Sync Policies

Sync repository policies to GitHub from nova.config.json.

Summary

The sync-policies recipe pushes repository-level governance settings from nova.config.json to GitHub. It uses gh repo edit for repository and branch behavior, plus the GitHub API for merge-commit presentation and web commit signoff.

If the github.policies block is missing entirely, or all policy fields are undefined, the recipe no-ops and emits a warning.

Why Use This Command?

Keeps visibility, branch, merge, update, and signoff choices in version-controlled configuration.
Applies related governance settings together so the repository does not retain a partial policy.
Makes policy recovery and review possible without reconstructing web UI choices.

Requirements

gh CLI ≥ 2.40.0 — The GitHub CLI must be installed and authenticated.
Repository write access — The authenticated user must have write access to the target repository.
github.owner and github.repo — Both fields must be set in nova.config.json to identify the target repository.

Behavior

Each policy field is independently optional. When a field is omitted, Nova preserves GitHub's current value.

Field	What it controls
`visibility`	Repository visibility: `public`, `private`, or `internal`.
`defaultBranch`	Default branch, after a read-only check confirms that branch exists.
`mergeMethods.merge`	Whether merge commits are allowed.
`mergeMethods.squash`	Whether squash merges are allowed.
`mergeMethods.rebase`	Whether rebase merges are allowed.
`mergeCommit.title`	Merge-commit title: `pull-request-title` or `merge-message`.
`mergeCommit.message`	Merge-commit message: `pull-request-body`, `pull-request-title`, or `blank`.
`squashMerge.title`	Squash title: `pull-request-title` or `commit-or-pull-request-title`.
`squashMerge.message`	Squash message: `pull-request-body`, `commit-messages`, or `blank`.
`autoDeleteHeadBranch`	Whether GitHub deletes a pull request's head branch after merge.
`autoMerge`	Whether pull requests may use auto-merge.
`allowUpdateBranch`	Whether GitHub shows the update-branch option when a pull request branch is behind its base.
`webCommitSignoffRequired`	Whether commits made in GitHub's web interface require a signoff.

mergeCommit.message requires mergeCommit.title, and squashMerge.message requires squashMerge.title. Nova rejects those incomplete pairs before sending any mutation.

Settings

Declare only the policies you want Nova to own, then enable the project-scoped recipe under recipes.github:

json

{
  "github": {
    "policies": {
      "visibility": "public",
      "defaultBranch": "main",
      "mergeMethods": {
        "merge": false,
        "squash": true,
        "rebase": true
      },
      "mergeCommit": {
        "title": "pull-request-title",
        "message": "pull-request-body"
      },
      "squashMerge": {
        "title": "commit-or-pull-request-title",
        "message": "commit-messages"
      },
      "autoDeleteHeadBranch": true,
      "autoMerge": true,
      "allowUpdateBranch": true,
      "webCommitSignoffRequired": false
    }
  },
  "recipes": {
    "github": {
      "sync-policies": {
        "enabled": true
      }
    }
  }
}

Usage

Options

Flag	Description
`-d, --dry-run`	Run read-only checks without changing any GitHub settings.