GitHub Settings as Code

Version updated for https://github.com/Vivswan/github-settings-as-code to version v2.0.0.

  • This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Settings as Code action automates the process of applying declarative repository settings from a .github/settings.yml file to GitHub repositories using Actions. It replaces the Probot Settings app and handles branch, tag, and push rules, providing visible workflow runs with API error messages. The action can be used to manage repository permissions and configurations without manual intervention, making it easier for developers to maintain consistent settings across their projects.

What’s Changed

2.0.0 (2026-08-11)

⚠ BREAKING CHANGES

  • the action moved to Vivswan/github-settings-as-code; uses: references to Vivswan/repo-settings-as-code fail with “repository not found” and must be updated.
  • branches[].protection.required_signatures now acts. Previously the key rode the protection PUT, where GitHub dropped it (check mode showed permanent drift). A settings file already carrying it will start toggling the signed-commit requirement on the first apply after upgrading - a stale required_signatures: false would REMOVE a hand-enabled requirement. Audit existing declarations for intent before moving to v2. The v1 line keeps the old inert behavior.
  • actions.fork_pr_contributor_approval and actions.fork_pr_workflows_private_repos now act. Previously both keys fell through to the base permissions PUT, where GitHub ignored them and a notice said so. A settings file already carrying either key will start applying these policies on the first apply after upgrading; audit existing declarations for intent before moving to v2. The v1 line keeps the old inert behavior.
  • actions.oidc_customization_sub now acts. Previously the key fell through to the base permissions PUT, where GitHub ignored it and a notice said so. A settings file already carrying the key will start customizing the OIDC subject claim template on the first apply after upgrading; audit existing declarations for intent before moving to v2. The v1 line keeps the old inert behavior.

Features

  • add issue-on-failure private-report channel (quiet on healthy runs) (934a321)
  • enrich API rejection errors and reject unknown keys in closed sections (7a44e90)
  • first-class GraphQL operation layer (7d5279f)
  • let settings.yml choose the undeclared-resource policy per section (372b884)
  • manage Actions artifact/log retention and cache limits (8014910)
  • manage code quality setup and check suite preferences (adab49e)
  • manage Copilot agents secrets and variables (1d839e1)
  • manage deploy keys (a6f7ae1)
  • manage environment custom deployment protection rules (f752ce8)
  • manage environment deployment branch-policy patterns (34eafe4)
  • manage environment variables in the environments section (1d272c3)
  • manage environment, Dependabot, and Codespaces secrets (c8bbe75)
  • manage fork pull request workflow policies from the actions section (cd2bfcf)
  • manage Git LFS enablement from the repository section (a0195fa)
  • manage immutable releases from the repository section (f2582f7)
  • manage pinned environments (c368c98)
  • manage repository Actions secrets (0f8ea4e)
  • manage repository Actions variables (780abf0)
  • manage repository custom property values (b5bf3ac)
  • manage repository interaction limits (c8dd58d)
  • manage repository secret scanning custom patterns (05f614c)
  • manage repository webhooks (85013d3)
  • manage required commit signatures in the branches section (16bec9a)
  • manage the Actions OIDC subject claim from the actions section (c4e712f)
  • manage the pull request creation cap and bypass list (e98fb3a)
  • manage the sponsor button and issue creation policy (97111fb)
  • manage wildcard branch protection, force-push bypassers, and required deployments (085ac52)
  • move repo-owned CI and release logic to template extension points (#12) (cdde9cc)
  • reconcile pending collaborator invitations (cb92188)
  • rename to github-settings-as-code (9678cee)

Bug Fixes

  • ci: cover src/report in the changed-sections selector and openapi cache key (a1c4302)
  • declare dependabot default labels and realign SECURITY.md (aa89a23)
  • drop connections for real in the e2e mock, on bun 1.3.14 (791c4bf)
  • e2e: keep body-presence checks active for requestOffSpec rejections (43426a6)
  • mark the secrets-and-vaults action pins for major-tag rewrites (9d1f616)
  • name every offender in errors and carry engine invariants in types (49b386a)
  • preserve a rotated deploy key’s live read_only flag (a36da82)
  • re-enable declared protection rules the API reports as disabled (b469a6f)
  • reject invalid actions and repository declarations before any section writes (85be8ef)
  • silence and label intentional error noise in green runs (a786ae6)
  • track secret-reference provenance structurally through the merge (e9c223e)
  • unpad flow-mapping braces in the pins cap scenario (7b041fd)
  • write version-less secret scanning patterns the way the API allows (6fa0cef)