Skip to content

Commit 17e6d5c

Browse files
Update README (#868)
1 parent 061bf84 commit 17e6d5c

File tree

1 file changed

+120
-2
lines changed

1 file changed

+120
-2
lines changed

README.md

Lines changed: 120 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
1-
# GitHub Safe-Settings
1+
# 🛡️ GitHub Safe-Settings
22

33
[![Create a release](https://github.com/github/safe-settings/actions/workflows/create-release.yml/badge.svg)](https://github.com/github/safe-settings/actions/workflows/create-release.yml)
4+
[![License: ISC](https://img.shields.io/badge/License-ISC-blue.svg)](https://opensource.org/licenses/ISC)
5+
[![Node.js Version](https://img.shields.io/badge/node-%3E%3D18.0.0-brightgreen.svg)](https://nodejs.org/)
6+
7+
> **Policy-as-Code for GitHub Organizations**
8+
> Centrally manage and enforce repository settings, branch protections, teams, and more across your entire GitHub organization.
49
510
`Safe-settings` – an app to manage policy-as-code and apply repository settings across an organization.
611

@@ -29,8 +34,121 @@
2934

3035
> [!NOTE]
3136
> The `suborg` and `repo` level settings directory structure cannot be customized.
32-
>
3337
38+
## 🚀 Quick Start
39+
40+
### 1. **Deploy Safe-Settings**
41+
42+
Choose your preferred deployment method:
43+
44+
- **🌟 AWS Lambda (**: Use the [SafeSettings-Template](https://github.com/bheemreddy181/SafeSettings-Template) for production-ready deployment with Docker containers, GitHub Actions CI/CD, and comprehensive testing
45+
- **🐳 Docker**: Deploy using Docker containers locally or in your infrastructure
46+
- **☁️ Cloud Platforms**: Deploy to Heroku, Glitch, or Kubernetes
47+
48+
👉 **[View all deployment options →](docs/deploy.md)**
49+
50+
### 2. **Create Admin Repository**
51+
52+
Create an `admin` repository in your organization to store all configuration files:
53+
54+
```bash
55+
# Create admin repo in your organization
56+
gh repo create your-org/admin --private
57+
```
58+
59+
### 3. **Configure Settings Structure**
60+
61+
Set up your configuration files in the admin repository:
62+
63+
```
64+
admin/
65+
├── .github/
66+
│ ├── settings.yml # Organization-wide settings
67+
│ ├── suborgs/ # Sub-organization settings
68+
│ │ ├── frontend-team.yml
69+
│ │ └── backend-team.yml
70+
│ └── repos/ # Repository-specific settings
71+
│ ├── api-service.yml
72+
│ └── web-app.yml
73+
```
74+
75+
### 4. **Install GitHub App**
76+
77+
Install the Safe-Settings GitHub App in your organization with the required permissions.
78+
79+
👉 **[Complete setup guide →](#how-to-use)**
80+
81+
## 📊 Visual Architecture
82+
83+
### Configuration Hierarchy
84+
85+
```mermaid
86+
graph TD
87+
A[Organization Settings<br/>.github/settings.yml] --> B[Sub-Organization Settings<br/>.github/suborgs/*.yml]
88+
B --> C[Repository Settings<br/>.github/repos/*.yml]
89+
90+
style A fill:#e1f5fe,stroke:#01579b,stroke-width:2px,color:#000
91+
style B fill:#f3e5f5,stroke:#4a148c,stroke-width:2px,color:#000
92+
style C fill:#e8f5e8,stroke:#1b5e20,stroke-width:2px,color:#000
93+
```
94+
95+
**Precedence Order**: Repository > Sub-Organization > Organization
96+
97+
### Request Flow
98+
99+
```mermaid
100+
sequenceDiagram
101+
participant GH as GitHub
102+
participant SS as Safe-Settings
103+
participant AR as Admin Repo
104+
participant TR as Target Repos
105+
106+
Note over GH,TR: Webhook Event Processing
107+
108+
GH->>+SS: Webhook Event<br/>(push, repo created, etc.)
109+
SS->>SS: Validate Event Source
110+
SS->>+AR: Fetch Configuration Files<br/>(.github/settings.yml, suborgs/, repos/)
111+
AR-->>-SS: Return Config Files
112+
113+
SS->>SS: Merge Configurations<br/>(Org → Suborg → Repo)
114+
SS->>SS: Compare with Current<br/>GitHub Settings
115+
116+
alt Configuration Changes Detected
117+
SS->>+TR: Apply Settings<br/>(Branch Protection, Teams, etc.)
118+
TR-->>-SS: Confirm Changes
119+
SS->>GH: Create Check Run<br/>(Success/Failure)
120+
else No Changes Needed
121+
SS->>GH: Create Check Run<br/>(No Changes)
122+
end
123+
124+
SS-->>-GH: HTTP 200 Response
125+
126+
Note over GH,TR: Pull Request Validation (Dry-Run Mode)
127+
128+
GH->>+SS: PR Event<br/>(opened, synchronize)
129+
SS->>+AR: Fetch PR Changes<br/>(Modified Config Files)
130+
AR-->>-SS: Return Changed Configs
131+
132+
SS->>SS: Validate Changes<br/>(Dry-Run Mode)
133+
SS->>SS: Run Custom Validators<br/>(if configured)
134+
135+
alt Validation Passes
136+
SS->>GH: ✅ Check Success<br/>+ PR Comment (optional)
137+
else Validation Fails
138+
SS->>GH: ❌ Check Failure<br/>+ Error Details
139+
end
140+
141+
SS-->>-GH: HTTP 200 Response
142+
143+
Note over GH,TR: Scheduled Sync (Drift Prevention)
144+
145+
SS->>SS: Cron Trigger<br/>(if configured)
146+
SS->>+AR: Fetch All Configurations
147+
AR-->>-SS: Return All Configs
148+
SS->>+TR: Sync All Repositories<br/>(Prevent Drift)
149+
TR-->>-SS: Confirm Sync
150+
SS->>GH: Create Check Run<br/>(Sync Results)
151+
```
34152

35153
## How it works
36154

0 commit comments

Comments
 (0)