Context
Sibling of the repo-settings codification in #596/PR B. apply-repo-settings.sh manages repo-level state (merge options, GHAS default-setup, check-suite prefs, push protection) via PATCH /repos/{owner}/{repo}/.... There is currently no org-level settings tooling.
Unlike org-level rulesets (paywalled — see the Team-upgrade issue), org-level settings via PATCH /orgs/{org} and related endpoints are available on the Free plan.
Proposal
A distinct declarative standard + applier for organization-level config (applied once to the org, not per-repo):
standards/org-settings.json — desired org state: member default repo permission, default workflow permissions, org-wide GHAS / secret-scanning defaults, Actions policy, etc.scripts/apply-org-settings.sh — idempotent applier (mirrors apply-rulesets.sh / the proposed apply-repo-settings.sh reading repo-settings.json).
Keep it separate from repo-settings.json: different target cardinality (1 org vs N repos) and API surface (/orgs vs /repos).
Scope note
Greenfield (no existing org-settings tooling to reconcile). Independent of #596's applier consolidation; file so the org-level layer is tracked distinctly.
Refs #596.
Context
Sibling of the repo-settings codification in #596/PR B.
apply-repo-settings.shmanages repo-level state (merge options, GHAS default-setup, check-suite prefs, push protection) viaPATCH /repos/{owner}/{repo}/.... There is currently no org-level settings tooling.Unlike org-level rulesets (paywalled — see the Team-upgrade issue), org-level settings via
PATCH /orgs/{org}and related endpoints are available on the Free plan.Proposal
A distinct declarative standard + applier for organization-level config (applied once to the org, not per-repo):
standards/org-settings.json— desired org state: member default repo permission, default workflow permissions, org-wide GHAS / secret-scanning defaults, Actions policy, etc.scripts/apply-org-settings.sh— idempotent applier (mirrorsapply-rulesets.sh/ the proposedapply-repo-settings.shreadingrepo-settings.json).Keep it separate from
repo-settings.json: different target cardinality (1 org vs N repos) and API surface (/orgsvs/repos).Scope note
Greenfield (no existing org-settings tooling to reconcile). Independent of #596's applier consolidation; file so the org-level layer is tracked distinctly.
Refs #596.