feat(branch-protection): add --apply to apply protection with a scoped token - #416
Merged
Merged
Conversation
…n PUT
Adds opt-in --apply path to cascade branch-protection. Default behavior
(emit JSON to stdout) is unchanged. With --apply the .protection body is
PUT to {api-url}/repos/{repo}/branches/{branch}/protection using a
caller-supplied token (--token or GITHUB_TOKEN), removing the repo-admin
adoption blocker that required the operator to pipe the output manually.
New flags (all additive, all optional without --apply):
--apply opt into the PUT instead of emitting JSON
--token repo-admin PAT (default GITHUB_TOKEN)
--repo owner/repo (default GITHUB_REPOSITORY)
--branch apply target (unchanged: also labels guidance note)
--api-url REST API base for testability (default GITHUB_API_URL
then https://api.github.com)
Non-2xx responses are surfaced with status and a bounded snippet of the
GitHub rejection body so a 403 from an under-scoped token is legible.
Signed-off-by: Joshua Temple <joshua.temple@stablekernel.com>
This was referenced Jun 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds an opt-in apply path to
cascade branch-protection:--apply --token --repo --branch --api-url. With--apply, cascade PUTs the generated protection body to the GitHub branch-protection API using a caller-supplied scoped token. Without the flags, behavior is byte-for-byte unchanged (emit the JSON to stdout).Why
Applying branch protection requires repo-admin authority, which makes a GITHUB_TOKEN approach impossible and a real-GitHub fleet test an adoption blocker. Letting the operator pass a scoped token makes the feature adoptable without granting a CI workflow admin, and makes the apply path hermetically testable. This is the coverage for gap #1 (#412); it supersedes the abandoned admin-gated fleet repo.
Design
Additive flags;
--token/--repo/--api-urlresolve from flag then env fallback.--api-urldefaults to GITHUB_API_URL or api.github.com. The no-apply default path is untouched.Coverage (hermetic)
Five httptest mock-GitHub-server tests: correct PUT path, exact protection payload (no operator_todo), Bearer auth, --api-url honored, 403 surfaced as an error, token/repo validation fails fast before any network call, and no-apply makes zero requests. The act+gitea e2e harness cannot host this because gitea's branch-protection API (
/api/v1/.../branch_protections) differs in path and shape from GitHub's (PUT /repos/.../branches/.../protection), a divergence the repo already encodes via isGitHubHost. The mock-server integration test is the faithful hermetic proof.Verification
go build, go test (incl. -race on the package), golangci-lint all clean.
Part of the feature-coverage goal (#412).