reposets 0.3.0 → 0.4.1

package/500.js

@@ -1037,6 +1037,24 @@ const GroupSchema = Schema.Struct({
             ]
         ]
     })),
+    security: Schema.optional(Schema.Array(Schema.String).annotations({
+        title: "Security groups",
+        description: "Names of security groups (vulnerability alerts, automated security fixes, private vulnerability reporting) to apply to these repos",
+        examples: [
+            [
+                "oss-defaults"
+            ]
+        ]
+    })),
+    code_scanning: Schema.optional(Schema.Array(Schema.String).annotations({
+        title: "Code scanning groups",
+        description: "Names of code_scanning groups (CodeQL default setup) to apply to these repos",
+        examples: [
+            [
+                "oss-defaults"
+            ]
+        ]
+    })),
     cleanup: Schema.optional(CleanupSchema)
 }).annotations({
     identifier: "Group",
@@ -1072,6 +1090,97 @@ const MergeCommitMessageSchema = Schema.Literal("PR_BODY", "PR_TITLE", "BLANK").
     title: "Merge commit message",
     description: "Default message body for merge commits: PR_BODY uses the pull request body, PR_TITLE uses the PR title, BLANK leaves it empty"
 });
+const SecurityAndAnalysisStatusSchema = Schema.Literal("enabled", "disabled").annotations({
+    identifier: "SecurityAndAnalysisStatus",
+    title: "Security feature status",
+    description: 'Whether the security feature is "enabled" or "disabled"'
+});
+const DelegatedBypassReviewerModeSchema = Schema.Literal("ALWAYS", "EXEMPT").annotations({
+    identifier: "DelegatedBypassReviewerMode",
+    title: "Delegated bypass reviewer mode",
+    description: "ALWAYS: reviewer is always required to approve bypass; EXEMPT: reviewer can bypass without review"
+});
+const DelegatedBypassReviewerSchema = Schema.Union(Schema.Struct({
+    team: Schema.String.annotations({
+        title: "Team slug",
+        description: 'GitHub team slug (e.g., "security-team"); resolved to numeric reviewer_id at sync time',
+        examples: [
+            "security-team"
+        ]
+    }),
+    mode: Schema.optional(DelegatedBypassReviewerModeSchema)
+}), Schema.Struct({
+    role: Schema.String.annotations({
+        title: "Organization role name",
+        description: 'Organization role name as defined in `GET /orgs/{org}/organization-roles` (e.g., "all_repo_admin", "security_manager"). Resolved to the numeric role ID at sync time.',
+        examples: [
+            "all_repo_admin",
+            "all_repo_maintain",
+            "security_manager"
+        ]
+    }),
+    mode: Schema.optional(DelegatedBypassReviewerModeSchema)
+})).annotations({
+    identifier: "DelegatedBypassReviewer",
+    title: "Delegated bypass reviewer",
+    description: "A reviewer who can approve secret-scanning push-protection bypass requests. Must specify exactly one of team or role."
+});
+const SecurityAndAnalysisSchema = Schema.Struct({
+    advanced_security: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
+        title: "GitHub Advanced Security",
+        description: "(GHAS-licensed) Master toggle for GitHub Advanced Security features. Free on public repos; requires a GHAS license on private repos."
+    })),
+    code_security: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
+        title: "GitHub Code Security",
+        description: "(GHAS-licensed) Toggle GitHub Code Security functionality."
+    })),
+    secret_scanning: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
+        title: "Secret scanning",
+        description: "Detect exposed credentials and sensitive data committed to the repository."
+    })),
+    secret_scanning_push_protection: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
+        title: "Secret scanning push protection",
+        description: "Block git pushes that contain detected secrets."
+    })),
+    secret_scanning_ai_detection: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
+        title: "Secret scanning AI detection",
+        description: "(GHAS-licensed) AI-powered detection of generic secrets beyond standard provider patterns."
+    })),
+    secret_scanning_non_provider_patterns: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
+        title: "Secret scanning non-provider patterns",
+        description: "(GHAS-licensed) Detect custom secret patterns beyond the standard provider list."
+    })),
+    secret_scanning_delegated_alert_dismissal: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
+        title: "Delegated alert dismissal",
+        description: "(org-only) Allow delegated dismissal of secret scanning alerts."
+    })),
+    secret_scanning_delegated_bypass: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
+        title: "Delegated push protection bypass",
+        description: "(org-only) Allow delegated approval of secret scanning push protection bypass requests."
+    })),
+    delegated_bypass_reviewers: Schema.optional(Schema.Array(DelegatedBypassReviewerSchema).annotations({
+        title: "Delegated bypass reviewers",
+        description: "(org-only) Reviewers authorized to approve push protection bypass requests. Each entry must specify a team slug or role name."
+    })),
+    dependabot_security_updates: Schema.optional(SecurityAndAnalysisStatusSchema.annotations({
+        title: "Dependabot security updates",
+        description: "Automatically open pull requests to patch known dependency vulnerabilities."
+    }))
+}).annotations({
+    identifier: "SecurityAndAnalysis",
+    title: "Security and analysis",
+    description: "GitHub repository security_and_analysis fields applied via the same PATCH /repos call as other settings. (GHAS-licensed) fields require a GHAS license on private repos; (org-only) fields are silently skipped on personal repos.",
+    jsonSchema: {
+        ...tombi({
+            tableKeysOrder: "schema"
+        }),
+        ...taplo({
+            links: {
+                key: "https://github.com/spencerbeggs/reposets/blob/main/docs/configuration.md"
+            }
+        })
+    }
+});
 const SettingsGroupSchema = Schema.Struct({
     is_template: Schema.optional(Schema.Boolean.annotations({
         title: "Template repository",
@@ -1136,7 +1245,8 @@ const SettingsGroupSchema = Schema.Struct({
     web_commit_signoff_required: Schema.optional(Schema.Boolean.annotations({
         title: "Require commit signoff",
         description: "Require contributors to sign off on web-based commits"
-    }))
+    })),
+    security_and_analysis: Schema.optional(SecurityAndAnalysisSchema)
 }, {
     key: Schema.String,
     value: Jsonifiable
@@ -1155,6 +1265,99 @@ const SettingsGroupSchema = Schema.Struct({
         })
     }
 });
+const SecurityGroupSchema = Schema.Struct({
+    vulnerability_alerts: Schema.optional(Schema.Boolean.annotations({
+        title: "Vulnerability alerts",
+        description: "Enable Dependabot vulnerability alerts (PUT/DELETE /repos/{o}/{r}/vulnerability-alerts)."
+    })),
+    automated_security_fixes: Schema.optional(Schema.Boolean.annotations({
+        title: "Automated security fixes",
+        description: "Enable Dependabot security pull requests (PUT/DELETE /repos/{o}/{r}/automated-security-fixes). Requires vulnerability_alerts to also be enabled."
+    })),
+    private_vulnerability_reporting: Schema.optional(Schema.Boolean.annotations({
+        title: "Private vulnerability reporting",
+        description: "Enable the private vulnerability reporting inbox (PUT/DELETE /repos/{o}/{r}/private-vulnerability-reporting)."
+    }))
+}).pipe(Schema.filter((group)=>!(true === group.automated_security_fixes && false === group.vulnerability_alerts), {
+    identifier: "SecurityGroup",
+    message: ()=>"automated_security_fixes = true requires vulnerability_alerts to be enabled (or omitted to leave the existing setting in place)"
+})).annotations({
+    identifier: "SecurityGroup",
+    title: "Security group",
+    description: "Toggles for repository-level security features that have dedicated PUT/DELETE endpoints (vulnerability alerts, automated security fixes, private vulnerability reporting). Omitted keys are left untouched.",
+    jsonSchema: {
+        ...tombi({
+            tableKeysOrder: "schema"
+        }),
+        ...taplo({
+            links: {
+                key: "https://github.com/spencerbeggs/reposets/blob/main/docs/configuration.md"
+            }
+        })
+    }
+});
+const CodeScanningLanguageSchema = Schema.Literal("actions", "c-cpp", "csharp", "go", "java-kotlin", "javascript-typescript", "python", "ruby", "swift").annotations({
+    identifier: "CodeScanningLanguage",
+    title: "CodeQL default-setup language",
+    description: "Languages supported by GitHub code scanning default setup. Note: this is narrower than the CodeQL analyzer (Rust is supported by CodeQL but not by default setup)."
+});
+const CodeScanningStateSchema = Schema.Literal("configured", "not-configured").annotations({
+    identifier: "CodeScanningState",
+    title: "Default setup state",
+    description: '"configured" enables CodeQL default setup; "not-configured" disables it.'
+});
+const CodeScanningQuerySuiteSchema = Schema.Literal("default", "extended").annotations({
+    identifier: "CodeScanningQuerySuite",
+    title: "Query suite",
+    description: '"default" runs the standard query set; "extended" includes additional security queries.'
+});
+const CodeScanningThreatModelSchema = Schema.Literal("remote", "remote_and_local").annotations({
+    identifier: "CodeScanningThreatModel",
+    title: "Threat model",
+    description: '"remote" analyzes network sources only; "remote_and_local" also includes filesystem and environment access.'
+});
+const CodeScanningRunnerTypeSchema = Schema.Literal("standard", "labeled").annotations({
+    identifier: "CodeScanningRunnerType",
+    title: "Runner type",
+    description: '"standard" uses GitHub-hosted runners; "labeled" uses runners matching runner_label.'
+});
+const CodeScanningGroupSchema = Schema.Struct({
+    state: Schema.optional(CodeScanningStateSchema),
+    languages: Schema.optional(Schema.Array(CodeScanningLanguageSchema).annotations({
+        title: "Languages",
+        description: "CodeQL languages to analyze. Languages not detected in the repository are skipped with a warning at sync time.",
+        examples: [
+            [
+                "javascript-typescript",
+                "python"
+            ]
+        ]
+    })),
+    query_suite: Schema.optional(CodeScanningQuerySuiteSchema),
+    threat_model: Schema.optional(CodeScanningThreatModelSchema),
+    runner_type: Schema.optional(CodeScanningRunnerTypeSchema),
+    runner_label: Schema.optional(Schema.String.annotations({
+        title: "Runner label",
+        description: 'Self-hosted runner label. Required when runner_type = "labeled".'
+    }))
+}).pipe(Schema.filter((group)=>"labeled" !== group.runner_type || void 0 !== group.runner_label, {
+    identifier: "CodeScanningGroup",
+    message: ()=>'runner_label is required when runner_type = "labeled"'
+})).annotations({
+    identifier: "CodeScanningGroup",
+    title: "Code scanning group",
+    description: "CodeQL default setup configuration applied via PATCH /repos/{o}/{r}/code-scanning/default-setup. The endpoint returns 202 Accepted and configures asynchronously; reposets sends the request and does not poll for completion.",
+    jsonSchema: {
+        ...tombi({
+            tableKeysOrder: "schema"
+        }),
+        ...taplo({
+            links: {
+                key: "https://github.com/spencerbeggs/reposets/blob/main/docs/configuration.md"
+            }
+        })
+    }
+});
 const LogLevelSchema = Schema.Literal("silent", "info", "verbose", "debug").annotations({
     identifier: "LogLevel",
     title: "Log level",
@@ -1235,12 +1438,36 @@ const ConfigSchema = Schema.Struct({
     }), {
         default: ()=>({})
     }),
+    security: Schema.optionalWith(Schema.Record({
+        key: Schema.String,
+        value: SecurityGroupSchema
+    }).annotations({
+        title: "Security groups",
+        description: "Named security groups for vulnerability alerts, automated security fixes, and private vulnerability reporting",
+        jsonSchema: tombi({
+            additionalKeyLabel: "security_group"
+        })
+    }), {
+        default: ()=>({})
+    }),
+    code_scanning: Schema.optionalWith(Schema.Record({
+        key: Schema.String,
+        value: CodeScanningGroupSchema
+    }).annotations({
+        title: "Code scanning groups",
+        description: "Named code scanning groups for CodeQL default setup configuration",
+        jsonSchema: tombi({
+            additionalKeyLabel: "code_scanning_group"
+        })
+    }), {
+        default: ()=>({})
+    }),
     groups: Schema.Record({
         key: Schema.String,
         value: GroupSchema
     }).annotations({
         title: "Groups",
-        description: "Named groups of repositories with their settings, secrets, variables, rulesets, and environment assignments",
+        description: "Named groups of repositories with their settings, secrets, variables, rulesets, environments, security, and code scanning assignments",
         jsonSchema: tombi({
             additionalKeyLabel: "group_name"
         })
@@ -1248,7 +1475,7 @@ const ConfigSchema = Schema.Struct({
 }).annotations({
     identifier: "Config",
     title: "reposets Configuration",
-    description: "Configuration for syncing GitHub repository settings, secrets, variables, rulesets, and deployment environments",
+    description: "Configuration for syncing GitHub repository settings, secrets, variables, rulesets, deployment environments, advanced security toggles, and CodeQL default setup",
     jsonSchema: {
         ...tombi({
             tableKeysOrder: "schema"
@@ -1374,6 +1601,8 @@ function validateConfigRefs(config) {
     const definedVariables = new Set(Object.keys(config.variables));
     const definedRulesets = new Set(Object.keys(config.rulesets));
     const definedEnvironments = new Set(Object.keys(config.environments));
+    const definedSecurity = new Set(Object.keys(config.security));
+    const definedCodeScanning = new Set(Object.keys(config.code_scanning));
     for (const [groupName, group] of Object.entries(config.groups)){
         if (group.settings) {
             for (const ref of group.settings)if (!definedSettings.has(ref)) errors.push(`group '${groupName}': unknown settings group '${ref}'`);
@@ -1384,6 +1613,12 @@ function validateConfigRefs(config) {
         if (group.environments) {
             for (const ref of group.environments)if (!definedEnvironments.has(ref)) errors.push(`group '${groupName}': unknown environment '${ref}'`);
         }
+        if (group.security) {
+            for (const ref of group.security)if (!definedSecurity.has(ref)) errors.push(`group '${groupName}': unknown security group '${ref}'`);
+        }
+        if (group.code_scanning) {
+            for (const ref of group.code_scanning)if (!definedCodeScanning.has(ref)) errors.push(`group '${groupName}': unknown code_scanning group '${ref}'`);
+        }
         if (group.secrets) {
             if (group.secrets.actions) {
                 for (const ref of group.secrets.actions)if (!definedSecrets.has(ref)) errors.push(`group '${groupName}': unknown secrets group '${ref}'`);
@@ -1537,6 +1772,31 @@ class GitHubClient extends Context.Tag("GitHubClient")() {
 const ORG_ONLY_SETTINGS = new Set([
     "allow_forking"
 ]);
+const SAA_STATUS_FIELDS = new Set([
+    "advanced_security",
+    "code_security",
+    "secret_scanning",
+    "secret_scanning_push_protection",
+    "secret_scanning_ai_detection",
+    "secret_scanning_non_provider_patterns",
+    "secret_scanning_delegated_alert_dismissal",
+    "secret_scanning_delegated_bypass",
+    "dependabot_security_updates"
+]);
+function transformSecurityAndAnalysis(value) {
+    if (null === value || "object" != typeof value) return;
+    const input = value;
+    const out = {};
+    for (const [key, raw] of Object.entries(input))if (void 0 !== raw) {
+        if (SAA_STATUS_FIELDS.has(key) && ("enabled" === raw || "disabled" === raw)) out[key] = {
+            status: raw
+        };
+        else if ("delegated_bypass_reviewers" === key && Array.isArray(raw) && raw.length > 0) out.secret_scanning_delegated_bypass_options = {
+            reviewers: raw
+        };
+    }
+    return Object.keys(out).length > 0 ? out : void 0;
+}
 const GRAPHQL_SETTINGS = {
     has_sponsorships: "hasSponsorshipsEnabled",
     has_pull_requests: "hasPullRequestsEnabled"
@@ -1563,6 +1823,8 @@ function GitHubClientLive(token) {
             });
         }
         const ownerTypeCache = new Map();
+        const teamIdCache = new Map();
+        const roleIdCache = new Map();
         return {
             getOwnerType (owner) {
                 return Effect.tryPromise({
@@ -1656,6 +1918,11 @@ function GitHubClientLive(token) {
                         const restSettings = {};
                         const graphqlInput = {};
                         for (const [key, value] of Object.entries(settings)){
+                            if ("security_and_analysis" === key) {
+                                const saa = transformSecurityAndAnalysis(value);
+                                if (void 0 !== saa) restSettings.security_and_analysis = saa;
+                                continue;
+                            }
                             const graphqlField = GRAPHQL_SETTINGS[key];
                             if (void 0 !== graphqlField) graphqlInput[graphqlField] = value;
                             else restSettings[key] = value;
@@ -1982,6 +2249,160 @@ function GitHubClientLive(token) {
                     },
                     catch: wrapError
                 });
+            },
+            getVulnerabilityAlerts (owner, repo) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        try {
+                            await octokit.request("GET /repos/{owner}/{repo}/vulnerability-alerts", {
+                                owner,
+                                repo
+                            });
+                            return true;
+                        } catch (error) {
+                            const status = error.status;
+                            if (404 === status) return false;
+                            throw error;
+                        }
+                    },
+                    catch: wrapError
+                });
+            },
+            setVulnerabilityAlerts (owner, repo, enabled) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        if (enabled) await octokit.request("PUT /repos/{owner}/{repo}/vulnerability-alerts", {
+                            owner,
+                            repo
+                        });
+                        else await octokit.request("DELETE /repos/{owner}/{repo}/vulnerability-alerts", {
+                            owner,
+                            repo
+                        });
+                    },
+                    catch: wrapError
+                });
+            },
+            getAutomatedSecurityFixes (owner, repo) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const { data } = await octokit.request("GET /repos/{owner}/{repo}/automated-security-fixes", {
+                            owner,
+                            repo
+                        });
+                        return Boolean(data.enabled);
+                    },
+                    catch: wrapError
+                });
+            },
+            setAutomatedSecurityFixes (owner, repo, enabled) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        if (enabled) await octokit.request("PUT /repos/{owner}/{repo}/automated-security-fixes", {
+                            owner,
+                            repo
+                        });
+                        else await octokit.request("DELETE /repos/{owner}/{repo}/automated-security-fixes", {
+                            owner,
+                            repo
+                        });
+                    },
+                    catch: wrapError
+                });
+            },
+            getPrivateVulnerabilityReporting (owner, repo) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const { data } = await octokit.request("GET /repos/{owner}/{repo}/private-vulnerability-reporting", {
+                            owner,
+                            repo
+                        });
+                        return Boolean(data.enabled);
+                    },
+                    catch: wrapError
+                });
+            },
+            setPrivateVulnerabilityReporting (owner, repo, enabled) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        if (enabled) await octokit.request("PUT /repos/{owner}/{repo}/private-vulnerability-reporting", {
+                            owner,
+                            repo
+                        });
+                        else await octokit.request("DELETE /repos/{owner}/{repo}/private-vulnerability-reporting", {
+                            owner,
+                            repo
+                        });
+                    },
+                    catch: wrapError
+                });
+            },
+            updateCodeScanningDefaultSetup (owner, repo, config) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const body = {};
+                        if (void 0 !== config.state) body.state = config.state;
+                        if (void 0 !== config.languages) body.languages = [
+                            ...config.languages
+                        ];
+                        if (void 0 !== config.query_suite) body.query_suite = config.query_suite;
+                        if (void 0 !== config.threat_model) body.threat_model = config.threat_model;
+                        if (void 0 !== config.runner_type) body.runner_type = config.runner_type;
+                        if (void 0 !== config.runner_label) body.runner_label = config.runner_label;
+                        await octokit.request("PATCH /repos/{owner}/{repo}/code-scanning/default-setup", {
+                            owner,
+                            repo,
+                            ...body
+                        });
+                    },
+                    catch: wrapError
+                });
+            },
+            listRepoLanguages (owner, repo) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const { data } = await octokit.repos.listLanguages({
+                            owner,
+                            repo
+                        });
+                        return Object.keys(data);
+                    },
+                    catch: wrapError
+                });
+            },
+            resolveTeamId (org, slug) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const cacheKey = `${org}:${slug}`;
+                        const cached = teamIdCache.get(cacheKey);
+                        if (void 0 !== cached) return cached;
+                        const { data } = await octokit.teams.getByName({
+                            org,
+                            team_slug: slug
+                        });
+                        teamIdCache.set(cacheKey, data.id);
+                        return data.id;
+                    },
+                    catch: wrapError
+                });
+            },
+            resolveRoleId (org, name) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const cacheKey = `${org}:${name}`;
+                        const cached = roleIdCache.get(cacheKey);
+                        if (void 0 !== cached) return cached;
+                        const { data } = await octokit.request("GET /orgs/{org}/organization-roles", {
+                            org
+                        });
+                        const roles = data.roles ?? [];
+                        const role = roles.find((r)=>r.name === name);
+                        if (!role) throw new Error(`organization role '${name}' not found in '${org}' (available: ${roles.map((r)=>r.name).join(", ") || "none"})`);
+                        roleIdCache.set(cacheKey, role.id);
+                        return role.id;
+                    },
+                    catch: wrapError
+                });
             }
         };
     })());
@@ -2158,6 +2579,82 @@ function GitHubClientTest() {
                 }
             });
             return Effect["void"];
+        },
+        getVulnerabilityAlerts (_owner, _repo) {
+            return Effect.succeed(false);
+        },
+        setVulnerabilityAlerts (owner, repo, enabled) {
+            recorded.push({
+                method: "setVulnerabilityAlerts",
+                args: {
+                    owner,
+                    repo,
+                    enabled
+                }
+            });
+            return Effect["void"];
+        },
+        getAutomatedSecurityFixes (_owner, _repo) {
+            return Effect.succeed(false);
+        },
+        setAutomatedSecurityFixes (owner, repo, enabled) {
+            recorded.push({
+                method: "setAutomatedSecurityFixes",
+                args: {
+                    owner,
+                    repo,
+                    enabled
+                }
+            });
+            return Effect["void"];
+        },
+        getPrivateVulnerabilityReporting (_owner, _repo) {
+            return Effect.succeed(false);
+        },
+        setPrivateVulnerabilityReporting (owner, repo, enabled) {
+            recorded.push({
+                method: "setPrivateVulnerabilityReporting",
+                args: {
+                    owner,
+                    repo,
+                    enabled
+                }
+            });
+            return Effect["void"];
+        },
+        updateCodeScanningDefaultSetup (owner, repo, config) {
+            recorded.push({
+                method: "updateCodeScanningDefaultSetup",
+                args: {
+                    owner,
+                    repo,
+                    config
+                }
+            });
+            return Effect["void"];
+        },
+        listRepoLanguages (_owner, _repo) {
+            return Effect.succeed([]);
+        },
+        resolveTeamId (org, slug) {
+            recorded.push({
+                method: "resolveTeamId",
+                args: {
+                    org,
+                    slug
+                }
+            });
+            return Effect.succeed(0);
+        },
+        resolveRoleId (org, name) {
+            recorded.push({
+                method: "resolveRoleId",
+                args: {
+                    org,
+                    name
+                }
+            });
+            return Effect.succeed(0);
         }
     });
     return {
@@ -2172,6 +2669,8 @@ class SyncLogger extends Context.Tag("SyncLogger")() {
 function pluralize(resource, count) {
     if (1 === count) return resource;
     if ("ruleset" === resource) return "rulesets";
+    if ("security feature" === resource) return "security features";
+    if ("code scanning" === resource) return "code scanning";
     return `${resource}s`;
 }
 function SyncLoggerLive(config) {
@@ -2278,6 +2777,24 @@ function SyncLoggerLive(config) {
         };
     }));
 }
+const ORG_ONLY_SAA_FIELDS = new Set([
+    "secret_scanning_delegated_alert_dismissal",
+    "secret_scanning_delegated_bypass",
+    "delegated_bypass_reviewers"
+]);
+const REPO_LANG_TO_CODEQL = {
+    JavaScript: "javascript-typescript",
+    TypeScript: "javascript-typescript",
+    C: "c-cpp",
+    "C++": "c-cpp",
+    "C#": "csharp",
+    Go: "go",
+    Java: "java-kotlin",
+    Kotlin: "java-kotlin",
+    Python: "python",
+    Ruby: "ruby",
+    Swift: "swift"
+};
 class SyncEngine extends Context.Tag("SyncEngine")() {
 }
 function isCleanupActive(scope) {
@@ -2335,6 +2852,29 @@ function groupEntryNames(group) {
     if ("resolved" in group) return Object.keys(group.resolved);
     return [];
 }
+function mergeSecurityAndAnalysis(blocks) {
+    const merged = {};
+    let hasAny = false;
+    for (const block of blocks)if (block) {
+        hasAny = true;
+        for (const [key, value] of Object.entries(block))if (void 0 !== value) merged[key] = value;
+    }
+    return hasAny ? merged : void 0;
+}
+function mergeSecurityGroups(groups) {
+    const merged = {};
+    for (const group of groups)if (group) {
+        for (const [key, value] of Object.entries(group))if ("boolean" == typeof value) merged[key] = value;
+    }
+    return merged;
+}
+function mergeCodeScanningGroups(groups) {
+    const merged = {};
+    for (const group of groups)if (group) {
+        for (const [key, value] of Object.entries(group))if (void 0 !== value) merged[key] = value;
+    }
+    return merged;
+}
 const SyncEngineLive = Layer.effect(SyncEngine, Effect.gen(function*() {
     const github = yield* GitHubClient;
     const credResolver = yield* CredentialResolver;
@@ -2459,9 +2999,14 @@ const SyncEngineLive = Layer.effect(SyncEngine, Effect.gen(function*() {
                     const settingGroupRefs = group.settings ?? [];
                     const mergedSettings = {};
                     const skippedSettings = [];
+                    const saaBlocks = [];
                     for (const ref of settingGroupRefs){
                         const settingGroup = config.settings[ref];
-                        if (settingGroup) Object.assign(mergedSettings, settingGroup);
+                        if (settingGroup) {
+                            const { security_and_analysis, ...rest } = settingGroup;
+                            Object.assign(mergedSettings, rest);
+                            saaBlocks.push(security_and_analysis);
+                        }
                     }
                     if ("User" === ownerType) {
                         for (const key of ORG_ONLY_SETTINGS)if (key in mergedSettings) {
@@ -2469,6 +3014,58 @@ const SyncEngineLive = Layer.effect(SyncEngine, Effect.gen(function*() {
                             skippedSettings.push(key);
                         }
                     }
+                    const mergedSAA = mergeSecurityAndAnalysis(saaBlocks);
+                    const skippedSAA = [];
+                    if (mergedSAA) {
+                        const saaOut = {
+                            ...mergedSAA
+                        };
+                        if ("User" === ownerType) {
+                            for (const key of ORG_ONLY_SAA_FIELDS)if (key in saaOut) {
+                                delete saaOut[key];
+                                skippedSAA.push(key);
+                            }
+                        } else {
+                            const reviewers = saaOut.delegated_bypass_reviewers;
+                            if (Array.isArray(reviewers)) {
+                                const resolved = [];
+                                for (const reviewer of reviewers)if ("string" == typeof reviewer.team) {
+                                    const teamId = yield* github.resolveTeamId(owner, reviewer.team).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
+                                            yield* logger.syncError(`resolve team '${reviewer.team}'`, err.message);
+                                        })));
+                                    if (void 0 !== teamId) {
+                                        const entry = {
+                                            reviewer_id: teamId,
+                                            reviewer_type: "TEAM"
+                                        };
+                                        if (void 0 !== reviewer.mode) entry.mode = reviewer.mode;
+                                        resolved.push(entry);
+                                    }
+                                } else if ("string" == typeof reviewer.role) {
+                                    const roleId = yield* github.resolveRoleId(owner, reviewer.role).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
+                                            yield* logger.syncError(`resolve role '${reviewer.role}'`, err.message);
+                                        })));
+                                    if (void 0 !== roleId) {
+                                        const entry = {
+                                            reviewer_id: roleId,
+                                            reviewer_type: "ROLE"
+                                        };
+                                        if (void 0 !== reviewer.mode) entry.mode = reviewer.mode;
+                                        resolved.push(entry);
+                                    }
+                                }
+                                saaOut.delegated_bypass_reviewers = resolved;
+                            }
+                        }
+                        if (Object.keys(saaOut).length > 0) mergedSettings.security_and_analysis = saaOut;
+                    }
+                    const securityGroupRefs = group.security ?? [];
+                    const mergedSecurity = mergeSecurityGroups(securityGroupRefs.map((ref)=>config.security[ref]));
+                    const codeScanningRefs = group.code_scanning ?? [];
+                    const mergedCodeScanning = mergeCodeScanningGroups(codeScanningRefs.map((ref)=>config.code_scanning[ref]));
+                    const hasSecurity = Object.keys(mergedSecurity).length > 0;
+                    const securityContradiction = true === mergedSecurity.automated_security_fixes && false === mergedSecurity.vulnerability_alerts;
+                    const hasCodeScanning = Object.keys(mergedCodeScanning).length > 0;
                     const hasSecrets = secretScopes.some((s)=>(resolvedSecrets.get(s)?.size ?? 0) > 0);
                     const hasVariables = resolvedVariables.size > 0;
                     const hasRulesets = rulesetMap.size > 0;
@@ -2478,7 +3075,7 @@ const SyncEngineLive = Layer.effect(SyncEngine, Effect.gen(function*() {
                     const hasEnvVariables = resolvedEnvVariables.size > 0;
                     const hasCleanup = !noCleanup && (isCleanupActive(effectiveCleanup.secrets.actions) || isCleanupActive(effectiveCleanup.secrets.dependabot) || isCleanupActive(effectiveCleanup.secrets.codespaces) || isCleanupActive(effectiveCleanup.secrets.environments) || isCleanupActive(effectiveCleanup.variables.actions) || isCleanupActive(effectiveCleanup.variables.environments) || isCleanupActive(effectiveCleanup.rulesets) || isCleanupActive(effectiveCleanup.environments));
                     for (const repoName of group.repos)if (!repoFilter || repoName === repoFilter) {
-                        if (!hasSecrets && !hasVariables && !hasRulesets && !hasSettings && !hasEnvironments && !hasEnvSecrets && !hasEnvVariables && !hasCleanup) {
+                        if (!hasSecrets && !hasVariables && !hasRulesets && !hasSettings && !hasEnvironments && !hasEnvSecrets && !hasEnvVariables && !hasSecurity && !hasCodeScanning && !hasCleanup) {
                             yield* logger.repoSkip(owner, repoName, "no changes configured");
                             continue;
                         }
@@ -2489,6 +3086,66 @@ const SyncEngineLive = Layer.effect(SyncEngine, Effect.gen(function*() {
                                 yield* github.syncSettings(owner, repoName, mergedSettings).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError("settings", err.message)));
                             }
                             for (const key of skippedSettings)yield* logger.syncOperation("skip", "setting", key, "(org-only, owner is a personal account)");
+                            for (const key of skippedSAA)yield* logger.syncOperation("skip", "security_and_analysis", key, "(org-only, owner is a personal account)");
+                            if (hasSecurity && securityContradiction) yield* logger.syncError("security merge", "automated_security_fixes = true requires vulnerability_alerts to be enabled (or omitted); skipping security sync");
+                            else if (hasSecurity) {
+                                if (void 0 !== mergedSecurity.vulnerability_alerts) {
+                                    const desired = mergedSecurity.vulnerability_alerts;
+                                    const current = yield* github.getVulnerabilityAlerts(owner, repoName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
+                                            yield* logger.syncError("get vulnerability_alerts", err.message);
+                                            return desired;
+                                        })));
+                                    if (current !== desired) {
+                                        yield* logger.syncOperation("sync", "vulnerability_alerts", desired ? "enable" : "disable");
+                                        yield* github.setVulnerabilityAlerts(owner, repoName, desired).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError("vulnerability_alerts", err.message)));
+                                    }
+                                }
+                                if (void 0 !== mergedSecurity.automated_security_fixes) {
+                                    const desired = mergedSecurity.automated_security_fixes;
+                                    const current = yield* github.getAutomatedSecurityFixes(owner, repoName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
+                                            yield* logger.syncError("get automated_security_fixes", err.message);
+                                            return desired;
+                                        })));
+                                    if (current !== desired) {
+                                        yield* logger.syncOperation("sync", "automated_security_fixes", desired ? "enable" : "disable");
+                                        yield* github.setAutomatedSecurityFixes(owner, repoName, desired).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError("automated_security_fixes", err.message)));
+                                    }
+                                }
+                                if (void 0 !== mergedSecurity.private_vulnerability_reporting) {
+                                    const desired = mergedSecurity.private_vulnerability_reporting;
+                                    const current = yield* github.getPrivateVulnerabilityReporting(owner, repoName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
+                                            yield* logger.syncError("get private_vulnerability_reporting", err.message);
+                                            return desired;
+                                        })));
+                                    if (current !== desired) {
+                                        yield* logger.syncOperation("sync", "private_vulnerability_reporting", desired ? "enable" : "disable");
+                                        yield* github.setPrivateVulnerabilityReporting(owner, repoName, desired).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError("private_vulnerability_reporting", err.message)));
+                                    }
+                                }
+                            }
+                            if (hasCodeScanning) {
+                                let desiredConfig = mergedCodeScanning;
+                                if (void 0 !== mergedCodeScanning.languages) {
+                                    const detected = yield* github.listRepoLanguages(owner, repoName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
+                                            yield* logger.syncError("list repo languages", err.message);
+                                            return [];
+                                        })));
+                                    const detectedCodeQL = new Set();
+                                    for (const lang of detected){
+                                        const mapped = REPO_LANG_TO_CODEQL[lang];
+                                        if (mapped) detectedCodeQL.add(mapped);
+                                    }
+                                    const filtered = [];
+                                    for (const lang of mergedCodeScanning.languages)if ("actions" === lang || detectedCodeQL.has(lang)) filtered.push(lang);
+                                    else yield* logger.syncOperation("skip", "code_scanning language", lang, "(not detected in repository)");
+                                    desiredConfig = {
+                                        ...mergedCodeScanning,
+                                        languages: filtered
+                                    };
+                                }
+                                yield* logger.syncOperation("sync", "code_scanning", desiredConfig.state ?? "default-setup");
+                                yield* github.updateCodeScanningDefaultSetup(owner, repoName, desiredConfig).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError("code_scanning default setup", err.message)));
+                            }
                             for (const envName of envRefs){
                                 const envConfig = config.environments[envName];
                                 if (envConfig) {
@@ -2520,6 +3177,11 @@ const SyncEngineLive = Layer.effect(SyncEngine, Effect.gen(function*() {
                                 yield* github.syncRuleset(owner, repoName, ruleset.name, ruleset).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`ruleset ${ruleset.name}`, err.message)));
                             }
                         }
+                        if (hasSecurity) {
+                            const securityCount = Object.values(mergedSecurity).filter((v)=>void 0 !== v).length;
+                            yield* logger.syncSummary("security feature", securityCount, "");
+                        }
+                        if (hasCodeScanning) yield* logger.syncSummary("code scanning", 1, mergedCodeScanning.state ?? "applied");
                         if (hasEnvironments) yield* logger.syncSummary("environment", envRefs.length, "");
                         if (hasSecrets) {
                             const scopeCounts = [];

package/README.md

@@ -4,7 +4,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![TypeScript](https://img.shields.io/badge/TypeScript-6.0-blue.svg)](https://www.typescriptlang.org/)
 
-Declarative GitHub repository management. Define your repo settings, secrets, variables, rulesets, and deployment environments in a TOML config file, then apply them across all your repositories with a single command.
+Declarative GitHub repository management. Define your repo settings, secrets, variables, rulesets, deployment environments, advanced security toggles, and CodeQL default setup in a TOML config file, then apply them across all your repositories with a single command.
 
 ## Why reposets
 
@@ -17,7 +17,8 @@ Managing repository settings by hand doesn't scale. When you have dozens of repo
 - **Multi-scope secret and variable management** — Assign the same secret group to Actions, Dependabot, Codespaces, and deployment environments with scoped targeting.
 - **Ruleset shorthand syntax** — Define branch and tag rulesets with compact inline syntax for pull request rules, status checks, and boolean flags instead of verbose API payloads.
 - **Deployment environment management** — Configure wait timers, reviewers, and branch policies for deployment environments alongside your other settings.
-- **Group-based targeting** — Organize repos into groups that share settings, secrets, variables, rulesets, and environments. Change the group config, sync once, and every repo updates.
+- **Advanced security and CodeQL** — Toggle secret scanning, push protection, vulnerability alerts, automated security fixes, private vulnerability reporting, and CodeQL default setup. License- and ownership-aware: GHAS-licensed fields warn instead of failing on private repos without a license, and org-only fields are silently skipped on personal accounts.
+- **Group-based targeting** — Organize repos into groups that share settings, secrets, variables, rulesets, environments, security toggles, and code scanning configuration. Change the group config, sync once, and every repo updates.
 - **Cleanup policies** — Automatically remove undeclared resources per scope with optional preserve lists, so your repos converge to the declared state.
 - **Dry-run and validation** — Preview changes before applying, validate config locally without touching the GitHub API, and catch typos with built-in diagnostics.
 
@@ -93,7 +94,7 @@ All commands accept `--log-level silent|info|verbose|debug`.
 
 reposets uses two TOML files:
 
-- `reposets.config.toml` — defines settings, secrets, variables, rulesets, environments, and groups
+- `reposets.config.toml` — defines settings, secrets, variables, rulesets, environments, security, code_scanning, and groups
 - `reposets.credentials.toml` — stores GitHub tokens and optional resolve sections for named values
 
 Config lookup order (first match wins):
@@ -112,8 +113,14 @@ reposets requires a fine-grained personal access token with:
 - Repository > Secrets (Read and write)
 - Repository > Variables (Read and write)
 - Repository > Environments (Read and write)
+- Repository > Code scanning alerts (Read and write) — for `[code_scanning.*]`
+- Repository > Dependabot alerts (Read and write) — for `[security.*]`
+- Repository > Secret scanning alerts (Read and write) — for `security_and_analysis`
+- Organization > Members (Read) — for `delegated_bypass_reviewers` team slugs on org-owned repos
 - Account > GPG keys (Read and write)
 
+The four security-related scopes are only required if you use the corresponding config sections.
+
 ## Documentation
 
 Full reference guides are available in the [`docs/`](https://github.com/spencerbeggs/reposets/tree/main/docs) folder:
@@ -124,6 +131,7 @@ Full reference guides are available in the [`docs/`](https://github.com/spencerb
 - [Secrets and Variables](https://github.com/spencerbeggs/reposets/blob/main/docs/secrets-and-variables.md) - resource groups, three kinds (file/value/resolved), and scoping
 - [Rulesets](https://github.com/spencerbeggs/reposets/blob/main/docs/rulesets.md) - branch and tag ruleset configuration
 - [Environments](https://github.com/spencerbeggs/reposets/blob/main/docs/environments.md) - deployment environment setup
+- [Advanced Security](https://github.com/spencerbeggs/reposets/blob/main/docs/configuration.md#security-and-analysis-nested-block) - secret scanning, vulnerability alerts, automated security fixes, private vulnerability reporting, and CodeQL default setup
 - [Cleanup](https://github.com/spencerbeggs/reposets/blob/main/docs/cleanup.md) - automatic cleanup of undeclared resources
 - [Token Permissions](https://github.com/spencerbeggs/reposets/blob/main/docs/token-permissions.md) - GitHub PAT setup guide
 

package/bin/reposets.js

@@ -81,6 +81,8 @@ const KNOWN_CONFIG_KEYS = new Set([
     "variables",
     "rulesets",
     "environments",
+    "security",
+    "code_scanning",
     "groups"
 ]);
 const KNOWN_GROUP_KEYS = new Set([
@@ -92,6 +94,8 @@ const KNOWN_GROUP_KEYS = new Set([
     "variables",
     "rulesets",
     "environments",
+    "security",
+    "code_scanning",
     "cleanup"
 ]);
 const KNOWN_CLEANUP_KEYS = new Set([
@@ -206,7 +210,11 @@ const doctorCommand = Command.make("doctor", {
         yield* Effect.log("  Repository permissions > Secrets (Read and write) -- Actions secrets");
         yield* Effect.log("  Repository permissions > Variables (Read and write) -- Actions variables");
         yield* Effect.log("  Repository permissions > Environments (Read and write) -- environment sync");
+        yield* Effect.log("  Repository permissions > Code scanning alerts (Read and write) -- code_scanning sync");
+        yield* Effect.log("  Repository permissions > Dependabot alerts (Read and write) -- security feature sync");
+        yield* Effect.log("  Repository permissions > Secret scanning alerts (Read and write) -- secret scanning delegation");
         yield* Effect.log("  Account permissions > GPG keys (Read and write) -- secrets encryption key");
+        yield* Effect.log("  Organization permissions > Members (Read) -- resolve team slugs (org-level only)");
         if (0 === warnings) yield* Effect.log("\nNo unknown keys detected.");
         else yield* Effect.log(`\n${warnings} warning(s) found.`);
     }).pipe(Effect.provide(makeConfigFilesLive(config)))).pipe(Command.withDescription("Deep config diagnostics with typo detection"));
@@ -256,6 +264,35 @@ const CONFIG_TEMPLATE = `# reposets configuration
 # [[rulesets.default-branch.rules]]
 # type = "deletion"
 
+# --- Advanced security ---
+# Nested inside a settings group (folded into the same PATCH /repos call).
+# Some fields are GHAS-licensed and only work on public repos or
+# private repos with a GHAS subscription. Org-only fields are silently
+# skipped on personal accounts.
+#
+# [settings.defaults.security_and_analysis]
+# secret_scanning = "enabled"
+# secret_scanning_push_protection = "enabled"
+# dependabot_security_updates = "enabled"
+
+# --- Security feature toggles ---
+# Dedicated PUT/DELETE endpoints; omit a key to leave it untouched.
+#
+# [security.oss-defaults]
+# vulnerability_alerts = true
+# automated_security_fixes = true
+# private_vulnerability_reporting = true
+
+# --- CodeQL default setup ---
+# Applies via PATCH /repos/{o}/{r}/code-scanning/default-setup.
+# Languages not detected in the repo are skipped with a warning.
+#
+# [code_scanning.oss-defaults]
+# state = "configured"
+# languages = ["javascript-typescript", "python"]
+# query_suite = "extended"
+# threat_model = "remote"
+
 # --- Cleanup defaults ---
 # [cleanup]
 # secrets = false
@@ -269,6 +306,8 @@ const CONFIG_TEMPLATE = `# reposets configuration
 # secrets = { actions = ["from-files", "from-creds"] }
 # variables = { actions = ["turbo", "bot"] }
 # rulesets = ["default-branch"]
+# security = ["oss-defaults"]
+# code_scanning = ["oss-defaults"]
 `;
 const CREDENTIALS_TEMPLATE = `# reposets credentials (keep this file private)
 # See: https://github.com/spencerbeggs/reposets
@@ -356,6 +395,8 @@ const listCommand = Command.make("list", {
                 if (parts.length) yield* Effect.log(`  variables: ${parts.join(", ")}`);
             }
             if (group.rulesets?.length) yield* Effect.log(`  rulesets: ${group.rulesets.join(", ")}`);
+            if (group.security?.length) yield* Effect.log(`  security: ${group.security.join(", ")}`);
+            if (group.code_scanning?.length) yield* Effect.log(`  code_scanning: ${group.code_scanning.join(", ")}`);
             if (group.credentials) yield* Effect.log(`  credentials: ${group.credentials}`);
             yield* Effect.log("");
         }

package/index.d.ts

@@ -111,6 +111,24 @@ export declare const CleanupScopeSchema: Schema.Union<[typeof Schema.Boolean, Sc
     preserve: Schema.Array$<typeof Schema.String>;
 }>]>;
 
+declare type CodeScanningGroup = typeof CodeScanningGroupSchema.Type;
+
+declare const CodeScanningGroupSchema: Schema.refine<{
+    readonly state?: "configured" | "not-configured" | undefined;
+    readonly languages?: readonly ("actions" | "c-cpp" | "csharp" | "go" | "java-kotlin" | "javascript-typescript" | "python" | "ruby" | "swift")[] | undefined;
+    readonly query_suite?: "default" | "extended" | undefined;
+    readonly threat_model?: "remote" | "remote_and_local" | undefined;
+    readonly runner_type?: "labeled" | "standard" | undefined;
+    readonly runner_label?: string | undefined;
+}, Schema.Struct<{
+    state: Schema.optional<Schema.Literal<["configured", "not-configured"]>>;
+    languages: Schema.optional<Schema.Array$<Schema.Literal<["actions", "c-cpp", "csharp", "go", "java-kotlin", "javascript-typescript", "python", "ruby", "swift"]>>>;
+    query_suite: Schema.optional<Schema.Literal<["default", "extended"]>>;
+    threat_model: Schema.optional<Schema.Literal<["remote", "remote_and_local"]>>;
+    runner_type: Schema.optional<Schema.Literal<["standard", "labeled"]>>;
+    runner_label: Schema.optional<Schema.SchemaClass<string, string, never>>;
+}>>;
+
 export declare type Config = typeof ConfigSchema.Type;
 
 export declare const CONFIG_FILENAME = "reposets.config.toml";
@@ -148,6 +166,24 @@ export declare const ConfigSchema: Schema.Struct<{
         merge_commit_message: Schema.optional<Schema.Literal<["PR_BODY", "PR_TITLE", "BLANK"]>>;
         delete_branch_on_merge: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
         web_commit_signoff_required: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
+        security_and_analysis: Schema.optional<Schema.Struct<{
+            advanced_security: Schema.optional<Schema.Literal<["enabled", "disabled"]>>;
+            code_security: Schema.optional<Schema.Literal<["enabled", "disabled"]>>;
+            secret_scanning: Schema.optional<Schema.Literal<["enabled", "disabled"]>>;
+            secret_scanning_push_protection: Schema.optional<Schema.Literal<["enabled", "disabled"]>>;
+            secret_scanning_ai_detection: Schema.optional<Schema.Literal<["enabled", "disabled"]>>;
+            secret_scanning_non_provider_patterns: Schema.optional<Schema.Literal<["enabled", "disabled"]>>;
+            secret_scanning_delegated_alert_dismissal: Schema.optional<Schema.Literal<["enabled", "disabled"]>>;
+            secret_scanning_delegated_bypass: Schema.optional<Schema.Literal<["enabled", "disabled"]>>;
+            delegated_bypass_reviewers: Schema.optional<Schema.Array$<Schema.Union<[Schema.Struct<{
+                team: Schema.SchemaClass<string, string, never>;
+                mode: Schema.optional<Schema.Literal<["ALWAYS", "EXEMPT"]>>;
+            }>, Schema.Struct<{
+                role: Schema.SchemaClass<string, string, never>;
+                mode: Schema.optional<Schema.Literal<["ALWAYS", "EXEMPT"]>>;
+            }>]>>>;
+            dependabot_security_updates: Schema.optional<Schema.Literal<["enabled", "disabled"]>>;
+        }>>;
     }, readonly [{
         readonly key: typeof Schema.String;
         readonly value: Schema.SchemaClass<unknown, unknown, never>;
@@ -390,6 +426,34 @@ export declare const ConfigSchema: Schema.Struct<{
     }>>, {
         default: () => {};
     }>;
+    security: Schema.optionalWith<Schema.Record$<typeof Schema.String, Schema.refine<{
+        readonly vulnerability_alerts?: boolean | undefined;
+        readonly automated_security_fixes?: boolean | undefined;
+        readonly private_vulnerability_reporting?: boolean | undefined;
+    }, Schema.Struct<{
+        vulnerability_alerts: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
+        automated_security_fixes: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
+        private_vulnerability_reporting: Schema.optional<Schema.SchemaClass<boolean, boolean, never>>;
+    }>>>, {
+        default: () => {};
+    }>;
+    code_scanning: Schema.optionalWith<Schema.Record$<typeof Schema.String, Schema.refine<{
+        readonly state?: "configured" | "not-configured" | undefined;
+        readonly languages?: readonly ("actions" | "c-cpp" | "csharp" | "go" | "java-kotlin" | "javascript-typescript" | "python" | "ruby" | "swift")[] | undefined;
+        readonly query_suite?: "default" | "extended" | undefined;
+        readonly threat_model?: "remote" | "remote_and_local" | undefined;
+        readonly runner_type?: "labeled" | "standard" | undefined;
+        readonly runner_label?: string | undefined;
+    }, Schema.Struct<{
+        state: Schema.optional<Schema.Literal<["configured", "not-configured"]>>;
+        languages: Schema.optional<Schema.Array$<Schema.Literal<["actions", "c-cpp", "csharp", "go", "java-kotlin", "javascript-typescript", "python", "ruby", "swift"]>>>;
+        query_suite: Schema.optional<Schema.Literal<["default", "extended"]>>;
+        threat_model: Schema.optional<Schema.Literal<["remote", "remote_and_local"]>>;
+        runner_type: Schema.optional<Schema.Literal<["standard", "labeled"]>>;
+        runner_label: Schema.optional<Schema.SchemaClass<string, string, never>>;
+    }>>>, {
+        default: () => {};
+    }>;
     groups: Schema.Record$<typeof Schema.String, Schema.Struct<{
         owner: Schema.optional<Schema.SchemaClass<string, string, never>>;
         repos: Schema.Array$<typeof Schema.String>;
@@ -407,6 +471,8 @@ export declare const ConfigSchema: Schema.Struct<{
             environments: Schema.optional<Schema.Record$<typeof Schema.String, Schema.Array$<typeof Schema.String>>>;
         }>>;
         rulesets: Schema.optional<Schema.Array$<typeof Schema.String>>;
+        security: Schema.optional<Schema.Array$<typeof Schema.String>>;
+        code_scanning: Schema.optional<Schema.Array$<typeof Schema.String>>;
         cleanup: Schema.optional<Schema.Struct<{
             secrets: Schema.optionalWith<Schema.Struct<{
                 actions: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
@@ -559,6 +625,16 @@ declare interface GitHubClientService {
     readonly deleteEnvironment: (owner: string, repo: string, name: string) => Effect.Effect<void, GitHubApiError>;
     readonly deleteEnvironmentSecret: (owner: string, repo: string, envName: string, name: string) => Effect.Effect<void, GitHubApiError>;
     readonly deleteEnvironmentVariable: (owner: string, repo: string, envName: string, name: string) => Effect.Effect<void, GitHubApiError>;
+    readonly getVulnerabilityAlerts: (owner: string, repo: string) => Effect.Effect<boolean, GitHubApiError>;
+    readonly setVulnerabilityAlerts: (owner: string, repo: string, enabled: boolean) => Effect.Effect<void, GitHubApiError>;
+    readonly getAutomatedSecurityFixes: (owner: string, repo: string) => Effect.Effect<boolean, GitHubApiError>;
+    readonly setAutomatedSecurityFixes: (owner: string, repo: string, enabled: boolean) => Effect.Effect<void, GitHubApiError>;
+    readonly getPrivateVulnerabilityReporting: (owner: string, repo: string) => Effect.Effect<boolean, GitHubApiError>;
+    readonly setPrivateVulnerabilityReporting: (owner: string, repo: string, enabled: boolean) => Effect.Effect<void, GitHubApiError>;
+    readonly updateCodeScanningDefaultSetup: (owner: string, repo: string, config: CodeScanningGroup) => Effect.Effect<void, GitHubApiError>;
+    readonly listRepoLanguages: (owner: string, repo: string) => Effect.Effect<ReadonlyArray<string>, GitHubApiError>;
+    readonly resolveTeamId: (org: string, slug: string) => Effect.Effect<number, GitHubApiError>;
+    readonly resolveRoleId: (org: string, name: string) => Effect.Effect<number, GitHubApiError>;
 }
 
 export declare function GitHubClientTest(): {
@@ -585,6 +661,8 @@ export declare const GroupSchema: Schema.Struct<{
         environments: Schema.optional<Schema.Record$<typeof Schema.String, Schema.Array$<typeof Schema.String>>>;
     }>>;
     rulesets: Schema.optional<Schema.Array$<typeof Schema.String>>;
+    security: Schema.optional<Schema.Array$<typeof Schema.String>>;
+    code_scanning: Schema.optional<Schema.Array$<typeof Schema.String>>;
     cleanup: Schema.optional<Schema.Struct<{
         secrets: Schema.optionalWith<Schema.Struct<{
             actions: Schema.optionalWith<Schema.Union<[typeof Schema.Boolean, Schema.Struct<{
@@ -712,6 +790,24 @@ readonly merge_commit_title?: "MERGE_MESSAGE" | "PR_TITLE" | undefined;
 readonly merge_commit_message?: "BLANK" | "PR_BODY" | "PR_TITLE" | undefined;
 readonly delete_branch_on_merge?: boolean | undefined;
 readonly web_commit_signoff_required?: boolean | undefined;
+readonly security_and_analysis?: {
+readonly advanced_security?: "disabled" | "enabled" | undefined;
+readonly code_security?: "disabled" | "enabled" | undefined;
+readonly secret_scanning?: "disabled" | "enabled" | undefined;
+readonly secret_scanning_push_protection?: "disabled" | "enabled" | undefined;
+readonly secret_scanning_ai_detection?: "disabled" | "enabled" | undefined;
+readonly secret_scanning_non_provider_patterns?: "disabled" | "enabled" | undefined;
+readonly secret_scanning_delegated_alert_dismissal?: "disabled" | "enabled" | undefined;
+readonly secret_scanning_delegated_bypass?: "disabled" | "enabled" | undefined;
+readonly delegated_bypass_reviewers?: readonly ({
+readonly team: string;
+readonly mode?: "ALWAYS" | "EXEMPT" | undefined;
+} | {
+readonly role: string;
+readonly mode?: "ALWAYS" | "EXEMPT" | undefined;
+})[] | undefined;
+readonly dependabot_security_updates?: "disabled" | "enabled" | undefined;
+} | undefined;
 };
 };
 readonly secrets: {
@@ -942,6 +1038,23 @@ readonly type: "branch" | "tag";
 }[] | undefined;
 };
 };
+readonly security: {
+readonly [x: string]: {
+readonly vulnerability_alerts?: boolean | undefined;
+readonly automated_security_fixes?: boolean | undefined;
+readonly private_vulnerability_reporting?: boolean | undefined;
+};
+};
+readonly code_scanning: {
+readonly [x: string]: {
+readonly state?: "configured" | "not-configured" | undefined;
+readonly languages?: readonly ("actions" | "c-cpp" | "csharp" | "go" | "java-kotlin" | "javascript-typescript" | "python" | "ruby" | "swift")[] | undefined;
+readonly query_suite?: "default" | "extended" | undefined;
+readonly threat_model?: "remote" | "remote_and_local" | undefined;
+readonly runner_type?: "labeled" | "standard" | undefined;
+readonly runner_label?: string | undefined;
+};
+};
 readonly groups: {
 readonly [x: string]: {
 readonly owner?: string | undefined;
@@ -964,6 +1077,8 @@ readonly [x: string]: readonly string[];
 } | undefined;
 } | undefined;
 readonly rulesets?: readonly string[] | undefined;
+readonly security?: readonly string[] | undefined;
+readonly code_scanning?: readonly string[] | undefined;
 readonly cleanup?: {
 readonly secrets: {
 readonly actions: boolean | {
@@ -1021,6 +1136,24 @@ readonly merge_commit_title?: "MERGE_MESSAGE" | "PR_TITLE" | undefined;
 readonly merge_commit_message?: "BLANK" | "PR_BODY" | "PR_TITLE" | undefined;
 readonly delete_branch_on_merge?: boolean | undefined;
 readonly web_commit_signoff_required?: boolean | undefined;
+readonly security_and_analysis?: {
+readonly advanced_security?: "disabled" | "enabled" | undefined;
+readonly code_security?: "disabled" | "enabled" | undefined;
+readonly secret_scanning?: "disabled" | "enabled" | undefined;
+readonly secret_scanning_push_protection?: "disabled" | "enabled" | undefined;
+readonly secret_scanning_ai_detection?: "disabled" | "enabled" | undefined;
+readonly secret_scanning_non_provider_patterns?: "disabled" | "enabled" | undefined;
+readonly secret_scanning_delegated_alert_dismissal?: "disabled" | "enabled" | undefined;
+readonly secret_scanning_delegated_bypass?: "disabled" | "enabled" | undefined;
+readonly delegated_bypass_reviewers?: readonly ({
+readonly team: string;
+readonly mode?: "ALWAYS" | "EXEMPT" | undefined;
+} | {
+readonly role: string;
+readonly mode?: "ALWAYS" | "EXEMPT" | undefined;
+})[] | undefined;
+readonly dependabot_security_updates?: "disabled" | "enabled" | undefined;
+} | undefined;
 };
 };
 readonly secrets: {
@@ -1251,6 +1384,23 @@ readonly type: "branch" | "tag";
 }[] | undefined;
 };
 };
+readonly security: {
+readonly [x: string]: {
+readonly vulnerability_alerts?: boolean | undefined;
+readonly automated_security_fixes?: boolean | undefined;
+readonly private_vulnerability_reporting?: boolean | undefined;
+};
+};
+readonly code_scanning: {
+readonly [x: string]: {
+readonly state?: "configured" | "not-configured" | undefined;
+readonly languages?: readonly ("actions" | "c-cpp" | "csharp" | "go" | "java-kotlin" | "javascript-typescript" | "python" | "ruby" | "swift")[] | undefined;
+readonly query_suite?: "default" | "extended" | undefined;
+readonly threat_model?: "remote" | "remote_and_local" | undefined;
+readonly runner_type?: "labeled" | "standard" | undefined;
+readonly runner_label?: string | undefined;
+};
+};
 readonly groups: {
 readonly [x: string]: {
 readonly owner?: string | undefined;
@@ -1273,6 +1423,8 @@ readonly [x: string]: readonly string[];
 } | undefined;
 } | undefined;
 readonly rulesets?: readonly string[] | undefined;
+readonly security?: readonly string[] | undefined;
+readonly code_scanning?: readonly string[] | undefined;
 readonly cleanup?: {
 readonly secrets: {
 readonly actions: boolean | {
@@ -1644,7 +1796,7 @@ declare interface SyncLoggerService {
     readonly groupStart: (name: string, repoCount: number) => Effect.Effect<void>;
     readonly repoStart: (owner: string, repo: string) => Effect.Effect<void>;
     readonly repoSkip: (owner: string, repo: string, reason: string) => Effect.Effect<void>;
-    readonly syncSummary: (resource: "secret" | "variable" | "ruleset" | "environment", count: number, detail: string) => Effect.Effect<void>;
+    readonly syncSummary: (resource: "secret" | "variable" | "ruleset" | "environment" | "security feature" | "code scanning", count: number, detail: string) => Effect.Effect<void>;
     readonly settingsApplied: () => Effect.Effect<void>;
     readonly cleanupSummary: (resource: string, count: number, names: string[]) => Effect.Effect<void>;
     readonly syncOperation: (verb: "sync" | "apply" | "delete" | "skip", resource: string, name: string, detail?: string, source?: string) => Effect.Effect<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "reposets",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "private": false,
   "description": "CLI tool to sync GitHub repo settings, secrets and rulesets across personal repositories",
   "keywords": [
@@ -42,19 +42,19 @@
     }
   },
   "bin": {
-    "reposets": "./bin/reposets.js"
+    "reposets": "bin/reposets.js"
   },
   "dependencies": {
     "@1password/sdk": "^0.4.0",
     "@effect/cli": "^0.75.1",
-    "@effect/platform": "^0.96.0",
+    "@effect/platform": "^0.96.1",
     "@effect/platform-node": "^0.106.0",
     "@octokit/rest": "^22.0.1",
     "blakejs": "^1.2.1",
-    "effect": "^3.21.1",
-    "smol-toml": ">=1.6.1",
+    "effect": "^3.21.2",
+    "smol-toml": "^1.6.1",
     "tweetnacl": "^1.0.3",
-    "xdg-effect": "^1.0.0"
+    "xdg-effect": "^1.0.1"
   },
   "engines": {
     "node": ">=20.0.0"