github-actions-repo-settings

Configure and enforce GitHub repository security settings as code: require actions to be pinned to full-length commit SHAs, require approval for all outside collaborators' fork pull-request workflow runs, and protect the default branch via a repository ruleset. The settings-as-code engine, its schema, and the fleet fan-out live in the repo-settings repo, which this skill points to; it also carries manual gh api recipes. Trigger when: setting up a new repo, running a security audit, onboarding a repo to org standards, enforcing settings across a fleet, or when asked to configure or harden Actions security settings. Trigger on mentions of "actions settings", "repo security settings", "repo settings as code", "settings drift", "fork approval", "outside collaborators", "actions policy", "branch protection", "ruleset", "harden repo", "actions event policy", or "pull_request_target policy".

Compatibility

Requires the GitHub CLI (gh). Settings-as-code also needs a checkout of the repo-settings repo (Python 3 with PyYAML); the manual recipes need only gh. Runs in any environment.