chore(main): release 3.0.0

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -17,8 +17,8 @@ body:
     id: version
     attributes:
       label: Action version
-      description: The ref you pin in `uses:` (a tag like `v2`, or a commit sha). # x-release-please-major
-      placeholder: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      description: The ref you pin in `uses:` (a tag like `v3`, or a commit sha). # x-release-please-major
+      placeholder: Vivswan/github-settings-as-code@v3 # x-release-please-major
     validations:
       required: true
   - type: input

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "2.0.0"
+  ".": "3.0.0"
 }

README.md

@@ -11,7 +11,7 @@ Apply declarative repository settings from `.github/settings.yml`: a loud, state
 2. Add `.github/settings.yml` (or start from a [snapshot](docs/operate/snapshot.md) of the live settings). The first line gives editor autocomplete and hover docs:
 
    ```yaml
-   # yaml-language-server: $schema=https://raw.githubusercontent.com/Vivswan/github-settings-as-code/v2/lib/settings.schema.json # x-release-please-major
+   # yaml-language-server: $schema=https://raw.githubusercontent.com/Vivswan/github-settings-as-code/v3/lib/settings.schema.json # x-release-please-major
 
    repository:
      description: My project
@@ -44,7 +44,7 @@ Apply declarative repository settings from `.github/settings.yml`: a loud, state
        runs-on: ubuntu-latest
        steps:
          - uses: actions/checkout@v7
-         - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+         - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
            with:
              token: ${{ secrets.ADMIN_TOKEN }}
              mode: check
@@ -54,7 +54,7 @@ Apply declarative repository settings from `.github/settings.yml`: a loud, state
 
 | Pin | Points at | Use it for |
 |---|---|---|
-| `@v2` <!-- x-release-please-major --> | The newest release in the major line, so fixes arrive without changing your pin | Production |
+| `@v3` <!-- x-release-please-major --> | The newest release in the major line, so fixes arrive without changing your pin | Production |
 | `@vX.Y.Z` or a commit SHA | One release, frozen by a ruleset | Byte-stable behavior |
 | `@latest` | The newest green `main` commit, packaged; breaking changes arrive here unannounced, ahead of any release | Trying unreleased fixes |
 

docs/operate/check-mode.md

@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.ADMIN_TOKEN }}
           mode: check
@@ -62,7 +62,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.ADMIN_TOKEN }}
           mode: check

docs/operate/layering.md

@@ -347,15 +347,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           mode: render
           settings-file: |
             .github/settings/fleet.yml
             .github/settings/team.yml
             .github/settings/repo.yml
           rendered-file: .github/settings/rendered.yml
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.ADMIN_TOKEN }}
           settings-file: .github/settings/rendered.yml

docs/operate/multi-repo.md

@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.FLEET_TOKEN }}
           repos-dir: .github/repos

docs/operate/snapshot.md

@@ -25,7 +25,7 @@ jobs:
   snapshot:
     runs-on: ubuntu-latest
     steps:
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.ADMIN_TOKEN }}
           mode: snapshot
@@ -41,7 +41,7 @@ The token needs the same read grants a check run needs for the sections you want
 ## What the file looks like
 
 ```yaml settings
-# yaml-language-server: $schema=https://raw.githubusercontent.com/Vivswan/github-settings-as-code/v2/lib/settings.schema.json # x-release-please-major
+# yaml-language-server: $schema=https://raw.githubusercontent.com/Vivswan/github-settings-as-code/v3/lib/settings.schema.json # x-release-please-major
 # actions_secrets[DEPLOY_TOKEN]: value of DEPLOY_TOKEN is not readable; export it into the environment as SECRET_ACTIONS_DEPLOY_TOKEN before apply
 # check_suite_preferences: GitHub exposes no read endpoint for this section, so there is nothing to snapshot; apply re-asserts the declared value on every run
 # milestones: nothing exists on the repository, so the section is omitted
@@ -94,12 +94,12 @@ jobs:
   backup:
     runs-on: ubuntu-latest
     steps:
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.ADMIN_TOKEN }}
           mode: snapshot
           snapshot-file: backup/settings.yml
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         env:
           SECRET_ACTIONS_DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         with:
@@ -161,7 +161,7 @@ jobs:
   snapshot:
     runs-on: ubuntu-latest
     steps:
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.FLEET_TOKEN }}
           mode: snapshot

docs/playbooks/drift-attestation.md

@@ -23,7 +23,7 @@ jobs:
     steps:
       - id: check
         continue-on-error: true
-        uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+        uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.FLEET_READ_TOKEN }}
           mode: check

docs/playbooks/fleet-baseline-rings.md

@@ -131,15 +131,15 @@ jobs:
         include: ${{ fromJSON(needs.plan.outputs.curated) }}
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           mode: render
           settings-file: |
             .github/settings/baseline.yml
             .github/settings/rings/${{ matrix.ring }}.yml
             .github/repos/${{ matrix.ring }}/${{ matrix.repo }}.yml
           rendered-file: merged/${{ matrix.repo }}.yml
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.FLEET_TOKEN }}
           repository: acme/${{ matrix.repo }}
@@ -154,14 +154,14 @@ jobs:
         ring: [settings-ring-0, settings-ring-1]
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           mode: render
           settings-file: |
             .github/settings/baseline.yml
             .github/settings/rings/${{ matrix.ring }}.yml
           rendered-file: merged/${{ matrix.ring }}.yml
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.FLEET_TOKEN }}
           repos: "*"

docs/playbooks/incident-freeze.md

@@ -57,7 +57,7 @@ jobs:
     environment: incident-response
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.INCIDENT_TOKEN }}
           settings-file: .github/profiles/${{ inputs.profile }}.yml

docs/playbooks/preview-blast-radius.md

@@ -37,7 +37,7 @@ jobs:
         repo: ${{ fromJSON(needs.plan.outputs.repos) }}
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           mode: render
           settings-file: |
@@ -61,7 +61,7 @@ jobs:
           path: merged
       - id: plan
         continue-on-error: true
-        uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+        uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.FLEET_READ_TOKEN }}
           mode: check

docs/playbooks/trust-tiers.md

@@ -43,7 +43,7 @@ jobs:
         repo: ${{ fromJSON(needs.plan.outputs.repos) }}
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           mode: render
           settings-file: |
@@ -65,7 +65,7 @@ jobs:
           pattern: merged-*
           merge-multiple: true
           path: merged
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.FLEET_WRITE_TOKEN }}
           repos-dir: merged

docs/reference/secrets-and-vaults.md

@@ -47,7 +47,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.ADMIN_TOKEN }}
         env:
@@ -77,7 +77,7 @@ jobs:
           role: settings-as-code
           secrets: |
             secret/data/ci webhook_secret | WEBHOOK_SECRET
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.ADMIN_TOKEN }}
 ```

docs/start/examples.md

@@ -296,7 +296,7 @@ A `mode: render` fold keeps all three meanings: a higher `pages: null` or `inter
 
 A multi-repo `defaults-file` never merges into a target's file, so a `null` there keeps the meanings above.
 
-A few individual fields accept `null` as a value of their own too, such as `pages.cname` to remove a custom domain; the [published schema](https://github.com/Vivswan/github-settings-as-code/blob/v2/lib/settings.schema.json) <!-- x-release-please-major --> marks those.
+A few individual fields accept `null` as a value of their own too, such as `pages.cname` to remove a custom domain; the [published schema](https://github.com/Vivswan/github-settings-as-code/blob/v3/lib/settings.schema.json) <!-- x-release-please-major --> marks those.
 
 ## Notes in the file
 

docs/start/getting-started.md

@@ -21,7 +21,7 @@ Save the token as a repository secret. The examples below call it `ADMIN_TOKEN`.
 Settings live in `.github/settings.yml` by default (the `settings-file` input moves it). A comment at the top wires editor autocomplete and hover documentation to the published JSON Schema. A small first file:
 
 ```yaml settings
-# yaml-language-server: $schema=https://raw.githubusercontent.com/Vivswan/github-settings-as-code/v2/lib/settings.schema.json # x-release-please-major
+# yaml-language-server: $schema=https://raw.githubusercontent.com/Vivswan/github-settings-as-code/v3/lib/settings.schema.json # x-release-please-major
 
 repository:
   description: Payments service
@@ -59,15 +59,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.ADMIN_TOKEN }}
           mode: check
 ```
 
 Each trigger earns its place. The push trigger runs the action on every reviewed change to the settings file: a check while `mode: check` is set, an apply once step 5 removes it. `workflow_dispatch` lets you run the action by hand from the Actions tab, which is how the first run happens. The schedule catches drift: in check mode a weekly run turns red when the live settings diverge from the file, and after the switch to apply it re-asserts the declared keys and reverts anything changed through the UI in the meantime (apply is convergent, see [Semantics](../reference/semantics.md)).
 
-The `@v2` pin <!-- x-release-please-major --> is the moving major tag, stable within its line; `@latest` is a moving tag on the packaged commit of the newest `main` commit (`main` itself is source-only), where breaking changes arrive unannounced, so keep production on the major pin.
+The `@v3` pin <!-- x-release-please-major --> is the moving major tag, stable within its line; `@latest` is a moving tag on the packaged commit of the newest `main` commit (`main` itself is source-only), where breaking changes arrive unannounced, so keep production on the major pin.
 
 ## 4. Run check mode first
 

docs/start/migrating-from-probot.md

@@ -69,7 +69,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.ADMIN_TOKEN }}
           mode: check

docs/upgrading/README.md

@@ -10,7 +10,7 @@ One page per major version. A major is the only release that can change what an
 
 | Pin | Moves when | Use it for |
 |---|---|---|
-| `@v2` (the moving major) <!-- x-release-please-major --> | Every release in that major line | Fixes arrive without touching your pin; the line never breaks a working file |
+| `@v3` (the moving major) <!-- x-release-please-major --> | Every release in that major line | Fixes arrive without touching your pin; the line never breaks a working file |
 | `@vX.Y.Z` | Never | Byte-stable behavior; upgrade deliberately |
 | A commit SHA | Never | The same, for repositories that pin actions by digest |
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vivswan/github-settings-as-code",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "description": "GitHub Action applying declarative repository settings: rulesets, labels, branch protection, and more.",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",

release-please-config.json

@@ -3,7 +3,7 @@
   "bump-minor-pre-major": true,
   "bump-patch-for-minor-pre-major": true,
   "include-component-in-tag": false,
-  "last-release-sha": "046adf3b24454f26f569850630809bcf481f8b84",
+  "last-release-sha": "1a25adbc40c5dc2d82ca1684cb5062917c953c23",
   "packages": {
     ".": {
       "release-type": "simple",

src/flows/snapshot.ts

@@ -44,7 +44,7 @@ import { snapshotTakenLine, writeSnapshotDirSummary, writeSummary } from "./summ
  * this file); test/docs/readme.test.ts pins it to the README's hint.
  */
 export const SNAPSHOT_SCHEMA_URL =
-  "https://raw.githubusercontent.com/Vivswan/github-settings-as-code/v2/lib/settings.schema.json"; // x-release-please-major
+  "https://raw.githubusercontent.com/Vivswan/github-settings-as-code/v3/lib/settings.schema.json"; // x-release-please-major
 
 interface SnapshotConfigBase {
   onMissingPermission: "fail" | "warn";