github-settings-as-code 3.0.2 → 3.2.0

package/dist/github/environments/read-environment-contents.d.mts

@@ -0,0 +1,4 @@
+import { EnvironmentSettings } from './constants.mjs';
+export declare const readEnvironmentFiles: () => Promise<readonly EnvironmentSettings[]>;
+export declare const readEnvironmentBackupFiles: () => Promise<readonly EnvironmentSettings[]>;
+//# sourceMappingURL=read-environment-contents.d.mts.map

package/dist/github/environments/read-environment-contents.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-environment-contents.d.mts","sourceRoot":"","sources":["../../../src/github/environments/read-environment-contents.mts"],"names":[],"mappings":"AAMA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,eAAO,MAAM,oBAAoB,QAAa,OAAO,CACnD,SAAS,mBAAmB,EAAE,CACC,CAAC;AAElC,eAAO,MAAM,0BAA0B,QAAa,OAAO,CACzD,SAAS,mBAAmB,EAAE,CACuB,CAAC"}

package/dist/github/environments/read-environment-contents.mjs

@@ -0,0 +1,32 @@
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as t from 'ts-fortress';
+import { isDirectlyExecuted, Result } from 'ts-repo-utils';
+import { environmentsDir } from '../constants.mjs';
+import { EnvironmentSettings } from './constants.mjs';
+export const readEnvironmentFiles = async () => readFilesIn(environmentsDir);
+export const readEnvironmentBackupFiles = async () => readFilesIn(path.resolve(environmentsDir, './bk'));
+const readFilesIn = async (dir) => {
+
+    const files = await fs.readdir(dir, {
+        withFileTypes: true,
+    });
+    const fileContents = await Promise.all(files
+        .filter((d) => d.isFile())
+        .map((d) => 
+
+    fs.readFile(path.resolve(dir, d.name), { encoding: 'utf8' })));
+    const validationResults = fileContents.map((content) => EnvironmentSettings.validate(JSON.parse(content)));
+    const mut_values = [];
+    for (const r of validationResults) {
+        if (Result.isErr(r)) {
+            throw new Error(t.validationErrorsToMessages(r.value).join('\n'));
+        }
+        mut_values.push(r.value);
+    }
+    return mut_values;
+};
+if (isDirectlyExecuted(import.meta.url)) {
+    await readEnvironmentFiles();
+}
+//# sourceMappingURL=read-environment-contents.mjs.map

package/dist/github/environments/read-environment-contents.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-environment-contents.mjs","sourceRoot":"","sources":["../../../src/github/environments/read-environment-contents.mts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,IAEvC,EAAE,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;AAElC,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,IAE7C,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;AAExD,MAAM,WAAW,GAAG,KAAK,EACvB,GAAW,EAC8B,EAAE;IAC3C,mEAAmE;IACnE,MAAM,KAAK,GAA8B,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;QAC7D,aAAa,EAAE,IAAI;KACpB,CAAC,CAAC;IAEH,MAAM,YAAY,GAAsB,MAAM,OAAO,CAAC,GAAG,CACvD,KAAK;SACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;IACT,mEAAmE;IACnE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAC7D,CACJ,CAAC;IAEF,MAAM,iBAAiB,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACrD,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAClD,CAAC;IAEF,MAAM,UAAU,GAA0B,EAAE,CAAC;IAE7C,KAAK,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF,IAAI,kBAAkB,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,MAAM,oBAAoB,EAAE,CAAC;AAC/B,CAAC"}

package/dist/github/index.d.mts

@@ -1,8 +1,10 @@
 export * from './actions-settings/index.mjs';
 export * from './constants.mjs';
+export * from './environments/index.mjs';
 export * from './pages/index.mjs';
 export * from './repository/index.mjs';
 export * from './resolve-target-repo.mjs';
 export * from './ruleset/index.mjs';
 export * from './variables/index.mjs';
+export * from './vulnerability-alerts/index.mjs';
 //# sourceMappingURL=index.d.mts.map

package/dist/github/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../../src/github/index.mts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../../src/github/index.mts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iBAAiB,CAAC;AAChC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,kCAAkC,CAAC"}

package/dist/github/index.mjs

@@ -1,8 +1,10 @@
 export * from './actions-settings/index.mjs';
 export * from './constants.mjs';
+export * from './environments/index.mjs';
 export * from './pages/index.mjs';
 export * from './repository/index.mjs';
 export * from './resolve-target-repo.mjs';
 export * from './ruleset/index.mjs';
 export * from './variables/index.mjs';
+export * from './vulnerability-alerts/index.mjs';
 //# sourceMappingURL=index.mjs.map

package/dist/github/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../src/github/index.mts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../src/github/index.mts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iBAAiB,CAAC;AAChC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,kCAAkC,CAAC"}

package/dist/github/vulnerability-alerts/api/get-vulnerability-alerts.d.mts

@@ -0,0 +1,10 @@
+import { VulnerabilityAlertsSettings } from '../constants.mjs';
+/**
+ * Dependabot alerts が有効かどうかを取得する。
+ *
+ * このエンドポイントは body を返さない: 有効なら 204、無効なら 404。
+ * octokit は 404 を例外にするので、それを `enabled: false` として扱う。
+ * 「無効」と「読めなかった」は区別する必要があるため、 404 以外は投げ直す。
+ */
+export declare const getVulnerabilityAlerts: () => Promise<VulnerabilityAlertsSettings>;
+//# sourceMappingURL=get-vulnerability-alerts.d.mts.map

package/dist/github/vulnerability-alerts/api/get-vulnerability-alerts.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-vulnerability-alerts.d.mts","sourceRoot":"","sources":["../../../../src/github/vulnerability-alerts/api/get-vulnerability-alerts.mts"],"names":[],"mappings":"AAIA,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,QACvB,OAAO,CAAC,2BAA2B,CAgB5C,CAAC"}

package/dist/github/vulnerability-alerts/api/get-vulnerability-alerts.mjs

@@ -0,0 +1,25 @@
+import { hasKey, isRecord } from 'ts-data-forge';
+import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
+import { octokit } from '../../octokit.mjs';
+import { VulnerabilityAlertsSettings } from '../constants.mjs';
+
+
+
+
+
+
+
+export const getVulnerabilityAlerts = async () => {
+    try {
+
+        await octokit.request('GET /repos/{owner}/{repo}/vulnerability-alerts', { owner: OWNER, repo: REPO, headers: octokitHeaders });
+        return VulnerabilityAlertsSettings.fill({ enabled: true });
+    }
+    catch (error) {
+        if (isRecord(error) && hasKey(error, 'status') && error.status === 404) {
+            return VulnerabilityAlertsSettings.fill({ enabled: false });
+        }
+        throw error;
+    }
+};
+//# sourceMappingURL=get-vulnerability-alerts.mjs.map

package/dist/github/vulnerability-alerts/api/get-vulnerability-alerts.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-vulnerability-alerts.mjs","sourceRoot":"","sources":["../../../../src/github/vulnerability-alerts/api/get-vulnerability-alerts.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,KAAK,IAA0C,EAAE;IAC/C,IAAI,CAAC;QACH,sGAAsG;QACtG,MAAM,OAAO,CAAC,OAAO,CACnB,gDAAuE,EACvE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CACtD,CAAC;QAEF,OAAO,2BAA2B,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvE,OAAO,2BAA2B,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC"}

package/dist/github/vulnerability-alerts/api/index.d.mts

@@ -0,0 +1,3 @@
+export * from './get-vulnerability-alerts.mjs';
+export * from './set-vulnerability-alerts.mjs';
+//# sourceMappingURL=index.d.mts.map

package/dist/github/vulnerability-alerts/api/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../../../../src/github/vulnerability-alerts/api/index.mts"],"names":[],"mappings":"AAAA,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC"}

package/dist/github/vulnerability-alerts/api/index.mjs

@@ -0,0 +1,3 @@
+export * from './get-vulnerability-alerts.mjs';
+export * from './set-vulnerability-alerts.mjs';
+//# sourceMappingURL=index.mjs.map

package/dist/github/vulnerability-alerts/api/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../../../src/github/vulnerability-alerts/api/index.mts"],"names":[],"mappings":"AAAA,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC"}

package/dist/github/vulnerability-alerts/api/set-vulnerability-alerts.d.mts

@@ -0,0 +1,10 @@
+import { type VulnerabilityAlertsSettings } from '../constants.mjs';
+/**
+ * Dependabot alerts を JSON の内容に合わせる。
+ *
+ * 有効化と無効化で別メソッドなので、書き込みは 1 回で済むように分岐する。
+ * `enabled: false` はきちんと無効化する — 宣言が現状に合わせて黙るなら、
+ * ファイルを読んでも何が有効なのか分からなくなる。
+ */
+export declare const setVulnerabilityAlerts: (settings: VulnerabilityAlertsSettings) => Promise<void>;
+//# sourceMappingURL=set-vulnerability-alerts.d.mts.map

package/dist/github/vulnerability-alerts/api/set-vulnerability-alerts.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-vulnerability-alerts.d.mts","sourceRoot":"","sources":["../../../../src/github/vulnerability-alerts/api/set-vulnerability-alerts.mts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAEpE;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,aACvB,2BAA2B,KACpC,OAAO,CAAC,IAAI,CAgBd,CAAC"}

package/dist/github/vulnerability-alerts/api/set-vulnerability-alerts.mjs

@@ -0,0 +1,19 @@
+import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
+import { octokit } from '../../octokit.mjs';
+
+
+
+
+
+
+
+export const setVulnerabilityAlerts = async (settings) => {
+    if (settings.enabled) {
+
+        await octokit.request('PUT /repos/{owner}/{repo}/vulnerability-alerts', { owner: OWNER, repo: REPO, headers: octokitHeaders });
+        return;
+    }
+
+    await octokit.request('DELETE /repos/{owner}/{repo}/vulnerability-alerts', { owner: OWNER, repo: REPO, headers: octokitHeaders });
+};
+//# sourceMappingURL=set-vulnerability-alerts.mjs.map

package/dist/github/vulnerability-alerts/api/set-vulnerability-alerts.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-vulnerability-alerts.mjs","sourceRoot":"","sources":["../../../../src/github/vulnerability-alerts/api/set-vulnerability-alerts.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAG5C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EACzC,QAAqC,EACtB,EAAE;IACjB,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,uEAAuE;QACvE,MAAM,OAAO,CAAC,OAAO,CACnB,gDAAuE,EACvE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CACtD,CAAC;QAEF,OAAO;IACT,CAAC;IAED,wEAAwE;IACxE,MAAM,OAAO,CAAC,OAAO,CACnB,mDAA0E,EAC1E,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CACtD,CAAC;AACJ,CAAC,CAAC"}

package/dist/github/vulnerability-alerts/apply.d.mts

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import 'dotenv/config';
+/**
+ * `repo-settings/vulnerability-alerts/settings.json` を Dependabot alerts に反映する。
+ *
+ * 設定ファイルを置いていない repository では何もしない。 pages と同じ理由 —
+ * この package は他の repository からも使われるので、ファイルの不在を
+ * 「無効にせよ」と読むと、宣言していない設定を勝手に落としてしまう。
+ */
+export declare const applyVulnerabilityAlerts: () => Promise<void>;
+//# sourceMappingURL=apply.d.mts.map

package/dist/github/vulnerability-alerts/apply.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.mts","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/apply.mts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AAiBvB;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,QAAa,OAAO,CAAC,IAAI,CA4B7D,CAAC"}

package/dist/github/vulnerability-alerts/apply.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+import 'dotenv/config';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as t from 'ts-fortress';
+import { formatUncommittedFiles, isDirectlyExecuted, pathExists, Result, } from 'ts-repo-utils';
+import { settingsJsonName, vulnerabilityAlertsDir } from '../constants.mjs';
+import { getVulnerabilityAlerts, setVulnerabilityAlerts, } from './api/index.mjs';
+import { VulnerabilityAlertsSettings } from './constants.mjs';
+
+
+
+
+
+
+
+export const applyVulnerabilityAlerts = async () => {
+    const settingsPath = path.resolve(vulnerabilityAlertsDir, settingsJsonName);
+    if (!(await pathExists(settingsPath))) {
+        return;
+    }
+    const settings = await readSettings(settingsPath);
+    await setVulnerabilityAlerts(settings);
+
+    {
+        const applied = await getVulnerabilityAlerts();
+        const str = JSON.stringify(applied, undefined, 2);
+
+        await fs.writeFile(settingsPath, str);
+
+        await fs.writeFile(path.resolve(vulnerabilityAlertsDir, 'bk', settingsJsonName), str);
+        await formatUncommittedFiles();
+    }
+};
+const readSettings = async (settingsPath) => {
+
+    const settingsText = await fs.readFile(settingsPath, { encoding: 'utf8' });
+    const validationResult = VulnerabilityAlertsSettings.validate(JSON.parse(settingsText));
+    if (Result.isErr(validationResult)) {
+        throw new Error(t.validationErrorsToMessages(validationResult.value).join('\n'));
+    }
+    return validationResult.value;
+};
+if (isDirectlyExecuted(import.meta.url)) {
+    await applyVulnerabilityAlerts();
+}
+//# sourceMappingURL=apply.mjs.map

package/dist/github/vulnerability-alerts/apply.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.mjs","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/apply.mts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,UAAU,EACV,MAAM,GACP,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,IAAmB,EAAE;IAChE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,gBAAgB,CAAC,CAAC;IAE5E,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACtC,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;IAElD,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAEvC,0BAA0B;IAC1B,CAAC;QACC,MAAM,OAAO,GAAG,MAAM,sBAAsB,EAAE,CAAC;QAE/C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAElD,mEAAmE;QACnE,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAEtC,mEAAmE;QACnE,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,IAAI,EAAE,gBAAgB,CAAC,EAC5D,GAAG,CACJ,CAAC;QAEF,MAAM,sBAAsB,EAAE,CAAC;IACjC,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,KAAK,EACxB,YAAoB,EACkB,EAAE;IACxC,mEAAmE;IACnE,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAE3E,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,QAAQ,CAC3D,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CACzB,CAAC;IAEF,IAAI,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,CAAC,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAChE,CAAC;IACJ,CAAC;IAED,OAAO,gBAAgB,CAAC,KAAK,CAAC;AAChC,CAAC,CAAC;AAEF,IAAI,kBAAkB,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,MAAM,wBAAwB,EAAE,CAAC;AACnC,CAAC"}

package/dist/github/vulnerability-alerts/backup.d.mts

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import 'dotenv/config';
+/** Dependabot alerts の現在値を `bk/` に保存する。 */
+export declare const backupVulnerabilityAlerts: (fmt?: boolean) => Promise<void>;
+//# sourceMappingURL=backup.d.mts.map

package/dist/github/vulnerability-alerts/backup.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.d.mts","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/backup.mts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AAavB,2CAA2C;AAC3C,eAAO,MAAM,yBAAyB,SAC/B,OAAO,KACX,OAAO,CAAC,IAAI,CAcd,CAAC"}

package/dist/github/vulnerability-alerts/backup.mjs

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+import 'dotenv/config';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { formatUncommittedFiles, isDirectlyExecuted, makeEmptyDir, } from 'ts-repo-utils';
+import { settingsJsonName, vulnerabilityAlertsDir } from '../constants.mjs';
+import { getVulnerabilityAlerts } from './api/index.mjs';
+const backupDir = path.resolve(vulnerabilityAlertsDir, './bk');
+
+export const backupVulnerabilityAlerts = async (fmt = true) => {
+    await makeEmptyDir(backupDir);
+    const settings = await getVulnerabilityAlerts();
+
+    await fs.writeFile(path.resolve(backupDir, settingsJsonName), JSON.stringify(settings, undefined, 2));
+    if (fmt) {
+        await formatUncommittedFiles();
+    }
+};
+if (isDirectlyExecuted(import.meta.url)) {
+    await backupVulnerabilityAlerts();
+}
+//# sourceMappingURL=backup.mjs.map

package/dist/github/vulnerability-alerts/backup.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.mjs","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/backup.mts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;AAE/D,2CAA2C;AAC3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAC5C,GAAG,GAAY,IAAI,EACJ,EAAE;IACjB,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;IAE9B,MAAM,QAAQ,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAEhD,mEAAmE;IACnE,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,CAAC,EACzC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CACvC,CAAC;IAEF,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,sBAAsB,EAAE,CAAC;IACjC,CAAC;AACH,CAAC,CAAC;AAEF,IAAI,kBAAkB,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,MAAM,yBAAyB,EAAE,CAAC;AACpC,CAAC"}

package/dist/github/vulnerability-alerts/constants.d.mts

@@ -0,0 +1,72 @@
+import * as t from 'ts-fortress';
+/**
+ * `repo-settings/vulnerability-alerts/settings.json` の型。
+ *
+ * Settings > Advanced Security > Dependabot alerts に対応する。
+ *
+ * `security_and_analysis` とは別の API
+ * (`GET|PUT|DELETE /repos/{owner}/{repo}/vulnerability-alerts`) で、
+ * 値も JSON body ではなく 204 / 404 で返ってくる。そのため
+ * `repository-settings/settings.json` には載せられず、 pages と同じく
+ * 独立した設定ファイルにしている。
+ *
+ * `repository-settings/settings.json` の `dependabot_security_updates` は
+ * これとは別物 — あちらは「脆弱な依存を直す PR を自動で作るか」で、
+ * この repository では `pnpm-update` が lockfile を持っているため無効のまま。
+ * ここで管理するのは「既知の脆弱性を知らせるか」だけ。
+ */
+export declare const VulnerabilityAlertsSettings: Readonly<{
+    typeName: string;
+    defaultValue: Readonly<{
+        enabled: boolean;
+    }>;
+    is: (a: unknown) => a is Readonly<{
+        enabled: boolean;
+    }>;
+    assertIs: (a: unknown) => asserts a is Readonly<{
+        enabled: boolean;
+    }>;
+    cast: (a: unknown) => Readonly<{
+        enabled: boolean;
+    }>;
+    fill: (a: unknown) => Readonly<{
+        enabled: boolean;
+    }>;
+    prune: <B extends Readonly<{
+        enabled: boolean;
+    }>>(a: B) => Readonly<{
+        enabled: boolean;
+    }>;
+    validate: (a: unknown) => t.Result<Readonly<{
+        enabled: boolean;
+    }>, readonly Readonly<{
+        path: readonly string[];
+        actualValue: unknown;
+        expectedType: string;
+        typeName: string;
+        details?: t.ValidationErrorDetails | undefined;
+    }>[]>;
+    optional?: true;
+}> & Readonly<{
+    shape: {
+        readonly enabled: Readonly<{
+            typeName: string;
+            defaultValue: boolean;
+            is: (a: unknown) => a is boolean;
+            assertIs: (a: unknown) => asserts a is boolean;
+            cast: (a: unknown) => boolean;
+            fill: (a: unknown) => boolean;
+            prune: <B extends boolean>(a: B) => boolean;
+            validate: (a: unknown) => t.Result<boolean, readonly Readonly<{
+                path: readonly string[];
+                actualValue: unknown;
+                expectedType: string;
+                typeName: string;
+                details?: t.ValidationErrorDetails | undefined;
+            }>[]>;
+            optional?: true;
+        }>;
+    };
+}>;
+export type VulnerabilityAlertsSettings = t.TypeOf<typeof VulnerabilityAlertsSettings>;
+//# sourceMappingURL=constants.d.mts.map

package/dist/github/vulnerability-alerts/constants.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.mts","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/constants.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEtC,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAChD,OAAO,2BAA2B,CACnC,CAAC"}

package/dist/github/vulnerability-alerts/constants.mjs

@@ -0,0 +1,21 @@
+import * as t from 'ts-fortress';
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+export const VulnerabilityAlertsSettings = t.record({
+    enabled: t.boolean(false),
+});
+//# sourceMappingURL=constants.mjs.map

package/dist/github/vulnerability-alerts/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/constants.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1B,CAAC,CAAC"}

package/dist/github/vulnerability-alerts/index.d.mts

@@ -0,0 +1,5 @@
+export * from './api/index.mjs';
+export * from './apply.mjs';
+export * from './backup.mjs';
+export * from './constants.mjs';
+//# sourceMappingURL=index.d.mts.map

package/dist/github/vulnerability-alerts/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/index.mts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC"}

package/dist/github/vulnerability-alerts/index.mjs

@@ -0,0 +1,5 @@
+export * from './api/index.mjs';
+export * from './apply.mjs';
+export * from './backup.mjs';
+export * from './constants.mjs';
+//# sourceMappingURL=index.mjs.map

package/dist/github/vulnerability-alerts/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/index.mts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "github-settings-as-code",
-  "version": "3.0.2",
+  "version": "3.2.0",
   "private": false,
   "keywords": [
     "github",
@@ -29,37 +29,37 @@
     "dedent": "^1.7.2",
     "dotenv": "^17.4.2",
     "octokit-safe-types": "^1.2.28",
-    "ts-data-forge": "^14.6.3",
-    "ts-fortress": "^12.1.1",
-    "ts-repo-utils": "^10.6.0",
+    "ts-data-forge": "^14.7.1",
+    "ts-fortress": "^12.1.3",
+    "ts-repo-utils": "^10.6.2",
     "ts-type-forge": "^9.2.2"
   },
   "devDependencies": {
-    "@types/node": "26.4.1",
-    "@vitest/coverage-v8": "4.1.11",
-    "@vitest/ui": "4.1.11",
-    "cspell": "10.1.1",
+    "@types/node": "26.5.0",
+    "@vitest/coverage-v8": "5.0.0",
+    "@vitest/ui": "5.0.0",
+    "cspell": "10.2.1",
     "eslint": "10.9.1",
-    "eslint-config-typed": "5.11.2",
-    "eslint-plugin-ts-data-forge": "0.7.0",
-    "eslint-plugin-ts-fortress": "1.2.0",
-    "eslint-plugin-ts-type-forge": "0.8.1",
+    "eslint-config-typed": "5.11.7",
+    "eslint-plugin-ts-data-forge": "0.7.4",
+    "eslint-plugin-ts-fortress": "1.2.2",
+    "eslint-plugin-ts-type-forge": "0.8.3",
     "jiti": "2.7.0",
     "npm-run-all2": "9.0.3",
     "prettier": "3.9.6",
     "prettier-plugin-organize-imports": "4.3.0",
     "prettier-plugin-packagejson": "3.0.2",
-    "tsx": "4.23.12",
+    "tsx": "4.23.13",
     "typescript": "6.0.3",
     "typescript-native": "npm:typescript@7.0.2",
-    "vitest": "4.1.11"
+    "vitest": "5.0.0"
   },
   "engines": {
     "node": ">=22.22.2",
     "pnpm": ">=9.0.0"
   },
   "volta": {
-    "node": "26.3.1"
+    "node": "26.8.1"
   },
   "publishConfig": {
     "access": "public",

package/src/cmd/repo-settings.mts

@@ -22,6 +22,9 @@ const HELP = dedent`
     variables          repository variables （ apply のみ ）
     actions            repo-settings/actions-settings/settings.json
     pages              repo-settings/pages/settings.json
+    environments       repo-settings/environments/*.json
+    vulnerability-alerts
+                       repo-settings/vulnerability-alerts/settings.json
 
   Options:
         --owner <owner>   対象の owner
@@ -54,6 +57,8 @@ const TARGETS = [
   'variables',
   'actions',
   'pages',
+  'environments',
+  'vulnerability-alerts',
 ] as const;
 
 type Target = (typeof TARGETS)[number];
@@ -125,12 +130,18 @@ const runners: ReadonlyRecord<
       await github.applyActionsSettings();
 
       await github.applyPagesSettings();
+
+      await github.applyEnvironments();
+
+      await github.applyVulnerabilityAlerts();
     },
     repository: github.applyRepositorySettings,
     rulesets: github.applyRulesets,
     variables: github.applyVariables,
     actions: github.applyActionsSettings,
     pages: github.applyPagesSettings,
+    environments: github.applyEnvironments,
+    'vulnerability-alerts': github.applyVulnerabilityAlerts,
   },
   backup: {
     all: async () => {
@@ -141,11 +152,17 @@ const runners: ReadonlyRecord<
       await github.backupActionsSettings();
 
       await github.backupPagesSettings();
+
+      await github.backupEnvironments();
+
+      await github.backupVulnerabilityAlerts();
     },
     repository: github.backupRepositorySettings,
     rulesets: github.backupRulesets,
     actions: github.backupActionsSettings,
     pages: github.backupPagesSettings,
+    environments: github.backupEnvironments,
+    'vulnerability-alerts': github.backupVulnerabilityAlerts,
   },
 } as const;
 

package/src/github/actions-settings/api/get-actions-settings.mts

@@ -6,7 +6,7 @@ import { ActionsSettings } from '../constants.mjs';
 /**
  * Settings > Actions > General の現在値を取得する。
  *
- * 2 つのエンドポイントの結果を 1 つのオブジェクトにまとめる。
+ * 3 つのエンドポイントの結果を 1 つのオブジェクトにまとめる。
  */
 export const getActionsSettings = async (): Promise<ActionsSettings> => {
   // https://docs.github.com/rest/actions/permissions#get-github-actions-permissions-for-a-repository
@@ -15,6 +15,12 @@ export const getActionsSettings = async (): Promise<ActionsSettings> => {
     { owner: OWNER, repo: REPO, headers: octokitHeaders },
   );
 
+  // https://docs.github.com/rest/actions/permissions#get-default-workflow-permissions-for-a-repository
+  const workflowPermissions = await octokit.request(
+    'GET /repos/{owner}/{repo}/actions/permissions/workflow' satisfies EndpointKeys,
+    { owner: OWNER, repo: REPO, headers: octokitHeaders },
+  );
+
   // https://docs.github.com/rest/actions/permissions#get-fork-pr-contributor-approval-permissions-for-a-repository
   const forkPrApproval = await octokit.request(
     'GET /repos/{owner}/{repo}/actions/permissions/fork-pr-contributor-approval' satisfies EndpointKeys,
@@ -25,6 +31,10 @@ export const getActionsSettings = async (): Promise<ActionsSettings> => {
     enabled: permissions.data.enabled,
     allowed_actions: permissions.data.allowed_actions,
     sha_pinning_required: permissions.data.sha_pinning_required,
+    default_workflow_permissions:
+      workflowPermissions.data.default_workflow_permissions,
+    can_approve_pull_request_reviews:
+      workflowPermissions.data.can_approve_pull_request_reviews,
     fork_pr_contributor_approval_policy: forkPrApproval.data.approval_policy,
   });
 };

package/src/github/actions-settings/api/set-actions-settings.mts

@@ -26,6 +26,19 @@ export const setActionsSettings = async (
     permissionsParams,
   );
 
+  // https://docs.github.com/rest/actions/permissions#set-default-workflow-permissions-for-a-repository
+  await octokit.request(
+    'PUT /repos/{owner}/{repo}/actions/permissions/workflow' satisfies EndpointKeys,
+    {
+      owner: OWNER,
+      repo: REPO,
+      headers: octokitHeaders,
+      default_workflow_permissions: settings.default_workflow_permissions,
+      can_approve_pull_request_reviews:
+        settings.can_approve_pull_request_reviews,
+    },
+  );
+
   // https://docs.github.com/rest/actions/permissions#set-fork-pr-contributor-approval-permissions-for-a-repository
   await octokit.request(
     'PUT /repos/{owner}/{repo}/actions/permissions/fork-pr-contributor-approval' satisfies EndpointKeys,

package/src/github/actions-settings/constants.mts

@@ -7,6 +7,7 @@ import * as t from 'ts-fortress';
  * 管理する:
  *
  * - `GET|PUT /repos/{owner}/{repo}/actions/permissions`
+ * - `GET|PUT /repos/{owner}/{repo}/actions/permissions/workflow`
  * - `GET|PUT /repos/{owner}/{repo}/actions/permissions/fork-pr-contributor-approval`
  */
 export const ActionsSettings = t.record({
@@ -27,6 +28,29 @@ export const ActionsSettings = t.record({
    */
   sha_pinning_required: t.boolean(false),
 
+  /**
+   * 「 Workflow permissions 」。 job が `permissions` を宣言しなかったときに
+   * `GITHUB_TOKEN` が受け取る既定値。
+   *
+   * `read` にできるのは、 workflow 側が全て明示的に `permissions` を宣言して
+   * いる場合だけ。宣言の無い job はこの既定値をそのまま受け取るため、
+   * `write` のままだと「 branch の中身が何であれ書き込めるトークン」が
+   * 渡る。 .github/workflows/type-check.yml 冒頭の注記を参照。
+   */
+  default_workflow_permissions: t.enumType(['read', 'write'], {
+    typeName: 'DefaultWorkflowPermissions',
+    defaultValue: 'read',
+  }),
+
+  /**
+   * 「 Allow GitHub Actions to create and approve pull requests 」。
+   *
+   * `main` の ruleset は `required_approving_review_count` が 0 なので
+   * 承認そのものは merge 条件ではないが、 Actions に PR を作らせる必要が
+   * あるのは App token を使う workflow だけで、 `GITHUB_TOKEN` には要らない。
+   */
+  can_approve_pull_request_reviews: t.boolean(false),
+
   /**
    * 「 Approval for running fork pull request workflows from contributors 」。
    *