d.mts","sourceRoot":"","sources":["../../../../src/github/actions-settings/api/set-actions-settings.mts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,oDAAoD;AACpD,eAAO,MAAM,kBAAkB,aACnB,eAAe,KACxB,OAAO,CAAC,IAAI,CA2Cd,CAAC"}

package/dist/github/actions-settings/api/set-actions-settings.mjs

@@ -17,6 +17,14 @@ export const setActionsSettings = async (settings) => {
     };
     await octokit.request('PUT /repos/{owner}/{repo}/actions/permissions', permissionsParams);
 
+    await octokit.request('PUT /repos/{owner}/{repo}/actions/permissions/workflow', {
+        owner: OWNER,
+        repo: REPO,
+        headers: octokitHeaders,
+        default_workflow_permissions: settings.default_workflow_permissions,
+        can_approve_pull_request_reviews: settings.can_approve_pull_request_reviews,
+    });
+
     await octokit.request('PUT /repos/{owner}/{repo}/actions/permissions/fork-pr-contributor-approval', {
         owner: OWNER,
         repo: REPO,

package/dist/github/actions-settings/api/set-actions-settings.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"set-actions-settings.mjs","sourceRoot":"","sources":["../../../../src/github/actions-settings/api/set-actions-settings.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAG5C,oDAAoD;AACpD,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,QAAyB,EACV,EAAE;IACjB,mGAAmG;IACnG,EAAE;IACF,mEAAmE;IACnE,yCAAyC;IACzC,oDAAoD;IACpD,MAAM,iBAAiB,GAAG;QACxB,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,cAAc;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;KAC3C,CAAC;IAEX,MAAM,OAAO,CAAC,OAAO,CACnB,+CAAsE,EACtE,iBAAiB,CAClB,CAAC;IAEF,iHAAiH;IACjH,MAAM,OAAO,CAAC,OAAO,CACnB,4EAAmG,EACnG;QACE,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,cAAc;QACvB,eAAe,EAAE,QAAQ,CAAC,mCAAmC;KAC9D,CACF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"set-actions-settings.mjs","sourceRoot":"","sources":["../../../../src/github/actions-settings/api/set-actions-settings.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAG5C,oDAAoD;AACpD,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,QAAyB,EACV,EAAE;IACjB,mGAAmG;IACnG,EAAE;IACF,mEAAmE;IACnE,yCAAyC;IACzC,oDAAoD;IACpD,MAAM,iBAAiB,GAAG;QACxB,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,cAAc;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;KAC3C,CAAC;IAEX,MAAM,OAAO,CAAC,OAAO,CACnB,+CAAsE,EACtE,iBAAiB,CAClB,CAAC;IAEF,qGAAqG;IACrG,MAAM,OAAO,CAAC,OAAO,CACnB,wDAA+E,EAC/E;QACE,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,cAAc;QACvB,4BAA4B,EAAE,QAAQ,CAAC,4BAA4B;QACnE,gCAAgC,EAC9B,QAAQ,CAAC,gCAAgC;KAC5C,CACF,CAAC;IAEF,iHAAiH;IACjH,MAAM,OAAO,CAAC,OAAO,CACnB,4EAAmG,EACnG;QACE,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,cAAc;QACvB,eAAe,EAAE,QAAQ,CAAC,mCAAmC;KAC9D,CACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/github/actions-settings/constants.d.mts

@@ -6,53 +6,70 @@ import * as t from 'ts-fortress';
  * 管理する:
  *
  * - `GET|PUT /repos/{owner}/{repo}/actions/permissions`
+ * - `GET|PUT /repos/{owner}/{repo}/actions/permissions/workflow`
  * - `GET|PUT /repos/{owner}/{repo}/actions/permissions/fork-pr-contributor-approval`
  */
 export declare const ActionsSettings: Readonly<{
     typeName: string;
     defaultValue: Readonly<{
         allowed_actions: "all" | "local_only" | "selected";
+        can_approve_pull_request_reviews: boolean;
+        default_workflow_permissions: "read" | "write";
         enabled: boolean;
         fork_pr_contributor_approval_policy: "all_external_contributors" | "first_time_contributors" | "first_time_contributors_new_to_github";
         sha_pinning_required: boolean;
     }>;
     is: (a: unknown) => a is Readonly<{
         allowed_actions: "all" | "local_only" | "selected";
+        can_approve_pull_request_reviews: boolean;
+        default_workflow_permissions: "read" | "write";
         enabled: boolean;
         fork_pr_contributor_approval_policy: "all_external_contributors" | "first_time_contributors" | "first_time_contributors_new_to_github";
         sha_pinning_required: boolean;
     }>;
     assertIs: (a: unknown) => asserts a is Readonly<{
         allowed_actions: "all" | "local_only" | "selected";
+        can_approve_pull_request_reviews: boolean;
+        default_workflow_permissions: "read" | "write";
         enabled: boolean;
         fork_pr_contributor_approval_policy: "all_external_contributors" | "first_time_contributors" | "first_time_contributors_new_to_github";
         sha_pinning_required: boolean;
     }>;
     cast: (a: unknown) => Readonly<{
         allowed_actions: "all" | "local_only" | "selected";
+        can_approve_pull_request_reviews: boolean;
+        default_workflow_permissions: "read" | "write";
         enabled: boolean;
         fork_pr_contributor_approval_policy: "all_external_contributors" | "first_time_contributors" | "first_time_contributors_new_to_github";
         sha_pinning_required: boolean;
     }>;
     fill: (a: unknown) => Readonly<{
         allowed_actions: "all" | "local_only" | "selected";
+        can_approve_pull_request_reviews: boolean;
+        default_workflow_permissions: "read" | "write";
         enabled: boolean;
         fork_pr_contributor_approval_policy: "all_external_contributors" | "first_time_contributors" | "first_time_contributors_new_to_github";
         sha_pinning_required: boolean;
     }>;
     prune: <B extends Readonly<{
         allowed_actions: "all" | "local_only" | "selected";
+        can_approve_pull_request_reviews: boolean;
+        default_workflow_permissions: "read" | "write";
         enabled: boolean;
         fork_pr_contributor_approval_policy: "all_external_contributors" | "first_time_contributors" | "first_time_contributors_new_to_github";
         sha_pinning_required: boolean;
     }>>(a: B) => Readonly<{
         allowed_actions: "all" | "local_only" | "selected";
+        can_approve_pull_request_reviews: boolean;
+        default_workflow_permissions: "read" | "write";
         enabled: boolean;
         fork_pr_contributor_approval_policy: "all_external_contributors" | "first_time_contributors" | "first_time_contributors_new_to_github";
         sha_pinning_required: boolean;
     }>;
     validate: (a: unknown) => t.Result<Readonly<{
         allowed_actions: "all" | "local_only" | "selected";
+        can_approve_pull_request_reviews: boolean;
+        default_workflow_permissions: "read" | "write";
         enabled: boolean;
         fork_pr_contributor_approval_policy: "all_external_contributors" | "first_time_contributors" | "first_time_contributors_new_to_github";
         sha_pinning_required: boolean;
@@ -125,6 +142,56 @@ export declare const ActionsSettings: Readonly<{
             }>[]>;
             optional?: true;
         }>;
+        /**
+         * 「 Workflow permissions 」。 job が `permissions` を宣言しなかったときに
+         * `GITHUB_TOKEN` が受け取る既定値。
+         *
+         * `read` にできるのは、 workflow 側が全て明示的に `permissions` を宣言して
+         * いる場合だけ。宣言の無い job はこの既定値をそのまま受け取るため、
+         * `write` のままだと「 branch の中身が何であれ書き込めるトークン」が
+         * 渡る。 .github/workflows/type-check.yml 冒頭の注記を参照。
+         */
+        readonly default_workflow_permissions: Readonly<{
+            typeName: string;
+            defaultValue: "read" | "write";
+            is: (a: unknown) => a is "read" | "write";
+            assertIs: (a: unknown) => asserts a is "read" | "write";
+            cast: (a: unknown) => "read" | "write";
+            fill: (a: unknown) => "read" | "write";
+            prune: <B extends "read" | "write">(a: B) => "read" | "write";
+            validate: (a: unknown) => t.Result<"read" | "write", readonly Readonly<{
+                path: readonly string[];
+                actualValue: unknown;
+                expectedType: string;
+                typeName: string;
+                details?: t.ValidationErrorDetails | undefined;
+            }>[]>;
+            optional?: true;
+        }>;
+        /**
+         * 「 Allow GitHub Actions to create and approve pull requests 」。
+         *
+         * `main` の ruleset は `required_approving_review_count` が 0 なので
+         * 承認そのものは merge 条件ではないが、 Actions に PR を作らせる必要が
+         * あるのは App token を使う workflow だけで、 `GITHUB_TOKEN` には要らない。
+         */
+        readonly can_approve_pull_request_reviews: Readonly<{
+            typeName: string;
+            defaultValue: boolean;
+            is: (a: unknown) => a is boolean;
+            assertIs: (a: unknown) => asserts a is boolean;
+            cast: (a: unknown) => boolean;
+            fill: (a: unknown) => boolean;
+            prune: <B extends boolean>(a: B) => boolean;
+            validate: (a: unknown) => t.Result<boolean, readonly Readonly<{
+                path: readonly string[];
+                actualValue: unknown;
+                expectedType: string;
+                typeName: string;
+                details?: t.ValidationErrorDetails | undefined;
+            }>[]>;
+            optional?: true;
+        }>;
         /**
          * 「 Approval for running fork pull request workflows from contributors 」。
          *

package/dist/github/actions-settings/constants.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.mts","sourceRoot":"","sources":["../../../src/github/actions-settings/constants.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAC1B,4DAA4D;;;;;;;;;;;;;;;;;;QAG5D,+CAA+C;;;;;;;;;;;;;;;;;;QAM/C;;;;;WAKG;;;;;;;;;;;;;;;;;;QAGH;;;;;;WAMG;;;;;;;;;;;;;;;;;;;EAYH,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC"}
+{"version":3,"file":"constants.d.mts","sourceRoot":"","sources":["../../../src/github/actions-settings/constants.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAC1B,4DAA4D;;;;;;;;;;;;;;;;;;QAG5D,+CAA+C;;;;;;;;;;;;;;;;;;QAM/C;;;;;WAKG;;;;;;;;;;;;;;;;;;QAGH;;;;;;;;WAQG;;;;;;;;;;;;;;;;;;QAMH;;;;;;WAMG;;;;;;;;;;;;;;;;;;QAGH;;;;;;WAMG;;;;;;;;;;;;;;;;;;;EAYH,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/github/actions-settings/constants.mjs

@@ -8,6 +8,7 @@ import * as t from 'ts-fortress';
 
 
 
+
 export const ActionsSettings = t.record({
 
     enabled: t.boolean(true),
@@ -30,6 +31,27 @@ export const ActionsSettings = t.record({
 
 
 
+
+
+    default_workflow_permissions: t.enumType(['read', 'write'], {
+        typeName: 'DefaultWorkflowPermissions',
+        defaultValue: 'read',
+    }),
+
+
+
+
+
+
+
+    can_approve_pull_request_reviews: t.boolean(false),
+
+
+
+
+
+
+
     fork_pr_contributor_approval_policy: t.enumType([
         'first_time_contributors_new_to_github',
         'first_time_contributors',

package/dist/github/actions-settings/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","sourceRoot":"","sources":["../../../src/github/actions-settings/constants.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,4DAA4D;IAC5D,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAExB,+CAA+C;IAC/C,eAAe,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE;QAC7D,QAAQ,EAAE,gBAAgB;QAC1B,YAAY,EAAE,KAAK;KACpB,CAAC;IAEF;;;;;OAKG;IACH,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAEtC;;;;;;OAMG;IACH,mCAAmC,EAAE,CAAC,CAAC,QAAQ,CAC7C;QACE,uCAAuC;QACvC,yBAAyB;QACzB,2BAA2B;KAC5B,EACD;QACE,QAAQ,EAAE,iCAAiC;QAC3C,YAAY,EAAE,2BAA2B;KAC1C,CACF;CACF,CAAC,CAAC"}
+{"version":3,"file":"constants.mjs","sourceRoot":"","sources":["../../../src/github/actions-settings/constants.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,4DAA4D;IAC5D,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAExB,+CAA+C;IAC/C,eAAe,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE;QAC7D,QAAQ,EAAE,gBAAgB;QAC1B,YAAY,EAAE,KAAK;KACpB,CAAC;IAEF;;;;;OAKG;IACH,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAEtC;;;;;;;;OAQG;IACH,4BAA4B,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;QAC1D,QAAQ,EAAE,4BAA4B;QACtC,YAAY,EAAE,MAAM;KACrB,CAAC;IAEF;;;;;;OAMG;IACH,gCAAgC,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAElD;;;;;;OAMG;IACH,mCAAmC,EAAE,CAAC,CAAC,QAAQ,CAC7C;QACE,uCAAuC;QACvC,yBAAyB;QACzB,2BAA2B;KAC5B,EACD;QACE,QAAQ,EAAE,iCAAiC;QAC3C,YAAY,EAAE,2BAA2B;KAC1C,CACF;CACF,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "github-settings-as-code",
-  "version": "3.0.2",
+  "version": "3.1.0",
   "private": false,
   "keywords": [
     "github",
@@ -29,37 +29,37 @@
     "dedent": "^1.7.2",
     "dotenv": "^17.4.2",
     "octokit-safe-types": "^1.2.28",
-    "ts-data-forge": "^14.6.3",
-    "ts-fortress": "^12.1.1",
-    "ts-repo-utils": "^10.6.0",
+    "ts-data-forge": "^14.7.1",
+    "ts-fortress": "^12.1.3",
+    "ts-repo-utils": "^10.6.2",
     "ts-type-forge": "^9.2.2"
   },
   "devDependencies": {
-    "@types/node": "26.4.1",
-    "@vitest/coverage-v8": "4.1.11",
-    "@vitest/ui": "4.1.11",
-    "cspell": "10.1.1",
+    "@types/node": "26.5.0",
+    "@vitest/coverage-v8": "5.0.0",
+    "@vitest/ui": "5.0.0",
+    "cspell": "10.2.1",
     "eslint": "10.9.1",
-    "eslint-config-typed": "5.11.2",
-    "eslint-plugin-ts-data-forge": "0.7.0",
-    "eslint-plugin-ts-fortress": "1.2.0",
-    "eslint-plugin-ts-type-forge": "0.8.1",
+    "eslint-config-typed": "5.11.7",
+    "eslint-plugin-ts-data-forge": "0.7.4",
+    "eslint-plugin-ts-fortress": "1.2.2",
+    "eslint-plugin-ts-type-forge": "0.8.3",
     "jiti": "2.7.0",
     "npm-run-all2": "9.0.3",
     "prettier": "3.9.6",
     "prettier-plugin-organize-imports": "4.3.0",
     "prettier-plugin-packagejson": "3.0.2",
-    "tsx": "4.23.12",
+    "tsx": "4.23.13",
     "typescript": "6.0.3",
     "typescript-native": "npm:typescript@7.0.2",
-    "vitest": "4.1.11"
+    "vitest": "5.0.0"
   },
   "engines": {
     "node": ">=22.22.2",
     "pnpm": ">=9.0.0"
   },
   "volta": {
-    "node": "26.3.1"
+    "node": "26.8.1"
   },
   "publishConfig": {
     "access": "public",

package/src/github/actions-settings/api/get-actions-settings.mts

@@ -6,7 +6,7 @@ import { ActionsSettings } from '../constants.mjs';
 /**
  * Settings > Actions > General の現在値を取得する。
  *
- * 2 つのエンドポイントの結果を 1 つのオブジェクトにまとめる。
+ * 3 つのエンドポイントの結果を 1 つのオブジェクトにまとめる。
  */
 export const getActionsSettings = async (): Promise<ActionsSettings> => {
   // https://docs.github.com/rest/actions/permissions#get-github-actions-permissions-for-a-repository
@@ -15,6 +15,12 @@ export const getActionsSettings = async (): Promise<ActionsSettings> => {
     { owner: OWNER, repo: REPO, headers: octokitHeaders },
   );
 
+  // https://docs.github.com/rest/actions/permissions#get-default-workflow-permissions-for-a-repository
+  const workflowPermissions = await octokit.request(
+    'GET /repos/{owner}/{repo}/actions/permissions/workflow' satisfies EndpointKeys,
+    { owner: OWNER, repo: REPO, headers: octokitHeaders },
+  );
+
   // https://docs.github.com/rest/actions/permissions#get-fork-pr-contributor-approval-permissions-for-a-repository
   const forkPrApproval = await octokit.request(
     'GET /repos/{owner}/{repo}/actions/permissions/fork-pr-contributor-approval' satisfies EndpointKeys,
@@ -25,6 +31,10 @@ export const getActionsSettings = async (): Promise<ActionsSettings> => {
     enabled: permissions.data.enabled,
     allowed_actions: permissions.data.allowed_actions,
     sha_pinning_required: permissions.data.sha_pinning_required,
+    default_workflow_permissions:
+      workflowPermissions.data.default_workflow_permissions,
+    can_approve_pull_request_reviews:
+      workflowPermissions.data.can_approve_pull_request_reviews,
     fork_pr_contributor_approval_policy: forkPrApproval.data.approval_policy,
   });
 };

package/src/github/actions-settings/api/set-actions-settings.mts

@@ -26,6 +26,19 @@ export const setActionsSettings = async (
     permissionsParams,
   );
 
+  // https://docs.github.com/rest/actions/permissions#set-default-workflow-permissions-for-a-repository
+  await octokit.request(
+    'PUT /repos/{owner}/{repo}/actions/permissions/workflow' satisfies EndpointKeys,
+    {
+      owner: OWNER,
+      repo: REPO,
+      headers: octokitHeaders,
+      default_workflow_permissions: settings.default_workflow_permissions,
+      can_approve_pull_request_reviews:
+        settings.can_approve_pull_request_reviews,
+    },
+  );
+
   // https://docs.github.com/rest/actions/permissions#set-fork-pr-contributor-approval-permissions-for-a-repository
   await octokit.request(
     'PUT /repos/{owner}/{repo}/actions/permissions/fork-pr-contributor-approval' satisfies EndpointKeys,

package/src/github/actions-settings/constants.mts

@@ -7,6 +7,7 @@ import * as t from 'ts-fortress';
  * 管理する:
  *
  * - `GET|PUT /repos/{owner}/{repo}/actions/permissions`
+ * - `GET|PUT /repos/{owner}/{repo}/actions/permissions/workflow`
  * - `GET|PUT /repos/{owner}/{repo}/actions/permissions/fork-pr-contributor-approval`
  */
 export const ActionsSettings = t.record({
@@ -27,6 +28,29 @@ export const ActionsSettings = t.record({
    */
   sha_pinning_required: t.boolean(false),
 
+  /**
+   * 「 Workflow permissions 」。 job が `permissions` を宣言しなかったときに
+   * `GITHUB_TOKEN` が受け取る既定値。
+   *
+   * `read` にできるのは、 workflow 側が全て明示的に `permissions` を宣言して
+   * いる場合だけ。宣言の無い job はこの既定値をそのまま受け取るため、
+   * `write` のままだと「 branch の中身が何であれ書き込めるトークン」が
+   * 渡る。 .github/workflows/type-check.yml 冒頭の注記を参照。
+   */
+  default_workflow_permissions: t.enumType(['read', 'write'], {
+    typeName: 'DefaultWorkflowPermissions',
+    defaultValue: 'read',
+  }),
+
+  /**
+   * 「 Allow GitHub Actions to create and approve pull requests 」。
+   *
+   * `main` の ruleset は `required_approving_review_count` が 0 なので
+   * 承認そのものは merge 条件ではないが、 Actions に PR を作らせる必要が
+   * あるのは App token を使う workflow だけで、 `GITHUB_TOKEN` には要らない。
+   */
+  can_approve_pull_request_reviews: t.boolean(false),
+
   /**
    * 「 Approval for running fork pull request workflows from contributors 」。
    *