github-actions-repo-settings

Configure and enforce GitHub repository security settings as code: require actions to be pinned to full-length commit SHAs, require approval for all outside collaborators' fork pull-request workflow runs, and protect the default branch via a repository ruleset. Includes a generate/diff/apply engine (introspect current state -> emit YAML; detect drift; apply desired state) and a central fan-out workflow to enforce a baseline across many repos. Trigger when: setting up a new repo, running a security audit, onboarding a repo to org standards, enforcing settings across a fleet, or when asked to configure or harden Actions security settings. Trigger on mentions of "actions settings", "repo security settings", "repo settings as code", "settings drift", "fork approval", "outside collaborators", "actions policy", "branch protection", "ruleset", or "harden repo".

Compatibility

Requires the GitHub CLI (gh) and Python 3 with PyYAML for the settings-as-code engine. Runs in any environment.