Viewing is open to everyone. Downloading and starring need a GitHub sign-in.
Sign in with GitHub
REPOSITORY-SETTINGS.md
v0.1.0-build.85
Latest
Commit ede38f5
Sign in with GitHub to download. Each download is recorded with your GitHub username.
| 1 | # Repository settings |
| 2 | |
| 3 | The repository is locked down in two places: in the files (pinned dependencies, code owners) and in GitHub's settings, which only an owner can change. This page lists both. |
| 4 | |
| 5 | ## In the repository |
| 6 | |
| 7 | - **Pinned actions.** Every GitHub Action in `.github/workflows/` is pinned to a full commit SHA, with its version tag as a comment (`actions/checkout@<sha> # v4`). A moved tag cannot change what runs. To upgrade an action, look up the new tag's commit (`git ls-remote https://github.com/<owner>/<repo> refs/tags/<tag>^{}`) and update the SHA and the comment together. |
| 8 | - **Pinned toolchains.** The Android build pins Gradle, the NDK and CMake; the web build pins emsdk; the Swift package and the CMake build compile the core from this repository. |
| 9 | - **Code owners.** `.github/CODEOWNERS` makes the maintainer a required reviewer for every path. |
| 10 | - **Immutable releases.** Release tags (`v0.1.0-build.N`) are made only on `Stable-Release` and are never moved or reused ([branches and releases](BRANCHES-AND-RELEASES.md)). |
| 11 | |
| 12 | ## In GitHub (owner only) |
| 13 | |
| 14 | **Settings → General** |
| 15 | |
| 16 | - Default branch: `Stable-Release`. |
| 17 | - Pull requests: allow squash merging only; enable **Automatically delete head branches**. |
| 18 | |
| 19 | **Settings → Rules → Rulesets → New branch ruleset** |
| 20 | |
| 21 | 1. **Stable-Release**: target `Stable-Release`. Enable: |
| 22 | - Restrict updates, creations and deletions (bypass: repository admins only); |
| 23 | - Block force pushes; |
| 24 | - Require linear history; |
| 25 | - Require a pull request before merging, with 1 approval and code-owner review; |
| 26 | - Require status checks to pass: the `ci` workflow's jobs. |
| 27 | 2. **scratch**: target `scratch`. Enable Restrict updates (bypass: repository admins only) and Block force pushes. |
| 28 | 3. **community**: target `community`. Enable Require a pull request before merging with 1 approval, Block force pushes and Restrict deletions. |
| 29 | |
| 30 | **Settings → Rules → Rulesets → New tag ruleset** |
| 31 | |
| 32 | - Target `v*`. Enable Restrict creations, Restrict updates and Restrict deletions (bypass: repository admins only), so a published tag can never be moved or removed. |
| 33 | |
| 34 | **Settings → Code security** |
| 35 | |
| 36 | - Private vulnerability reporting: on ([SECURITY.md](../SECURITY.md)). |
| 37 | - Dependabot alerts: on. |
| 38 | - Secret scanning and push protection: on. |
| 39 | |
| 40 | **Settings → Actions → General** |
| 41 | |
| 42 | - Workflow permissions: **Read repository contents** by default. The release workflow asks for the extra permissions it needs itself. |
| 43 | - Fork pull request workflows: require approval for first-time contributors. |
| 44 | |
| 45 | **Settings → Environments** |
| 46 | |
| 47 | - Create a `release` environment that only `v*` tags can deploy to, and keep any publishing tokens there, never as repository-wide secrets. Workflows that run for `community` must not see them. |