feat(scripts): add read-only repository settings audit - #511
Merged
Conversation
Implements the ADR-0013 rollout item that issue #478 tracks as still open: a read-only audit reporting per-repository settings/ruleset drift against decisions/0013-repository-settings-baseline.md's R/S/- baseline table, following the scripts/labels-sync.rb pattern (fixture- testable client injection, --json/Markdown dual output). - lib/repository-classes.yml: machine-readable ADR-0007 class mapping, mirroring lib/labels.yml's role, with unlisted repos defaulting to class 3 per the manual audit methodology already used in #478. - scripts/repo-settings-audit.rb: ClassResolver, Baseline (the R/S/- table), SettingsExtractor (unions live rulesets and classic branch protection per ADR-0013), Evaluator, RepoAuditor, Inventory, Renderer, and CLI. No --apply/--confirm-apply: the settings changes applied so far in #478 were hand-judged per-repo ruleset mutations, meaningfully riskier than label create/update, so apply mode is deferred to separate follow-up work rather than built here. - scripts/test-repo-settings-audit.rb: fixture-injected unit tests (33 assertions) covering class resolution, baseline dispositions, the union-of-both-protection-systems extraction, per-repo auditing, org-wide inventory filtering/error-handling, and CLI guardrails. - .github/workflows/repo-settings-audit-test.yml: CI wiring on the same path-triggered pattern as labels-sync-test.yml. Manually verified against live z-shell/.github and z-shell/wiki via `gh api` (read-only GETs only): the tool correctly found that z-shell/.github's own `main` ruleset has drifted since the #478 gated-apply comment recorded it -- pull_request and non_fast_forward rules are no longer present, live-failing pr_required and force_push_blocked.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
decisions/0013-repository-settings-baseline.md's R/S/- baseline table, keyed by each repo's ADR-0007 class (lib/repository-classes.yml).scripts/labels-sync.rb's CLI/output conventions andscripts/audit-scheduled-workflows.rb's injectable-client testable design.linear_historycontradiction (wiki/src) and the "no CI"required_status_checkscarve-out the ADR documents.--apply/--confirm-apply: the settings changes applied so far in Track ADR-0013 rollout: repository settings baseline audit #478 were hand-judged, per-repo ruleset mutations, meaningfully riskier than label create/update. Apply mode is deliberately deferred to separate follow-up work.Verification
ruby scripts/test-repo-settings-audit.rb— 33/33 tests pass, written test-first (TDD), each watched fail for the right reason before implementation.ruby -cclean on both scripts.git diff --checkclean.trunk checkclean (the only reported failures are a pre-existing sandbox gap: gitleaks binary missing from PATH, unrelated to these files).z-shell/.githubandz-shell/wikivia read-onlygh apiGETs (no mutation calls exist in this script). This surfaced real, previously-unknown drift:z-shell/.github's ownmainruleset is currently missingpull_requestandnon_fast_forward, which the Track ADR-0013 rollout: repository settings baseline audit #478 2026-07-28 gated-apply comment recorded as present. Filed separately as its own issue rather than fixed in this PR..github/workflows/repo-settings-audit-test.yml, mirroringlabels-sync-test.yml's path-triggered pattern; it runs the fixture-only test suite, no live API calls.Agent handoff
No handoff needed.