github-settings-as-code 4.0.6 → 4.0.7

package/README.md

@@ -42,11 +42,15 @@ repo-settings backup
 repo-settings apply --owner noshiro-pf --repo ts-repo-utils
 ```
 
-`backup` rewrites the settings files themselves from what GitHub currently
-has — there is one copy of each resource, not a declaration and a mirror of it.
-`apply` reads the values back from GitHub afterwards and rewrites the files
-with what was actually applied, so a value GitHub canonicalized or refused
-shows up as a diff.
+`backup` rewrites the settings files themselves from what GitHub currently has —
+there is one copy of each resource, not a declaration and a mirror of it.
+`apply` reads the values back from GitHub afterwards and rewrites the files with
+what was actually applied, so a value GitHub canonicalized or refused shows up
+as a diff; `variables` writes nothing back. For rulesets and environments, only
+the ones a declaration file names are rewritten (a ruleset by its id, or by the
+id GitHub gave it when created; an environment by name). One that exists only on
+GitHub stays undeclared, so the drift check keeps reporting it; importing it is
+an explicit `backup`.
 
 ## Resolving the target repository
 

package/dist/github/environments/apply.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"apply.d.mts","sourceRoot":"","sources":["../../../src/github/environments/apply.mts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AAUvB;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,QAAa,OAAO,CAAC,IAAI,CA4BtD,CAAC"}
+{"version":3,"file":"apply.d.mts","sourceRoot":"","sources":["../../../src/github/environments/apply.mts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AAWvB;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,QAAa,OAAO,CAAC,IAAI,CAiCtD,CAAC"}

package/dist/github/environments/apply.mjs

@@ -7,6 +7,7 @@ import { environmentsDir } from '../constants.mjs';
 import { settingsFilePath } from '../settings-file-path.mjs';
 import { getAllEnvironments, setEnvironment } from './api/index.mjs';
 import { readEnvironmentFiles } from './read-environment-contents.mjs';
+import { selectDeclaredEnvironments } from './select-declared-environments.mjs';
 
 
 
@@ -23,8 +24,10 @@ export const applyEnvironments = async () => {
         await setEnvironment(environment);
     }
 
+
+
     {
-        const applied = await getAllEnvironments();
+        const applied = selectDeclaredEnvironments(await getAllEnvironments(), environments);
         for (const environment of applied) {
             const str = JSON.stringify(environment, undefined, 2);
 

package/dist/github/environments/apply.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"apply.mjs","sourceRoot":"","sources":["../../../src/github/environments/apply.mts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AACpC,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAErE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,IAAmB,EAAE;IACzD,MAAM,YAAY,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAElD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,cAAc,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;IAED,0BAA0B;IAC1B,CAAC;QACC,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAE3C,KAAK,MAAM,WAAW,IAAI,OAAO,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YAEtD,0DAA0D;YAC1D,mEAAmE;YACnE,MAAM,EAAE,CAAC,SAAS,CAChB,gBAAgB,CAAC,eAAe,EAAE,WAAW,CAAC,IAAI,CAAC,EACnD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,sBAAsB,EAAE,CAAC;IACjC,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,CAAC,WAAgC,EAAQ,EAAE;IAClE,MAAM,MAAM,GACV,WAAW,CAAC,wBAAwB,EAAE,sBAAsB,KAAK,IAAI,CAAC;IAExE,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb;YACE,OAAO,WAAW,CAAC,IAAI,0CAA0C;YACjE,iEAAiE;YACjE,wDAAwD;SACzD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,gDAAgD;IAChD,mBAAmB;IACnB,IAAI,MAAM,IAAI,WAAW,CAAC,wBAAwB,CAAC,kBAAkB,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,OAAO,WAAW,CAAC,IAAI,kEAAkE,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,IAAI,kBAAkB,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,MAAM,iBAAiB,EAAE,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"apply.mjs","sourceRoot":"","sources":["../../../src/github/environments/apply.mts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AACpC,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAErE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,IAAmB,EAAE;IACzD,MAAM,YAAY,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAElD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,cAAc,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;IAED,wCAAwC;IACxC,0CAA0C;IAC1C,yCAAyC;IACzC,CAAC;QACC,MAAM,OAAO,GAAG,0BAA0B,CACxC,MAAM,kBAAkB,EAAE,EAC1B,YAAY,CACb,CAAC;QAEF,KAAK,MAAM,WAAW,IAAI,OAAO,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YAEtD,0DAA0D;YAC1D,mEAAmE;YACnE,MAAM,EAAE,CAAC,SAAS,CAChB,gBAAgB,CAAC,eAAe,EAAE,WAAW,CAAC,IAAI,CAAC,EACnD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,sBAAsB,EAAE,CAAC;IACjC,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,CAAC,WAAgC,EAAQ,EAAE;IAClE,MAAM,MAAM,GACV,WAAW,CAAC,wBAAwB,EAAE,sBAAsB,KAAK,IAAI,CAAC;IAExE,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb;YACE,OAAO,WAAW,CAAC,IAAI,0CAA0C;YACjE,iEAAiE;YACjE,wDAAwD;SACzD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,gDAAgD;IAChD,mBAAmB;IACnB,IAAI,MAAM,IAAI,WAAW,CAAC,wBAAwB,CAAC,kBAAkB,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,OAAO,WAAW,CAAC,IAAI,kEAAkE,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,IAAI,kBAAkB,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,MAAM,iBAAiB,EAAE,CAAC;AAC5B,CAAC"}

package/dist/github/environments/index.d.mts

@@ -3,4 +3,5 @@ export * from './apply.mjs';
 export * from './backup.mjs';
 export * from './constants.mjs';
 export * from './read-environment-contents.mjs';
+export * from './select-declared-environments.mjs';
 //# sourceMappingURL=index.d.mts.map

package/dist/github/environments/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../../../src/github/environments/index.mts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iCAAiC,CAAC"}
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../../../src/github/environments/index.mts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iCAAiC,CAAC;AAChD,cAAc,oCAAoC,CAAC"}

package/dist/github/environments/index.mjs

@@ -3,4 +3,5 @@ export * from './apply.mjs';
 export * from './backup.mjs';
 export * from './constants.mjs';
 export * from './read-environment-contents.mjs';
+export * from './select-declared-environments.mjs';
 //# sourceMappingURL=index.mjs.map

package/dist/github/environments/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../../src/github/environments/index.mts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iCAAiC,CAAC"}
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../../src/github/environments/index.mts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iCAAiC,CAAC;AAChD,cAAc,oCAAoC,CAAC"}

package/dist/github/environments/select-declared-environments.d.mts

@@ -0,0 +1,12 @@
+/**
+ * The live environments `apply` may write back: those whose name a declaration
+ * file names. One that exists only on GitHub (made in the UI, or created by
+ * GitHub when a workflow names it) is left to the drift check rather than
+ * adopted as a declaration.
+ */
+export declare const selectDeclaredEnvironments: <const E extends Readonly<{
+    name: string;
+}>>(live: readonly E[], declared: readonly Readonly<{
+    name: string;
+}>[]) => readonly E[];
+//# sourceMappingURL=select-declared-environments.d.mts.map

package/dist/github/environments/select-declared-environments.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"select-declared-environments.d.mts","sourceRoot":"","sources":["../../../src/github/environments/select-declared-environments.mts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,GACrC,KAAK,CAAC,CAAC,SAAS,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,QAEpC,SAAS,CAAC,EAAE,YACR,SAAS,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAAE,KAC9C,SAAS,CAAC,EAMZ,CAAC"}

package/dist/github/environments/select-declared-environments.mjs

@@ -0,0 +1,11 @@
+
+
+
+
+
+
+export const selectDeclaredEnvironments = (live, declared) => {
+    const declaredNames = new Set(declared.map((e) => e.name));
+    return live.filter((e) => declaredNames.has(e.name));
+};
+//# sourceMappingURL=select-declared-environments.mjs.map

package/dist/github/environments/select-declared-environments.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"select-declared-environments.mjs","sourceRoot":"","sources":["../../../src/github/environments/select-declared-environments.mts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAGxC,IAAkB,EAClB,QAA+C,EACjC,EAAE;IAChB,MAAM,aAAa,GAAwB,IAAI,GAAG,CAChD,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC5B,CAAC;IAEF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACvD,CAAC,CAAC"}

package/dist/github/ruleset/api/create-ruleset.d.mts

@@ -1,5 +1,5 @@
 import type { CreateRulesetRequest } from 'octokit-safe-types';
 export declare const createRuleset: ({ payload: { name, target, enforcement, bypass_actors, conditions, rules }, }: Readonly<{
     payload: CreateRulesetRequest;
-}>) => Promise<void>;
+}>) => Promise<number>;
 //# sourceMappingURL=create-ruleset.d.mts.map

package/dist/github/ruleset/api/create-ruleset.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"create-ruleset.d.mts","sourceRoot":"","sources":["../../../../src/github/ruleset/api/create-ruleset.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,oBAAoB,EAErB,MAAM,oBAAoB,CAAC;AAK5B,eAAO,MAAM,aAAa,kFAEvB,QAAQ,CAAC;IACV,OAAO,EAAE,oBAAoB,CAAC;CAC/B,CAAC,KAAG,OAAO,CAAC,IAAI,CAqBhB,CAAC"}
+{"version":3,"file":"create-ruleset.d.mts","sourceRoot":"","sources":["../../../../src/github/ruleset/api/create-ruleset.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,oBAAoB,EAErB,MAAM,oBAAoB,CAAC;AAK5B,eAAO,MAAM,aAAa,kFAEvB,QAAQ,CAAC;IACV,OAAO,EAAE,oBAAoB,CAAC;CAC/B,CAAC,KAAG,OAAO,CAAC,MAAM,CAwBlB,CAAC"}

package/dist/github/ruleset/api/create-ruleset.mjs

@@ -3,7 +3,7 @@ import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
 import { octokit } from '../../octokit.mjs';
 export const createRuleset = async ({ payload: { name, target, enforcement, bypass_actors, conditions, rules }, }) => {
 
-    await octokit.request('POST /repos/{owner}/{repo}/rulesets', 
+    const { data } = await octokit.request('POST /repos/{owner}/{repo}/rulesets', 
 
     {
         owner: OWNER,
@@ -17,5 +17,7 @@ export const createRuleset = async ({ payload: { name, target, enforcement, bypa
 
         rules: rules,
     });
+
+    return data.id;
 };
 //# sourceMappingURL=create-ruleset.mjs.map

package/dist/github/ruleset/api/create-ruleset.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"create-ruleset.mjs","sourceRoot":"","sources":["../../../../src/github/ruleset/api/create-ruleset.mts"],"names":[],"mappings":"AAKA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE5C,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,EAClC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,GAGxE,EAAiB,EAAE;IACnB,gGAAgG;IAChG,MAAM,OAAO,CAAC,OAAO,CACnB,qCAA4D;IAC5D,mDAAmD;IACnD;QACE,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,cAAc;QAEvB,IAAI;QACJ,MAAM;QACN,WAAW;QACX,aAAa,EAAE,eAAe,CAAC,aAAa,CAAC;QAC7C,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;QACvC,oEAAoE;QACpE,KAAK,EAAE,eAAe,CACpB,KAAK,CACwC;KAChD,CACF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"create-ruleset.mjs","sourceRoot":"","sources":["../../../../src/github/ruleset/api/create-ruleset.mts"],"names":[],"mappings":"AAKA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE5C,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,EAClC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,GAGxE,EAAmB,EAAE;IACrB,gGAAgG;IAChG,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CACpC,qCAA4D;IAC5D,mDAAmD;IACnD;QACE,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,cAAc;QAEvB,IAAI;QACJ,MAAM;QACN,WAAW;QACX,aAAa,EAAE,eAAe,CAAC,aAAa,CAAC;QAC7C,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;QACvC,oEAAoE;QACpE,KAAK,EAAE,eAAe,CACpB,KAAK,CACwC;KAChD,CACF,CAAC;IAEF,wDAAwD;IACxD,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC,CAAC"}

package/dist/github/ruleset/apply.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"apply.d.mts","sourceRoot":"","sources":["../../../src/github/ruleset/apply.mts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AAevB,eAAO,MAAM,aAAa,QAAa,OAAO,CAAC,IAAI,CA6DlD,CAAC"}
+{"version":3,"file":"apply.d.mts","sourceRoot":"","sources":["../../../src/github/ruleset/apply.mts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AAevB,eAAO,MAAM,aAAa,QAAa,OAAO,CAAC,IAAI,CA4ElD,CAAC"}

package/dist/github/ruleset/apply.mjs

@@ -29,8 +29,9 @@ export const applyRulesets = async () => {
             },
         });
     }
+    const mut_createdIds = [];
     for (const ruleset of rulesetsToCreate) {
-        await createRuleset({
+        const createdId = await createRuleset({
             payload: {
                 bypass_actors: ruleset.bypass_actors,
                 conditions: ruleset.conditions ?? undefined,
@@ -40,16 +41,28 @@ export const applyRulesets = async () => {
                 target: ruleset.target === 'repository' ? undefined : ruleset.target,
             },
         });
+        mut_createdIds.push(createdId);
     }
 
+
+
+
+
+    const appliedIds = new Set([
+        ...rulesetsToUpdate.map((r) => r.id),
+        ...mut_createdIds,
+    ]);
+
+
+
+
     {
-        const rulesetsResult = await getAllRulesets();
-        for (const rule of rulesetsResult) {
-            const content = await getRuleset(rule.id);
+        const contents = await Promise.all(Array.from(appliedIds, getRuleset));
+        for (const content of contents) {
             const str = JSON.stringify(Obj.pick(content, rulesetKeysToPick), undefined, 2);
 
 
-            await fs.writeFile(settingsFilePath(rulesetsDir, rule.name), str);
+            await fs.writeFile(settingsFilePath(rulesetsDir, content.name), str);
         }
         await formatUncommittedFiles();
     }

package/dist/github/ruleset/apply.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"apply.mjs","sourceRoot":"","sources":["../../../src/github/ruleset/apply.mts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AACpC,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EACL,aAAa,EACb,cAAc,EACd,UAAU,EACV,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEhE,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,IAAmB,EAAE;IACrD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAE1C,8CAA8C;IAC9C,2CAA2C;IAC3C,mCAAmC;IACnC,MAAM,WAAW,GAAwB,MAAM,cAAc,EAAE,CAAC,IAAI,CAClE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CACrC,CAAC;IAEF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEvE,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAExE,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,aAAa,CAAC;YAClB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,OAAO,EAAE;gBACP,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,SAAS;gBAC3C,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM;aACrE;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,aAAa,CAAC;YAClB,OAAO,EAAE;gBACP,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,SAAS;gBAC3C,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM;aACrE;SACF,CAAC,CAAC;IACL,CAAC;IAED,6BAA6B;IAC7B,CAAC;QACC,MAAM,cAAc,GAAG,MAAM,cAAc,EAAE,CAAC;QAE9C,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAE1C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CACxB,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,EACpC,SAAS,EACT,CAAC,CACF,CAAC;YAEF,sDAAsD;YACtD,mEAAmE;YACnE,MAAM,EAAE,CAAC,SAAS,CAAC,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,sBAAsB,EAAE,CAAC;IACjC,CAAC;AACH,CAAC,CAAC;AAEF,IAAI,kBAAkB,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,MAAM,aAAa,EAAE,CAAC;AACxB,CAAC"}
+{"version":3,"file":"apply.mjs","sourceRoot":"","sources":["../../../src/github/ruleset/apply.mts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AACpC,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EACL,aAAa,EACb,cAAc,EACd,UAAU,EACV,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEhE,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,IAAmB,EAAE;IACrD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAE1C,8CAA8C;IAC9C,2CAA2C;IAC3C,mCAAmC;IACnC,MAAM,WAAW,GAAwB,MAAM,cAAc,EAAE,CAAC,IAAI,CAClE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CACrC,CAAC;IAEF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEvE,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAExE,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,aAAa,CAAC;YAClB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,OAAO,EAAE;gBACP,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,SAAS;gBAC3C,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM;aACrE;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,cAAc,GAAa,EAAE,CAAC;IAEpC,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC;YACpC,OAAO,EAAE;gBACP,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,SAAS;gBAC3C,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM;aACrE;SACF,CAAC,CAAC;QAEH,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,6CAA6C;IAC7C,kDAAkD;IAClD,qDAAqD;IACrD,oCAAoC;IACpC,uCAAuC;IACvC,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAS;QACtD,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,GAAG,cAAc;KAClB,CAAC,CAAC;IAEH,+CAA+C;IAC/C,yCAAyC;IACzC,4CAA4C;IAC5C,oCAAoC;IACpC,CAAC;QACC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;QAEvE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CACxB,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,EACpC,SAAS,EACT,CAAC,CACF,CAAC;YAEF,sDAAsD;YACtD,mEAAmE;YACnE,MAAM,EAAE,CAAC,SAAS,CAAC,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,sBAAsB,EAAE,CAAC;IACjC,CAAC;AACH,CAAC,CAAC;AAEF,IAAI,kBAAkB,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,MAAM,aAAa,EAAE,CAAC;AACxB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "github-settings-as-code",
-  "version": "4.0.6",
+  "version": "4.0.7",
   "private": false,
   "keywords": [
     "github",
@@ -30,20 +30,20 @@
     "dotenv": "^18.0.8",
     "octokit-safe-types": "^1.2.28",
     "ts-data-forge": "^14.11.0",
-    "ts-fortress": "^12.4.3",
-    "ts-repo-utils": "^10.7.2",
+    "ts-fortress": "^12.4.4",
+    "ts-repo-utils": "^10.7.3",
     "ts-type-forge": "^9.2.2"
   },
   "devDependencies": {
     "@types/node": "26.6.5",
-    "@vitest/coverage-v8": "5.0.5",
+    "@vitest/coverage-istanbul": "5.0.5",
     "@vitest/ui": "5.0.5",
     "cspell": "10.4.0",
     "eslint": "10.13.0",
-    "eslint-config-typed": "7.4.0",
-    "eslint-plugin-ts-data-forge": "0.10.9",
-    "eslint-plugin-ts-fortress": "1.3.13",
-    "eslint-plugin-ts-type-forge": "0.8.18",
+    "eslint-config-typed": "7.5.0",
+    "eslint-plugin-ts-data-forge": "0.10.10",
+    "eslint-plugin-ts-fortress": "1.3.14",
+    "eslint-plugin-ts-type-forge": "0.8.19",
     "jiti": "2.7.0",
     "npm-run-all2": "9.0.4",
     "prettier": "3.9.10",
@@ -59,7 +59,7 @@
     "pnpm": ">=9.0.0"
   },
   "volta": {
-    "node": "26.12.1"
+    "node": "26.13.0"
   },
   "publishConfig": {
     "access": "public",
@@ -83,9 +83,10 @@
     "fix:fmt:full": "prettier --write .",
     "fix:lint": "node ../../tools/scripts/cmd/assert-deps-built.mts && oxlint . --fix && eslint . --fix",
     "fmt": "pnpm run fix:fmt",
-    "gen": "run-s gen:index",
+    "gen": "run-s gen:index gen:readme",
     "gen:index": "run-s gen:index:src fix:fmt",
     "gen:index:src": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ../../libs/ts-repo-utils/src/cmd/gen-index-ts.mts ./src/github --index-ext .mts --export-ext .mjs --target-ext .mts --exclude cmd --exclude octokit.mts",
+    "gen:readme": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ./scripts/cmd/embed-examples.mts",
     "test": "pnpm run check:test",
     "test:cov:ui": "vite preview --outDir ./coverage",
     "test:ui": "pnpm run z:vitest:node --ui",

package/src/github/environments/apply.mts

@@ -8,6 +8,7 @@ import { settingsFilePath } from '../settings-file-path.mjs';
 import { getAllEnvironments, setEnvironment } from './api/index.mjs';
 import type { EnvironmentSettings } from './constants.mjs';
 import { readEnvironmentFiles } from './read-environment-contents.mjs';
+import { selectDeclaredEnvironments } from './select-declared-environments.mjs';
 
 /**
  * `repo-settings/environments/*.json` を Settings > Environments に反映する。
@@ -27,9 +28,14 @@ export const applyEnvironments = async (): Promise<void> => {
     await setEnvironment(environment);
   }
 
-  // 反映後の実際の値でローカルのファイルを更新する
+  // 反映後の実際の値で、宣言したファイルだけを更新する。 GitHub が値を
+  // 正規化したり受け付けなかったりしたものが diff に出る。宣言に無い環境まで
+  // 書くと、 drift 検査が報せるはずのものが宣言として取り込まれてしまう。
   {
-    const applied = await getAllEnvironments();
+    const applied = selectDeclaredEnvironments(
+      await getAllEnvironments(),
+      environments,
+    );
 
     for (const environment of applied) {
       const str = JSON.stringify(environment, undefined, 2);

package/src/github/environments/index.mts

@@ -3,3 +3,4 @@ export * from './apply.mjs';
 export * from './backup.mjs';
 export * from './constants.mjs';
 export * from './read-environment-contents.mjs';
+export * from './select-declared-environments.mjs';

package/src/github/environments/select-declared-environments.mts

@@ -0,0 +1,18 @@
+/**
+ * The live environments `apply` may write back: those whose name a declaration
+ * file names. One that exists only on GitHub (made in the UI, or created by
+ * GitHub when a workflow names it) is left to the drift check rather than
+ * adopted as a declaration.
+ */
+export const selectDeclaredEnvironments = <
+  const E extends Readonly<{ name: string }>,
+>(
+  live: readonly E[],
+  declared: readonly Readonly<{ name: string }>[],
+): readonly E[] => {
+  const declaredNames: ReadonlySet<string> = new Set(
+    declared.map((e) => e.name),
+  );
+
+  return live.filter((e) => declaredNames.has(e.name));
+};

package/src/github/environments/select-declared-environments.test.mts

@@ -0,0 +1,28 @@
+import { selectDeclaredEnvironments } from './select-declared-environments.mjs';
+
+describe(selectDeclaredEnvironments, () => {
+  test('keeps the live environments that are declared, by name', () => {
+    const live = [
+      { name: 'npm-publish', wait_timer: 0 },
+      { name: 'made-in-the-ui', wait_timer: 0 },
+      { name: 'github-pages', wait_timer: 5 },
+    ] as const;
+
+    const declared = [
+      { name: 'github-pages' },
+      { name: 'npm-publish' },
+    ] as const;
+
+    assert.deepStrictEqual(selectDeclaredEnvironments(live, declared), [
+      { name: 'npm-publish', wait_timer: 0 },
+      { name: 'github-pages', wait_timer: 5 },
+    ]);
+  });
+
+  test('writes nothing back when nothing is declared', () => {
+    assert.deepStrictEqual(
+      selectDeclaredEnvironments([{ name: 'made-in-the-ui' }], []),
+      [],
+    );
+  });
+});

package/src/github/ruleset/api/create-ruleset.mts

@@ -11,9 +11,9 @@ export const createRuleset = async ({
   payload: { name, target, enforcement, bypass_actors, conditions, rules },
 }: Readonly<{
   payload: CreateRulesetRequest;
-}>): Promise<void> => {
+}>): Promise<number> => {
   // https://docs.github.com/ja/rest/repos/rules?apiVersion=2022-11-28#create-a-repository-ruleset
-  await octokit.request(
+  const { data } = await octokit.request(
     'POST /repos/{owner}/{repo}/rulesets' satisfies EndpointKeys,
     // transformer-ignore-next-line convert-to-readonly
     {
@@ -32,4 +32,7 @@ export const createRuleset = async ({
       ) as components['schemas']['repository-rule'][],
     },
   );
+
+  // 作られた ruleset の id。 apply の書き戻しは、送った ruleset をこれで特定する。
+  return data.id;
 };

package/src/github/ruleset/apply.mts

@@ -42,8 +42,10 @@ export const applyRulesets = async (): Promise<void> => {
     });
   }
 
+  const mut_createdIds: number[] = [];
+
   for (const ruleset of rulesetsToCreate) {
-    await createRuleset({
+    const createdId = await createRuleset({
       payload: {
         bypass_actors: ruleset.bypass_actors,
         conditions: ruleset.conditions ?? undefined,
@@ -53,15 +55,28 @@ export const applyRulesets = async (): Promise<void> => {
         target: ruleset.target === 'repository' ? undefined : ruleset.target,
       },
     });
+
+    mut_createdIds.push(createdId);
   }
 
-  // update local ruleset files
-  {
-    const rulesetsResult = await getAllRulesets();
+  // 書き戻すのは、いま送った ruleset だけ — 更新したものは宣言の id で、
+  // 作ったものは GitHub が付けた id で特定する。宣言に無い ruleset（GUI で
+  // 作られたもの、 organization の ruleset）まで書くと、 drift 検査が報せる
+  // はずのものが宣言として取り込まれてしまう。名前では特定しない。親の
+  // ruleset が同じ名前を持てるので、別物が同じファイルに書かれうる。
+  const appliedIds: ReadonlySet<number> = new Set<number>([
+    ...rulesetsToUpdate.map((r) => r.id),
+    ...mut_createdIds,
+  ]);
 
-    for (const rule of rulesetsResult) {
-      const content = await getRuleset(rule.id);
+  // 反映後の実際の値で、送った ruleset のファイルを更新する。 GitHub が値を
+  // 正規化したり受け付けなかったりしたものが diff に出る。一覧は読み直さず
+  // id ごとに取る（一覧はページ分割され、親の ruleset も含む）。全部取って
+  // から書くので、途中で取得に失敗しても一部だけ書き換わることはない。
+  {
+    const contents = await Promise.all(Array.from(appliedIds, getRuleset));
 
+    for (const content of contents) {
       const str = JSON.stringify(
         Obj.pick(content, rulesetKeysToPick),
         undefined,
@@ -70,7 +85,7 @@ export const applyRulesets = async (): Promise<void> => {
 
       // `settingsFilePath` が `rulesetsDir` の直下であることを確かめている。
       // eslint-disable-next-line security/detect-non-literal-fs-filename
-      await fs.writeFile(settingsFilePath(rulesetsDir, rule.name), str);
+      await fs.writeFile(settingsFilePath(rulesetsDir, content.name), str);
     }
 
     await formatUncommittedFiles();