GitHub Settings as Code

Version updated for https://github.com/Vivswan/github-settings-as-code to version v2.0.0.

  • This action is used across all versions by 15 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the application of declarative repository settings from a .github/settings.yml file, replacing the Probot Settings app. It manages branch protections, rulesets, and other configurations in a stateless manner, providing detailed error messages upon failure. The action is triggered on pushes to .github/settings.yml or manual workflows dispatches, ensuring that every change is visible and auditable through workflow runs.

What’s Changed

2.0.0 (2026-08-11)

⚠ BREAKING CHANGES

  • the action moved to Vivswan/github-settings-as-code; uses: references to Vivswan/repo-settings-as-code fail with “repository not found” and must be updated.
  • branches[].protection.required_signatures now acts. Previously the key rode the protection PUT, where GitHub dropped it (check mode showed permanent drift). A settings file already carrying it will start toggling the signed-commit requirement on the first apply after upgrading - a stale required_signatures: false would REMOVE a hand-enabled requirement. Audit existing declarations for intent before moving to v2. The v1 line keeps the old inert behavior.
  • actions.fork_pr_contributor_approval and actions.fork_pr_workflows_private_repos now act. Previously both keys fell through to the base permissions PUT, where GitHub ignored them and a notice said so. A settings file already carrying either key will start applying these policies on the first apply after upgrading; audit existing declarations for intent before moving to v2. The v1 line keeps the old inert behavior.
  • actions.oidc_customization_sub now acts. Previously the key fell through to the base permissions PUT, where GitHub ignored it and a notice said so. A settings file already carrying the key will start customizing the OIDC subject claim template on the first apply after upgrading; audit existing declarations for intent before moving to v2. The v1 line keeps the old inert behavior.

Features

  • add issue-on-failure private-report channel (quiet on healthy runs) (934a321)
  • enrich API rejection errors and reject unknown keys in closed sections (7a44e90)
  • first-class GraphQL operation layer (7d5279f)
  • let settings.yml choose the undeclared-resource policy per section (372b884)
  • manage Actions artifact/log retention and cache limits (8014910)
  • manage code quality setup and check suite preferences (adab49e)
  • manage Copilot agents secrets and variables (1d839e1)
  • manage deploy keys (a6f7ae1)
  • manage environment custom deployment protection rules (f752ce8)
  • manage environment deployment branch-policy patterns (34eafe4)
  • manage environment variables in the environments section (1d272c3)
  • manage environment, Dependabot, and Codespaces secrets (c8bbe75)
  • manage fork pull request workflow policies from the actions section (cd2bfcf)
  • manage Git LFS enablement from the repository section (a0195fa)
  • manage immutable releases from the repository section (f2582f7)
  • manage pinned environments (c368c98)
  • manage repository Actions secrets (0f8ea4e)
  • manage repository Actions variables (780abf0)
  • manage repository custom property values (b5bf3ac)
  • manage repository interaction limits (c8dd58d)
  • manage repository secret scanning custom patterns (05f614c)
  • manage repository webhooks (85013d3)
  • manage required commit signatures in the branches section (16bec9a)
  • manage the Actions OIDC subject claim from the actions section (c4e712f)
  • manage the pull request creation cap and bypass list (e98fb3a)
  • manage the sponsor button and issue creation policy (97111fb)
  • manage wildcard branch protection, force-push bypassers, and required deployments (085ac52)
  • move repo-owned CI and release logic to template extension points (#12) (cdde9cc)
  • reconcile pending collaborator invitations (cb92188)
  • rename to github-settings-as-code (9678cee)

Bug Fixes

  • ci: cover src/report in the changed-sections selector and openapi cache key (a1c4302)
  • declare dependabot default labels and realign SECURITY.md (aa89a23)
  • drop connections for real in the e2e mock, on bun 1.3.14 (791c4bf)
  • e2e: keep body-presence checks active for requestOffSpec rejections (43426a6)
  • mark the secrets-and-vaults action pins for major-tag rewrites (9d1f616)
  • name every offender in errors and carry engine invariants in types (49b386a)
  • preserve a rotated deploy key’s live read_only flag (a36da82)
  • re-enable declared protection rules the API reports as disabled (b469a6f)
  • reject invalid actions and repository declarations before any section writes (85be8ef)
  • silence and label intentional error noise in green runs (a786ae6)
  • track secret-reference provenance structurally through the merge (e9c223e)
  • unpad flow-mapping braces in the pins cap scenario (7b041fd)
  • write version-less secret scanning patterns the way the API allows (6fa0cef)