gh-repo-setup

Apply GitHub branch protection rulesets to an existing repository by running an idempotent PUT-replace operation that enforces canonical main-branch protection rules. The process auto-detects required status checks from actual PR-triggering workflows to ensure valid security controls.

Sync canonical policy files across GitHub repositories using a content-diff-aware sweep that reports created, updated, ok, or conflict statuses. This idempotent syncing ensures standardized config files match the target setup without overwriting unintended changes.

Yes, GitHub branch protection onboarding auto-detects required status checks by analyzing the repository's actual PR-triggering workflows. It uses this detection to configure the canonical ruleset template accurately for the specific repository.

Fix GitHub repository drift from standard security controls during an audit by reapplying the canonical setup. This performs an idempotent ruleset replacement and a policy file sweep to restore main-branch protection and standardized configurations.

Yes, you can apply repo onboarding templates for different stacks including rust, electron, vsce-ext, nvim-plugin, tree-sitter, static-site, brew-tap, and github-action. The setup detects the repository's stack to choose the correct managed template set.

Overwrite policy file conflicts during a GitHub repo setup by enabling the overwrite conflicts option during the policy sweep. This forces the canonical policy and setup files to replace existing content, ensuring strict alignment with the release-loop conventions.