reposets 0.2.1 → 0.4.0

package/500.js

@@ -1,9 +1,9 @@
 import { Context, Data, Effect, Layer, Option, Ref, Schema } from "effect";
 import { blake2b } from "blakejs";
 import tweetnacl from "tweetnacl";
-import { AppDirsConfig, ConfigError, ConfigFile, FirstMatch, Jsonifiable, TomlCodec, UpwardWalk, XdgConfig, XdgConfigLive, XdgSavePath, taplo, tombi } from "xdg-effect";
+import { AppDirsConfig, ConfigError, ConfigFile, ExplicitPath, FirstMatch, Jsonifiable, StaticDir, TomlCodec, UpwardWalk, XdgConfigLive, XdgConfigResolver, XdgSavePath, taplo, tombi } from "xdg-effect";
 import { existsSync, readFileSync, statSync } from "node:fs";
-import { dirname, isAbsolute, join, resolve } from "node:path";
+import { isAbsolute, resolve } from "node:path";
 import { Octokit } from "@octokit/rest";
 class ResolveError extends Data.TaggedError("ResolveError") {
 }
@@ -1037,6 +1037,24 @@ const GroupSchema = Schema.Struct({
             ]
         ]
     })),
+    security: Schema.optional(Schema.Array(Schema.String).annotations({
+        title: "Security groups",
+        description: "Names of security groups (vulnerability alerts, automated security fixes, private vulnerability reporting) to apply to these repos",
+        examples: [
+            [
+                "oss-defaults"
+            ]
+        ]
+    })),
+    code_scanning: Schema.optional(Schema.Array(Schema.String).annotations({
+        title: "Code scanning groups",
+        description: "Names of code_scanning groups (CodeQL default setup) to apply to these repos",
+        examples: [
+            [
+                "oss-defaults"
+            ]
+        ]
+    })),
     cleanup: Schema.optional(CleanupSchema)
 }).annotations({
     identifier: "Group",
@@ -1072,6 +1090,97 @@ const MergeCommitMessageSchema = Schema.Literal("PR_BODY", "PR_TITLE", "BLANK").
     title: "Merge commit message",
     description: "Default message body for merge commits: PR_BODY uses the pull request body, PR_TITLE uses the PR title, BLANK leaves it empty"
 });
+const SecurityAndAnalysisStatusSchema = Schema.Literal("enabled", "disabled").annotations({
+    identifier: "SecurityAndAnalysisStatus",
+    title: "Security feature status",
+    description: 'Whether the security feature is "enabled" or "disabled"'
+});
+const DelegatedBypassReviewerModeSchema = Schema.Literal("ALWAYS", "EXEMPT").annotations({
+    identifier: "DelegatedBypassReviewerMode",
+    title: "Delegated bypass reviewer mode",
+    description: "ALWAYS: reviewer is always required to approve bypass; EXEMPT: reviewer can bypass without review"
+});
+const DelegatedBypassReviewerSchema = Schema.Union(Schema.Struct({
+    team: Schema.String.annotations({
+        title: "Team slug",
+        description: 'GitHub team slug (e.g., "security-team"); resolved to numeric reviewer_id at sync time',
+        examples: [
+            "security-team"
+        ]
+    }),
+    mode: Schema.optional(DelegatedBypassReviewerModeSchema)
+}), Schema.Struct({
+    role: Schema.String.annotations({
+        title: "Organization role name",
+        description: 'Organization role name as defined in `GET /orgs/{org}/organization-roles` (e.g., "all_repo_admin", "security_manager"). Resolved to the numeric role ID at sync time.',
+        examples: [
+            "all_repo_admin",
+            "all_repo_maintain",
+            "security_manager"
+        ]
+    }),
+    mode: Schema.optional(DelegatedBypassReviewerModeSchema)
+})).annotations({
+    identifier: "DelegatedBypassReviewer",
+    title: "Delegated bypass reviewer",
+    description: "A reviewer who can approve secret-scanning push-protection bypass requests. Must specify exactly one of team or role."
+});
+const SecurityAndAnalysisSchema = Schema.Struct({
+    advanced_security: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
+        title: "GitHub Advanced Security",
+        description: "(GHAS-licensed) Master toggle for GitHub Advanced Security features. Free on public repos; requires a GHAS license on private repos."
+    })),
+    code_security: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
+        title: "GitHub Code Security",
+        description: "(GHAS-licensed) Toggle GitHub Code Security functionality."
+    })),
+    secret_scanning: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
+        title: "Secret scanning",
+        description: "Detect exposed credentials and sensitive data committed to the repository."
+    })),
+    secret_scanning_push_protection: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
+        title: "Secret scanning push protection",
+        description: "Block git pushes that contain detected secrets."
+    })),
+    secret_scanning_ai_detection: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
+        title: "Secret scanning AI detection",
+        description: "(GHAS-licensed) AI-powered detection of generic secrets beyond standard provider patterns."
+    })),
+    secret_scanning_non_provider_patterns: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
+        title: "Secret scanning non-provider patterns",
+        description: "(GHAS-licensed) Detect custom secret patterns beyond the standard provider list."
+    })),
+    secret_scanning_delegated_alert_dismissal: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
+        title: "Delegated alert dismissal",
+        description: "(org-only) Allow delegated dismissal of secret scanning alerts."
+    })),
+    secret_scanning_delegated_bypass: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
+        title: "Delegated push protection bypass",
+        description: "(org-only) Allow delegated approval of secret scanning push protection bypass requests."
+    })),
+    delegated_bypass_reviewers: Schema.optional(Schema.Array(DelegatedBypassReviewerSchema).annotations({
+        title: "Delegated bypass reviewers",
+        description: "(org-only) Reviewers authorized to approve push protection bypass requests. Each entry must specify a team slug or role name."
+    })),
+    dependabot_security_updates: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
+        title: "Dependabot security updates",
+        description: "Automatically open pull requests to patch known dependency vulnerabilities."
+    }))
+}).annotations({
+    identifier: "SecurityAndAnalysis",
+    title: "Security and analysis",
+    description: "GitHub repository security_and_analysis fields applied via the same PATCH /repos call as other settings. (GHAS-licensed) fields require a GHAS license on private repos; (org-only) fields are silently skipped on personal repos.",
+    jsonSchema: {
+        ...tombi({
+            tableKeysOrder: "schema"
+        }),
+        ...taplo({
+            links: {
+                key: "https://github.com/spencerbeggs/reposets/blob/main/docs/configuration.md"
+            }
+        })
+    }
+});
 const SettingsGroupSchema = Schema.Struct({
     is_template: Schema.optional(Schema.Boolean.annotations({
         title: "Template repository",
@@ -1136,7 +1245,8 @@ const SettingsGroupSchema = Schema.Struct({
     web_commit_signoff_required: Schema.optional(Schema.Boolean.annotations({
         title: "Require commit signoff",
         description: "Require contributors to sign off on web-based commits"
-    }))
+    })),
+    security_and_analysis: Schema.optional(SecurityAndAnalysisSchema)
 }, {
     key: Schema.String,
     value: Jsonifiable
@@ -1155,6 +1265,99 @@ const SettingsGroupSchema = Schema.Struct({
         })
     }
 });
+const SecurityGroupSchema = Schema.Struct({
+    vulnerability_alerts: Schema.optional(Schema.Boolean.annotations({
+        title: "Vulnerability alerts",
+        description: "Enable Dependabot vulnerability alerts (PUT/DELETE /repos/{o}/{r}/vulnerability-alerts)."
+    })),
+    automated_security_fixes: Schema.optional(Schema.Boolean.annotations({
+        title: "Automated security fixes",
+        description: "Enable Dependabot security pull requests (PUT/DELETE /repos/{o}/{r}/automated-security-fixes). Requires vulnerability_alerts to also be enabled."
+    })),
+    private_vulnerability_reporting: Schema.optional(Schema.Boolean.annotations({
+        title: "Private vulnerability reporting",
+        description: "Enable the private vulnerability reporting inbox (PUT/DELETE /repos/{o}/{r}/private-vulnerability-reporting)."
+    }))
+}).pipe(Schema.filter((group)=>!(true === group.automated_security_fixes && false === group.vulnerability_alerts), {
+    identifier: "SecurityGroup",
+    message: ()=>"automated_security_fixes = true requires vulnerability_alerts to be enabled (or omitted to leave the existing setting in place)"
+})).annotations({
+    identifier: "SecurityGroup",
+    title: "Security group",
+    description: "Toggles for repository-level security features that have dedicated PUT/DELETE endpoints (vulnerability alerts, automated security fixes, private vulnerability reporting). Omitted keys are left untouched.",
+    jsonSchema: {
+        ...tombi({
+            tableKeysOrder: "schema"
+        }),
+        ...taplo({
+            links: {
+                key: "https://github.com/spencerbeggs/reposets/blob/main/docs/configuration.md"
+            }
+        })
+    }
+});
+const CodeScanningLanguageSchema = Schema.Literal("actions", "c-cpp", "csharp", "go", "java-kotlin", "javascript-typescript", "python", "ruby", "swift").annotations({
+    identifier: "CodeScanningLanguage",
+    title: "CodeQL default-setup language",
+    description: "Languages supported by GitHub code scanning default setup. Note: this is narrower than the CodeQL analyzer (Rust is supported by CodeQL but not by default setup)."
+});
+const CodeScanningStateSchema = Schema.Literal("configured", "not-configured").annotations({
+    identifier: "CodeScanningState",
+    title: "Default setup state",
+    description: '"configured" enables CodeQL default setup; "not-configured" disables it.'
+});
+const CodeScanningQuerySuiteSchema = Schema.Literal("default", "extended").annotations({
+    identifier: "CodeScanningQuerySuite",
+    title: "Query suite",
+    description: '"default" runs the standard query set; "extended" includes additional security queries.'
+});
+const CodeScanningThreatModelSchema = Schema.Literal("remote", "remote_and_local").annotations({
+    identifier: "CodeScanningThreatModel",
+    title: "Threat model",
+    description: '"remote" analyzes network sources only; "remote_and_local" also includes filesystem and environment access.'
+});
+const CodeScanningRunnerTypeSchema = Schema.Literal("standard", "labeled").annotations({
+    identifier: "CodeScanningRunnerType",
+    title: "Runner type",
+    description: '"standard" uses GitHub-hosted runners; "labeled" uses runners matching runner_label.'
+});
+const CodeScanningGroupSchema = Schema.Struct({
+    state: Schema.optional(CodeScanningStateSchema),
+    languages: Schema.optional(Schema.Array(CodeScanningLanguageSchema).annotations({
+        title: "Languages",
+        description: "CodeQL languages to analyze. Languages not detected in the repository are skipped with a warning at sync time.",
+        examples: [
+            [
+                "javascript-typescript",
+                "python"
+            ]
+        ]
+    })),
+    query_suite: Schema.optional(CodeScanningQuerySuiteSchema),
+    threat_model: Schema.optional(CodeScanningThreatModelSchema),
+    runner_type: Schema.optional(CodeScanningRunnerTypeSchema),
+    runner_label: Schema.optional(Schema.String.annotations({
+        title: "Runner label",
+        description: 'Self-hosted runner label. Required when runner_type = "labeled".'
+    }))
+}).pipe(Schema.filter((group)=>"labeled" !== group.runner_type || void 0 !== group.runner_label, {
+    identifier: "CodeScanningGroup",
+    message: ()=>'runner_label is required when runner_type = "labeled"'
+})).annotations({
+    identifier: "CodeScanningGroup",
+    title: "Code scanning group",
+    description: "CodeQL default setup configuration applied via PATCH /repos/{o}/{r}/code-scanning/default-setup. The endpoint returns 202 Accepted and configures asynchronously; reposets sends the request and does not poll for completion.",
+    jsonSchema: {
+        ...tombi({
+            tableKeysOrder: "schema"
+        }),
+        ...taplo({
+            links: {
+                key: "https://github.com/spencerbeggs/reposets/blob/main/docs/configuration.md"
+            }
+        })
+    }
+});
 const LogLevelSchema = Schema.Literal("silent", "info", "verbose", "debug").annotations({
     identifier: "LogLevel",
     title: "Log level",
@@ -1235,12 +1438,36 @@ const ConfigSchema = Schema.Struct({
     }), {
         default: ()=>({})
     }),
+    security: Schema.optionalWith(Schema.Record({
+        key: Schema.String,
+        value: SecurityGroupSchema
+    }).annotations({
+        title: "Security groups",
+        description: "Named security groups for vulnerability alerts, automated security fixes, and private vulnerability reporting",
+        jsonSchema: tombi({
+            additionalKeyLabel: "security_group"
+        })
+    }), {
+        default: ()=>({})
+    }),
+    code_scanning: Schema.optionalWith(Schema.Record({
+        key: Schema.String,
+        value: CodeScanningGroupSchema
+    }).annotations({
+        title: "Code scanning groups",
+        description: "Named code scanning groups for CodeQL default setup configuration",
+        jsonSchema: tombi({
+            additionalKeyLabel: "code_scanning_group"
+        })
+    }), {
+        default: ()=>({})
+    }),
     groups: Schema.Record({
         key: Schema.String,
         value: GroupSchema
     }).annotations({
         title: "Groups",
-        description: "Named groups of repositories with their settings, secrets, variables, rulesets, and environment assignments",
+        description: "Named groups of repositories with their settings, secrets, variables, rulesets, environments, security, and code scanning assignments",
         jsonSchema: tombi({
             additionalKeyLabel: "group_name"
         })
@@ -1248,7 +1475,7 @@ const ConfigSchema = Schema.Struct({
 }).annotations({
     identifier: "Config",
     title: "reposets Configuration",
-    description: "Configuration for syncing GitHub repository settings, secrets, variables, rulesets, and deployment environments",
+    description: "Configuration for syncing GitHub repository settings, secrets, variables, rulesets, deployment environments, advanced security toggles, and CodeQL default setup",
     jsonSchema: {
         ...tombi({
             tableKeysOrder: "schema"
@@ -1367,64 +1594,109 @@ const CONFIG_FILENAME = "reposets.config.toml";
 const CREDENTIALS_FILENAME = "reposets.credentials.toml";
 const ReposetsConfigFile = ConfigFile.Tag("reposets/Config");
 const ReposetsCredentialsFile = ConfigFile.Tag("reposets/Credentials");
-const xdgLayer = XdgConfigLive({
-    app: new AppDirsConfig({
-        namespace: "reposets"
-    }),
-    config: {
-        tag: ReposetsConfigFile,
-        schema: ConfigSchema,
-        codec: TomlCodec,
-        strategy: FirstMatch,
-        resolvers: [
-            UpwardWalk({
-                filename: CONFIG_FILENAME
-            }),
-            XdgConfig({
-                filename: CONFIG_FILENAME
-            })
-        ]
+function validateConfigRefs(config) {
+    const errors = [];
+    const definedSettings = new Set(Object.keys(config.settings));
+    const definedSecrets = new Set(Object.keys(config.secrets));
+    const definedVariables = new Set(Object.keys(config.variables));
+    const definedRulesets = new Set(Object.keys(config.rulesets));
+    const definedEnvironments = new Set(Object.keys(config.environments));
+    const definedSecurity = new Set(Object.keys(config.security));
+    const definedCodeScanning = new Set(Object.keys(config.code_scanning));
+    for (const [groupName, group] of Object.entries(config.groups)){
+        if (group.settings) {
+            for (const ref of group.settings)if (!definedSettings.has(ref)) errors.push(`group '${groupName}': unknown settings group '${ref}'`);
+        }
+        if (group.rulesets) {
+            for (const ref of group.rulesets)if (!definedRulesets.has(ref)) errors.push(`group '${groupName}': unknown ruleset '${ref}'`);
+        }
+        if (group.environments) {
+            for (const ref of group.environments)if (!definedEnvironments.has(ref)) errors.push(`group '${groupName}': unknown environment '${ref}'`);
+        }
+        if (group.security) {
+            for (const ref of group.security)if (!definedSecurity.has(ref)) errors.push(`group '${groupName}': unknown security group '${ref}'`);
+        }
+        if (group.code_scanning) {
+            for (const ref of group.code_scanning)if (!definedCodeScanning.has(ref)) errors.push(`group '${groupName}': unknown code_scanning group '${ref}'`);
+        }
+        if (group.secrets) {
+            if (group.secrets.actions) {
+                for (const ref of group.secrets.actions)if (!definedSecrets.has(ref)) errors.push(`group '${groupName}': unknown secrets group '${ref}'`);
+            }
+            if (group.secrets.dependabot) {
+                for (const ref of group.secrets.dependabot)if (!definedSecrets.has(ref)) errors.push(`group '${groupName}': unknown secrets group '${ref}'`);
+            }
+            if (group.secrets.codespaces) {
+                for (const ref of group.secrets.codespaces)if (!definedSecrets.has(ref)) errors.push(`group '${groupName}': unknown secrets group '${ref}'`);
+            }
+            if (group.secrets.environments) for (const [envName, secretGroups] of Object.entries(group.secrets.environments)){
+                if (!definedEnvironments.has(envName)) errors.push(`group '${groupName}': unknown environment '${envName}' in secrets.environments`);
+                for (const ref of secretGroups)if (!definedSecrets.has(ref)) errors.push(`group '${groupName}': in secrets.environments.'${envName}': unknown secrets group '${ref}'`);
+            }
+        }
+        if (group.variables) {
+            if (group.variables.actions) {
+                for (const ref of group.variables.actions)if (!definedVariables.has(ref)) errors.push(`group '${groupName}': unknown variables group '${ref}'`);
+            }
+            if (group.variables.environments) for (const [envName, varGroups] of Object.entries(group.variables.environments)){
+                if (!definedEnvironments.has(envName)) errors.push(`group '${groupName}': unknown environment '${envName}' in variables.environments`);
+                for (const ref of varGroups)if (!definedVariables.has(ref)) errors.push(`group '${groupName}': in variables.environments.'${envName}': unknown variables group '${ref}'`);
+            }
+        }
     }
-});
-const credentialsLayer = ConfigFile.Live({
-    tag: ReposetsCredentialsFile,
-    schema: CredentialsSchema,
-    codec: TomlCodec,
-    strategy: FirstMatch,
-    resolvers: [
-        UpwardWalk({
-            filename: CREDENTIALS_FILENAME
-        }),
-        XdgConfig({
-            filename: CREDENTIALS_FILENAME
-        })
-    ],
-    defaultPath: XdgSavePath(CREDENTIALS_FILENAME)
-}).pipe(Layer.provide(xdgLayer));
-const ConfigFilesLive = Layer.mergeAll(xdgLayer, credentialsLayer);
-function resolveConfigFlag(configFlag) {
-    if (Option.isNone(configFlag)) return;
-    const flag = configFlag.value;
-    if (existsSync(flag) && statSync(flag).isDirectory()) return join(flag, CONFIG_FILENAME);
-    return flag;
+    if (errors.length > 0) return Effect.fail(new ConfigError({
+        operation: "validate",
+        reason: errors.join("\n")
+    }));
+    return Effect.succeed(config);
 }
-function loadConfigWithDir(configFile, configFlag) {
-    const resolved = resolveConfigFlag(configFlag);
-    if (resolved) return Effect.map(configFile.loadFrom(resolved), (config)=>({
-            config,
-            configDir: dirname(resolved)
+function makeConfigFilesLive(configFlag) {
+    const configResolvers = [];
+    if (Option.isSome(configFlag)) {
+        const flag = configFlag.value;
+        if (existsSync(flag) && statSync(flag).isDirectory()) configResolvers.push(StaticDir({
+            dir: flag,
+            filename: CONFIG_FILENAME
         }));
-    return Effect.flatMap(configFile.discover, (sources)=>{
-        if (0 === sources.length) return Effect.fail(new ConfigError({
-            operation: "discover",
-            reason: "No config file found"
-        }));
-        return Effect.succeed({
-            config: sources[0].value,
-            configDir: dirname(sources[0].path)
-        });
+        else configResolvers.push(ExplicitPath(flag));
+    }
+    configResolvers.push(UpwardWalk({
+        filename: CONFIG_FILENAME
+    }), XdgConfigResolver({
+        filename: CONFIG_FILENAME
+    }));
+    return XdgConfigLive.multi({
+        app: new AppDirsConfig({
+            namespace: "reposets"
+        }),
+        configs: [
+            {
+                tag: ReposetsConfigFile,
+                schema: ConfigSchema,
+                codec: TomlCodec,
+                strategy: FirstMatch,
+                resolvers: configResolvers,
+                validate: validateConfigRefs
+            },
+            {
+                tag: ReposetsCredentialsFile,
+                schema: CredentialsSchema,
+                codec: TomlCodec,
+                strategy: FirstMatch,
+                resolvers: [
+                    UpwardWalk({
+                        filename: CREDENTIALS_FILENAME
+                    }),
+                    XdgConfigResolver({
+                        filename: CREDENTIALS_FILENAME
+                    })
+                ],
+                defaultPath: XdgSavePath(CREDENTIALS_FILENAME)
+            }
+        ]
     });
 }
+const ConfigFilesLive = makeConfigFilesLive(Option.none());
 class OnePasswordClient extends Context.Tag("OnePasswordClient")() {
 }
 const OnePasswordClientLive = Layer.succeed(OnePasswordClient, {
@@ -1500,6 +1772,31 @@ class GitHubClient extends Context.Tag("GitHubClient")() {
 const ORG_ONLY_SETTINGS = new Set([
     "allow_forking"
 ]);
+const SAA_STATUS_FIELDS = new Set([
+    "advanced_security",
+    "code_security",
+    "secret_scanning",
+    "secret_scanning_push_protection",
+    "secret_scanning_ai_detection",
+    "secret_scanning_non_provider_patterns",
+    "secret_scanning_delegated_alert_dismissal",
+    "secret_scanning_delegated_bypass",
+    "dependabot_security_updates"
+]);
+function transformSecurityAndAnalysis(value) {
+    if (null === value || "object" != typeof value) return;
+    const input = value;
+    const out = {};
+    for (const [key, raw] of Object.entries(input))if (void 0 !== raw) {
+        if (SAA_STATUS_FIELDS.has(key) && ("enabled" === raw || "disabled" === raw)) out[key] = {
+            status: raw
+        };
+        else if ("delegated_bypass_reviewers" === key && Array.isArray(raw) && raw.length > 0) out.secret_scanning_delegated_bypass_options = {
+            reviewers: raw
+        };
+    }
+    return Object.keys(out).length > 0 ? out : void 0;
+}
 const GRAPHQL_SETTINGS = {
     has_sponsorships: "hasSponsorshipsEnabled",
     has_pull_requests: "hasPullRequestsEnabled"
@@ -1526,6 +1823,8 @@ function GitHubClientLive(token) {
             });
         }
         const ownerTypeCache = new Map();
+        const teamIdCache = new Map();
+        const roleIdCache = new Map();
         return {
             getOwnerType (owner) {
                 return Effect.tryPromise({
@@ -1619,6 +1918,11 @@ function GitHubClientLive(token) {
                         const restSettings = {};
                         const graphqlInput = {};
                         for (const [key, value] of Object.entries(settings)){
+                            if ("security_and_analysis" === key) {
+                                const saa = transformSecurityAndAnalysis(value);
+                                if (void 0 !== saa) restSettings.security_and_analysis = saa;
+                                continue;
+                            }
                             const graphqlField = GRAPHQL_SETTINGS[key];
                             if (void 0 !== graphqlField) graphqlInput[graphqlField] = value;
                             else restSettings[key] = value;
@@ -1945,6 +2249,160 @@ function GitHubClientLive(token) {
                     },
                     catch: wrapError
                 });
+            },
+            getVulnerabilityAlerts (owner, repo) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        try {
+                            await octokit.request("GET /repos/{owner}/{repo}/vulnerability-alerts", {
+                                owner,
+                                repo
+                            });
+                            return true;
+                        } catch (error) {
+                            const status = error.status;
+                            if (404 === status) return false;
+                            throw error;
+                        }
+                    },
+                    catch: wrapError
+                });
+            },
+            setVulnerabilityAlerts (owner, repo, enabled) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        if (enabled) await octokit.request("PUT /repos/{owner}/{repo}/vulnerability-alerts", {
+                            owner,
+                            repo
+                        });
+                        else await octokit.request("DELETE /repos/{owner}/{repo}/vulnerability-alerts", {
+                            owner,
+                            repo
+                        });
+                    },
+                    catch: wrapError
+                });
+            },
+            getAutomatedSecurityFixes (owner, repo) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const { data } = await octokit.request("GET /repos/{owner}/{repo}/automated-security-fixes", {
+                            owner,
+                            repo
+                        });
+                        return Boolean(data.enabled);
+                    },
+                    catch: wrapError
+                });
+            },
+            setAutomatedSecurityFixes (owner, repo, enabled) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        if (enabled) await octokit.request("PUT /repos/{owner}/{repo}/automated-security-fixes", {
+                            owner,
+                            repo
+                        });
+                        else await octokit.request("DELETE /repos/{owner}/{repo}/automated-security-fixes", {
+                            owner,
+                            repo
+                        });
+                    },
+                    catch: wrapError
+                });
+            },
+            getPrivateVulnerabilityReporting (owner, repo) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const { data } = await octokit.request("GET /repos/{owner}/{repo}/private-vulnerability-reporting", {
+                            owner,
+                            repo
+                        });
+                        return Boolean(data.enabled);
+                    },
+                    catch: wrapError
+                });
+            },
+            setPrivateVulnerabilityReporting (owner, repo, enabled) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        if (enabled) await octokit.request("PUT /repos/{owner}/{repo}/private-vulnerability-reporting", {
+                            owner,
+                            repo
+                        });
+                        else await octokit.request("DELETE /repos/{owner}/{repo}/private-vulnerability-reporting", {
+                            owner,
+                            repo
+                        });
+                    },
+                    catch: wrapError
+                });
+            },
+            updateCodeScanningDefaultSetup (owner, repo, config) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const body = {};
+                        if (void 0 !== config.state) body.state = config.state;
+                        if (void 0 !== config.languages) body.languages = [
+                            ...config.languages
+                        ];
+                        if (void 0 !== config.query_suite) body.query_suite = config.query_suite;
+                        if (void 0 !== config.threat_model) body.threat_model = config.threat_model;
+                        if (void 0 !== config.runner_type) body.runner_type = config.runner_type;
+                        if (void 0 !== config.runner_label) body.runner_label = config.runner_label;
+                        await octokit.request("PATCH /repos/{owner}/{repo}/code-scanning/default-setup", {
+                            owner,
+                            repo,
+                            ...body
+                        });
+                    },
+                    catch: wrapError
+                });
+            },
+            listRepoLanguages (owner, repo) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const { data } = await octokit.repos.listLanguages({
+                            owner,
+                            repo
+                        });
+                        return Object.keys(data);
+                    },
+                    catch: wrapError
+                });
+            },
+            resolveTeamId (org, slug) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const cacheKey = `${org}:${slug}`;
+                        const cached = teamIdCache.get(cacheKey);
+                        if (void 0 !== cached) return cached;
+                        const { data } = await octokit.teams.getByName({
+                            org,
+                            team_slug: slug
+                        });
+                        teamIdCache.set(cacheKey, data.id);
+                        return data.id;
+                    },
+                    catch: wrapError
+                });
+            },
+            resolveRoleId (org, name) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const cacheKey = `${org}:${name}`;
+                        const cached = roleIdCache.get(cacheKey);
+                        if (void 0 !== cached) return cached;
+                        const { data } = await octokit.request("GET /orgs/{org}/organization-roles", {
+                            org
+                        });
+                        const roles = data.roles ?? [];
+                        const role = roles.find((r)=>r.name === name);
+                        if (!role) throw new Error(`organization role '${name}' not found in '${org}' (available: ${roles.map((r)=>r.name).join(", ") || "none"})`);
+                        roleIdCache.set(cacheKey, role.id);
+                        return role.id;
+                    },
+                    catch: wrapError
+                });
             }
         };
     })());
@@ -2121,6 +2579,82 @@ function GitHubClientTest() {
                 }
             });
             return Effect["void"];
+        },
+        getVulnerabilityAlerts (_owner, _repo) {
+            return Effect.succeed(false);
+        },
+        setVulnerabilityAlerts (owner, repo, enabled) {
+            recorded.push({
+                method: "setVulnerabilityAlerts",
+                args: {
+                    owner,
+                    repo,
+                    enabled
+                }
+            });
+            return Effect["void"];
+        },
+        getAutomatedSecurityFixes (_owner, _repo) {
+            return Effect.succeed(false);
+        },
+        setAutomatedSecurityFixes (owner, repo, enabled) {
+            recorded.push({
+                method: "setAutomatedSecurityFixes",
+                args: {
+                    owner,
+                    repo,
+                    enabled
+                }
+            });
+            return Effect["void"];
+        },
+        getPrivateVulnerabilityReporting (_owner, _repo) {
+            return Effect.succeed(false);
+        },
+        setPrivateVulnerabilityReporting (owner, repo, enabled) {
+            recorded.push({
+                method: "setPrivateVulnerabilityReporting",
+                args: {
+                    owner,
+                    repo,
+                    enabled
+                }
+            });
+            return Effect["void"];
+        },
+        updateCodeScanningDefaultSetup (owner, repo, config) {
+            recorded.push({
+                method: "updateCodeScanningDefaultSetup",
+                args: {
+                    owner,
+                    repo,
+                    config
+                }
+            });
+            return Effect["void"];
+        },
+        listRepoLanguages (_owner, _repo) {
+            return Effect.succeed([]);
+        },
+        resolveTeamId (org, slug) {
+            recorded.push({
+                method: "resolveTeamId",
+                args: {
+                    org,
+                    slug
+                }
+            });
+            return Effect.succeed(0);
+        },
+        resolveRoleId (org, name) {
+            recorded.push({
+                method: "resolveRoleId",
+                args: {
+                    org,
+                    name
+                }
+            });
+            return Effect.succeed(0);
         }
     });
     return {
@@ -2135,6 +2669,8 @@ class SyncLogger extends Context.Tag("SyncLogger")() {
 function pluralize(resource, count) {
     if (1 === count) return resource;
     if ("ruleset" === resource) return "rulesets";
+    if ("security feature" === resource) return "security features";
+    if ("code scanning" === resource) return "code scanning";
     return `${resource}s`;
 }
 function SyncLoggerLive(config) {
@@ -2241,6 +2777,24 @@ function SyncLoggerLive(config) {
         };
     }));
 }
+const ORG_ONLY_SAA_FIELDS = new Set([
+    "secret_scanning_delegated_alert_dismissal",
+    "secret_scanning_delegated_bypass",
+    "delegated_bypass_reviewers"
+]);
+const REPO_LANG_TO_CODEQL = {
+    JavaScript: "javascript-typescript",
+    TypeScript: "javascript-typescript",
+    C: "c-cpp",
+    "C++": "c-cpp",
+    "C#": "csharp",
+    Go: "go",
+    Java: "java-kotlin",
+    Kotlin: "java-kotlin",
+    Python: "python",
+    Ruby: "ruby",
+    Swift: "swift"
+};
 class SyncEngine extends Context.Tag("SyncEngine")() {
 }
 function isCleanupActive(scope) {
@@ -2298,6 +2852,29 @@ function groupEntryNames(group) {
     if ("resolved" in group) return Object.keys(group.resolved);
     return [];
 }
+function mergeSecurityAndAnalysis(blocks) {
+    const merged = {};
+    let hasAny = false;
+    for (const block of blocks)if (block) {
+        hasAny = true;
+        for (const [key, value] of Object.entries(block))if (void 0 !== value) merged[key] = value;
+    }
+    return hasAny ? merged : void 0;
+}
+function mergeSecurityGroups(groups) {
+    const merged = {};
+    for (const group of groups)if (group) {
+        for (const [key, value] of Object.entries(group))if ("boolean" == typeof value) merged[key] = value;
+    }
+    return merged;
+}
+function mergeCodeScanningGroups(groups) {
+    const merged = {};
+    for (const group of groups)if (group) {
+        for (const [key, value] of Object.entries(group))if (void 0 !== value) merged[key] = value;
+    }
+    return merged;
+}
 const SyncEngineLive = Layer.effect(SyncEngine, Effect.gen(function*() {
     const github = yield* GitHubClient;
     const credResolver = yield* CredentialResolver;
@@ -2422,9 +2999,14 @@ const SyncEngineLive = Layer.effect(SyncEngine, Effect.gen(function*() {
                     const settingGroupRefs = group.settings ?? [];
                     const mergedSettings = {};
                     const skippedSettings = [];
+                    const saaBlocks = [];
                     for (const ref of settingGroupRefs){
                         const settingGroup = config.settings[ref];
-                        if (settingGroup) Object.assign(mergedSettings, settingGroup);
+                        if (settingGroup) {
+                            const { security_and_analysis, ...rest } = settingGroup;
+                            Object.assign(mergedSettings, rest);
+                            saaBlocks.push(security_and_analysis);
+                        }
                     }
                     if ("User" === ownerType) {
                         for (const key of ORG_ONLY_SETTINGS)if (key in mergedSettings) {
@@ -2432,6 +3014,58 @@ const SyncEngineLive = Layer.effect(SyncEngine, Effect.gen(function*() {
                             skippedSettings.push(key);
                         }
                     }
+                    const mergedSAA = mergeSecurityAndAnalysis(saaBlocks);
+                    const skippedSAA = [];
+                    if (mergedSAA) {
+                        const saaOut = {
+                            ...mergedSAA
+                        };
+                        if ("User" === ownerType) {
+                            for (const key of ORG_ONLY_SAA_FIELDS)if (key in saaOut) {
+                                delete saaOut[key];
+                                skippedSAA.push(key);
+                            }
+                        } else {
+                            const reviewers = saaOut.delegated_bypass_reviewers;
+                            if (Array.isArray(reviewers)) {
+                                const resolved = [];
+                                for (const reviewer of reviewers)if ("string" == typeof reviewer.team) {
+                                    const teamId = yield* github.resolveTeamId(owner, reviewer.team).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
+                                            yield* logger.syncError(`resolve team '${reviewer.team}'`, err.message);
+                                        })));
+                                    if (void 0 !== teamId) {
+                                        const entry = {
+                                            reviewer_id: teamId,
+                                            reviewer_type: "TEAM"
+                                        };
+                                        if (void 0 !== reviewer.mode) entry.mode = reviewer.mode;
+                                        resolved.push(entry);
+                                    }
+                                } else if ("string" == typeof reviewer.role) {
+                                    const roleId = yield* github.resolveRoleId(owner, reviewer.role).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
+                                            yield* logger.syncError(`resolve role '${reviewer.role}'`, err.message);
+                                        })));
+                                    if (void 0 !== roleId) {
+                                        const entry = {
+                                            reviewer_id: roleId,
+                                            reviewer_type: "ROLE"
+                                        };
+                                        if (void 0 !== reviewer.mode) entry.mode = reviewer.mode;
+                                        resolved.push(entry);
+                                    }
+                                }
+                                saaOut.delegated_bypass_reviewers = resolved;
+                            }
+                        }
+                        if (Object.keys(saaOut).length > 0) mergedSettings.security_and_analysis = saaOut;
+                    }
+                    const securityGroupRefs = group.security ?? [];
+                    const mergedSecurity = mergeSecurityGroups(securityGroupRefs.map((ref)=>config.security[ref]));
+                    const codeScanningRefs = group.code_scanning ?? [];
+                    const mergedCodeScanning = mergeCodeScanningGroups(codeScanningRefs.map((ref)=>config.code_scanning[ref]));
+                    const hasSecurity = Object.keys(mergedSecurity).length > 0;
+                    const securityContradiction = true === mergedSecurity.automated_security_fixes && false === mergedSecurity.vulnerability_alerts;
+                    const hasCodeScanning = Object.keys(mergedCodeScanning).length > 0;
                     const hasSecrets = secretScopes.some((s)=>(resolvedSecrets.get(s)?.size ?? 0) > 0);
                     const hasVariables = resolvedVariables.size > 0;
                     const hasRulesets = rulesetMap.size > 0;
@@ -2441,7 +3075,7 @@ const SyncEngineLive = Layer.effect(SyncEngine, Effect.gen(function*() {
                     const hasEnvVariables = resolvedEnvVariables.size > 0;
                     const hasCleanup = !noCleanup && (isCleanupActive(effectiveCleanup.secrets.actions) || isCleanupActive(effectiveCleanup.secrets.dependabot) || isCleanupActive(effectiveCleanup.secrets.codespaces) || isCleanupActive(effectiveCleanup.secrets.environments) || isCleanupActive(effectiveCleanup.variables.actions) || isCleanupActive(effectiveCleanup.variables.environments) || isCleanupActive(effectiveCleanup.rulesets) || isCleanupActive(effectiveCleanup.environments));
                     for (const repoName of group.repos)if (!repoFilter || repoName === repoFilter) {
-                        if (!hasSecrets && !hasVariables && !hasRulesets && !hasSettings && !hasEnvironments && !hasEnvSecrets && !hasEnvVariables && !hasCleanup) {
+                        if (!hasSecrets && !hasVariables && !hasRulesets && !hasSettings && !hasEnvironments && !hasEnvSecrets && !hasEnvVariables && !hasSecurity && !hasCodeScanning && !hasCleanup) {
                             yield* logger.repoSkip(owner, repoName, "no changes configured");
                             continue;
                         }
@@ -2452,6 +3086,66 @@ const SyncEngineLive = Layer.effect(SyncEngine, Effect.gen(function*() {
                                 yield* github.syncSettings(owner, repoName, mergedSettings).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError("settings", err.message)));
                             }
                             for (const key of skippedSettings)yield* logger.syncOperation("skip", "setting", key, "(org-only, owner is a personal account)");
+                            for (const key of skippedSAA)yield* logger.syncOperation("skip", "security_and_analysis", key, "(org-only, owner is a personal account)");
+                            if (hasSecurity && securityContradiction) yield* logger.syncError("security merge", "automated_security_fixes = true requires vulnerability_alerts to be enabled (or omitted); skipping security sync");
+                            else if (hasSecurity) {
+                                if (void 0 !== mergedSecurity.vulnerability_alerts) {
+                                    const desired = mergedSecurity.vulnerability_alerts;
+                                    const current = yield* github.getVulnerabilityAlerts(owner, repoName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
+                                            yield* logger.syncError("get vulnerability_alerts", err.message);
+                                            return desired;
+                                        })));
+                                    if (current !== desired) {
+                                        yield* logger.syncOperation("sync", "vulnerability_alerts", desired ? "enable" : "disable");
+                                        yield* github.setVulnerabilityAlerts(owner, repoName, desired).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError("vulnerability_alerts", err.message)));
+                                    }
+                                }
+                                if (void 0 !== mergedSecurity.automated_security_fixes) {
+                                    const desired = mergedSecurity.automated_security_fixes;
+                                    const current = yield* github.getAutomatedSecurityFixes(owner, repoName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
+                                            yield* logger.syncError("get automated_security_fixes", err.message);
+                                            return desired;
+                                        })));
+                                    if (current !== desired) {
+                                        yield* logger.syncOperation("sync", "automated_security_fixes", desired ? "enable" : "disable");
+                                        yield* github.setAutomatedSecurityFixes(owner, repoName, desired).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError("automated_security_fixes", err.message)));
+                                    }
+                                }
+                                if (void 0 !== mergedSecurity.private_vulnerability_reporting) {
+                                    const desired = mergedSecurity.private_vulnerability_reporting;
+                                    const current = yield* github.getPrivateVulnerabilityReporting(owner, repoName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
+                                            yield* logger.syncError("get private_vulnerability_reporting", err.message);
+                                            return desired;
+                                        })));
+                                    if (current !== desired) {
+                                        yield* logger.syncOperation("sync", "private_vulnerability_reporting", desired ? "enable" : "disable");
+                                        yield* github.setPrivateVulnerabilityReporting(owner, repoName, desired).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError("private_vulnerability_reporting", err.message)));
+                                    }
+                                }
+                            }
+                            if (hasCodeScanning) {
+                                let desiredConfig = mergedCodeScanning;
+                                if (void 0 !== mergedCodeScanning.languages) {
+                                    const detected = yield* github.listRepoLanguages(owner, repoName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
+                                            yield* logger.syncError("list repo languages", err.message);
+                                            return [];
+                                        })));
+                                    const detectedCodeQL = new Set();
+                                    for (const lang of detected){
+                                        const mapped = REPO_LANG_TO_CODEQL[lang];
+                                        if (mapped) detectedCodeQL.add(mapped);
+                                    }
+                                    const filtered = [];
+                                    for (const lang of mergedCodeScanning.languages)if ("actions" === lang || detectedCodeQL.has(lang)) filtered.push(lang);
+                                    else yield* logger.syncOperation("skip", "code_scanning language", lang, "(not detected in repository)");
+                                    desiredConfig = {
+                                        ...mergedCodeScanning,
+                                        languages: filtered
+                                    };
+                                }
+                                yield* logger.syncOperation("sync", "code_scanning", desiredConfig.state ?? "default-setup");
+                                yield* github.updateCodeScanningDefaultSetup(owner, repoName, desiredConfig).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError("code_scanning default setup", err.message)));
+                            }
                             for (const envName of envRefs){
                                 const envConfig = config.environments[envName];
                                 if (envConfig) {
@@ -2483,6 +3177,11 @@ const SyncEngineLive = Layer.effect(SyncEngine, Effect.gen(function*() {
                                 yield* github.syncRuleset(owner, repoName, ruleset.name, ruleset).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`ruleset ${ruleset.name}`, err.message)));
                             }
                         }
+                        if (hasSecurity) {
+                            const securityCount = Object.values(mergedSecurity).filter((v)=>void 0 !== v).length;
+                            yield* logger.syncSummary("security feature", securityCount, "");
+                        }
+                        if (hasCodeScanning) yield* logger.syncSummary("code scanning", 1, mergedCodeScanning.state ?? "applied");
                         if (hasEnvironments) yield* logger.syncSummary("environment", envRefs.length, "");
                         if (hasSecrets) {
                             const scopeCounts = [];
@@ -2652,4 +3351,4 @@ const SyncEngineLive = Layer.effect(SyncEngine, Effect.gen(function*() {
         }
     };
 }));
-export { BypassActorSchema, CleanupSchema, CleanupScopeSchema, ConfigFilesLive, ConfigSchema, CredentialProfileSchema, CredentialResolver, CredentialResolverLive, CredentialsSchema, GitHubApiError, GitHubClient, GitHubClientLive, GitHubClientTest, GroupSchema, LogLevelSchema, OnePasswordClient, OnePasswordClientLive, OnePasswordClientTest, OnePasswordError, ReposetsConfigFile, ReposetsCredentialsFile, ResolveError, ResolveSectionSchema, ResolvedRefSchema, RulesetSchema, SecretGroupSchema, SyncEngine, SyncEngineLive, SyncError, SyncLogger, SyncLoggerLive, VariableGroupSchema, buildRulesetPayload, encryptSecret, loadConfigWithDir, resolveConfigFlag };
+export { BypassActorSchema, CONFIG_FILENAME, CREDENTIALS_FILENAME, CleanupSchema, CleanupScopeSchema, ConfigFilesLive, ConfigSchema, CredentialProfileSchema, CredentialResolver, CredentialResolverLive, CredentialsSchema, GitHubApiError, GitHubClient, GitHubClientLive, GitHubClientTest, GroupSchema, LogLevelSchema, OnePasswordClient, OnePasswordClientLive, OnePasswordClientTest, OnePasswordError, ReposetsConfigFile, ReposetsCredentialsFile, ResolveError, ResolveSectionSchema, ResolvedRefSchema, RulesetSchema, SecretGroupSchema, SyncEngine, SyncEngineLive, SyncError, SyncLogger, SyncLoggerLive, VariableGroupSchema, buildRulesetPayload, encryptSecret, makeConfigFilesLive, validateConfigRefs };