|
1 | | -# GitHub Safe-Settings |
| 1 | +# 🛡️ GitHub Safe-Settings |
2 | 2 |
|
3 | 3 | [](https://github.com/github/safe-settings/actions/workflows/create-release.yml) |
| 4 | +[](https://opensource.org/licenses/ISC) |
| 5 | +[](https://nodejs.org/) |
| 6 | + |
| 7 | +> **Policy-as-Code for GitHub Organizations** |
| 8 | +> Centrally manage and enforce repository settings, branch protections, teams, and more across your entire GitHub organization. |
4 | 9 |
|
5 | 10 | `Safe-settings` – an app to manage policy-as-code and apply repository settings across an organization. |
6 | 11 |
|
|
29 | 34 |
|
30 | 35 | > [!NOTE] |
31 | 36 | > The `suborg` and `repo` level settings directory structure cannot be customized. |
32 | | -> |
33 | 37 |
|
| 38 | +## 🚀 Quick Start |
| 39 | + |
| 40 | +### 1. **Deploy Safe-Settings** |
| 41 | + |
| 42 | +Choose your preferred deployment method: |
| 43 | + |
| 44 | +- **🌟 AWS Lambda (**: Use the [SafeSettings-Template](https://github.com/bheemreddy181/SafeSettings-Template) for production-ready deployment with Docker containers, GitHub Actions CI/CD, and comprehensive testing |
| 45 | +- **🐳 Docker**: Deploy using Docker containers locally or in your infrastructure |
| 46 | +- **☁️ Cloud Platforms**: Deploy to Heroku, Glitch, or Kubernetes |
| 47 | + |
| 48 | +👉 **[View all deployment options →](docs/deploy.md)** |
| 49 | + |
| 50 | +### 2. **Create Admin Repository** |
| 51 | + |
| 52 | +Create an `admin` repository in your organization to store all configuration files: |
| 53 | + |
| 54 | +```bash |
| 55 | +# Create admin repo in your organization |
| 56 | +gh repo create your-org/admin --private |
| 57 | +``` |
| 58 | + |
| 59 | +### 3. **Configure Settings Structure** |
| 60 | + |
| 61 | +Set up your configuration files in the admin repository: |
| 62 | + |
| 63 | +``` |
| 64 | +admin/ |
| 65 | +├── .github/ |
| 66 | +│ ├── settings.yml # Organization-wide settings |
| 67 | +│ ├── suborgs/ # Sub-organization settings |
| 68 | +│ │ ├── frontend-team.yml |
| 69 | +│ │ └── backend-team.yml |
| 70 | +│ └── repos/ # Repository-specific settings |
| 71 | +│ ├── api-service.yml |
| 72 | +│ └── web-app.yml |
| 73 | +``` |
| 74 | + |
| 75 | +### 4. **Install GitHub App** |
| 76 | + |
| 77 | +Install the Safe-Settings GitHub App in your organization with the required permissions. |
| 78 | + |
| 79 | +👉 **[Complete setup guide →](#how-to-use)** |
| 80 | + |
| 81 | +## 📊 Visual Architecture |
| 82 | + |
| 83 | +### Configuration Hierarchy |
| 84 | + |
| 85 | +```mermaid |
| 86 | +graph TD |
| 87 | + A[Organization Settings<br/>.github/settings.yml] --> B[Sub-Organization Settings<br/>.github/suborgs/*.yml] |
| 88 | + B --> C[Repository Settings<br/>.github/repos/*.yml] |
| 89 | + |
| 90 | + style A fill:#e1f5fe,stroke:#01579b,stroke-width:2px,color:#000 |
| 91 | + style B fill:#f3e5f5,stroke:#4a148c,stroke-width:2px,color:#000 |
| 92 | + style C fill:#e8f5e8,stroke:#1b5e20,stroke-width:2px,color:#000 |
| 93 | +``` |
| 94 | + |
| 95 | +**Precedence Order**: Repository > Sub-Organization > Organization |
| 96 | + |
| 97 | +### Request Flow |
| 98 | + |
| 99 | +```mermaid |
| 100 | +sequenceDiagram |
| 101 | + participant GH as GitHub |
| 102 | + participant SS as Safe-Settings |
| 103 | + participant AR as Admin Repo |
| 104 | + participant TR as Target Repos |
| 105 | + |
| 106 | + Note over GH,TR: Webhook Event Processing |
| 107 | + |
| 108 | + GH->>+SS: Webhook Event<br/>(push, repo created, etc.) |
| 109 | + SS->>SS: Validate Event Source |
| 110 | + SS->>+AR: Fetch Configuration Files<br/>(.github/settings.yml, suborgs/, repos/) |
| 111 | + AR-->>-SS: Return Config Files |
| 112 | + |
| 113 | + SS->>SS: Merge Configurations<br/>(Org → Suborg → Repo) |
| 114 | + SS->>SS: Compare with Current<br/>GitHub Settings |
| 115 | + |
| 116 | + alt Configuration Changes Detected |
| 117 | + SS->>+TR: Apply Settings<br/>(Branch Protection, Teams, etc.) |
| 118 | + TR-->>-SS: Confirm Changes |
| 119 | + SS->>GH: Create Check Run<br/>(Success/Failure) |
| 120 | + else No Changes Needed |
| 121 | + SS->>GH: Create Check Run<br/>(No Changes) |
| 122 | + end |
| 123 | + |
| 124 | + SS-->>-GH: HTTP 200 Response |
| 125 | + |
| 126 | + Note over GH,TR: Pull Request Validation (Dry-Run Mode) |
| 127 | + |
| 128 | + GH->>+SS: PR Event<br/>(opened, synchronize) |
| 129 | + SS->>+AR: Fetch PR Changes<br/>(Modified Config Files) |
| 130 | + AR-->>-SS: Return Changed Configs |
| 131 | + |
| 132 | + SS->>SS: Validate Changes<br/>(Dry-Run Mode) |
| 133 | + SS->>SS: Run Custom Validators<br/>(if configured) |
| 134 | + |
| 135 | + alt Validation Passes |
| 136 | + SS->>GH: ✅ Check Success<br/>+ PR Comment (optional) |
| 137 | + else Validation Fails |
| 138 | + SS->>GH: ❌ Check Failure<br/>+ Error Details |
| 139 | + end |
| 140 | + |
| 141 | + SS-->>-GH: HTTP 200 Response |
| 142 | + |
| 143 | + Note over GH,TR: Scheduled Sync (Drift Prevention) |
| 144 | + |
| 145 | + SS->>SS: Cron Trigger<br/>(if configured) |
| 146 | + SS->>+AR: Fetch All Configurations |
| 147 | + AR-->>-SS: Return All Configs |
| 148 | + SS->>+TR: Sync All Repositories<br/>(Prevent Drift) |
| 149 | + TR-->>-SS: Confirm Sync |
| 150 | + SS->>GH: Create Check Run<br/>(Sync Results) |
| 151 | +``` |
34 | 152 |
|
35 | 153 | ## How it works |
36 | 154 |
|
|
0 commit comments