github-community-projects / github-community-projects/safe-settings
Settings should have a way to express "no opinion" for a setting
- Dominant language
- JavaScript
- Stars
- 921
- Forks
- 226
- Avg merge
- 18h 3m
- Merged PRs (30d)
- 14
Description
The current behavior of settings.yml is that a lot of fields are required. They can be `null`, or they can be filled out, but they must be present (otherwise the API returns a 422). This means you can either specify things, or turn them off, but you cannot express the concept "safe-settings has no opinion on this setting, and each repository is free to make its own choices".
I'll describe the example I just encountered:
* I have an organization with several repos, and each repo has some set of checks that I want to make required for PRs to land
* But the set of checks is different depending on the repo
* With safe-settings, I can specify `branches.protection.required_status_checks` but I can't provide one coherent value for `contexts`, since the check names are different across repos.
* I could specify `contexts: []` but this prevents me from _adding_ contexts within one repo in the org: safe-settings removes my required check.
* I also tried specifying `branches.protection.required_status_checks: null`, hoping that this would just leave the setting alone. Instead, it disabled `required_status_checks`, even if I enabled it for one repo.
It would be nice for some of the fields to be optional (meaning safe-settings will just leave them alone), or to have values that are "minimums". In the case of `required_status_checks`, I might want to say that every repo needs to enforce that the linter check passes, or the secret scanning check passes (though, with [Required Workflows](https://docs.github.com/en/actions/using-workflows/required-workflows) this will be taken care of without safe-settings), but allow repos to add other checks they require, on top of that.
Contributor guide
Assessment
This issue has not been assessed yet.