Flatcar icon indicating copy to clipboard operation
Flatcar copied to clipboard
verified publisher icon flatcar

Deploy Safe Settings app for managing GitHub settings as IaC

Open John15321 opened this issue 3 months ago • 2 comments

Context

Safe Settings from GitHub (https://github.com/github/safe-settings) is an Infrastructure-as-Code solution for managing GitHub repository settings in a controlled, versioned, and auditable way. I have previously created a dedicated test organization (TestOrg11233465) and validated the functionalities of Safe Settings there, confirming it performs as required. The next step is to create a dedicated and production-ready Safe Settings deployment for the Flatcar GitHub organization.

This will help ensure Flatcar’s GitHub settings are managed consistently and transparently, supporting contributor onboarding, organizational governance, and CNCF graduation requirements.

Example configuration

Below are configuration snippets used in my test organization to give you the idea of how the configuration looks like:

Repository settings

repository:
  allow_merge_commit: true
  allow_squash_merge: false
  allow_rebase_merge: false
  allow_update_branch: true
  allow_auto_merge: false
  delete_branch_on_merge: true
  has_issues: false
  has_projects: false
  merge_commit_title: PR_TITLE
  merge_commit_message: PR_BODY

Main branch ruleset

rulesets:
  - name: main
    target: branch
    enforcement: active
    bypass_actors:
      - type: repository_role
        repository_role: admin
    conditions:
      ref_name:
        include:
          - 'main'
        default_branch_only: true
    rules:
      restrict_deletion:
        enabled: true
      require_pull_request:
        enabled: true
        required_approvals: 1
      require_code_owner_review:
        enabled: true
      require_last_push_approval:
        enabled: true
      require_conversation_resolution:
        enabled: true
      require_status_checks:
        enabled: true
        contexts: []
      block_force_pushes:
        enabled: true

These can be adapted for Flatcar to automate settings management and improve security and compliance. The thing to keep in mind is that this is directly connected to the GitHub API, thus if any changes are made there the configs need to reflect it.

References

John15321 avatar Sep 17 '25 14:09 John15321

The settings themselves will be taken from the discussion in this issue: https://github.com/flatcar/Flatcar/issues/1714

John15321 avatar Sep 17 '25 14:09 John15321

Commits and PRs related to the testing out of the configuration setup:

John15321 avatar Sep 29 '25 12:09 John15321