github-settings-as-code 3.0.2 → 3.2.0

package/README.md

@@ -1,12 +1,19 @@
-# Github Settings as Code
+# GitHub Settings as Code
 
-GitHub の repository 設定を JSON ファイルで管理するための CLI。
+A CLI for managing a GitHub repository's settings as JSON files.
 
-設定ファイルは repository root の `repo-settings/` から読む。
+The settings files are read from `repo-settings/` at the repository root.
 
-> **v3.0.0 での破壊的変更**: 読み込み元が `github/` から `repo-settings/` に
-> 変わった。`git mv github repo-settings` で移行する。旧名は `.github/` の
-> 別名に見えて、workflow もここにあると誤解させるものだった。
+> **Breaking change in v3.0.0**: the settings directory moved from `github/` to
+> `repo-settings/`. Migrate with `git mv github repo-settings`. The old name
+> looked like an alias of `.github/` and suggested that workflows lived there
+> too.
+
+## Installation
+
+```sh
+npm install -D github-settings-as-code
+```
 
 ## Usage
 
@@ -14,19 +21,19 @@ GitHub の repository 設定を JSON ファイルで管理するための CLI。
 repo-settings <command> [target] [options]
 ```
 
-| Command  | 説明                                         |
-| -------- | -------------------------------------------- |
-| `apply`  | ローカルの設定ファイルを GitHub に反映する   |
-| `backup` | GitHub の現在値をローカルの `bk/` に保存する |
+| Command  | Description                                                      |
+| -------- | ---------------------------------------------------------------- |
+| `apply`  | Apply the local settings files to GitHub                         |
+| `backup` | Save the current values on GitHub to the local `bk/` directories |
 
-| Target        | 対応するファイル                                  | `apply` | `backup` |
-| ------------- | ------------------------------------------------- | ------- | -------- |
-| `all`（既定） | すべて                                            | ✅      | ✅       |
-| `repository`  | `repo-settings/repository-settings/settings.json` | ✅      | ✅       |
-| `rulesets`    | `repo-settings/rulesets/*.json`                   | ✅      | ✅       |
-| `variables`   | repository variables                              | ✅      | —        |
-| `actions`     | `repo-settings/actions-settings/settings.json`    | ✅      | ✅       |
-| `pages`       | `repo-settings/pages/settings.json`               | ✅      | ✅       |
+| Target          | Files                                             | `apply` | `backup` |
+| --------------- | ------------------------------------------------- | ------- | -------- |
+| `all` (default) | All of the below                                  | ✅      | ✅       |
+| `repository`    | `repo-settings/repository-settings/settings.json` | ✅      | ✅       |
+| `rulesets`      | `repo-settings/rulesets/*.json`                   | ✅      | ✅       |
+| `variables`     | Repository variables                              | ✅      | —        |
+| `actions`       | `repo-settings/actions-settings/settings.json`    | ✅      | ✅       |
+| `pages`         | `repo-settings/pages/settings.json`               | ✅      | ✅       |
 
 ```sh
 repo-settings apply
@@ -35,34 +42,47 @@ repo-settings backup
 repo-settings apply --owner noshiro-pf --repo ts-repo-utils
 ```
 
-## 対象 repository の解決
+Each `backup` is written to a `bk/` directory next to the settings file it
+mirrors (for example `repo-settings/rulesets/bk/`). `apply` reads the values
+back from GitHub afterwards and rewrites the local files with what was actually
+applied.
+
+## Resolving the target repository
 
-以下の順で決まる。通常は `git remote` から決まるため、どちらの指定も不要。
+The target is resolved in the following order. It is normally derived from
+`git remote`, so neither option is usually needed.
 
-1. コマンドライン引数 `--owner` / `--repo`
-2. 環境変数 `OWNER` / `REPO_NAME`
+1. The command-line options `--owner` / `--repo`
+2. The environment variables `OWNER` / `REPO_NAME`
 3. `git remote get-url origin`
-4. `package.json` の `name`（ repository 名のみ ）
+4. The `name` field of `package.json` (repository name only)
+
+## Authentication
 
-## 認証
+The token is resolved in the following order. Locally, nothing needs to be
+configured once you have run `gh auth login`.
 
-以下の順で解決される。ローカルでは `gh auth login` 済みであれば設定不要。
+1. The environment variables `GITHUB_APP_TOKEN` / `GH_TOKEN` /
+   `PERSONAL_ACCESS_TOKEN`
+2. `gh auth token` (the gh CLI's login)
 
-1. 環境変数 `GITHUB_APP_TOKEN` / `GH_TOKEN` / `PERSONAL_ACCESS_TOKEN`
-2. `gh auth token`（ gh CLI のログイン情報 ）
+`GITHUB_TOKEN` is deliberately not read. In GitHub Actions it may hold the
+default token, which lacks the Administration permission.
 
-CI では GitHub App の installation token を `GH_TOKEN` に渡す。 repository
-設定・ruleset の操作には **Administration** 権限が必要で、既定の `GITHUB_TOKEN`
-では権限が足りない（`permissions:` に `administration` は存在しない）。
+In CI, pass a GitHub App installation token as `GH_TOKEN`. Changing repository
+settings and rulesets requires the **Administration** permission, which the
+default `GITHUB_TOKEN` cannot be granted (`administration` is not a valid key
+under `permissions:`).
 
-## 管理できる設定
+## Managed settings
 
-| ファイル                                          | GitHub 上の場所                         |
+| File                                              | Location on GitHub                      |
 | ------------------------------------------------- | --------------------------------------- |
 | `repo-settings/repository-settings/settings.json` | Settings > General                      |
 | `repo-settings/rulesets/*.json`                   | Settings > Rules > Rulesets             |
 | `repo-settings/actions-settings/settings.json`    | Settings > Actions > General            |
 | `repo-settings/pages/settings.json`               | Settings > Pages > Build and deployment |
 
-`repo-settings/pages/settings.json` を置いていない repository では Pages の操作を行わない
-（ Pages を使わない repository で誤って有効化しないため ）。
+In a repository without `repo-settings/pages/settings.json`, Pages is left
+untouched, so that a repository that does not use Pages never has it enabled by
+mistake.

package/dist/cmd/repo-settings.mjs

@@ -19,6 +19,9 @@ const HELP = dedent `
     variables          repository variables （ apply のみ ）
     actions            repo-settings/actions-settings/settings.json
     pages              repo-settings/pages/settings.json
+    environments       repo-settings/environments/*.json
+    vulnerability-alerts
+                       repo-settings/vulnerability-alerts/settings.json
 
   Options:
         --owner <owner>   対象の owner
@@ -47,6 +50,8 @@ const TARGETS = [
     'variables',
     'actions',
     'pages',
+    'environments',
+    'vulnerability-alerts',
 ];
 const COMMAND_SET = new Set(COMMANDS);
 const isCommand = (value) => COMMAND_SET.has(value);
@@ -93,12 +98,16 @@ const runners = {
             await github.applyRepositorySettings();
             await github.applyActionsSettings();
             await github.applyPagesSettings();
+            await github.applyEnvironments();
+            await github.applyVulnerabilityAlerts();
         },
         repository: github.applyRepositorySettings,
         rulesets: github.applyRulesets,
         variables: github.applyVariables,
         actions: github.applyActionsSettings,
         pages: github.applyPagesSettings,
+        environments: github.applyEnvironments,
+        'vulnerability-alerts': github.applyVulnerabilityAlerts,
     },
     backup: {
         all: async () => {
@@ -106,11 +115,15 @@ const runners = {
             await github.backupRepositorySettings();
             await github.backupActionsSettings();
             await github.backupPagesSettings();
+            await github.backupEnvironments();
+            await github.backupVulnerabilityAlerts();
         },
         repository: github.backupRepositorySettings,
         rulesets: github.backupRulesets,
         actions: github.backupActionsSettings,
         pages: github.backupPagesSettings,
+        environments: github.backupEnvironments,
+        'vulnerability-alerts': github.backupVulnerabilityAlerts,
     },
 };
 const runner = runners[commandArg][targetArg];

package/dist/cmd/repo-settings.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"repo-settings.mjs","sourceRoot":"","sources":["../../src/cmd/repo-settings.mts"],"names":[],"mappings":";AAEA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,eAAe,CAAC;AACvB,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAGpC,MAAM,IAAI,GAAG,MAAM,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmClB,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAU,CAAC;AAI9C,MAAM,OAAO,GAAG;IACd,KAAK;IACL,YAAY;IACZ,UAAU;IACV,WAAW;IACX,SAAS;IACT,OAAO;CACC,CAAC;AAIX,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;AAE3D,MAAM,SAAS,GAAG,CAAC,KAAa,EAAoB,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAE9E,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;AAEzD,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAmB,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAE3E,0CAA0C;AAC1C,gDAAgD;AAChD,MAAM,IAAI,GAA+B,CAAC,OAAO,EAAE,EAAE;IACnD,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;IAE9B,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAElB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IAC7C,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/B,OAAO,EAAE;QACP,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;KACtD;IACD,MAAM,EAAE,KAAK;IACb,gBAAgB,EAAE,IAAI;CACvB,CAAC,CAAC;AAEH,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;IACrD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEnB,0EAA0E;IAC1E,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,UAAU,EAAE,SAAS,GAAG,KAAK,CAAC,GAAG,WAAW,CAAC;AAEpD,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;IACvD,IAAI,CAAC,qBAAqB,UAAU,IAAI,EAAE,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;IACzB,IAAI,CAAC,oBAAoB,SAAS,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,wDAAwD;AACxD,oCAAoC;AACpC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAEnD,MAAM,OAAO,GAGT;IACF,KAAK,EAAE;QACL,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;YAE9B,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;YAE7B,MAAM,MAAM,CAAC,uBAAuB,EAAE,CAAC;YAEvC,MAAM,MAAM,CAAC,oBAAoB,EAAE,CAAC;YAEpC,MAAM,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACpC,CAAC;QACD,UAAU,EAAE,MAAM,CAAC,uBAAuB;QAC1C,QAAQ,EAAE,MAAM,CAAC,aAAa;QAC9B,SAAS,EAAE,MAAM,CAAC,cAAc;QAChC,OAAO,EAAE,MAAM,CAAC,oBAAoB;QACpC,KAAK,EAAE,MAAM,CAAC,kBAAkB;KACjC;IACD,MAAM,EAAE;QACN,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;YAE9B,MAAM,MAAM,CAAC,wBAAwB,EAAE,CAAC;YAExC,MAAM,MAAM,CAAC,qBAAqB,EAAE,CAAC;YAErC,MAAM,MAAM,CAAC,mBAAmB,EAAE,CAAC;QACrC,CAAC;QACD,UAAU,EAAE,MAAM,CAAC,wBAAwB;QAC3C,QAAQ,EAAE,MAAM,CAAC,cAAc;QAC/B,OAAO,EAAE,MAAM,CAAC,qBAAqB;QACrC,KAAK,EAAE,MAAM,CAAC,mBAAmB;KAClC;CACO,CAAC;AAEX,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;AAE9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,IAAI,UAAU,kCAAkC,SAAS,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,MAAM,EAAE,CAAC"}
+{"version":3,"file":"repo-settings.mjs","sourceRoot":"","sources":["../../src/cmd/repo-settings.mts"],"names":[],"mappings":";AAEA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,eAAe,CAAC;AACvB,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAGpC,MAAM,IAAI,GAAG,MAAM,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsClB,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAU,CAAC;AAI9C,MAAM,OAAO,GAAG;IACd,KAAK;IACL,YAAY;IACZ,UAAU;IACV,WAAW;IACX,SAAS;IACT,OAAO;IACP,cAAc;IACd,sBAAsB;CACd,CAAC;AAIX,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;AAE3D,MAAM,SAAS,GAAG,CAAC,KAAa,EAAoB,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAE9E,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;AAEzD,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAmB,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAE3E,0CAA0C;AAC1C,gDAAgD;AAChD,MAAM,IAAI,GAA+B,CAAC,OAAO,EAAE,EAAE;IACnD,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;IAE9B,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAElB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IAC7C,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/B,OAAO,EAAE;QACP,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;KACtD;IACD,MAAM,EAAE,KAAK;IACb,gBAAgB,EAAE,IAAI;CACvB,CAAC,CAAC;AAEH,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;IACrD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEnB,0EAA0E;IAC1E,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,UAAU,EAAE,SAAS,GAAG,KAAK,CAAC,GAAG,WAAW,CAAC;AAEpD,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;IACvD,IAAI,CAAC,qBAAqB,UAAU,IAAI,EAAE,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;IACzB,IAAI,CAAC,oBAAoB,SAAS,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,wDAAwD;AACxD,oCAAoC;AACpC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAEnD,MAAM,OAAO,GAGT;IACF,KAAK,EAAE;QACL,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;YAE9B,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;YAE7B,MAAM,MAAM,CAAC,uBAAuB,EAAE,CAAC;YAEvC,MAAM,MAAM,CAAC,oBAAoB,EAAE,CAAC;YAEpC,MAAM,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAElC,MAAM,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAEjC,MAAM,MAAM,CAAC,wBAAwB,EAAE,CAAC;QAC1C,CAAC;QACD,UAAU,EAAE,MAAM,CAAC,uBAAuB;QAC1C,QAAQ,EAAE,MAAM,CAAC,aAAa;QAC9B,SAAS,EAAE,MAAM,CAAC,cAAc;QAChC,OAAO,EAAE,MAAM,CAAC,oBAAoB;QACpC,KAAK,EAAE,MAAM,CAAC,kBAAkB;QAChC,YAAY,EAAE,MAAM,CAAC,iBAAiB;QACtC,sBAAsB,EAAE,MAAM,CAAC,wBAAwB;KACxD;IACD,MAAM,EAAE;QACN,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;YAE9B,MAAM,MAAM,CAAC,wBAAwB,EAAE,CAAC;YAExC,MAAM,MAAM,CAAC,qBAAqB,EAAE,CAAC;YAErC,MAAM,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAEnC,MAAM,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAElC,MAAM,MAAM,CAAC,yBAAyB,EAAE,CAAC;QAC3C,CAAC;QACD,UAAU,EAAE,MAAM,CAAC,wBAAwB;QAC3C,QAAQ,EAAE,MAAM,CAAC,cAAc;QAC/B,OAAO,EAAE,MAAM,CAAC,qBAAqB;QACrC,KAAK,EAAE,MAAM,CAAC,mBAAmB;QACjC,YAAY,EAAE,MAAM,CAAC,kBAAkB;QACvC,sBAAsB,EAAE,MAAM,CAAC,yBAAyB;KACzD;CACO,CAAC;AAEX,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;AAE9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,IAAI,UAAU,kCAAkC,SAAS,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,MAAM,EAAE,CAAC"}

package/dist/github/actions-settings/api/get-actions-settings.d.mts

@@ -2,7 +2,7 @@ import { ActionsSettings } from '../constants.mjs';
 /**
  * Settings > Actions > General の現在値を取得する。
  *
- * 2 つのエンドポイントの結果を 1 つのオブジェクトにまとめる。
+ * 3 つのエンドポイントの結果を 1 つのオブジェクトにまとめる。
  */
 export declare const getActionsSettings: () => Promise<ActionsSettings>;
 //# sourceMappingURL=get-actions-settings.d.mts.map

package/dist/github/actions-settings/api/get-actions-settings.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"get-actions-settings.d.mts","sourceRoot":"","sources":["../../../../src/github/actions-settings/api/get-actions-settings.mts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,QAAa,OAAO,CAAC,eAAe,CAmBlE,CAAC"}
+{"version":3,"file":"get-actions-settings.d.mts","sourceRoot":"","sources":["../../../../src/github/actions-settings/api/get-actions-settings.mts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,QAAa,OAAO,CAAC,eAAe,CA6BlE,CAAC"}

package/dist/github/actions-settings/api/get-actions-settings.mjs

@@ -10,11 +10,15 @@ export const getActionsSettings = async () => {
 
     const permissions = await octokit.request('GET /repos/{owner}/{repo}/actions/permissions', { owner: OWNER, repo: REPO, headers: octokitHeaders });
 
+    const workflowPermissions = await octokit.request('GET /repos/{owner}/{repo}/actions/permissions/workflow', { owner: OWNER, repo: REPO, headers: octokitHeaders });
+
     const forkPrApproval = await octokit.request('GET /repos/{owner}/{repo}/actions/permissions/fork-pr-contributor-approval', { owner: OWNER, repo: REPO, headers: octokitHeaders });
     return ActionsSettings.fill({
         enabled: permissions.data.enabled,
         allowed_actions: permissions.data.allowed_actions,
         sha_pinning_required: permissions.data.sha_pinning_required,
+        default_workflow_permissions: workflowPermissions.data.default_workflow_permissions,
+        can_approve_pull_request_reviews: workflowPermissions.data.can_approve_pull_request_reviews,
         fork_pr_contributor_approval_policy: forkPrApproval.data.approval_policy,
     });
 };

package/dist/github/actions-settings/api/get-actions-settings.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"get-actions-settings.mjs","sourceRoot":"","sources":["../../../../src/github/actions-settings/api/get-actions-settings.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,IAA8B,EAAE;IACrE,mGAAmG;IACnG,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,OAAO,CACvC,+CAAsE,EACtE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CACtD,CAAC;IAEF,iHAAiH;IACjH,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,OAAO,CAC1C,4EAAmG,EACnG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CACtD,CAAC;IAEF,OAAO,eAAe,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO;QACjC,eAAe,EAAE,WAAW,CAAC,IAAI,CAAC,eAAe;QACjD,oBAAoB,EAAE,WAAW,CAAC,IAAI,CAAC,oBAAoB;QAC3D,mCAAmC,EAAE,cAAc,CAAC,IAAI,CAAC,eAAe;KACzE,CAAC,CAAC;AACL,CAAC,CAAC"}
+{"version":3,"file":"get-actions-settings.mjs","sourceRoot":"","sources":["../../../../src/github/actions-settings/api/get-actions-settings.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,IAA8B,EAAE;IACrE,mGAAmG;IACnG,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,OAAO,CACvC,+CAAsE,EACtE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CACtD,CAAC;IAEF,qGAAqG;IACrG,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,OAAO,CAC/C,wDAA+E,EAC/E,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CACtD,CAAC;IAEF,iHAAiH;IACjH,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,OAAO,CAC1C,4EAAmG,EACnG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CACtD,CAAC;IAEF,OAAO,eAAe,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO;QACjC,eAAe,EAAE,WAAW,CAAC,IAAI,CAAC,eAAe;QACjD,oBAAoB,EAAE,WAAW,CAAC,IAAI,CAAC,oBAAoB;QAC3D,4BAA4B,EAC1B,mBAAmB,CAAC,IAAI,CAAC,4BAA4B;QACvD,gCAAgC,EAC9B,mBAAmB,CAAC,IAAI,CAAC,gCAAgC;QAC3D,mCAAmC,EAAE,cAAc,CAAC,IAAI,CAAC,eAAe;KACzE,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/github/actions-settings/api/set-actions-settings.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"set-actions-settings.d.mts","sourceRoot":"","sources":["../../../../src/github/actions-settings/api/set-actions-settings.mts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,oDAAoD;AACpD,eAAO,MAAM,kBAAkB,aACnB,eAAe,KACxB,OAAO,CAAC,IAAI,CA8Bd,CAAC"}
+{"version":3,"file":"set-actions-settings.d.mts","sourceRoot":"","sources":["../../../../src/github/actions-settings/api/set-actions-settings.mts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,oDAAoD;AACpD,eAAO,MAAM,kBAAkB,aACnB,eAAe,KACxB,OAAO,CAAC,IAAI,CA2Cd,CAAC"}

package/dist/github/actions-settings/api/set-actions-settings.mjs

@@ -17,6 +17,14 @@ export const setActionsSettings = async (settings) => {
     };
     await octokit.request('PUT /repos/{owner}/{repo}/actions/permissions', permissionsParams);
 
+    await octokit.request('PUT /repos/{owner}/{repo}/actions/permissions/workflow', {
+        owner: OWNER,
+        repo: REPO,
+        headers: octokitHeaders,
+        default_workflow_permissions: settings.default_workflow_permissions,
+        can_approve_pull_request_reviews: settings.can_approve_pull_request_reviews,
+    });
+
     await octokit.request('PUT /repos/{owner}/{repo}/actions/permissions/fork-pr-contributor-approval', {
         owner: OWNER,
         repo: REPO,

package/dist/github/actions-settings/api/set-actions-settings.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"set-actions-settings.mjs","sourceRoot":"","sources":["../../../../src/github/actions-settings/api/set-actions-settings.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAG5C,oDAAoD;AACpD,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,QAAyB,EACV,EAAE;IACjB,mGAAmG;IACnG,EAAE;IACF,mEAAmE;IACnE,yCAAyC;IACzC,oDAAoD;IACpD,MAAM,iBAAiB,GAAG;QACxB,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,cAAc;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;KAC3C,CAAC;IAEX,MAAM,OAAO,CAAC,OAAO,CACnB,+CAAsE,EACtE,iBAAiB,CAClB,CAAC;IAEF,iHAAiH;IACjH,MAAM,OAAO,CAAC,OAAO,CACnB,4EAAmG,EACnG;QACE,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,cAAc;QACvB,eAAe,EAAE,QAAQ,CAAC,mCAAmC;KAC9D,CACF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"set-actions-settings.mjs","sourceRoot":"","sources":["../../../../src/github/actions-settings/api/set-actions-settings.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAG5C,oDAAoD;AACpD,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,QAAyB,EACV,EAAE;IACjB,mGAAmG;IACnG,EAAE;IACF,mEAAmE;IACnE,yCAAyC;IACzC,oDAAoD;IACpD,MAAM,iBAAiB,GAAG;QACxB,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,cAAc;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;KAC3C,CAAC;IAEX,MAAM,OAAO,CAAC,OAAO,CACnB,+CAAsE,EACtE,iBAAiB,CAClB,CAAC;IAEF,qGAAqG;IACrG,MAAM,OAAO,CAAC,OAAO,CACnB,wDAA+E,EAC/E;QACE,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,cAAc;QACvB,4BAA4B,EAAE,QAAQ,CAAC,4BAA4B;QACnE,gCAAgC,EAC9B,QAAQ,CAAC,gCAAgC;KAC5C,CACF,CAAC;IAEF,iHAAiH;IACjH,MAAM,OAAO,CAAC,OAAO,CACnB,4EAAmG,EACnG;QACE,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,cAAc;QACvB,eAAe,EAAE,QAAQ,CAAC,mCAAmC;KAC9D,CACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/github/actions-settings/constants.d.mts

@@ -6,53 +6,70 @@ import * as t from 'ts-fortress';
  * 管理する:
  *
  * - `GET|PUT /repos/{owner}/{repo}/actions/permissions`
+ * - `GET|PUT /repos/{owner}/{repo}/actions/permissions/workflow`
  * - `GET|PUT /repos/{owner}/{repo}/actions/permissions/fork-pr-contributor-approval`
  */
 export declare const ActionsSettings: Readonly<{
     typeName: string;
     defaultValue: Readonly<{
         allowed_actions: "all" | "local_only" | "selected";
+        can_approve_pull_request_reviews: boolean;
+        default_workflow_permissions: "read" | "write";
         enabled: boolean;
         fork_pr_contributor_approval_policy: "all_external_contributors" | "first_time_contributors" | "first_time_contributors_new_to_github";
         sha_pinning_required: boolean;
     }>;
     is: (a: unknown) => a is Readonly<{
         allowed_actions: "all" | "local_only" | "selected";
+        can_approve_pull_request_reviews: boolean;
+        default_workflow_permissions: "read" | "write";
         enabled: boolean;
         fork_pr_contributor_approval_policy: "all_external_contributors" | "first_time_contributors" | "first_time_contributors_new_to_github";
         sha_pinning_required: boolean;
     }>;
     assertIs: (a: unknown) => asserts a is Readonly<{
         allowed_actions: "all" | "local_only" | "selected";
+        can_approve_pull_request_reviews: boolean;
+        default_workflow_permissions: "read" | "write";
         enabled: boolean;
         fork_pr_contributor_approval_policy: "all_external_contributors" | "first_time_contributors" | "first_time_contributors_new_to_github";
         sha_pinning_required: boolean;
     }>;
     cast: (a: unknown) => Readonly<{
         allowed_actions: "all" | "local_only" | "selected";
+        can_approve_pull_request_reviews: boolean;
+        default_workflow_permissions: "read" | "write";
         enabled: boolean;
         fork_pr_contributor_approval_policy: "all_external_contributors" | "first_time_contributors" | "first_time_contributors_new_to_github";
         sha_pinning_required: boolean;
     }>;
     fill: (a: unknown) => Readonly<{
         allowed_actions: "all" | "local_only" | "selected";
+        can_approve_pull_request_reviews: boolean;
+        default_workflow_permissions: "read" | "write";
         enabled: boolean;
         fork_pr_contributor_approval_policy: "all_external_contributors" | "first_time_contributors" | "first_time_contributors_new_to_github";
         sha_pinning_required: boolean;
     }>;
     prune: <B extends Readonly<{
         allowed_actions: "all" | "local_only" | "selected";
+        can_approve_pull_request_reviews: boolean;
+        default_workflow_permissions: "read" | "write";
         enabled: boolean;
         fork_pr_contributor_approval_policy: "all_external_contributors" | "first_time_contributors" | "first_time_contributors_new_to_github";
         sha_pinning_required: boolean;
     }>>(a: B) => Readonly<{
         allowed_actions: "all" | "local_only" | "selected";
+        can_approve_pull_request_reviews: boolean;
+        default_workflow_permissions: "read" | "write";
         enabled: boolean;
         fork_pr_contributor_approval_policy: "all_external_contributors" | "first_time_contributors" | "first_time_contributors_new_to_github";
         sha_pinning_required: boolean;
     }>;
     validate: (a: unknown) => t.Result<Readonly<{
         allowed_actions: "all" | "local_only" | "selected";
+        can_approve_pull_request_reviews: boolean;
+        default_workflow_permissions: "read" | "write";
         enabled: boolean;
         fork_pr_contributor_approval_policy: "all_external_contributors" | "first_time_contributors" | "first_time_contributors_new_to_github";
         sha_pinning_required: boolean;
@@ -125,6 +142,56 @@ export declare const ActionsSettings: Readonly<{
             }>[]>;
             optional?: true;
         }>;
+        /**
+         * 「 Workflow permissions 」。 job が `permissions` を宣言しなかったときに
+         * `GITHUB_TOKEN` が受け取る既定値。
+         *
+         * `read` にできるのは、 workflow 側が全て明示的に `permissions` を宣言して
+         * いる場合だけ。宣言の無い job はこの既定値をそのまま受け取るため、
+         * `write` のままだと「 branch の中身が何であれ書き込めるトークン」が
+         * 渡る。 .github/workflows/type-check.yml 冒頭の注記を参照。
+         */
+        readonly default_workflow_permissions: Readonly<{
+            typeName: string;
+            defaultValue: "read" | "write";
+            is: (a: unknown) => a is "read" | "write";
+            assertIs: (a: unknown) => asserts a is "read" | "write";
+            cast: (a: unknown) => "read" | "write";
+            fill: (a: unknown) => "read" | "write";
+            prune: <B extends "read" | "write">(a: B) => "read" | "write";
+            validate: (a: unknown) => t.Result<"read" | "write", readonly Readonly<{
+                path: readonly string[];
+                actualValue: unknown;
+                expectedType: string;
+                typeName: string;
+                details?: t.ValidationErrorDetails | undefined;
+            }>[]>;
+            optional?: true;
+        }>;
+        /**
+         * 「 Allow GitHub Actions to create and approve pull requests 」。
+         *
+         * `main` の ruleset は `required_approving_review_count` が 0 なので
+         * 承認そのものは merge 条件ではないが、 Actions に PR を作らせる必要が
+         * あるのは App token を使う workflow だけで、 `GITHUB_TOKEN` には要らない。
+         */
+        readonly can_approve_pull_request_reviews: Readonly<{
+            typeName: string;
+            defaultValue: boolean;
+            is: (a: unknown) => a is boolean;
+            assertIs: (a: unknown) => asserts a is boolean;
+            cast: (a: unknown) => boolean;
+            fill: (a: unknown) => boolean;
+            prune: <B extends boolean>(a: B) => boolean;
+            validate: (a: unknown) => t.Result<boolean, readonly Readonly<{
+                path: readonly string[];
+                actualValue: unknown;
+                expectedType: string;
+                typeName: string;
+                details?: t.ValidationErrorDetails | undefined;
+            }>[]>;
+            optional?: true;
+        }>;
         /**
          * 「 Approval for running fork pull request workflows from contributors 」。
          *

package/dist/github/actions-settings/constants.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.mts","sourceRoot":"","sources":["../../../src/github/actions-settings/constants.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAC1B,4DAA4D;;;;;;;;;;;;;;;;;;QAG5D,+CAA+C;;;;;;;;;;;;;;;;;;QAM/C;;;;;WAKG;;;;;;;;;;;;;;;;;;QAGH;;;;;;WAMG;;;;;;;;;;;;;;;;;;;EAYH,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC"}
+{"version":3,"file":"constants.d.mts","sourceRoot":"","sources":["../../../src/github/actions-settings/constants.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAC1B,4DAA4D;;;;;;;;;;;;;;;;;;QAG5D,+CAA+C;;;;;;;;;;;;;;;;;;QAM/C;;;;;WAKG;;;;;;;;;;;;;;;;;;QAGH;;;;;;;;WAQG;;;;;;;;;;;;;;;;;;QAMH;;;;;;WAMG;;;;;;;;;;;;;;;;;;QAGH;;;;;;WAMG;;;;;;;;;;;;;;;;;;;EAYH,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/github/actions-settings/constants.mjs

@@ -8,6 +8,7 @@ import * as t from 'ts-fortress';
 
 
 
+
 export const ActionsSettings = t.record({
 
     enabled: t.boolean(true),
@@ -30,6 +31,27 @@ export const ActionsSettings = t.record({
 
 
 
+
+
+    default_workflow_permissions: t.enumType(['read', 'write'], {
+        typeName: 'DefaultWorkflowPermissions',
+        defaultValue: 'read',
+    }),
+
+
+
+
+
+
+
+    can_approve_pull_request_reviews: t.boolean(false),
+
+
+
+
+
+
+
     fork_pr_contributor_approval_policy: t.enumType([
         'first_time_contributors_new_to_github',
         'first_time_contributors',

package/dist/github/actions-settings/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","sourceRoot":"","sources":["../../../src/github/actions-settings/constants.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,4DAA4D;IAC5D,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAExB,+CAA+C;IAC/C,eAAe,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE;QAC7D,QAAQ,EAAE,gBAAgB;QAC1B,YAAY,EAAE,KAAK;KACpB,CAAC;IAEF;;;;;OAKG;IACH,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAEtC;;;;;;OAMG;IACH,mCAAmC,EAAE,CAAC,CAAC,QAAQ,CAC7C;QACE,uCAAuC;QACvC,yBAAyB;QACzB,2BAA2B;KAC5B,EACD;QACE,QAAQ,EAAE,iCAAiC;QAC3C,YAAY,EAAE,2BAA2B;KAC1C,CACF;CACF,CAAC,CAAC"}
+{"version":3,"file":"constants.mjs","sourceRoot":"","sources":["../../../src/github/actions-settings/constants.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,4DAA4D;IAC5D,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAExB,+CAA+C;IAC/C,eAAe,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE;QAC7D,QAAQ,EAAE,gBAAgB;QAC1B,YAAY,EAAE,KAAK;KACpB,CAAC;IAEF;;;;;OAKG;IACH,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAEtC;;;;;;;;OAQG;IACH,4BAA4B,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;QAC1D,QAAQ,EAAE,4BAA4B;QACtC,YAAY,EAAE,MAAM;KACrB,CAAC;IAEF;;;;;;OAMG;IACH,gCAAgC,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAElD;;;;;;OAMG;IACH,mCAAmC,EAAE,CAAC,CAAC,QAAQ,CAC7C;QACE,uCAAuC;QACvC,yBAAyB;QACzB,2BAA2B;KAC5B,EACD;QACE,QAAQ,EAAE,iCAAiC;QAC3C,YAAY,EAAE,2BAA2B;KAC1C,CACF;CACF,CAAC,CAAC"}

package/dist/github/constants.d.mts

@@ -4,6 +4,8 @@ export declare const settingsJsonName = "settings.json";
 export declare const repositorySettingsDir: string;
 export declare const actionsSettingsDir: string;
 export declare const pagesSettingsDir: string;
+export declare const environmentsDir: string;
+export declare const vulnerabilityAlertsDir: string;
 export declare const rulesetsDir: string;
 export declare const octokitHeaders: {
     readonly 'X-GitHub-Api-Version': '2022-11-28';

package/dist/github/constants.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.mts","sourceRoot":"","sources":["../../src/github/constants.mts"],"names":[],"mappings":"AAKA,eAAO,MAAM,KAAK,EAAE,MAAyB,CAAC;AAE9C,eAAO,MAAM,IAAI,EAAE,MAAwB,CAAC;AAM5C,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAEhD,eAAO,MAAM,qBAAqB,QAGjC,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAG9B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAuC,CAAC;AAErE,eAAO,MAAM,WAAW,QAA0C,CAAC;AAEnE,eAAO,MAAM,cAAc;aACzB,sBAAsB,EAAE,YAAY;CAC5B,CAAC"}
+{"version":3,"file":"constants.d.mts","sourceRoot":"","sources":["../../src/github/constants.mts"],"names":[],"mappings":"AAKA,eAAO,MAAM,KAAK,EAAE,MAAyB,CAAC;AAE9C,eAAO,MAAM,IAAI,EAAE,MAAwB,CAAC;AAM5C,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAEhD,eAAO,MAAM,qBAAqB,QAGjC,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAG9B,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAuC,CAAC;AAErE,eAAO,MAAM,eAAe,QAA8C,CAAC;AAE3E,eAAO,MAAM,sBAAsB,QAGlC,CAAC;AAEF,eAAO,MAAM,WAAW,QAA0C,CAAC;AAEnE,eAAO,MAAM,cAAc;aACzB,sBAAsB,EAAE,YAAY;CAC5B,CAAC"}

package/dist/github/constants.mjs

@@ -10,6 +10,8 @@ export const settingsJsonName = 'settings.json';
 export const repositorySettingsDir = path.resolve(settingsDir, './repository-settings');
 export const actionsSettingsDir = path.resolve(settingsDir, './actions-settings');
 export const pagesSettingsDir = path.resolve(settingsDir, './pages');
+export const environmentsDir = path.resolve(settingsDir, './environments');
+export const vulnerabilityAlertsDir = path.resolve(settingsDir, './vulnerability-alerts');
 export const rulesetsDir = path.resolve(settingsDir, './rulesets');
 export const octokitHeaders = {
     'X-GitHub-Api-Version': '2022-11-28',

package/dist/github/constants.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"constants.mjs","sourceRoot":"","sources":["../../src/github/constants.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAC;AAE7C,MAAM,CAAC,MAAM,KAAK,GAAW,UAAU,CAAC,KAAK,CAAC;AAE9C,MAAM,CAAC,MAAM,IAAI,GAAW,UAAU,CAAC,IAAI,CAAC;AAE5C,yEAAyE;AACzE,iEAAiE;AACjE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEhD,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC,OAAO,CAC/C,WAAW,EACX,uBAAuB,CACxB,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAC5C,WAAW,EACX,oBAAoB,CACrB,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AAErE,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,sBAAsB,EAAE,YAAY;CAC5B,CAAC"}
+{"version":3,"file":"constants.mjs","sourceRoot":"","sources":["../../src/github/constants.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAC;AAE7C,MAAM,CAAC,MAAM,KAAK,GAAW,UAAU,CAAC,KAAK,CAAC;AAE9C,MAAM,CAAC,MAAM,IAAI,GAAW,UAAU,CAAC,IAAI,CAAC;AAE5C,yEAAyE;AACzE,iEAAiE;AACjE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEhD,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC,OAAO,CAC/C,WAAW,EACX,uBAAuB,CACxB,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAC5C,WAAW,EACX,oBAAoB,CACrB,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AAErE,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC,OAAO,CAChD,WAAW,EACX,wBAAwB,CACzB,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,sBAAsB,EAAE,YAAY;CAC5B,CAAC"}

package/dist/github/environments/api/get-environments.d.mts

@@ -0,0 +1,16 @@
+import { EnvironmentSettings } from '../constants.mjs';
+/**
+ * Settings > Environments の現在値を、宣言ファイルと同じ形にして返す。
+ *
+ * 名前順に整える。 GitHub が返す順は作成順で、環境を 1 つ足しただけで
+ * `bk/` の中身が並び替わると差分が読めなくなるため。
+ */
+export declare const getAllEnvironments: () => Promise<readonly EnvironmentSettings[]>;
+/** 「 Selected branches and tags 」に登録されている pattern を列挙する。 */
+export declare const getDeploymentBranchPolicies: (environmentName: string) => Promise<readonly DeploymentBranchPolicy[]>;
+export type DeploymentBranchPolicy = Readonly<{
+    id: number;
+    name: string;
+    type: 'branch' | 'tag';
+}>;
+//# sourceMappingURL=get-environments.d.mts.map

package/dist/github/environments/api/get-environments.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-environments.d.mts","sourceRoot":"","sources":["../../../../src/github/environments/api/get-environments.mts"],"names":[],"mappings":"AAMA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAAa,OAAO,CACjD,SAAS,mBAAmB,EAAE,CAoC/B,CAAC;AAWF,4DAA4D;AAC5D,eAAO,MAAM,2BAA2B,oBACrB,MAAM,KACtB,OAAO,CAAC,SAAS,sBAAsB,EAAE,CAkB3C,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,GAAG,KAAK,CAAC;CACxB,CAAC,CAAC"}

package/dist/github/environments/api/get-environments.mjs

@@ -0,0 +1,98 @@
+import { Arr } from 'ts-data-forge';
+import * as t from 'ts-fortress';
+import { Result } from 'ts-repo-utils';
+import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
+import { octokit } from '../../octokit.mjs';
+import { EnvironmentSettings } from '../constants.mjs';
+
+
+
+
+
+
+export const getAllEnvironments = async () => {
+
+
+
+
+    const response = await octokit.request('GET /repos/{owner}/{repo}/environments', { owner: OWNER, repo: REPO, headers: octokitHeaders, per_page: 100 });
+    const environments = response.data.environments ?? [];
+    const settings = await Promise.all(environments.map(async (environment) => {
+        const policy = environment.deployment_branch_policy ?? undefined;
+        return EnvironmentSettings.fill({
+            name: environment.name,
+            ...parseProtectionRules(environment.protection_rules),
+            deployment_branch_policy: policy === undefined
+                ? null
+                : {
+                    protected_branches: policy.protected_branches,
+                    custom_branch_policies: policy.custom_branch_policies,
+                },
+            deployment_branch_policies: policy?.custom_branch_policies === true
+                ? await getDeploymentBranchPolicyNames(environment.name)
+                : [],
+        });
+    }));
+    return settings.toSorted((a, b) => a.name.localeCompare(b.name));
+};
+
+const getDeploymentBranchPolicyNames = async (environmentName) => {
+    const policies = await getDeploymentBranchPolicies(environmentName);
+    return policies.map(({ name, type }) => ({ name, type }));
+};
+
+export const getDeploymentBranchPolicies = async (environmentName) => {
+
+    const response = await octokit.request('GET /repos/{owner}/{repo}/environments/{environment_name}/deployment-branch-policies', {
+        owner: OWNER,
+        repo: REPO,
+        environment_name: environmentName,
+        headers: octokitHeaders,
+        per_page: 100,
+    });
+    return response.data.branch_policies.map((policy) => ({
+        id: policy.id ?? 0,
+        name: policy.name ?? '',
+        type: policy.type === 'tag' ? 'tag' : 'branch',
+    }));
+};
+
+
+
+
+
+
+
+
+const parseProtectionRules = (protectionRules) => {
+    const validationResult = ProtectionRules.validate(protectionRules ?? []);
+    if (Result.isErr(validationResult)) {
+        throw new Error(Arr.toUnshifted('GitHub が返した environment の protection_rules を読めませんでした。')(t.validationErrorsToMessages(validationResult.value)).join('\n'));
+    }
+    const rules = validationResult.value;
+    const waitTimer = rules.find((rule) => rule.type === 'wait_timer');
+    const requiredReviewers = rules.find((rule) => rule.type === 'required_reviewers');
+    return {
+        wait_timer: waitTimer?.wait_timer ?? 0,
+        prevent_self_review: requiredReviewers?.prevent_self_review ?? false,
+        reviewers: (requiredReviewers?.reviewers ?? []).map((entry) => ({
+            type: entry.type,
+            id: entry.reviewer.id,
+        })),
+    };
+};
+const ProtectionRules = t.array(t.record({
+    type: t.string(''),
+    wait_timer: t.optional(t.number(0)),
+    prevent_self_review: t.optional(t.boolean(false)),
+    reviewers: t.optional(t.array(t.record({
+        type: t.enumType(['User', 'Team'], {
+            typeName: 'EnvironmentReviewerType',
+            defaultValue: 'User',
+        }),
+
+
+        reviewer: t.record({ id: t.number(0) }),
+    }))),
+}), { typeName: 'EnvironmentProtectionRules' });
+//# sourceMappingURL=get-environments.mjs.map

package/dist/github/environments/api/get-environments.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-environments.mjs","sourceRoot":"","sources":["../../../../src/github/environments/api/get-environments.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AACpC,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,IAErC,EAAE;IACF,0EAA0E;IAC1E,EAAE;IACF,uCAAuC;IACvC,wCAAwC;IACxC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CACpC,wCAA+D,EAC/D,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,EAAE,CACrE,CAAC;IAEF,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IAEtD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,WAAW,CAAC,wBAAwB,IAAI,SAAS,CAAC;QAEjE,OAAO,mBAAmB,CAAC,IAAI,CAAC;YAC9B,IAAI,EAAE,WAAW,CAAC,IAAI;YACtB,GAAG,oBAAoB,CAAC,WAAW,CAAC,gBAAgB,CAAC;YACrD,wBAAwB,EACtB,MAAM,KAAK,SAAS;gBAClB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC;oBACE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;oBAC7C,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;iBACtD;YACP,0BAA0B,EACxB,MAAM,EAAE,sBAAsB,KAAK,IAAI;gBACrC,CAAC,CAAC,MAAM,8BAA8B,CAAC,WAAW,CAAC,IAAI,CAAC;gBACxD,CAAC,CAAC,EAAE;SACT,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC,CAAC;AAEF,4CAA4C;AAC5C,MAAM,8BAA8B,GAAG,KAAK,EAC1C,eAAuB,EACiD,EAAE;IAC1E,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,eAAe,CAAC,CAAC;IAEpE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC5D,CAAC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,EAC9C,eAAuB,EACqB,EAAE;IAC9C,2FAA2F;IAC3F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CACpC,sFAA6G,EAC7G;QACE,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,IAAI;QACV,gBAAgB,EAAE,eAAe;QACjC,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,GAAG;KACd,CACF,CAAC;IAEF,OAAO,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpD,EAAE,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;KAC/C,CAAC,CAAC,CAAC;AACN,CAAC,CAAC;AAQF;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAG,CAC3B,eAAwB,EAKvB,EAAE;IACH,MAAM,gBAAgB,GAAG,eAAe,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IAEzE,IAAI,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,GAAG,CAAC,WAAW,CACb,uDAAuD,CACxD,CAAC,CAAC,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAErC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;IAEnE,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAClC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,oBAAoB,CAC7C,CAAC;IAEF,OAAO;QACL,UAAU,EAAE,SAAS,EAAE,UAAU,IAAI,CAAC;QACtC,mBAAmB,EAAE,iBAAiB,EAAE,mBAAmB,IAAI,KAAK;QACpE,SAAS,EAAE,CAAC,iBAAiB,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC9D,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;SACtB,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAC7B,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;IAClB,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACnC,mBAAmB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,QAAQ,CACnB,CAAC,CAAC,KAAK,CACL,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE;YACjC,QAAQ,EAAE,yBAAyB;YACnC,YAAY,EAAE,MAAM;SACrB,CAAC;QACF,iDAAiD;QACjD,yCAAyC;QACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CACH,CACF;CACF,CAAC,EACF,EAAE,QAAQ,EAAE,4BAA4B,EAAE,CAC3C,CAAC"}

package/dist/github/environments/api/index.d.mts

@@ -0,0 +1,3 @@
+export * from './get-environments.mjs';
+export * from './set-environment.mjs';
+//# sourceMappingURL=index.d.mts.map

package/dist/github/environments/api/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../../../../src/github/environments/api/index.mts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC"}

package/dist/github/environments/api/index.mjs

@@ -0,0 +1,3 @@
+export * from './get-environments.mjs';
+export * from './set-environment.mjs';
+//# sourceMappingURL=index.mjs.map

package/dist/github/environments/api/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../../../src/github/environments/api/index.mts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC"}