Chore: [AEA-0000] - new script to setup new repo

[anthony-nhs]

Summary

• Routine Change

Details

• new script to setup repo

[Copilot]

Pull request overview

This PR introduces a new setup_github_repo package and a wrapper script intended to automate GitHub repository setup (repo settings, team access, environments, and secrets), with supporting unit tests and coverage configuration.

Changes:

• Add packages/setup_github_repo application code for repo setup orchestration (GitHub + AWS exports + CLI bootstrap).
• Add a scripts/setup_github_repos.py wrapper entrypoint and update repo config/ignores to support local secret files.
• Add boto3 dependency plus a new test suite and per-package pytest/coverage config.

Reviewed changes

Copilot reviewed 32 out of 34 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
scripts/setup_github_repos.py	Wrapper script to invoke the new repo-setup CLI.
pyproject.toml	Adds boto3 dependency for AWS export retrieval.
poetry.lock	Locks new dependencies (notably boto3/botocore stack).
packages/setup_github_repo/app/aws_exports.py	Fetches CloudFormation exports and maps them into role values.
packages/setup_github_repo/app/cli.py	CLI entrypoint: GitHub auth token resolution + AWS credential validation + runner invocation.
packages/setup_github_repo/app/constants.py	Central constants for AWS profiles, app IDs, and target hostnames.
packages/setup_github_repo/app/github_access.py	Applies standard EPS team access settings to repos.
packages/setup_github_repo/app/github_base.py	Shared interactive confirmation + rate-limit pacing helpers.
packages/setup_github_repo/app/github_environments.py	Creates GitHub environments with reviewers and deployment policies.
packages/setup_github_repo/app/github_repo_settings.py	Applies repo edit options, Actions permissions, and branch protection.
packages/setup_github_repo/app/github_secrets.py	Creates Actions/Dependabot/environment secrets for weekly release and other cases.
packages/setup_github_repo/app/github_setup.py	Facade coordinating settings/access/environments/secrets setup.
packages/setup_github_repo/app/models.py	Dataclasses for repo config, teams, roles, secrets, environments.
packages/setup_github_repo/app/repo_status.py	Loads and normalises setup config from NHSDigital/eps-repo-status repos.json.
packages/setup_github_repo/app/runner.py	End-to-end orchestration using GitHub + AWS exports + repo-status config.
packages/setup_github_repo/app/secrets_builder.py	Builds consolidated secrets payload from files, AWS exports, and env vars.
packages/setup_github_repo/app/init.py	Package init for app modules.
packages/setup_github_repo/init.py	Top-level package init.
packages/setup_github_repo/main.py	Enables running via python -m setup_github_repo.
packages/setup_github_repo/.coveragerc	Coverage configuration for the new package.
packages/setup_github_repo/pytest.ini	Pytest configuration (test discovery + coverage output).
packages/setup_github_repo/tests/init.py	Test package init.
packages/setup_github_repo/tests/test_aws_exports.py	Unit tests for AWS export pagination + role mapping.
packages/setup_github_repo/tests/test_cli.py	Unit tests for GitHub token/AWS credential bootstrap logic.
packages/setup_github_repo/tests/test_github_access.py	Unit tests for team permission application.
packages/setup_github_repo/tests/test_github_environments.py	Unit tests for environment creation in weekly/non-weekly paths.
packages/setup_github_repo/tests/test_github_repo_settings.py	Unit tests for repo settings + branch protection + Actions permissions.
packages/setup_github_repo/tests/test_github_secrets.py	Unit tests for secret creation behavior based on repo config flags.
packages/setup_github_repo/tests/test_github_setup.py	Unit tests for facade wiring and manager invocation.
packages/setup_github_repo/tests/test_repo_status.py	Unit tests for repos.json payload parsing and loader behavior.
packages/setup_github_repo/tests/test_runner.py	Unit tests for runner dependency wiring and repo filtering behavior.
packages/setup_github_repo/tests/test_secrets_builder.py	Unit tests for secret payload assembly from files/exports/env.
.gitignore	Ignores local .secrets/ directory used by the setup workflow.
.gitallowed	Allows additional token-related patterns used by the new CLI/tests.

[Copilot]

run() currently only applies setup to a single hard-coded repository (NHSDigital/eps-dependabot-approve). For a general "setup repo(s)" script this is a functional limitation and will be surprising in production use. Consider making the target repo(s) configurable via CLI args (e.g., --repo, --all, --filter) or applying setup to all entries returned by RepoStatusLoader.

Suggested change

	if repo.repoUrl == "NHSDigital/eps-dependabot-approve":
	self._github_setup.setup_repo(repo_config=repo, secrets=secrets)
	self._github_setup.setup_repo(repo_config=repo, secrets=secrets)