Declarative, testable GitHub repository governance for organizations that want consistent security controls without maintaining rulesets repository by repository.
GitHub Governance reconciles repository rulesets from configuration owned by each organization. The engine stays organization-agnostic: branch protections, review requirements, required checks, conditional exceptions and repository overrides are declared by the caller.
- Consistent governance: define policy once and reconcile it across an organization.
- Reviewable changes: policy evolves through pull requests instead of manual UI changes.
- Safe operations: dry-run is the default and mutation requires explicit apply.
- Credential isolation: each organization owns its GitHub App and protected environment.
- Least privilege: reconciliation uses short-lived tokens scoped to one repository.
- Reusable architecture: product-specific exceptions stay in caller configuration, not engine code.
- Auditable dependencies: third-party Actions are pinned to immutable commit SHAs.
The same engine is used by two independent caller repositories:
- LibreSign/.github — LibreSign organization policy.
- LibreCodeCoop/.github — LibreCode Coop organization policy and additional CI requirements for this project.
These are reference implementations, not engine dependencies.
- The caller discovers public, non-archived repositories.
- A short-lived organization token is used only for discovery.
- Each repository gets its own short-lived GitHub App token.
- Caller-owned configuration resolves the desired rulesets.
- The engine compares desired and current state.
- Dry-run reports drift; explicit apply reconciles it.
Start with the adoption guide. It covers the GitHub App, protected environment, caller workflow, configuration, dry-run validation and controlled rollout.
Consumers should pin releases by immutable SHA and keep the corresponding version as a comment:
uses: LibreCodeCoop/github-governance@<full-release-sha> # v0.1.0The SHA is the security boundary; the version comment is the human-readable release reference.
Read the security model before production adoption. Vulnerabilities should be reported according to SECURITY.md.
- Adoption guide
- Configuration reference
- Architecture
- Security model
- Development and quality checks
- Release process
- Safe Settings evaluation
GitHub Governance is free software licensed under AGPL-3.0-or-later and follows the REUSE specification.