.github/settings.yml at main · fullsend-ai/.github · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
# Safe-settings org-level defaults, applied to every repository unless
# repos/<repo>.yml overrides a key. Schema: safe-settings
# docs/sample-settings/settings.yml.
#
# ACCESS BOUNDARY: peribolos owns all access. Never add `teams:` or
# `collaborators:` keys here -- those plugins delete unlisted entries
# and would fight peribolos.

repository:
  delete_branch_on_merge: true
  security:
    enableVulnerabilityAlerts: true
    enableAutomatedSecurityFixes: true

# Baseline protection for every default branch: main changes only
# through PRs. Approval counts stay per-repo (repos/*.yml) so
# autonomous merges keep working; this floor cannot be loosened by a
# repo file -- org rulesets stack. The org's automation Apps bypass;
# workflows pushing to main with GITHUB_TOKEN will need a PR flow or a
# bypass actor added here.
rulesets:
  - name: default-branch
    description: Baseline protection for every default branch
    target: branch
    enforcement: active
    conditions:
      ref_name:
        include:
          - ~DEFAULT_BRANCH
        exclude: []
      repository_name:
        include: []
        exclude:
          - devlake # fork synced by direct push; see repos/devlake.yml
          - agent-eval-harness # semantic-release pushes to main with GITHUB_TOKEN; see repos/agent-eval-harness.yml
    bypass_actors:
      - actor_id: 4113971 # renovate-fullsend
        actor_type: Integration
        bypass_mode: always
      - actor_id: 4648700 # fullsend-ai-sync
        actor_type: Integration
        bypass_mode: always
    rules:
      - type: deletion
      - type: non_fast_forward
      - type: pull_request
        parameters:
          # Full parameter set: the rulesets API rejects partial rules, and
          # safe-settings diffs against the full shape GitHub returns.
          # Zero/false = no opinion; repo rulesets stack on top.
          required_approving_review_count: 0
          dismiss_stale_reviews_on_push: false
          require_code_owner_review: true # bites only where CODEOWNERS exists
          require_last_push_approval: false
          required_review_thread_resolution: true
          require_extra_approval_for_unattributed_changes: true
          dismissal_restriction:
            enabled: false
            allowed_actors: []
          required_reviewers: []
          allowed_merge_methods: [merge, squash, rebase]