github-settings-as-code 3.1.0 → 3.2.0

package/dist/github/vulnerability-alerts/apply.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+import 'dotenv/config';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as t from 'ts-fortress';
+import { formatUncommittedFiles, isDirectlyExecuted, pathExists, Result, } from 'ts-repo-utils';
+import { settingsJsonName, vulnerabilityAlertsDir } from '../constants.mjs';
+import { getVulnerabilityAlerts, setVulnerabilityAlerts, } from './api/index.mjs';
+import { VulnerabilityAlertsSettings } from './constants.mjs';
+
+
+
+
+
+
+
+export const applyVulnerabilityAlerts = async () => {
+    const settingsPath = path.resolve(vulnerabilityAlertsDir, settingsJsonName);
+    if (!(await pathExists(settingsPath))) {
+        return;
+    }
+    const settings = await readSettings(settingsPath);
+    await setVulnerabilityAlerts(settings);
+
+    {
+        const applied = await getVulnerabilityAlerts();
+        const str = JSON.stringify(applied, undefined, 2);
+
+        await fs.writeFile(settingsPath, str);
+
+        await fs.writeFile(path.resolve(vulnerabilityAlertsDir, 'bk', settingsJsonName), str);
+        await formatUncommittedFiles();
+    }
+};
+const readSettings = async (settingsPath) => {
+
+    const settingsText = await fs.readFile(settingsPath, { encoding: 'utf8' });
+    const validationResult = VulnerabilityAlertsSettings.validate(JSON.parse(settingsText));
+    if (Result.isErr(validationResult)) {
+        throw new Error(t.validationErrorsToMessages(validationResult.value).join('\n'));
+    }
+    return validationResult.value;
+};
+if (isDirectlyExecuted(import.meta.url)) {
+    await applyVulnerabilityAlerts();
+}
+//# sourceMappingURL=apply.mjs.map

package/dist/github/vulnerability-alerts/apply.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.mjs","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/apply.mts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,UAAU,EACV,MAAM,GACP,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,IAAmB,EAAE;IAChE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,gBAAgB,CAAC,CAAC;IAE5E,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACtC,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;IAElD,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAEvC,0BAA0B;IAC1B,CAAC;QACC,MAAM,OAAO,GAAG,MAAM,sBAAsB,EAAE,CAAC;QAE/C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAElD,mEAAmE;QACnE,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAEtC,mEAAmE;QACnE,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,IAAI,EAAE,gBAAgB,CAAC,EAC5D,GAAG,CACJ,CAAC;QAEF,MAAM,sBAAsB,EAAE,CAAC;IACjC,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,KAAK,EACxB,YAAoB,EACkB,EAAE;IACxC,mEAAmE;IACnE,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAE3E,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,QAAQ,CAC3D,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CACzB,CAAC;IAEF,IAAI,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,CAAC,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAChE,CAAC;IACJ,CAAC;IAED,OAAO,gBAAgB,CAAC,KAAK,CAAC;AAChC,CAAC,CAAC;AAEF,IAAI,kBAAkB,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,MAAM,wBAAwB,EAAE,CAAC;AACnC,CAAC"}

package/dist/github/vulnerability-alerts/backup.d.mts

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import 'dotenv/config';
+/** Dependabot alerts の現在値を `bk/` に保存する。 */
+export declare const backupVulnerabilityAlerts: (fmt?: boolean) => Promise<void>;
+//# sourceMappingURL=backup.d.mts.map

package/dist/github/vulnerability-alerts/backup.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.d.mts","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/backup.mts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AAavB,2CAA2C;AAC3C,eAAO,MAAM,yBAAyB,SAC/B,OAAO,KACX,OAAO,CAAC,IAAI,CAcd,CAAC"}

package/dist/github/vulnerability-alerts/backup.mjs

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+import 'dotenv/config';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { formatUncommittedFiles, isDirectlyExecuted, makeEmptyDir, } from 'ts-repo-utils';
+import { settingsJsonName, vulnerabilityAlertsDir } from '../constants.mjs';
+import { getVulnerabilityAlerts } from './api/index.mjs';
+const backupDir = path.resolve(vulnerabilityAlertsDir, './bk');
+
+export const backupVulnerabilityAlerts = async (fmt = true) => {
+    await makeEmptyDir(backupDir);
+    const settings = await getVulnerabilityAlerts();
+
+    await fs.writeFile(path.resolve(backupDir, settingsJsonName), JSON.stringify(settings, undefined, 2));
+    if (fmt) {
+        await formatUncommittedFiles();
+    }
+};
+if (isDirectlyExecuted(import.meta.url)) {
+    await backupVulnerabilityAlerts();
+}
+//# sourceMappingURL=backup.mjs.map

package/dist/github/vulnerability-alerts/backup.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.mjs","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/backup.mts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;AAE/D,2CAA2C;AAC3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAC5C,GAAG,GAAY,IAAI,EACJ,EAAE;IACjB,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;IAE9B,MAAM,QAAQ,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAEhD,mEAAmE;IACnE,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,CAAC,EACzC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CACvC,CAAC;IAEF,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,sBAAsB,EAAE,CAAC;IACjC,CAAC;AACH,CAAC,CAAC;AAEF,IAAI,kBAAkB,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,MAAM,yBAAyB,EAAE,CAAC;AACpC,CAAC"}

package/dist/github/vulnerability-alerts/constants.d.mts

@@ -0,0 +1,72 @@
+import * as t from 'ts-fortress';
+/**
+ * `repo-settings/vulnerability-alerts/settings.json` の型。
+ *
+ * Settings > Advanced Security > Dependabot alerts に対応する。
+ *
+ * `security_and_analysis` とは別の API
+ * (`GET|PUT|DELETE /repos/{owner}/{repo}/vulnerability-alerts`) で、
+ * 値も JSON body ではなく 204 / 404 で返ってくる。そのため
+ * `repository-settings/settings.json` には載せられず、 pages と同じく
+ * 独立した設定ファイルにしている。
+ *
+ * `repository-settings/settings.json` の `dependabot_security_updates` は
+ * これとは別物 — あちらは「脆弱な依存を直す PR を自動で作るか」で、
+ * この repository では `pnpm-update` が lockfile を持っているため無効のまま。
+ * ここで管理するのは「既知の脆弱性を知らせるか」だけ。
+ */
+export declare const VulnerabilityAlertsSettings: Readonly<{
+    typeName: string;
+    defaultValue: Readonly<{
+        enabled: boolean;
+    }>;
+    is: (a: unknown) => a is Readonly<{
+        enabled: boolean;
+    }>;
+    assertIs: (a: unknown) => asserts a is Readonly<{
+        enabled: boolean;
+    }>;
+    cast: (a: unknown) => Readonly<{
+        enabled: boolean;
+    }>;
+    fill: (a: unknown) => Readonly<{
+        enabled: boolean;
+    }>;
+    prune: <B extends Readonly<{
+        enabled: boolean;
+    }>>(a: B) => Readonly<{
+        enabled: boolean;
+    }>;
+    validate: (a: unknown) => t.Result<Readonly<{
+        enabled: boolean;
+    }>, readonly Readonly<{
+        path: readonly string[];
+        actualValue: unknown;
+        expectedType: string;
+        typeName: string;
+        details?: t.ValidationErrorDetails | undefined;
+    }>[]>;
+    optional?: true;
+}> & Readonly<{
+    shape: {
+        readonly enabled: Readonly<{
+            typeName: string;
+            defaultValue: boolean;
+            is: (a: unknown) => a is boolean;
+            assertIs: (a: unknown) => asserts a is boolean;
+            cast: (a: unknown) => boolean;
+            fill: (a: unknown) => boolean;
+            prune: <B extends boolean>(a: B) => boolean;
+            validate: (a: unknown) => t.Result<boolean, readonly Readonly<{
+                path: readonly string[];
+                actualValue: unknown;
+                expectedType: string;
+                typeName: string;
+                details?: t.ValidationErrorDetails | undefined;
+            }>[]>;
+            optional?: true;
+        }>;
+    };
+}>;
+export type VulnerabilityAlertsSettings = t.TypeOf<typeof VulnerabilityAlertsSettings>;
+//# sourceMappingURL=constants.d.mts.map

package/dist/github/vulnerability-alerts/constants.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.mts","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/constants.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEtC,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAChD,OAAO,2BAA2B,CACnC,CAAC"}

package/dist/github/vulnerability-alerts/constants.mjs

@@ -0,0 +1,21 @@
+import * as t from 'ts-fortress';
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+export const VulnerabilityAlertsSettings = t.record({
+    enabled: t.boolean(false),
+});
+//# sourceMappingURL=constants.mjs.map

package/dist/github/vulnerability-alerts/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/constants.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1B,CAAC,CAAC"}

package/dist/github/vulnerability-alerts/index.d.mts

@@ -0,0 +1,5 @@
+export * from './api/index.mjs';
+export * from './apply.mjs';
+export * from './backup.mjs';
+export * from './constants.mjs';
+//# sourceMappingURL=index.d.mts.map

package/dist/github/vulnerability-alerts/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/index.mts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC"}

package/dist/github/vulnerability-alerts/index.mjs

@@ -0,0 +1,5 @@
+export * from './api/index.mjs';
+export * from './apply.mjs';
+export * from './backup.mjs';
+export * from './constants.mjs';
+//# sourceMappingURL=index.mjs.map

package/dist/github/vulnerability-alerts/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/index.mts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "github-settings-as-code",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "private": false,
   "keywords": [
     "github",

package/src/cmd/repo-settings.mts

@@ -22,6 +22,9 @@ const HELP = dedent`
     variables          repository variables （ apply のみ ）
     actions            repo-settings/actions-settings/settings.json
     pages              repo-settings/pages/settings.json
+    environments       repo-settings/environments/*.json
+    vulnerability-alerts
+                       repo-settings/vulnerability-alerts/settings.json
 
   Options:
         --owner <owner>   対象の owner
@@ -54,6 +57,8 @@ const TARGETS = [
   'variables',
   'actions',
   'pages',
+  'environments',
+  'vulnerability-alerts',
 ] as const;
 
 type Target = (typeof TARGETS)[number];
@@ -125,12 +130,18 @@ const runners: ReadonlyRecord<
       await github.applyActionsSettings();
 
       await github.applyPagesSettings();
+
+      await github.applyEnvironments();
+
+      await github.applyVulnerabilityAlerts();
     },
     repository: github.applyRepositorySettings,
     rulesets: github.applyRulesets,
     variables: github.applyVariables,
     actions: github.applyActionsSettings,
     pages: github.applyPagesSettings,
+    environments: github.applyEnvironments,
+    'vulnerability-alerts': github.applyVulnerabilityAlerts,
   },
   backup: {
     all: async () => {
@@ -141,11 +152,17 @@ const runners: ReadonlyRecord<
       await github.backupActionsSettings();
 
       await github.backupPagesSettings();
+
+      await github.backupEnvironments();
+
+      await github.backupVulnerabilityAlerts();
     },
     repository: github.backupRepositorySettings,
     rulesets: github.backupRulesets,
     actions: github.backupActionsSettings,
     pages: github.backupPagesSettings,
+    environments: github.backupEnvironments,
+    'vulnerability-alerts': github.backupVulnerabilityAlerts,
   },
 } as const;
 

package/src/github/constants.mts

@@ -25,6 +25,13 @@ export const actionsSettingsDir = path.resolve(
 
 export const pagesSettingsDir = path.resolve(settingsDir, './pages');
 
+export const environmentsDir = path.resolve(settingsDir, './environments');
+
+export const vulnerabilityAlertsDir = path.resolve(
+  settingsDir,
+  './vulnerability-alerts',
+);
+
 export const rulesetsDir = path.resolve(settingsDir, './rulesets');
 
 export const octokitHeaders = {

package/src/github/environments/api/get-environments.mts

@@ -0,0 +1,155 @@
+import { type EndpointKeys } from 'octokit-safe-types';
+import { Arr } from 'ts-data-forge';
+import * as t from 'ts-fortress';
+import { Result } from 'ts-repo-utils';
+import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
+import { octokit } from '../../octokit.mjs';
+import { EnvironmentSettings } from '../constants.mjs';
+
+/**
+ * Settings > Environments の現在値を、宣言ファイルと同じ形にして返す。
+ *
+ * 名前順に整える。 GitHub が返す順は作成順で、環境を 1 つ足しただけで
+ * `bk/` の中身が並び替わると差分が読めなくなるため。
+ */
+export const getAllEnvironments = async (): Promise<
+  readonly EnvironmentSettings[]
+> => {
+  // https://docs.github.com/rest/deployments/environments#list-environments
+  //
+  // per_page の上限。環境は数個しか無く、 2 ページ目が要る状況は
+  // 「 GUI で何かが大量に作られた」ときだけなので、ページングは張らない。
+  const response = await octokit.request(
+    'GET /repos/{owner}/{repo}/environments' satisfies EndpointKeys,
+    { owner: OWNER, repo: REPO, headers: octokitHeaders, per_page: 100 },
+  );
+
+  const environments = response.data.environments ?? [];
+
+  const settings = await Promise.all(
+    environments.map(async (environment) => {
+      const policy = environment.deployment_branch_policy ?? undefined;
+
+      return EnvironmentSettings.fill({
+        name: environment.name,
+        ...parseProtectionRules(environment.protection_rules),
+        deployment_branch_policy:
+          policy === undefined
+            ? null
+            : {
+                protected_branches: policy.protected_branches,
+                custom_branch_policies: policy.custom_branch_policies,
+              },
+        deployment_branch_policies:
+          policy?.custom_branch_policies === true
+            ? await getDeploymentBranchPolicyNames(environment.name)
+            : [],
+      });
+    }),
+  );
+
+  return settings.toSorted((a, b) => a.name.localeCompare(b.name));
+};
+
+/** 宣言ファイルに載る形。 `id` は GitHub 側の都合なので落とす。 */
+const getDeploymentBranchPolicyNames = async (
+  environmentName: string,
+): Promise<readonly Readonly<{ name: string; type: 'branch' | 'tag' }>[]> => {
+  const policies = await getDeploymentBranchPolicies(environmentName);
+
+  return policies.map(({ name, type }) => ({ name, type }));
+};
+
+/** 「 Selected branches and tags 」に登録されている pattern を列挙する。 */
+export const getDeploymentBranchPolicies = async (
+  environmentName: string,
+): Promise<readonly DeploymentBranchPolicy[]> => {
+  // https://docs.github.com/rest/deployments/branch-policies#list-deployment-branch-policies
+  const response = await octokit.request(
+    'GET /repos/{owner}/{repo}/environments/{environment_name}/deployment-branch-policies' satisfies EndpointKeys,
+    {
+      owner: OWNER,
+      repo: REPO,
+      environment_name: environmentName,
+      headers: octokitHeaders,
+      per_page: 100,
+    },
+  );
+
+  return response.data.branch_policies.map((policy) => ({
+    id: policy.id ?? 0,
+    name: policy.name ?? '',
+    type: policy.type === 'tag' ? 'tag' : 'branch',
+  }));
+};
+
+export type DeploymentBranchPolicy = Readonly<{
+  id: number;
+  name: string;
+  type: 'branch' | 'tag';
+}>;
+
+/**
+ * GET が返す `protection_rules` を PUT の body の形に戻す。
+ *
+ * GitHub は有効な保護ルールだけを配列で返し、その要素の `type` は openapi の
+ * 型定義では素の `string` — つまり判別可能 union になっていないので、絞り込みが
+ * 効かない。実データを ts-fortress で読み直すほうが、上流の型に合わせて
+ * キャストを書くより素直で、形が変わったときに黙って通り過ぎることもない。
+ */
+const parseProtectionRules = (
+  protectionRules: unknown,
+): Readonly<{
+  wait_timer: number;
+  prevent_self_review: boolean;
+  reviewers: readonly Readonly<{ type: 'User' | 'Team'; id: number }>[];
+}> => {
+  const validationResult = ProtectionRules.validate(protectionRules ?? []);
+
+  if (Result.isErr(validationResult)) {
+    throw new Error(
+      Arr.toUnshifted(
+        'GitHub が返した environment の protection_rules を読めませんでした。',
+      )(t.validationErrorsToMessages(validationResult.value)).join('\n'),
+    );
+  }
+
+  const rules = validationResult.value;
+
+  const waitTimer = rules.find((rule) => rule.type === 'wait_timer');
+
+  const requiredReviewers = rules.find(
+    (rule) => rule.type === 'required_reviewers',
+  );
+
+  return {
+    wait_timer: waitTimer?.wait_timer ?? 0,
+    prevent_self_review: requiredReviewers?.prevent_self_review ?? false,
+    reviewers: (requiredReviewers?.reviewers ?? []).map((entry) => ({
+      type: entry.type,
+      id: entry.reviewer.id,
+    })),
+  };
+};
+
+const ProtectionRules = t.array(
+  t.record({
+    type: t.string(''),
+    wait_timer: t.optional(t.number(0)),
+    prevent_self_review: t.optional(t.boolean(false)),
+    reviewers: t.optional(
+      t.array(
+        t.record({
+          type: t.enumType(['User', 'Team'], {
+            typeName: 'EnvironmentReviewerType',
+            defaultValue: 'User',
+          }),
+          // `reviewer` は User / Team の完全な表現だが、書き戻しに要るのは id
+          // だけ。 record は既定で余剰キーを通すので、残りはそのまま無視される。
+          reviewer: t.record({ id: t.number(0) }),
+        }),
+      ),
+    ),
+  }),
+  { typeName: 'EnvironmentProtectionRules' },
+);

package/src/github/environments/api/index.mts

@@ -0,0 +1,2 @@
+export * from './get-environments.mjs';
+export * from './set-environment.mjs';

package/src/github/environments/api/set-environment.mts

@@ -0,0 +1,106 @@
+import { type EndpointKeys } from 'octokit-safe-types';
+import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
+import { octokit } from '../../octokit.mjs';
+import { type EnvironmentSettings } from '../constants.mjs';
+import { getDeploymentBranchPolicies } from './get-environments.mjs';
+
+/**
+ * 環境を JSON の内容に合わせる。無ければ作られる。
+ *
+ * `PUT` は保護ルールを丸ごと置き換えるので、省いたキーは「変更しない」ではなく
+ * 「無効にする」になる。宣言ファイルをそのまま渡しているのはそのため —
+ * 部分更新にすると、ファイルから消した設定が GitHub 側に残る。
+ */
+export const setEnvironment = async (
+  settings: EnvironmentSettings,
+): Promise<void> => {
+  // https://docs.github.com/rest/deployments/environments#create-or-update-an-environment
+  await octokit.request(
+    'PUT /repos/{owner}/{repo}/environments/{environment_name}' satisfies EndpointKeys,
+    {
+      owner: OWNER,
+      repo: REPO,
+      environment_name: settings.name,
+      headers: octokitHeaders,
+      wait_timer: settings.wait_timer,
+      prevent_self_review: settings.prevent_self_review,
+      reviewers: settings.reviewers.map((reviewer) => ({
+        type: reviewer.type,
+        id: reviewer.id,
+      })),
+      deployment_branch_policy:
+        settings.deployment_branch_policy === null
+          ? null
+          : {
+              protected_branches:
+                settings.deployment_branch_policy.protected_branches,
+              custom_branch_policies:
+                settings.deployment_branch_policy.custom_branch_policies,
+            },
+    },
+  );
+
+  await setDeploymentBranchPolicies(settings);
+};
+
+/**
+ * 「 Selected branches and tags 」の pattern を宣言に合わせる。
+ *
+ * 個別の追加・削除しか無いエンドポイントなので、現在値との差分を取って埋める。
+ * 名前と種別が一致するものは触らない — 消して作り直すと id が変わり、
+ * その間だけ deploy できない ref ができる。
+ */
+const keyOf = (policy: Readonly<{ name: string; type: string }>): string =>
+  `${policy.type}:${policy.name}` as const;
+
+const setDeploymentBranchPolicies = async (
+  settings: EnvironmentSettings,
+): Promise<void> => {
+  if (settings.deployment_branch_policy?.custom_branch_policies !== true) {
+    // 選択されていないなら pattern は存在し得ない。 PUT 側が既に消している。
+    return;
+  }
+
+  const current = await getDeploymentBranchPolicies(settings.name);
+
+  const desiredKeys: ReadonlySet<string> = new Set(
+    settings.deployment_branch_policies.map(keyOf),
+  );
+
+  const currentKeys: ReadonlySet<string> = new Set(current.map(keyOf));
+
+  const toDelete = current.filter((p) => !desiredKeys.has(keyOf(p)));
+
+  const toCreate = settings.deployment_branch_policies.filter(
+    (p) => !currentKeys.has(keyOf(p)),
+  );
+
+  for (const policy of toDelete) {
+    // https://docs.github.com/rest/deployments/branch-policies#delete-a-deployment-branch-policy
+    await octokit.request(
+      'DELETE /repos/{owner}/{repo}/environments/{environment_name}/deployment-branch-policies/{branch_policy_id}' satisfies EndpointKeys,
+      {
+        owner: OWNER,
+        repo: REPO,
+        environment_name: settings.name,
+        branch_policy_id: policy.id,
+        headers: octokitHeaders,
+      },
+    );
+  }
+
+  for (const policy of toCreate) {
+    // https://docs.github.com/rest/deployments/branch-policies#create-a-deployment-branch-policy
+    await octokit.request(
+      'POST /repos/{owner}/{repo}/environments/{environment_name}/deployment-branch-policies' satisfies EndpointKeys,
+      {
+        owner: OWNER,
+        repo: REPO,
+        environment_name: settings.name,
+        headers: octokitHeaders,
+        name: policy.name,
+        type: policy.type,
+      },
+    );
+  }
+};

package/src/github/environments/apply.mts

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+import 'dotenv/config';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { Arr } from 'ts-data-forge';
+import { isDirectlyExecuted } from 'ts-repo-utils';
+import { environmentsDir } from '../constants.mjs';
+import { getAllEnvironments, setEnvironment } from './api/index.mjs';
+import { backupEnvironments } from './backup.mjs';
+import { type EnvironmentSettings } from './constants.mjs';
+import { readEnvironmentFiles } from './read-environment-contents.mjs';
+
+/**
+ * `repo-settings/environments/*.json` を Settings > Environments に反映する。
+ *
+ * ruleset と同じく、宣言に無い環境は消さない。 GUI で作られたものが `bk/` に
+ * 現れることが drift の見え方であって、 apply が黙って片付けてしまうと
+ * 「いつ誰が何を作ったか」を見る機会がなくなる。
+ */
+export const applyEnvironments = async (): Promise<void> => {
+  await backupEnvironments(false);
+
+  const environments = await readEnvironmentFiles();
+
+  for (const environment of environments) {
+    assertConsistent(environment);
+  }
+
+  for (const environment of environments) {
+    await setEnvironment(environment);
+  }
+
+  // 反映後の実際の値でローカルのファイルを更新する
+  {
+    const applied = await getAllEnvironments();
+
+    for (const environment of applied) {
+      const str = JSON.stringify(environment, undefined, 2);
+
+      // eslint-disable-next-line security/detect-non-literal-fs-filename
+      await fs.writeFile(
+        path.resolve(environmentsDir, `${environment.name}.json`),
+        str,
+      );
+    }
+
+    // `bk/` は backup 側が makeEmptyDir から作り直す。ここで書き足すのではなく
+    // 呼び直しているのは、消えた環境のファイルが残らないようにするため。
+    // 整形もそこでまとめて走る。
+    await backupEnvironments();
+  }
+};
+
+/**
+ * GitHub 側が黙って無視する組み合わせを、送る前に落とす。
+ *
+ * `custom_branch_policies` が立っていないのに pattern が書いてあるファイルは、
+ * 読む側には「この ref だけに制限されている」と読めて、実際には何の制限にも
+ * なっていない — 一番危ない種類の嘘なので、エラーにする。
+ */
+const assertConsistent = (environment: EnvironmentSettings): void => {
+  const custom =
+    environment.deployment_branch_policy?.custom_branch_policies === true;
+
+  if (!custom && Arr.isNonEmpty(environment.deployment_branch_policies)) {
+    throw new Error(
+      [
+        `環境 "${environment.name}": deployment_branch_policies が書かれていますが、`,
+        'deployment_branch_policy.custom_branch_policies が true ではありません。',
+        'pattern は "Selected branches and tags" を選んだときにしか効きません。',
+      ].join('\n'),
+    );
+  }
+
+  // `custom` が立っている時点で TypeScript は `deployment_branch_policy` を
+  // record 側に絞り込んでいる。両方 true は JSON としては書けてしまうので、
+  // この組み合わせは送る前に落とす。
+  if (custom && environment.deployment_branch_policy.protected_branches) {
+    throw new Error(
+      `環境 "${environment.name}": protected_branches と custom_branch_policies は同時に true にできません。`,
+    );
+  }
+};
+
+if (isDirectlyExecuted(import.meta.url)) {
+  await applyEnvironments();
+}