These pages document master, which is unreleased and in development. The Quick Start installs the latest stable release; anything newer than that tag is marked in the text.

GitHub Hardening Playbook

This playbook sets repository-level guardrails that complement in-repo checks.

Scope

Enforce branch protection on the default branch
Require the sync-check CI gate
Require pull-request approval
Require Code Owners review
Require conversation resolution before merge
Prevent force pushes and branch deletions

Prerequisites

You have admin permission on the repository.
GitHub CLI is installed and authenticated:
Terminal window
```
gh auth status
```

Apply protections

Run from repository root:

bash scripts/apply-branch-protection.sh --repo gosha70/code-copilot-team --branch master --checks "sync-check"

Or run apply + audit in one command:

bash scripts/harden-github.sh --repo gosha70/code-copilot-team --branch master --checks "sync-check"

If you prefer a non-mutating preview first:

bash scripts/apply-branch-protection.sh --repo gosha70/code-copilot-team --branch master --checks "sync-check" --dry-run

Verify protections

CLI verification:

gh api repos/gosha70/code-copilot-team/branches/master/protection --jq '{
  required_status_checks: .required_status_checks.contexts,
  strict_status_checks: .required_status_checks.strict,
  require_code_owner_reviews: .required_pull_request_reviews.require_code_owner_reviews,
  required_approving_review_count: .required_pull_request_reviews.required_approving_review_count,
  enforce_admins: .enforce_admins.enabled,
  required_linear_history: .required_linear_history.enabled,
  required_conversation_resolution: .required_conversation_resolution.enabled
}'

Or run the consolidated hardening audit script:

bash scripts/check-github-hardening.sh --repo gosha70/code-copilot-team --branch master --required-checks "sync-check"

UI verification:

Open repository settings.
Navigate to Settings > Branches.
Confirm the default-branch rule requires:
- status check sync-check
- at least 1 approving review
- code owner review
- conversation resolution
- linear history
- no force pushes/deletions

Security hardening follow-up

Enable private vulnerability reporting in repository settings:

Open Settings > Security & analysis.
Turn on Private vulnerability reporting.