Skip to content

fix(github-tools): carry the safe-settings traps found on the 2026-09 rollout - #31

Merged
jimisola merged 3 commits into
mainfrom
fix/safe-settings-rollout-traps
Oct 13, 2026
Merged

jimisola merged 3 commits into
mainfrom
fix/safe-settings-rollout-traps

Conversation

@jimisola

Copy link
Copy Markdown
Owner

What & Why

Two commits from 2026-09-06 were pushed to feat/renovate-automerge-skill after #8 had merged, so they never reached main. Found while cleaning up merged branches; this cherry-picks them (-x) unchanged. github-tools → 1.6.3.

  • SKILL.md, traps: archived and free-plan private repos both fail the run (keep them in restrictedRepos.exclude); suborgrepos: ["*"] skips dot-named repos like .github; quote every label color:; a repos/<name>.yml override cannot change required_status_checks; undeclared rulesets are deleted; a ruleset can be active and match nothing; pin ref: 2.1.18 (2.1.19–2.1.21 crash in Actions mode); OrganizationAdmin bypass actors read back with actor_id: null; pushing to a public admin repo publishes the config.
  • SKILL.md, new Verifying a sync section: read the non-GET requests from a debug log; compare declared vs enforced checks as a set; a red run doesn't mean nothing applied.
  • references/repo-layout.md: moving the config out of a private admin repo, in order; bringing a repo under management without touching its labels.

Test Plan

  • claude plugin validate .
  • Plugin-load check: github-tools:safe-settings loads
  • Diff identical to the two orphaned commits (98 insertions, 2 deletions in the two safe-settings files)

… rollout

The dot-repo minimatch gap, unquoted label colours, the repos/ override
limit, undeclared-ruleset deletion, active-but-empty rulesets, the
2.1.19+ startup crash, bypass-actor readback, and how to verify a sync
by its request list and a declared-vs-enforced set diff. repo-layout
gains the procedure for folding a private admin repo into .github.

Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>
(cherry picked from commit 31cecae)
…ey is declared

Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>
(cherry picked from commit 69bb18c)
Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>
@jimisola jimisola self-assigned this Oct 12, 2026
@jimisola
jimisola merged commit 4d41e83 into main Oct 13, 2026
1 check passed
@jimisola
jimisola deleted the fix/safe-settings-rollout-traps branch October 13, 2026 06:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant