unmango/scm

Source control infrastructure for unmango as code. Repositories, branch protection, and settings managed via Pulumi. Each forge has its own directory; GitHub lives under github/.

What is this?

This repository replaces manual forge UI configuration with declarative TypeScript. Rather than configuring repositories through a web UI, settings are version-controlled, reviewed via pull request, and applied programmatically.

Pulumi is an infrastructure-as-code tool that lets you describe infrastructure (GitHub repos, AWS resources, Kubernetes clusters, etc.) using real programming languages instead of domain-specific configuration languages like HCL. It tracks deployed state and computes diffs between desired and actual configuration, the same mental model as kubectl apply or terraform plan/apply.

What's managed here

Every public repository under @unmango is defined in github/repos.ts. Each repo gets:

• Branch protection on the default branch (usually main): required PRs, stale review dismissal, required status checks, commit signatures, linear history
• Consistent merge settings: squash-only, delete branch on merge, auto-merge enabled
• MIT license and vulnerability alerts enabled by default

Private repos use a minimal configuration without branch rulesets.

Structure

index.ts                # Entrypoint: imports each forge's program
github/
  index.ts              # Organization secrets and stack outputs
  repos.ts              # All repos declared here
  components/
    repo.ts             # Base class: shared defaults for all repos
    publicRepo.ts       # Adds branch ruleset enforcement
    privateRepo.ts      # Private visibility, no rulesets

PublicRepo and PrivateRepo extend a shared base component. Adding a new repo means instantiating one of these classes with a name, description, and the CI check names that must pass before merging.

Usage

make preview   # Dry run — see what would change
make diff      # Detailed diff of pending changes
make up        # Apply changes to GitHub