git:20261002.4d31436 to git:20261004.f03a551

- description: "Configure GitHub topics, descriptions, merge policy, and security settings with gh."

- updated: "2026-10-02"

- Derive a repository's description, homepage, and topics from its codebase and apply the requested fields with `gh repo edit`. For a new solo-maintained repository or an explicitly requested settings pass, use the baseline below; a metadata-only request does not include merge policy, sidebar features, or security settings.

- Use [gh](../gh/SKILL.md) for account selection, bounded API calls, and request serialization when needed.

- 1. **Inspect the current state** so the edit stays idempotent; stop when there is no GitHub remote or `gh` is not authenticated. Resolve repository identity through `gh`; never print raw remote URLs, which can contain credentials:

- gh auth status

- gh repo view --json nameWithOwner,visibility,isInOrganization,description,homepageUrl,repositoryTopics,deleteBranchOnMerge,squashMergeAllowed,mergeCommitAllowed,rebaseMergeAllowed,hasIssuesEnabled,hasProjectsEnabled,hasWikiEnabled,hasDiscussionsEnabled

- 1. **Build one scoped edit**: for metadata-only work, include only the requested metadata flags and topic changes. Use the complete baseline below only when repository settings are in scope, preserving an existing team's policy and active wiki/projects/discussions unless their removal was requested. Add the desired topics, remove obsolete topics only when replacing the set, and append `--enable-issues=false` only when the project tracks issues elsewhere. Query the repository REST payload and add the two secret-scanning flags only for a public repository or when `security_and_analysis.secret_scanning` is present; otherwise report that the capability is unavailable and continue with the remaining settings:

- repository="$(gh repo view --json nameWithOwner --jq .nameWithOwner)"

- repository_json="$(gh api "repos/$repository")"

- args=(

- --description "<description>" --homepage "<homepage-url>"

- --delete-branch-on-merge --enable-squash-merge

- --squash-merge-commit-message pr-title-description

- --enable-merge-commit=false --enable-rebase-merge=false --allow-update-branch

- --enable-wiki=false --enable-projects=false --enable-discussions=false

- )

- done < <(jq -r '.topics[]' <<<"$repository_json")

- if [[ "$(jq -r .visibility <<<"$repository_json")" == public ]] ||

- [[ "$(jq -r '.security_and_analysis.secret_scanning.status? // empty' <<<"$repository_json")" ]]; then

- args+=(--enable-secret-scanning --enable-secret-scanning-push-protection)

- else

- echo "Secret scanning is unavailable for $repository; leaving it unchanged." >&2

- fi

- gh repo edit "$repository" "${args[@]}"

- 1. **Protect a public repository** in the same settings pass: enable private vulnerability reporting and add a default-branch ruleset that blocks deletion and force pushes without requiring pull requests or signatures, so direct pushes keep working. Skip the ruleset when `gh api "repos/$repository/rules/branches/<default-branch>" --jq 'map(.type)'` already lists both rules:

- ```bash

- gh api -X PUT "repos/$repository/private-vulnerability-reporting"

- gh api -X POST "repos/$repository/rulesets" --input - <<'EOF'

- {"name": "Protect default branch", "target": "branch", "enforcement": "active",

- "conditions": {"ref_name": {"include": ["~DEFAULT_BRANCH"], "exclude": []}},

- "rules": [{"type": "deletion"}, {"type": "non_fast_forward"}], "bypass_actors": []}

- EOF

- ```

- 1. **Verify** with the same `gh repo view --json ...` call and report the fields that changed.

- - **Secret scanning eligibility**: public repositories are covered; private and internal repositories require an eligible GitHub Secret Protection or Advanced Security entitlement. Capability-detect instead of inferring availability from personal versus organization ownership.

- - **Plan limits**: rulesets and branch protection on a private repository need GitHub Pro or Team; on Free the API answers 403 `Upgrade to GitHub Pro`. Report the gap instead of changing visibility. Private vulnerability reporting applies to public repositories only.