Sync Security

Sync repository security settings from nova.config.json.

Summary

The sync-security recipe reconciles vulnerability alerts, Dependabot security updates, secret scanning, and secret-scanning push protection. Each field is optional; omitted fields leave the current GitHub value untouched.

GitHub controls feature availability by repository visibility, organization policy, license, and plan. Nova reports an API failure instead of silently claiming an unavailable feature was enabled.

Why Use This Command?

1. Prevent security switches from being overlooked on a newly created repository.
2. Repair manual UI drift from a reviewed configuration file.
3. Apply secret scanning before push protection so dependent updates happen safely.

Requirements

• gh CLI ≥ 2.40.0 — The GitHub CLI must be installed and authenticated.
• Repository administration access — The authenticated user must be able to change security settings.
• github.owner and github.repo — Both fields identify the target repository.

Behavior

dependabotSecurityUpdates: true requires vulnerabilityAlerts: true in the same configuration because GitHub's security-update service depends on Dependabot alerts. pushProtection: true requires secretScanning: true in the same configuration. Nova validates both relationships before sending any GitHub mutation. When disabling both secret-scanning settings, Nova disables push protection before secret scanning. When enabling both, Nova enables secret scanning first.

Settings

{
  "github": {
    "security": {
      "vulnerabilityAlerts": true,
      "dependabotSecurityUpdates": true,
      "secretScanning": true,
      "pushProtection": true
    }
  },
  "recipes": {
    "github": {
      "sync-security": {
        "enabled": true
      }
    }
  }
}

Usage

Options