Add setting workflow

[a5chin]

User description

Type of Change

• Hotfix
• Bug Fix
• Dependency Update
• Feature
• Refactor
• CI/CD
• Documentation

Related Issues

Breaking Changes

• No breaking changes
• API signature changed
• Configuration changed
• Behavior changed
• Dependencies changed
• Features removed

Checklist

• Dependencies added/updated
• New environment variables
• Performance impact assessed
• Security implications reviewed
• Deployment notes

Additional Context

---

PR Type

Enhancement, Documentation

---

Description

• Add workflow for repository settings.

• Configure branch protection rules.

• Enable auto-delete head branches.

• Set GitHub Pages source.

---

Diagram Walkthrough

flowchart LR
  A[Trigger: PR, Schedule, Manual] --> B{Repository Settings Workflow}
  B --> C[Job: Delete Branch]
  B --> D[Job: Configure GitHub Pages]
  B --> E[Job: Apply Branch Protection]
  C -- "Enables auto-delete" --> F[Repository Settings]
  D -- "Sets gh-pages source" --> F
  E -- "Applies rules from protection.json" --> F

Loading

File Walkthrough

	Relevant files
Configuration changes	protection.json Define branch protection rules for the main branch              .github/protection.json Adds a new JSON file to define branch protection rules. Specifies rules for the main branch, including requiring one approving review. Enforces code owner reviews and disallows force pushes and deletions. +17/-0
Ci/cd	setting.yml Implement GitHub Actions workflow for repository settings .github/workflows/setting.yml Introduces a new GitHub Actions workflow for managing repository settings. Configures triggers for pull requests, scheduled runs, and manual dispatch. Adds a delete-branch job to enable auto-deletion of head branches on merge. Includes a pages job to set GitHub Pages source to gh-pages branch and root path. Implements a protection job to apply branch protection rules from .github/protection.json. Utilizes actions/create-github-app-token@v2 for secure token generation. +88/-0

---

[a5chin]

/review

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪

🧪 No relevant tests

🔒 Security concerns Sensitive information exposure: The actions/create-github-app-token@v2 action, as used in this PR, does not specify explicit permissions. By default, it will request all permissions available to the GitHub App. This creates a security risk as the generated token will have overly broad privileges. If this token were to be compromised, it could allow an attacker to perform actions beyond what is necessary for the workflow, potentially leading to unauthorized repository modifications or data exposure. It is recommended to explicitly define the minimum required permissions for each job's token.

⚡ Recommended focus areas for review Token Permissions The GitHub App token generated by actions/create-github-app-token@v2 should specify the minimum required permissions for each job. Currently, it appears to request all available permissions for the app, which violates the principle of least privilege and could pose a security risk if the token is compromised. uses: actions/create-github-app-token@v2 with: app-id: ${{ vars.APP_ID }} private-key: ${{ secrets.APP_KEY }} Error Handling In the pages job, the gh api -X POST command uses --silent. If this command fails for reasons other than the page already existing (e.g., a permission error or malformed request), the error message will be suppressed, potentially masking underlying issues before the PUT attempt. gh api -X POST "repos/${{ github.repository }}/pages" \ -f "source[branch]=${{ env.BRANCH }}" \ -f "source[path]=${{ env.TARGET_PATH }}" --silent \ || \ gh api -X PUT "repos/${{ github.repository }}/pages" \ -f "source[branch]=${{ env.BRANCH }}" \ -f "source[path]=${{ env.TARGET_PATH }}" Temporary File Naming In the protection job, the temporary file for branch protection rules is named $BRANCH_protection.json. If a branch name contains characters invalid for a filename (e.g., /), this could lead to unexpected behavior or errors. Consider using a more robust method for temporary file creation or a fixed, unique temporary filename. jq -c ".\"$BRANCH\"" "$CONFIG_FILE" > "$BRANCH_protection.json"

[a5chin]

/improve