Sync settings after App installation

[mvegter]

Fixes #1

Implementation has overlap with #179

[kevo1ution]

It seems that this is very similar to the installation event. Have you considered doing something like repositories = payload.repositories | payload.repositories_added and just combine the two events.

[travi]

am i correct in understanding that this would directly update the file in the default branch? if so, it seems dangerous to do this without submitting the changes as a PR to give the repository maintainer a change to review and accept the changes. if a project already has the settings file, it's likely that there is a reason for it to include the contents that it does, even if it should be supplemented with additional details.

[mvegter]

What do you mean with directly updating the settings file?

The flow this results in:

• Probot settings is installed by user (all or selected repos)
• Probot will loop the previous repos and if it finds a settings file it will sync it
• If the user installs additional repos it will repeat this loop for the new repos.

[travi]

sorry, i definitely misunderstood the goal. i was thinking about the opposite situation where a repo without an existing file would have one created by pulling the existing settings for that repo through the api and written to the config file. i think there was an issue for that at one point, so i think i made the wrong assumption before reading deeply enough.

with a better understanding now, i do see high value to this. i have been really busy lately, but will try to look through your PR soon and give feedback soon.

[stale]

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?

[travi]

sorry that i still havent gotten to this, but it is still on my radar

[rogerluan]

Maybe ping @travi ? 😊

[jftanner]

Is there anything blocking this PR @travi?
This (or another implementation for #1) would significantly improve the security stance when using this app.

Currently, an org admin configuring a new repo needs to do two tasks in order:

1. Install the app in the repo
2. Push/merge a commit with .github/settings.yml with the required branch protection rules

If they do those in the wrong order, then it's very easy for them to be under the mistaken impression that the repo has been configured safely. This leaves the repo significantly vulnerable until either the settings are updated or an admin notices the missing rules.

That condition is especially likely when creating repos from a template, as the template is likely to have the settings file already.