github-settings-as-code 3.1.0 → 4.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "github-settings-as-code",
-  "version": "3.1.0",
+  "version": "4.0.0",
   "private": false,
   "keywords": [
     "github",
@@ -31,19 +31,19 @@
     "octokit-safe-types": "^1.2.28",
     "ts-data-forge": "^14.7.1",
     "ts-fortress": "^12.1.3",
-    "ts-repo-utils": "^10.6.2",
+    "ts-repo-utils": "^10.7.0",
     "ts-type-forge": "^9.2.2"
   },
   "devDependencies": {
-    "@types/node": "26.5.0",
+    "@types/node": "26.5.1",
     "@vitest/coverage-v8": "5.0.0",
     "@vitest/ui": "5.0.0",
-    "cspell": "10.2.1",
-    "eslint": "10.9.1",
-    "eslint-config-typed": "5.11.7",
-    "eslint-plugin-ts-data-forge": "0.7.4",
-    "eslint-plugin-ts-fortress": "1.2.2",
-    "eslint-plugin-ts-type-forge": "0.8.3",
+    "cspell": "10.3.0",
+    "eslint": "10.10.0",
+    "eslint-config-typed": "5.11.10",
+    "eslint-plugin-ts-data-forge": "0.8.1",
+    "eslint-plugin-ts-fortress": "1.2.3",
+    "eslint-plugin-ts-type-forge": "0.8.4",
     "jiti": "2.7.0",
     "npm-run-all2": "9.0.3",
     "prettier": "3.9.6",
@@ -59,7 +59,7 @@
     "pnpm": ">=9.0.0"
   },
   "volta": {
-    "node": "26.8.1"
+    "node": "26.8.2"
   },
   "publishConfig": {
     "access": "public",
@@ -67,29 +67,30 @@
   },
   "scripts": {
     "build": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ./scripts/cmd/build.mts",
-    "build:min": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ./scripts/cmd/build.mts --skip-check",
+    "check:cspell": "cspell \"**\" --gitignore --gitignore-root ../../ --no-progress",
     "check:ext": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ./scripts/cmd/check-ext.mts",
+    "check:lint": "eslint .",
+    "check:test": "pnpm run z:vitest:node run",
+    "check:test:cov": "pnpm run z:vitest:node run --coverage",
+    "check:types": "node ../../node_modules/typescript-native/bin/tsc --noEmit",
     "check-all": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ./scripts/cmd/check-all.mts",
-    "codemod": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ../../libs/ts-codemod-cli/src/cmd/ts-codemod.mts --uncommitted --transformer append-as-const --transformer convert-to-readonly '{src,scripts,samples}/**/*.mts' && pnpm run fmt",
-    "codemod:diff": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ../../libs/ts-codemod-cli/src/cmd/ts-codemod.mts --diff-from origin/main --transformer append-as-const --transformer convert-to-readonly '{src,scripts,samples}/**/*.mts' && pnpm run fmt",
-    "codemod:full": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ../../libs/ts-codemod-cli/src/cmd/ts-codemod.mts --transformer append-as-const --transformer convert-to-readonly '{src,scripts,samples}/**/*.mts' && pnpm run fmt",
-    "cspell": "cspell \"**\" --gitignore --gitignore-root ../../ --no-progress",
     "doc": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ./scripts/cmd/gen-docs.mts",
-    "fmt": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ../../libs/ts-repo-utils/src/cmd/format-uncommitted.mts --cwd .",
-    "fmt:diff": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ../../libs/ts-repo-utils/src/cmd/format-diff-from.mts origin/main --cwd .",
-    "fmt:full": "prettier --write .",
-    "gi": "run-s gi:src fmt",
-    "gi:src": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ../../libs/ts-repo-utils/src/cmd/gen-index-ts.mts ./src/github --index-ext .mts --export-ext .mjs --target-ext .mts --exclude cmd --exclude octokit.mts",
-    "lint": "eslint .",
-    "lint:fix": "eslint . --fix",
-    "test": "pnpm run z:vitest:node run",
-    "test:cov": "pnpm run z:vitest:node run --coverage",
+    "fix:codemod": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ../../libs/ts-codemod-cli/src/cmd/ts-codemod.mts --uncommitted --transformer append-as-const --transformer convert-to-readonly '{src,scripts,samples}/**/*.mts' && pnpm run fix:fmt",
+    "fix:codemod:diff": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ../../libs/ts-codemod-cli/src/cmd/ts-codemod.mts --diff-from origin/main --transformer append-as-const --transformer convert-to-readonly '{src,scripts,samples}/**/*.mts' && pnpm run fix:fmt",
+    "fix:codemod:full": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ../../libs/ts-codemod-cli/src/cmd/ts-codemod.mts --transformer append-as-const --transformer convert-to-readonly '{src,scripts,samples}/**/*.mts' && pnpm run fix:fmt",
+    "fix:fmt": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ../../libs/ts-repo-utils/src/cmd/format-uncommitted.mts --cwd .",
+    "fix:fmt:diff": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ../../libs/ts-repo-utils/src/cmd/format-diff-from.mts origin/main --cwd .",
+    "fix:fmt:full": "prettier --write .",
+    "fix:lint": "eslint . --fix",
+    "fmt": "pnpm run fix:fmt",
+    "gen": "run-s gen:index",
+    "gen:index": "run-s gen:index:src fix:fmt",
+    "gen:index:src": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ../../libs/ts-repo-utils/src/cmd/gen-index-ts.mts ./src/github --index-ext .mts --export-ext .mjs --target-ext .mts --exclude cmd --exclude octokit.mts",
+    "test": "pnpm run check:test",
     "test:cov:ui": "vite preview --outDir ./coverage",
     "test:ui": "pnpm run z:vitest:node --ui",
-    "testw": "pnpm run z:vitest:node watch",
-    "tsc": "node ../../node_modules/typescript-native/bin/tsc --noEmit",
-    "tscw": "node ../../node_modules/typescript-native/bin/tsc --noEmit --watch -p ./tsconfig.json",
-    "type-check": "node ../../node_modules/typescript-native/bin/tsc --noEmit",
+    "watch:test": "pnpm run z:vitest:node watch",
+    "watch:types": "node ../../node_modules/typescript-native/bin/tsc --noEmit --watch -p ./tsconfig.json",
     "z:vitest": "vitest --config ./configs/vitest.config.mts",
     "z:vitest:node": "pnpm run z:vitest --project='Node.js'"
   }

package/src/cmd/repo-settings.mts

@@ -13,15 +13,18 @@ const HELP = dedent`
 
   Commands:
     apply [target]     ローカルの設定ファイルを GitHub に反映する
-    backup [target]    GitHub の現在値をローカルの bk/ に保存する
+    backup [target]    GitHub の現在値でローカルの設定ファイルを撮り直す
 
   Targets:
     all                すべて（既定）
     repository         repo-settings/repository-settings/settings.json
     rulesets           repo-settings/rulesets/*.json
-    variables          repository variables （ apply のみ ）
+    variables          repo-settings/variables/settings.json
     actions            repo-settings/actions-settings/settings.json
     pages              repo-settings/pages/settings.json
+    environments       repo-settings/environments/*.json
+    vulnerability-alerts
+                       repo-settings/vulnerability-alerts/settings.json
 
   Options:
         --owner <owner>   対象の owner
@@ -54,6 +57,8 @@ const TARGETS = [
   'variables',
   'actions',
   'pages',
+  'environments',
+  'vulnerability-alerts',
 ] as const;
 
 type Target = (typeof TARGETS)[number];
@@ -125,12 +130,18 @@ const runners: ReadonlyRecord<
       await github.applyActionsSettings();
 
       await github.applyPagesSettings();
+
+      await github.applyEnvironments();
+
+      await github.applyVulnerabilityAlerts();
     },
     repository: github.applyRepositorySettings,
     rulesets: github.applyRulesets,
     variables: github.applyVariables,
     actions: github.applyActionsSettings,
     pages: github.applyPagesSettings,
+    environments: github.applyEnvironments,
+    'vulnerability-alerts': github.applyVulnerabilityAlerts,
   },
   backup: {
     all: async () => {
@@ -141,11 +152,20 @@ const runners: ReadonlyRecord<
       await github.backupActionsSettings();
 
       await github.backupPagesSettings();
+
+      await github.backupEnvironments();
+
+      await github.backupVulnerabilityAlerts();
+
+      await github.backupVariables();
     },
     repository: github.backupRepositorySettings,
     rulesets: github.backupRulesets,
+    variables: github.backupVariables,
     actions: github.backupActionsSettings,
     pages: github.backupPagesSettings,
+    environments: github.backupEnvironments,
+    'vulnerability-alerts': github.backupVulnerabilityAlerts,
   },
 } as const;
 

package/src/github/actions-settings/apply.mts

@@ -10,13 +10,10 @@ import {
 } from 'ts-repo-utils';
 import { actionsSettingsDir, settingsJsonName } from '../constants.mjs';
 import { getActionsSettings, setActionsSettings } from './api/index.mjs';
-import { backupActionsSettings } from './backup.mjs';
 import { ActionsSettings } from './constants.mjs';
 
 /** `repo-settings/actions-settings/settings.json` を Settings > Actions > General に反映する。 */
 export const applyActionsSettings = async (): Promise<void> => {
-  await backupActionsSettings(false);
-
   const settings = await readSettings();
 
   await setActionsSettings(settings);
@@ -30,12 +27,6 @@ export const applyActionsSettings = async (): Promise<void> => {
     // eslint-disable-next-line security/detect-non-literal-fs-filename
     await fs.writeFile(path.resolve(actionsSettingsDir, settingsJsonName), str);
 
-    // eslint-disable-next-line security/detect-non-literal-fs-filename
-    await fs.writeFile(
-      path.resolve(actionsSettingsDir, 'bk', settingsJsonName),
-      str,
-    );
-
     await formatUncommittedFiles();
   }
 };

package/src/github/actions-settings/backup.mts

@@ -2,27 +2,22 @@
 import 'dotenv/config';
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
-import {
-  formatUncommittedFiles,
-  isDirectlyExecuted,
-  makeEmptyDir,
-} from 'ts-repo-utils';
+import { formatUncommittedFiles, isDirectlyExecuted } from 'ts-repo-utils';
+import { clearJsonFilesIn } from '../clear-json-files.mjs';
 import { actionsSettingsDir, settingsJsonName } from '../constants.mjs';
 import { getActionsSettings } from './api/index.mjs';
 
-const backupDir = path.resolve(actionsSettingsDir, './bk');
-
-/** Settings > Actions > General の現在値を `bk/` に保存する。 */
+/** Settings > Actions > General の現在値を宣言ファイルへ撮り直す。 */
 export const backupActionsSettings = async (
   fmt: boolean = true,
 ): Promise<void> => {
-  await makeEmptyDir(backupDir);
-
   const settings = await getActionsSettings();
 
+  await clearJsonFilesIn(actionsSettingsDir);
+
   // eslint-disable-next-line security/detect-non-literal-fs-filename
   await fs.writeFile(
-    path.resolve(backupDir, settingsJsonName),
+    path.resolve(actionsSettingsDir, settingsJsonName),
     JSON.stringify(settings, undefined, 2),
   );
 

package/src/github/actions-settings/constants.mts

@@ -35,7 +35,7 @@ export const ActionsSettings = t.record({
    * `read` にできるのは、 workflow 側が全て明示的に `permissions` を宣言して
    * いる場合だけ。宣言の無い job はこの既定値をそのまま受け取るため、
    * `write` のままだと「 branch の中身が何であれ書き込めるトークン」が
-   * 渡る。 .github/workflows/type-check.yml 冒頭の注記を参照。
+   * 渡る。 .github/workflows/code-check.yml 冒頭の注記を参照。
    */
   default_workflow_permissions: t.enumType(['read', 'write'], {
     typeName: 'DefaultWorkflowPermissions',

package/src/github/clear-json-files.mts

@@ -0,0 +1,31 @@
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+
+/**
+ * `dir` の直下の `*.json` を消す。ディレクトリが無ければ作る。
+ *
+ * backup が書き込む前にこれを呼ぶ。撮り直したあとにそこに在るものが、そのまま
+ * 「GitHub から取れたもの」になる — 取れなかった資源は `git status` に削除と
+ * して現れる。消さずに上書きするだけだと、取れなかった資源の古いファイルが
+ * 残り、取れたのと見分けがつかない。
+ *
+ * まだ apply していない宣言も同じように削除として現れるが、それも見えた方が
+ * よい情報で、コミットしなければ失われない。
+ *
+ * `rm -rf` ではなく直下の `*.json` に限る。宣言の隣に置いてある README
+ * （`repo-settings/variables/README.md`）のような、JSON でない同居ファイルを
+ * 巻き込まないため。
+ */
+export const clearJsonFilesIn = async (dir: string): Promise<void> => {
+  // eslint-disable-next-line security/detect-non-literal-fs-filename
+  await fs.mkdir(dir, { recursive: true });
+
+  // eslint-disable-next-line security/detect-non-literal-fs-filename
+  const entries = await fs.readdir(dir, { withFileTypes: true });
+
+  for (const entry of entries) {
+    if (entry.isFile() && entry.name.endsWith('.json')) {
+      await fs.rm(path.resolve(dir, entry.name));
+    }
+  }
+};

package/src/github/clear-json-files.test.mts

@@ -0,0 +1,78 @@
+import * as fs from 'node:fs/promises';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { clearJsonFilesIn } from './clear-json-files.mjs';
+
+const makeDir = async (): Promise<string> =>
+  fs.mkdtemp(path.join(os.tmpdir(), 'clear-json-files-'));
+
+/** 途中のディレクトリごと作って書く。入れ子の fixture もこれで用意する。 */
+const write = async (filePath: string, content: string): Promise<void> => {
+  // eslint-disable-next-line security/detect-non-literal-fs-filename
+  await fs.mkdir(path.dirname(filePath), { recursive: true });
+
+  // eslint-disable-next-line security/detect-non-literal-fs-filename
+  await fs.writeFile(filePath, content);
+};
+
+const namesIn = async (dir: string): Promise<readonly string[]> =>
+  // eslint-disable-next-line security/detect-non-literal-fs-filename
+  fs.readdir(dir).then((names) => names.toSorted());
+
+describe(clearJsonFilesIn, () => {
+  test('removes the json files directly under the directory', async () => {
+    const dir = await makeDir();
+
+    await write(path.join(dir, 'main.json'), '{}');
+
+    await write(path.join(dir, 'release.json'), '{}');
+
+    await clearJsonFilesIn(dir);
+
+    assert.deepStrictEqual(await namesIn(dir), []);
+  });
+
+  test('keeps a file that is not json, so a README beside the declarations survives', async () => {
+    const dir = await makeDir();
+
+    await write(path.join(dir, 'settings.json'), '{}');
+
+    await write(path.join(dir, 'README.md'), '# notes');
+
+    await clearJsonFilesIn(dir);
+
+    assert.deepStrictEqual(await namesIn(dir), ['README.md']);
+  });
+
+  test('does not descend into a subdirectory', async () => {
+    const dir = await makeDir();
+
+    await write(path.join(dir, 'nested', 'deep.json'), '{}');
+
+    await clearJsonFilesIn(dir);
+
+    assert.deepStrictEqual(await namesIn(dir), ['nested']);
+
+    assert.deepStrictEqual(await namesIn(path.join(dir, 'nested')), [
+      'deep.json',
+    ]);
+  });
+
+  test('creates the directory when it does not exist', async () => {
+    const dir = path.join(await makeDir(), 'not-yet');
+
+    await clearJsonFilesIn(dir);
+
+    assert.deepStrictEqual(await namesIn(dir), []);
+  });
+
+  test('is a no-op on a directory holding no json', async () => {
+    const dir = await makeDir();
+
+    await write(path.join(dir, 'README.md'), '# notes');
+
+    await clearJsonFilesIn(dir);
+
+    assert.deepStrictEqual(await namesIn(dir), ['README.md']);
+  });
+});

package/src/github/constants.mts

@@ -25,8 +25,17 @@ export const actionsSettingsDir = path.resolve(
 
 export const pagesSettingsDir = path.resolve(settingsDir, './pages');
 
+export const environmentsDir = path.resolve(settingsDir, './environments');
+
+export const vulnerabilityAlertsDir = path.resolve(
+  settingsDir,
+  './vulnerability-alerts',
+);
+
 export const rulesetsDir = path.resolve(settingsDir, './rulesets');
 
+export const variablesDir = path.resolve(settingsDir, './variables');
+
 export const octokitHeaders = {
   'X-GitHub-Api-Version': '2022-11-28',
 } as const;

package/src/github/environments/api/get-environments.mts

@@ -0,0 +1,155 @@
+import { type EndpointKeys } from 'octokit-safe-types';
+import { Arr } from 'ts-data-forge';
+import * as t from 'ts-fortress';
+import { Result } from 'ts-repo-utils';
+import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
+import { octokit } from '../../octokit.mjs';
+import { EnvironmentSettings } from '../constants.mjs';
+
+/**
+ * Settings > Environments の現在値を、宣言ファイルと同じ形にして返す。
+ *
+ * 名前順に整える。 GitHub が返す順は作成順で、環境を 1 つ足しただけで
+ * 宣言ファイルの中身が並び替わると差分が読めなくなるため。
+ */
+export const getAllEnvironments = async (): Promise<
+  readonly EnvironmentSettings[]
+> => {
+  // https://docs.github.com/rest/deployments/environments#list-environments
+  //
+  // per_page の上限。環境は数個しか無く、 2 ページ目が要る状況は
+  // 「 GUI で何かが大量に作られた」ときだけなので、ページングは張らない。
+  const response = await octokit.request(
+    'GET /repos/{owner}/{repo}/environments' satisfies EndpointKeys,
+    { owner: OWNER, repo: REPO, headers: octokitHeaders, per_page: 100 },
+  );
+
+  const environments = response.data.environments ?? [];
+
+  const settings = await Promise.all(
+    environments.map(async (environment) => {
+      const policy = environment.deployment_branch_policy ?? undefined;
+
+      return EnvironmentSettings.fill({
+        name: environment.name,
+        ...parseProtectionRules(environment.protection_rules),
+        deployment_branch_policy:
+          policy === undefined
+            ? null
+            : {
+                protected_branches: policy.protected_branches,
+                custom_branch_policies: policy.custom_branch_policies,
+              },
+        deployment_branch_policies:
+          policy?.custom_branch_policies === true
+            ? await getDeploymentBranchPolicyNames(environment.name)
+            : [],
+      });
+    }),
+  );
+
+  return settings.toSorted((a, b) => a.name.localeCompare(b.name));
+};
+
+/** 宣言ファイルに載る形。 `id` は GitHub 側の都合なので落とす。 */
+const getDeploymentBranchPolicyNames = async (
+  environmentName: string,
+): Promise<readonly Readonly<{ name: string; type: 'branch' | 'tag' }>[]> => {
+  const policies = await getDeploymentBranchPolicies(environmentName);
+
+  return policies.map(({ name, type }) => ({ name, type }));
+};
+
+/** 「 Selected branches and tags 」に登録されている pattern を列挙する。 */
+export const getDeploymentBranchPolicies = async (
+  environmentName: string,
+): Promise<readonly DeploymentBranchPolicy[]> => {
+  // https://docs.github.com/rest/deployments/branch-policies#list-deployment-branch-policies
+  const response = await octokit.request(
+    'GET /repos/{owner}/{repo}/environments/{environment_name}/deployment-branch-policies' satisfies EndpointKeys,
+    {
+      owner: OWNER,
+      repo: REPO,
+      environment_name: environmentName,
+      headers: octokitHeaders,
+      per_page: 100,
+    },
+  );
+
+  return response.data.branch_policies.map((policy) => ({
+    id: policy.id ?? 0,
+    name: policy.name ?? '',
+    type: policy.type === 'tag' ? 'tag' : 'branch',
+  }));
+};
+
+export type DeploymentBranchPolicy = Readonly<{
+  id: number;
+  name: string;
+  type: 'branch' | 'tag';
+}>;
+
+/**
+ * GET が返す `protection_rules` を PUT の body の形に戻す。
+ *
+ * GitHub は有効な保護ルールだけを配列で返し、その要素の `type` は openapi の
+ * 型定義では素の `string` — つまり判別可能 union になっていないので、絞り込みが
+ * 効かない。実データを ts-fortress で読み直すほうが、上流の型に合わせて
+ * キャストを書くより素直で、形が変わったときに黙って通り過ぎることもない。
+ */
+const parseProtectionRules = (
+  protectionRules: unknown,
+): Readonly<{
+  wait_timer: number;
+  prevent_self_review: boolean;
+  reviewers: readonly Readonly<{ type: 'User' | 'Team'; id: number }>[];
+}> => {
+  const validationResult = ProtectionRules.validate(protectionRules ?? []);
+
+  if (Result.isErr(validationResult)) {
+    throw new Error(
+      Arr.toUnshifted(
+        'GitHub が返した environment の protection_rules を読めませんでした。',
+      )(t.validationErrorsToMessages(validationResult.value)).join('\n'),
+    );
+  }
+
+  const rules = validationResult.value;
+
+  const waitTimer = rules.find((rule) => rule.type === 'wait_timer');
+
+  const requiredReviewers = rules.find(
+    (rule) => rule.type === 'required_reviewers',
+  );
+
+  return {
+    wait_timer: waitTimer?.wait_timer ?? 0,
+    prevent_self_review: requiredReviewers?.prevent_self_review ?? false,
+    reviewers: (requiredReviewers?.reviewers ?? []).map((entry) => ({
+      type: entry.type,
+      id: entry.reviewer.id,
+    })),
+  };
+};
+
+const ProtectionRules = t.array(
+  t.record({
+    type: t.string(''),
+    wait_timer: t.optional(t.number(0)),
+    prevent_self_review: t.optional(t.boolean(false)),
+    reviewers: t.optional(
+      t.array(
+        t.record({
+          type: t.enumType(['User', 'Team'], {
+            typeName: 'EnvironmentReviewerType',
+            defaultValue: 'User',
+          }),
+          // `reviewer` は User / Team の完全な表現だが、書き戻しに要るのは id
+          // だけ。 record は既定で余剰キーを通すので、残りはそのまま無視される。
+          reviewer: t.record({ id: t.number(0) }),
+        }),
+      ),
+    ),
+  }),
+  { typeName: 'EnvironmentProtectionRules' },
+);

package/src/github/environments/api/index.mts

@@ -0,0 +1,2 @@
+export * from './get-environments.mjs';
+export * from './set-environment.mjs';

package/src/github/environments/api/set-environment.mts

@@ -0,0 +1,106 @@
+import { type EndpointKeys } from 'octokit-safe-types';
+import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
+import { octokit } from '../../octokit.mjs';
+import { type EnvironmentSettings } from '../constants.mjs';
+import { getDeploymentBranchPolicies } from './get-environments.mjs';
+
+/**
+ * 環境を JSON の内容に合わせる。無ければ作られる。
+ *
+ * `PUT` は保護ルールを丸ごと置き換えるので、省いたキーは「変更しない」ではなく
+ * 「無効にする」になる。宣言ファイルをそのまま渡しているのはそのため —
+ * 部分更新にすると、ファイルから消した設定が GitHub 側に残る。
+ */
+export const setEnvironment = async (
+  settings: EnvironmentSettings,
+): Promise<void> => {
+  // https://docs.github.com/rest/deployments/environments#create-or-update-an-environment
+  await octokit.request(
+    'PUT /repos/{owner}/{repo}/environments/{environment_name}' satisfies EndpointKeys,
+    {
+      owner: OWNER,
+      repo: REPO,
+      environment_name: settings.name,
+      headers: octokitHeaders,
+      wait_timer: settings.wait_timer,
+      prevent_self_review: settings.prevent_self_review,
+      reviewers: settings.reviewers.map((reviewer) => ({
+        type: reviewer.type,
+        id: reviewer.id,
+      })),
+      deployment_branch_policy:
+        settings.deployment_branch_policy === null
+          ? null
+          : {
+              protected_branches:
+                settings.deployment_branch_policy.protected_branches,
+              custom_branch_policies:
+                settings.deployment_branch_policy.custom_branch_policies,
+            },
+    },
+  );
+
+  await setDeploymentBranchPolicies(settings);
+};
+
+/**
+ * 「 Selected branches and tags 」の pattern を宣言に合わせる。
+ *
+ * 個別の追加・削除しか無いエンドポイントなので、現在値との差分を取って埋める。
+ * 名前と種別が一致するものは触らない — 消して作り直すと id が変わり、
+ * その間だけ deploy できない ref ができる。
+ */
+const keyOf = (policy: Readonly<{ name: string; type: string }>): string =>
+  `${policy.type}:${policy.name}` as const;
+
+const setDeploymentBranchPolicies = async (
+  settings: EnvironmentSettings,
+): Promise<void> => {
+  if (settings.deployment_branch_policy?.custom_branch_policies !== true) {
+    // 選択されていないなら pattern は存在し得ない。 PUT 側が既に消している。
+    return;
+  }
+
+  const current = await getDeploymentBranchPolicies(settings.name);
+
+  const desiredKeys: ReadonlySet<string> = new Set(
+    settings.deployment_branch_policies.map(keyOf),
+  );
+
+  const currentKeys: ReadonlySet<string> = new Set(current.map(keyOf));
+
+  const toDelete = current.filter((p) => !desiredKeys.has(keyOf(p)));
+
+  const toCreate = settings.deployment_branch_policies.filter(
+    (p) => !currentKeys.has(keyOf(p)),
+  );
+
+  for (const policy of toDelete) {
+    // https://docs.github.com/rest/deployments/branch-policies#delete-a-deployment-branch-policy
+    await octokit.request(
+      'DELETE /repos/{owner}/{repo}/environments/{environment_name}/deployment-branch-policies/{branch_policy_id}' satisfies EndpointKeys,
+      {
+        owner: OWNER,
+        repo: REPO,
+        environment_name: settings.name,
+        branch_policy_id: policy.id,
+        headers: octokitHeaders,
+      },
+    );
+  }
+
+  for (const policy of toCreate) {
+    // https://docs.github.com/rest/deployments/branch-policies#create-a-deployment-branch-policy
+    await octokit.request(
+      'POST /repos/{owner}/{repo}/environments/{environment_name}/deployment-branch-policies' satisfies EndpointKeys,
+      {
+        owner: OWNER,
+        repo: REPO,
+        environment_name: settings.name,
+        headers: octokitHeaders,
+        name: policy.name,
+        type: policy.type,
+      },
+    );
+  }
+};