{
	"$schema": "http://json-schema.org/draft-07/schema#",
	"$id": "https://raw.githubusercontent.com/spencerbeggs/reposets/main/package/schemas/reposets.config.schema.json",
	"type": "object",
	"required": ["groups"],
	"properties": {
		"owner": {
			"type": "string",
			"description": "Default GitHub user or organization for all groups. Can be overridden per group.",
			"title": "Default owner",
			"examples": ["spencerbeggs", "savvy-web"]
		},
		"log_level": {
			"allOf": [
				{
					"$ref": "#/$defs/LogLevel"
				}
			],
			"title": "Log level",
			"description": "Default output verbosity. Can be overridden with --log-level CLI flag."
		},
		"settings": {
			"type": "object",
			"additionalProperties": {
				"$ref": "#/$defs/SettingsGroup"
			},
			"description": "Named groups of GitHub repository settings to apply",
			"title": "Settings groups",
			"x-tombi-additional-key-label": "setting_group"
		},
		"secrets": {
			"type": "object",
			"additionalProperties": {
				"$ref": "#/$defs/SecretGroup"
			},
			"description": "Named groups of secrets. Each group is one kind: file, value, or resolved.",
			"title": "Secret groups",
			"x-tombi-additional-key-label": "secret_group"
		},
		"variables": {
			"type": "object",
			"additionalProperties": {
				"$ref": "#/$defs/VariableGroup"
			},
			"description": "Named groups of variables. Each group is one kind: file, value, or resolved.",
			"title": "Variable groups",
			"x-tombi-additional-key-label": "variable_group"
		},
		"rulesets": {
			"type": "object",
			"additionalProperties": {
				"$ref": "#/$defs/Ruleset"
			},
			"description": "Named rulesets defining branch and tag protection rules",
			"title": "Rulesets",
			"x-tombi-additional-key-label": "ruleset_name"
		},
		"environments": {
			"type": "object",
			"additionalProperties": {
				"$ref": "#/$defs/Environment"
			},
			"description": "Named deployment environment configurations",
			"title": "Environments",
			"x-tombi-additional-key-label": "environment_name"
		},
		"groups": {
			"type": "object",
			"additionalProperties": {
				"$ref": "#/$defs/Group"
			},
			"description": "Named groups of repositories with their settings, secrets, variables, rulesets, and environment assignments",
			"title": "Groups",
			"x-tombi-additional-key-label": "group_name"
		}
	},
	"additionalProperties": false,
	"description": "Configuration for syncing GitHub repository settings, secrets, variables, rulesets, and deployment environments",
	"title": "reposets Configuration",
	"x-tombi-table-keys-order": "schema",
	"x-taplo": {
		"links": {
			"key": "https://github.com/spencerbeggs/reposets/blob/main/docs/configuration.md"
		},
		"initKeys": ["owner", "groups"]
	},
	"$defs": {
		"LogLevel": {
			"type": "string",
			"enum": ["silent", "info", "verbose", "debug"],
			"description": "Controls output verbosity: silent (none), info (summaries), verbose (per-operation), debug (with sources)",
			"title": "Log level"
		},
		"SettingsGroup": {
			"type": "object",
			"properties": {
				"is_template": {
					"type": "boolean",
					"description": "Whether the repository is a template that can be used to generate new repositories",
					"title": "Template repository"
				},
				"has_wiki": {
					"type": "boolean",
					"description": "Enable the wiki feature for the repository",
					"title": "Wikis"
				},
				"has_issues": {
					"type": "boolean",
					"description": "Enable the issues feature for the repository",
					"title": "Issues"
				},
				"has_projects": {
					"type": "boolean",
					"description": "Enable the projects feature for the repository",
					"title": "Projects"
				},
				"has_discussions": {
					"type": "boolean",
					"description": "Enable the discussions feature for the repository",
					"title": "Discussions"
				},
				"has_sponsorships": {
					"type": "boolean",
					"description": "Display a Sponsor button for the repository (synced via GraphQL)",
					"title": "Sponsorships"
				},
				"has_pull_requests": {
					"type": "boolean",
					"description": "Enable the pull requests feature for the repository (synced via GraphQL)",
					"title": "Pull requests"
				},
				"allow_forking": {
					"type": "boolean",
					"description": "Allow forking of the repository",
					"title": "Allow forking"
				},
				"allow_merge_commit": {
					"type": "boolean",
					"description": "Allow merge commits when merging pull requests",
					"title": "Allow merge commits"
				},
				"allow_squash_merge": {
					"type": "boolean",
					"description": "Allow squash merging when merging pull requests",
					"title": "Allow squash merging"
				},
				"allow_rebase_merge": {
					"type": "boolean",
					"description": "Allow rebase merging when merging pull requests",
					"title": "Allow rebase merging"
				},
				"allow_auto_merge": {
					"type": "boolean",
					"description": "Allow pull requests to be automatically merged once all requirements are met",
					"title": "Allow auto-merge"
				},
				"allow_update_branch": {
					"type": "boolean",
					"description": "Show the update branch button on pull requests",
					"title": "Always suggest updating pull request branches"
				},
				"squash_merge_commit_title": {
					"type": "string",
					"enum": ["PR_TITLE", "COMMIT_OR_PR_TITLE"],
					"description": "Default title for squash merge commits: PR_TITLE uses the pull request title, COMMIT_OR_PR_TITLE uses the commit message if only one commit, otherwise the PR title",
					"title": "Squash merge commit title"
				},
				"squash_merge_commit_message": {
					"type": "string",
					"enum": ["PR_BODY", "COMMIT_MESSAGES", "BLANK"],
					"description": "Default message body for squash merge commits: PR_BODY uses the pull request body, COMMIT_MESSAGES concatenates all commit messages, BLANK leaves it empty",
					"title": "Squash merge commit message"
				},
				"merge_commit_title": {
					"type": "string",
					"enum": ["PR_TITLE", "MERGE_MESSAGE"],
					"description": "Default title for merge commits: PR_TITLE uses the pull request title, MERGE_MESSAGE uses the classic merge message",
					"title": "Merge commit title"
				},
				"merge_commit_message": {
					"type": "string",
					"enum": ["PR_BODY", "PR_TITLE", "BLANK"],
					"description": "Default message body for merge commits: PR_BODY uses the pull request body, PR_TITLE uses the PR title, BLANK leaves it empty",
					"title": "Merge commit message"
				},
				"delete_branch_on_merge": {
					"type": "boolean",
					"description": "Automatically delete head branches after pull requests are merged",
					"title": "Automatically delete head branches"
				},
				"web_commit_signoff_required": {
					"type": "boolean",
					"description": "Require contributors to sign off on web-based commits",
					"title": "Require commit signoff"
				}
			},
			"additionalProperties": {},
			"description": "GitHub repository settings to apply. Known fields are typed; additional fields are passed through to the API.",
			"title": "Settings group",
			"x-tombi-table-keys-order": "schema",
			"x-taplo": {
				"links": {
					"key": "https://github.com/spencerbeggs/reposets/blob/main/docs/configuration.md"
				}
			}
		},
		"SecretGroup": {
			"anyOf": [
				{
					"type": "object",
					"required": ["file"],
					"properties": {
						"file": {
							"type": "object",
							"additionalProperties": {
								"type": "string"
							},
							"description": "Named entries with file path values, resolved relative to config directory",
							"title": "File entries",
							"x-tombi-additional-key-label": "name"
						}
					},
					"additionalProperties": false
				},
				{
					"type": "object",
					"required": ["value"],
					"properties": {
						"value": {
							"type": "object",
							"additionalProperties": {
								"anyOf": [
									{
										"type": "string"
									},
									{
										"type": "object",
										"additionalProperties": {}
									}
								]
							},
							"description": "Named entries with inline values. Strings used as-is, objects JSON-stringified.",
							"title": "Value entries",
							"x-tombi-additional-key-label": "name"
						}
					},
					"additionalProperties": false
				},
				{
					"type": "object",
					"required": ["resolved"],
					"properties": {
						"resolved": {
							"type": "object",
							"additionalProperties": {
								"type": "string"
							},
							"description": "Named entries mapped to credential labels. Values come from the active credential profile.",
							"title": "Resolved entries",
							"x-tombi-additional-key-label": "name"
						}
					},
					"additionalProperties": false
				}
			],
			"description": "A group of secrets. Must be exactly one kind: file, value, or resolved.",
			"title": "Secret group",
			"x-taplo": {
				"links": {
					"key": "https://github.com/spencerbeggs/reposets/blob/main/docs/secrets-and-variables.md"
				}
			}
		},
		"VariableGroup": {
			"anyOf": [
				{
					"type": "object",
					"required": ["file"],
					"properties": {
						"file": {
							"type": "object",
							"additionalProperties": {
								"type": "string"
							},
							"description": "Named entries with file path values, resolved relative to config directory",
							"title": "File entries",
							"x-tombi-additional-key-label": "name"
						}
					},
					"additionalProperties": false
				},
				{
					"type": "object",
					"required": ["value"],
					"properties": {
						"value": {
							"type": "object",
							"additionalProperties": {
								"anyOf": [
									{
										"type": "string"
									},
									{
										"type": "object",
										"additionalProperties": {}
									}
								]
							},
							"description": "Named entries with inline values. Strings used as-is, objects JSON-stringified.",
							"title": "Value entries",
							"x-tombi-additional-key-label": "name"
						}
					},
					"additionalProperties": false
				},
				{
					"type": "object",
					"required": ["resolved"],
					"properties": {
						"resolved": {
							"type": "object",
							"additionalProperties": {
								"type": "string"
							},
							"description": "Named entries mapped to credential labels. Values come from the active credential profile.",
							"title": "Resolved entries",
							"x-tombi-additional-key-label": "name"
						}
					},
					"additionalProperties": false
				}
			],
			"description": "A group of variables. Must be exactly one kind: file, value, or resolved.",
			"title": "Variable group",
			"x-taplo": {
				"links": {
					"key": "https://github.com/spencerbeggs/reposets/blob/main/docs/secrets-and-variables.md"
				}
			}
		},
		"Ruleset": {
			"anyOf": [
				{
					"$ref": "#/$defs/BranchRuleset"
				},
				{
					"$ref": "#/$defs/TagRuleset"
				}
			],
			"description": "A set of rules to apply when specified conditions are met",
			"title": "Repository ruleset",
			"x-taplo": {
				"links": {
					"key": "https://github.com/spencerbeggs/reposets/blob/main/docs/rulesets.md"
				}
			}
		},
		"BranchRuleset": {
			"type": "object",
			"required": ["name", "enforcement", "type"],
			"properties": {
				"name": {
					"type": "string",
					"description": "The name of the ruleset (used for matching when creating or updating)",
					"title": "Ruleset name"
				},
				"enforcement": {
					"type": "string",
					"enum": ["disabled", "active", "evaluate"],
					"description": "disabled = off, active = enforced, evaluate = test mode (GitHub Enterprise only)",
					"title": "Enforcement level"
				},
				"conditions": {
					"$ref": "#/$defs/RulesetConditions"
				},
				"bypass_actors": {
					"type": "array",
					"items": {
						"$ref": "#/$defs/BypassActor"
					}
				},
				"creation": {
					"type": "boolean",
					"description": "When true, adds a creation rule",
					"title": "Restrict creation"
				},
				"update": {
					"type": "boolean",
					"description": "When true, adds an update rule with update_allows_fetch_and_merge: true",
					"title": "Restrict updates"
				},
				"deletion": {
					"type": "boolean",
					"description": "When true, adds a deletion rule",
					"title": "Restrict deletion"
				},
				"required_linear_history": {
					"type": "boolean",
					"description": "When true, adds a required_linear_history rule",
					"title": "Require linear history"
				},
				"required_signatures": {
					"type": "boolean",
					"description": "When true, adds a required_signatures rule",
					"title": "Require signatures"
				},
				"non_fast_forward": {
					"type": "boolean",
					"description": "When true, adds a non_fast_forward rule",
					"title": "Prevent non-fast-forward"
				},
				"deployments": {
					"type": "array",
					"items": {
						"type": "string"
					},
					"description": "Deployment environments that must succeed; converts to required_deployments rule",
					"title": "Required deployments"
				},
				"targets": {
					"$ref": "#/$defs/Targets"
				},
				"status_checks": {
					"$ref": "#/$defs/StatusChecksShorthand"
				},
				"commit_message": {
					"type": "array",
					"items": {
						"$ref": "#/$defs/PatternEntry"
					},
					"description": "Commit message pattern rules",
					"title": "Commit message patterns"
				},
				"commit_author_email": {
					"type": "array",
					"items": {
						"$ref": "#/$defs/PatternEntry"
					},
					"description": "Commit author email pattern rules",
					"title": "Commit author email patterns"
				},
				"committer_email": {
					"type": "array",
					"items": {
						"$ref": "#/$defs/PatternEntry"
					},
					"description": "Committer email pattern rules",
					"title": "Committer email patterns"
				},
				"type": {
					"type": "string",
					"enum": ["branch"],
					"description": "This ruleset applies to branches",
					"title": "Ruleset type"
				},
				"pull_requests": {
					"$ref": "#/$defs/PullRequestsShorthand"
				},
				"merge_queue": {
					"$ref": "#/$defs/MergeQueueShorthand"
				},
				"copilot_review": {
					"$ref": "#/$defs/CopilotReviewShorthand"
				},
				"code_scanning": {
					"type": "array",
					"items": {
						"$ref": "#/$defs/CodeScanningEntry"
					},
					"description": "Code scanning tool requirements",
					"title": "Code scanning tools"
				},
				"workflows": {
					"$ref": "#/$defs/WorkflowsShorthand"
				},
				"branch_name": {
					"type": "array",
					"items": {
						"$ref": "#/$defs/PatternEntry"
					},
					"description": "Branch name pattern rules",
					"title": "Branch name patterns"
				}
			},
			"additionalProperties": false,
			"description": "A ruleset that applies to branches",
			"title": "Branch ruleset",
			"x-tombi-table-keys-order": "schema",
			"x-taplo": {
				"links": {
					"key": "https://github.com/spencerbeggs/reposets/blob/main/docs/rulesets.md"
				},
				"initKeys": ["name", "type", "enforcement", "targets"]
			}
		},
		"RulesetConditions": {
			"type": "object",
			"properties": {
				"ref_name": {
					"$ref": "#/$defs/RefNameCondition"
				}
			},
			"additionalProperties": false,
			"description": "Conditions that determine when the ruleset applies",
			"title": "Ruleset conditions"
		},
		"RefNameCondition": {
			"type": "object",
			"properties": {
				"include": {
					"type": "array",
					"items": {
						"type": "string"
					},
					"description": "Ref name patterns to include. Accepts ~DEFAULT_BRANCH, ~ALL, or glob patterns.",
					"title": "Include patterns",
					"examples": [["~DEFAULT_BRANCH"]]
				},
				"exclude": {
					"type": "array",
					"items": {
						"type": "string"
					},
					"description": "Ref name patterns to exclude",
					"title": "Exclude patterns"
				}
			},
			"additionalProperties": false,
			"description": "Conditions for matching ref names (branches or tags)",
			"title": "Ref name condition"
		},
		"BypassActor": {
			"type": "object",
			"required": ["actor_type"],
			"properties": {
				"actor_id": {
					"anyOf": [
						{
							"$ref": "#/$defs/Int"
						},
						{
							"$ref": "#/$defs/ResolvedRef"
						}
					],
					"description": "The ID of the actor, or a { resolved } reference to a credential label.",
					"title": "Actor ID"
				},
				"actor_type": {
					"type": "string",
					"enum": ["Integration", "OrganizationAdmin", "RepositoryRole", "Team", "DeployKey"],
					"description": "The type of actor that can bypass a ruleset",
					"title": "Actor type"
				},
				"bypass_mode": {
					"type": "string",
					"enum": ["always", "pull_request", "exempt"],
					"description": "When the specified actor can bypass the ruleset",
					"title": "Bypass mode"
				}
			},
			"additionalProperties": false,
			"description": "An actor that can bypass rules in a ruleset",
			"title": "Bypass actor"
		},
		"Int": {
			"type": "integer",
			"description": "an integer",
			"title": "int"
		},
		"ResolvedRef": {
			"type": "object",
			"required": ["resolved"],
			"properties": {
				"resolved": {
					"type": "string",
					"description": "Reference to a named value in the active credential profile's resolve section",
					"title": "Credential label"
				}
			},
			"additionalProperties": false,
			"description": "A reference to a credential-resolved value",
			"title": "Resolved reference"
		},
		"Targets": {
			"anyOf": [
				{
					"type": "string",
					"enum": ["default", "all"],
					"description": "'default' targets the default branch; 'all' targets all branches/tags",
					"title": "Target preset"
				},
				{
					"type": "array",
					"items": {
						"$ref": "#/$defs/TargetPattern"
					},
					"description": "Array of include/exclude patterns for fine-grained ref targeting",
					"title": "Custom target patterns"
				}
			],
			"description": "Shorthand for specifying ref_name conditions: 'default', 'all', or custom patterns",
			"title": "Targets shorthand"
		},
		"TargetPattern": {
			"anyOf": [
				{
					"type": "object",
					"required": ["include"],
					"properties": {
						"include": {
							"type": "string",
							"description": "Glob pattern to include",
							"title": "Include pattern"
						}
					},
					"additionalProperties": false
				},
				{
					"type": "object",
					"required": ["exclude"],
					"properties": {
						"exclude": {
							"type": "string",
							"description": "Glob pattern to exclude",
							"title": "Exclude pattern"
						}
					},
					"additionalProperties": false
				}
			],
			"description": "An include or exclude pattern for ref matching",
			"title": "Target pattern"
		},
		"StatusChecksShorthand": {
			"type": "object",
			"required": ["required"],
			"properties": {
				"update_branch": {
					"type": "boolean",
					"description": "PRs must be tested with the latest code",
					"title": "Strict status checks"
				},
				"on_creation": {
					"type": "boolean",
					"description": "When false, allows branch creation even if checks would prohibit it",
					"title": "Enforce on create"
				},
				"default_integration_id": {
					"anyOf": [
						{
							"$ref": "#/$defs/Int"
						},
						{
							"$ref": "#/$defs/ResolvedRef"
						}
					],
					"description": "Default integration ID applied to all checks that do not specify one",
					"title": "Default integration ID"
				},
				"required": {
					"type": "array",
					"items": {
						"type": "object",
						"required": ["context"],
						"properties": {
							"context": {
								"type": "string",
								"description": "The status check context name that must be present on the commit",
								"title": "Context"
							},
							"integration_id": {
								"anyOf": [
									{
										"$ref": "#/$defs/Int"
									},
									{
										"$ref": "#/$defs/ResolvedRef"
									}
								],
								"description": "The integration ID, or a { resolved } reference to a credential label",
								"title": "Integration ID"
							}
						},
						"additionalProperties": false
					},
					"description": "Status checks that must pass",
					"title": "Required checks"
				}
			},
			"additionalProperties": false,
			"description": "Simplified status checks configuration",
			"title": "Status checks shorthand"
		},
		"PatternEntry": {
			"type": "object",
			"required": ["operator", "pattern"],
			"properties": {
				"operator": {
					"type": "string",
					"enum": ["starts_with", "ends_with", "contains", "regex"],
					"description": "The operator to use for matching",
					"title": "Operator"
				},
				"pattern": {
					"type": "string",
					"description": "The pattern to match",
					"title": "Pattern"
				},
				"name": {
					"type": "string",
					"description": "Display name for this pattern rule",
					"title": "Rule name"
				},
				"negate": {
					"type": "boolean",
					"description": "If true, the rule fails when the pattern matches",
					"title": "Negate"
				}
			},
			"additionalProperties": false,
			"description": "A pattern matching rule with operator, pattern, and optional name/negate",
			"title": "Pattern entry"
		},
		"PullRequestsShorthand": {
			"type": "object",
			"properties": {
				"approvals": {
					"allOf": [
						{
							"$ref": "#/$defs/Int",
							"description": "Number of approving reviews required (0-10)",
							"title": "Required approvals",
							"minimum": 0,
							"maximum": 10
						}
					],
					"title": "Required approvals",
					"description": "Number of approving reviews required (0-10)"
				},
				"dismiss_stale_reviews": {
					"type": "boolean",
					"description": "Dismiss previous approvals when new commits are pushed",
					"title": "Dismiss stale reviews"
				},
				"code_owner_review": {
					"type": "boolean",
					"description": "Require review from code owners for files they own",
					"title": "Code owner review"
				},
				"last_push_approval": {
					"type": "boolean",
					"description": "Most recent push must be approved by someone other than the pusher",
					"title": "Last push approval"
				},
				"resolve_threads": {
					"type": "boolean",
					"description": "All review conversations must be resolved before merging",
					"title": "Resolve threads"
				},
				"merge_methods": {
					"type": "array",
					"items": {
						"type": "string",
						"enum": ["merge", "squash", "rebase"]
					},
					"description": "Allowed merge methods. At least one must be enabled.",
					"title": "Merge methods"
				},
				"reviewers": {
					"type": "array",
					"items": {
						"type": "object",
						"required": ["file_patterns", "minimum_approvals", "reviewer"],
						"properties": {
							"file_patterns": {
								"type": "array",
								"items": {
									"type": "string"
								},
								"description": "File patterns this reviewer must approve (fnmatch syntax)",
								"title": "File patterns"
							},
							"minimum_approvals": {
								"type": "integer",
								"description": "Minimum approvals required from this team (0 = optional)",
								"title": "Minimum approvals"
							},
							"reviewer": {
								"type": "object",
								"required": ["id", "type"],
								"properties": {
									"id": {
										"type": "integer",
										"description": "Team ID",
										"title": "Team ID"
									},
									"type": {
										"type": "string",
										"enum": ["Team"]
									}
								},
								"additionalProperties": false,
								"title": "Reviewer team"
							}
						},
						"additionalProperties": false
					},
					"description": "Teams that must approve specific file patterns",
					"title": "Required reviewers"
				}
			},
			"additionalProperties": false,
			"description": "Simplified pull request configuration (branch rulesets only)",
			"title": "Pull requests shorthand"
		},
		"MergeQueueShorthand": {
			"type": "object",
			"required": ["check_timeout", "grouping", "max_build", "max_merge", "merge_method", "min_merge", "min_wait"],
			"properties": {
				"check_timeout": {
					"$ref": "#/$defs/Int",
					"description": "Max time for status checks to report",
					"title": "Check timeout (minutes)",
					"minimum": 1,
					"maximum": 360
				},
				"grouping": {
					"type": "string",
					"enum": ["ALLGREEN", "HEADGREEN"],
					"description": "Whether all commits or only the head commit must pass checks",
					"title": "Grouping strategy"
				},
				"max_build": {
					"$ref": "#/$defs/Int",
					"description": "Max queued PRs requesting checks simultaneously",
					"title": "Max entries to build",
					"minimum": 0,
					"maximum": 100
				},
				"max_merge": {
					"$ref": "#/$defs/Int",
					"description": "Max PRs merged together in a group",
					"title": "Max entries to merge",
					"minimum": 0,
					"maximum": 100
				},
				"merge_method": {
					"type": "string",
					"enum": ["MERGE", "SQUASH", "REBASE"],
					"description": "Merge method for queued PRs",
					"title": "Merge method"
				},
				"min_merge": {
					"$ref": "#/$defs/Int",
					"description": "Min PRs merged together in a group",
					"title": "Min entries to merge",
					"minimum": 0,
					"maximum": 100
				},
				"min_wait": {
					"$ref": "#/$defs/Int",
					"description": "Wait time for min group size after first PR is added",
					"title": "Min wait time (minutes)",
					"minimum": 0,
					"maximum": 360
				}
			},
			"additionalProperties": false,
			"description": "Merge queue configuration",
			"title": "Merge queue"
		},
		"CopilotReviewShorthand": {
			"type": "object",
			"properties": {
				"draft_prs": {
					"type": "boolean",
					"description": "Review draft PRs before they are marked ready",
					"title": "Review draft PRs"
				},
				"on_push": {
					"type": "boolean",
					"description": "Review each new push to the PR",
					"title": "Review on push"
				}
			},
			"additionalProperties": false,
			"description": "Copilot code review configuration",
			"title": "Copilot review"
		},
		"CodeScanningEntry": {
			"type": "object",
			"required": ["tool", "alerts", "security_alerts"],
			"properties": {
				"tool": {
					"type": "string",
					"description": "Name of the code scanning tool",
					"title": "Tool name"
				},
				"alerts": {
					"type": "string",
					"enum": ["none", "errors", "errors_and_warnings", "all"],
					"description": "Severity level at which alerts block updates",
					"title": "Alerts threshold"
				},
				"security_alerts": {
					"type": "string",
					"enum": ["none", "critical", "high_or_higher", "medium_or_higher", "all"],
					"description": "Severity level at which security alerts block updates",
					"title": "Security alerts threshold"
				}
			},
			"additionalProperties": false,
			"description": "A code scanning tool with alert thresholds",
			"title": "Code scanning tool"
		},
		"WorkflowsShorthand": {
			"type": "object",
			"required": ["required"],
			"properties": {
				"on_creation": {
					"type": "boolean",
					"description": "Enforce workflows when a branch is created (false = skip on creation)",
					"title": "Enforce on creation"
				},
				"required": {
					"type": "array",
					"items": {
						"type": "object",
						"required": ["path", "repository_id"],
						"properties": {
							"path": {
								"type": "string",
								"description": "Path to the workflow file",
								"title": "Workflow path"
							},
							"ref": {
								"type": "string",
								"description": "Branch or tag of the workflow file",
								"title": "Ref"
							},
							"repository_id": {
								"anyOf": [
									{
										"$ref": "#/$defs/Int"
									},
									{
										"$ref": "#/$defs/ResolvedRef"
									}
								],
								"description": "Repository ID, or a { resolved } reference to a credential label",
								"title": "Repository ID"
							},
							"sha": {
								"type": "string",
								"description": "Commit SHA of the workflow file",
								"title": "SHA"
							}
						},
						"additionalProperties": false
					},
					"description": "Workflows that must pass for this rule",
					"title": "Required workflows"
				}
			},
			"additionalProperties": false,
			"description": "Required workflow configuration",
			"title": "Workflows"
		},
		"TagRuleset": {
			"type": "object",
			"required": ["name", "enforcement", "type"],
			"properties": {
				"name": {
					"type": "string",
					"description": "The name of the ruleset (used for matching when creating or updating)",
					"title": "Ruleset name"
				},
				"enforcement": {
					"type": "string",
					"enum": ["disabled", "active", "evaluate"],
					"description": "disabled = off, active = enforced, evaluate = test mode (GitHub Enterprise only)",
					"title": "Enforcement level"
				},
				"conditions": {
					"$ref": "#/$defs/RulesetConditions"
				},
				"bypass_actors": {
					"type": "array",
					"items": {
						"$ref": "#/$defs/BypassActor"
					}
				},
				"creation": {
					"type": "boolean",
					"description": "When true, adds a creation rule",
					"title": "Restrict creation"
				},
				"update": {
					"type": "boolean",
					"description": "When true, adds an update rule with update_allows_fetch_and_merge: true",
					"title": "Restrict updates"
				},
				"deletion": {
					"type": "boolean",
					"description": "When true, adds a deletion rule",
					"title": "Restrict deletion"
				},
				"required_linear_history": {
					"type": "boolean",
					"description": "When true, adds a required_linear_history rule",
					"title": "Require linear history"
				},
				"required_signatures": {
					"type": "boolean",
					"description": "When true, adds a required_signatures rule",
					"title": "Require signatures"
				},
				"non_fast_forward": {
					"type": "boolean",
					"description": "When true, adds a non_fast_forward rule",
					"title": "Prevent non-fast-forward"
				},
				"deployments": {
					"type": "array",
					"items": {
						"type": "string"
					},
					"description": "Deployment environments that must succeed; converts to required_deployments rule",
					"title": "Required deployments"
				},
				"targets": {
					"$ref": "#/$defs/Targets"
				},
				"status_checks": {
					"$ref": "#/$defs/StatusChecksShorthand"
				},
				"commit_message": {
					"type": "array",
					"items": {
						"$ref": "#/$defs/PatternEntry"
					},
					"description": "Commit message pattern rules",
					"title": "Commit message patterns"
				},
				"commit_author_email": {
					"type": "array",
					"items": {
						"$ref": "#/$defs/PatternEntry"
					},
					"description": "Commit author email pattern rules",
					"title": "Commit author email patterns"
				},
				"committer_email": {
					"type": "array",
					"items": {
						"$ref": "#/$defs/PatternEntry"
					},
					"description": "Committer email pattern rules",
					"title": "Committer email patterns"
				},
				"type": {
					"type": "string",
					"enum": ["tag"],
					"description": "This ruleset applies to tags",
					"title": "Ruleset type"
				},
				"tag_name": {
					"type": "array",
					"items": {
						"$ref": "#/$defs/PatternEntry"
					},
					"description": "Tag name pattern rules",
					"title": "Tag name patterns"
				}
			},
			"additionalProperties": false,
			"description": "A ruleset that applies to tags",
			"title": "Tag ruleset",
			"x-tombi-table-keys-order": "schema",
			"x-taplo": {
				"links": {
					"key": "https://github.com/spencerbeggs/reposets/blob/main/docs/rulesets.md"
				},
				"initKeys": ["name", "type", "enforcement", "targets"]
			}
		},
		"Environment": {
			"type": "object",
			"properties": {
				"wait_timer": {
					"$ref": "#/$defs/Int",
					"description": "Number of minutes to wait before allowing deployments to proceed (0-43200)",
					"title": "Wait timer (minutes)",
					"minimum": 0,
					"maximum": 43200
				},
				"prevent_self_review": {
					"type": "boolean",
					"description": "Prevent the user who triggered the deployment from approving it",
					"title": "Prevent self-review"
				},
				"reviewers": {
					"type": "array",
					"items": {
						"$ref": "#/$defs/Reviewer"
					},
					"description": "Users or teams required to approve deployments to this environment",
					"title": "Required reviewers"
				},
				"deployment_branches": {
					"$ref": "#/$defs/DeploymentBranches"
				}
			},
			"additionalProperties": false,
			"description": "Configuration for a GitHub deployment environment",
			"title": "Deployment environment",
			"x-tombi-table-keys-order": "schema",
			"x-taplo": {
				"links": {
					"key": "https://github.com/spencerbeggs/reposets/blob/main/docs/environments.md"
				}
			}
		},
		"Reviewer": {
			"type": "object",
			"required": ["type", "id"],
			"properties": {
				"type": {
					"type": "string",
					"enum": ["User", "Team"],
					"description": "Whether the reviewer is an individual user or a team",
					"title": "Reviewer type"
				},
				"id": {
					"type": "integer",
					"description": "The numeric GitHub ID of the user or team",
					"title": "Reviewer ID"
				}
			},
			"additionalProperties": false,
			"description": "A user or team required to review deployments",
			"title": "Reviewer"
		},
		"DeploymentBranches": {
			"anyOf": [
				{
					"type": "string",
					"enum": ["all", "protected"],
					"description": "\"all\" allows any branch, \"protected\" allows only protected branches",
					"title": "Deployment branch preset"
				},
				{
					"type": "array",
					"items": {
						"$ref": "#/$defs/DeploymentBranchPolicy"
					},
					"description": "Array of branch or tag name patterns allowed to deploy to this environment",
					"title": "Custom deployment policies"
				}
			],
			"description": "Controls which branches can deploy. Use \"all\", \"protected\", or a list of custom policies.",
			"title": "Deployment branches"
		},
		"DeploymentBranchPolicy": {
			"type": "object",
			"required": ["name"],
			"properties": {
				"name": {
					"type": "string",
					"description": "The name pattern (branch name, tag name, or glob) to allow deployments from",
					"title": "Pattern"
				},
				"type": {
					"type": "string",
					"enum": ["branch", "tag"],
					"description": "Whether this policy matches branches or tags. Defaults to \"branch\".",
					"title": "Policy type"
				}
			},
			"additionalProperties": false,
			"description": "A custom branch or tag pattern that deployments are allowed from",
			"title": "Deployment branch policy"
		},
		"Group": {
			"type": "object",
			"required": ["repos"],
			"properties": {
				"owner": {
					"type": "string",
					"description": "GitHub user or organization that owns these repos. Overrides the top-level owner.",
					"title": "Owner override",
					"examples": ["savvy-web"]
				},
				"repos": {
					"type": "array",
					"items": {
						"type": "string"
					},
					"description": "List of repository names (without owner prefix) to sync in this group",
					"title": "Repository names",
					"examples": [["repo-one", "repo-two", "repo-three"]],
					"x-tombi-array-values-order": "ascending"
				},
				"credentials": {
					"type": "string",
					"description": "Name of the credential profile to use. If only one profile exists, it is used automatically.",
					"title": "Credential profile",
					"examples": ["personal", "work"]
				},
				"settings": {
					"type": "array",
					"items": {
						"type": "string"
					},
					"description": "Names of settings groups to apply to these repos",
					"title": "Settings groups",
					"examples": [["oss-defaults"]]
				},
				"environments": {
					"type": "array",
					"items": {
						"type": "string"
					},
					"description": "Names of environment definitions to create/update for these repos",
					"title": "Environments",
					"examples": [["staging", "production"]]
				},
				"secrets": {
					"$ref": "#/$defs/SecretScopes"
				},
				"variables": {
					"$ref": "#/$defs/VariableScopes"
				},
				"rulesets": {
					"type": "array",
					"items": {
						"type": "string"
					},
					"description": "Names of rulesets to apply to these repos",
					"title": "Rulesets",
					"examples": [["workflow", "release"]]
				},
				"cleanup": {
					"$ref": "#/$defs/Cleanup"
				}
			},
			"additionalProperties": false,
			"description": "A named group of repositories with their resource assignments",
			"title": "Repository group",
			"x-tombi-table-keys-order": "schema",
			"x-taplo": {
				"links": {
					"key": "https://github.com/spencerbeggs/reposets/blob/main/docs/configuration.md"
				},
				"initKeys": ["repos"]
			}
		},
		"SecretScopes": {
			"type": "object",
			"properties": {
				"actions": {
					"type": "array",
					"items": {
						"type": "string"
					},
					"description": "Secret groups to sync as GitHub Actions repository secrets",
					"title": "Action secret groups",
					"examples": [["deploy", "app"]]
				},
				"dependabot": {
					"type": "array",
					"items": {
						"type": "string"
					},
					"description": "Secret groups to sync as Dependabot secrets",
					"title": "Dependabot secret groups",
					"examples": [["deploy"]]
				},
				"codespaces": {
					"type": "array",
					"items": {
						"type": "string"
					},
					"description": "Secret groups to sync as Codespaces secrets",
					"title": "Codespaces secret groups",
					"examples": [["deploy"]]
				},
				"environments": {
					"type": "object",
					"additionalProperties": {
						"type": "array",
						"items": {
							"type": "string"
						},
						"description": "Secret groups to sync as environment secrets",
						"title": "Environment secret groups"
					},
					"description": "Map of environment names to secret group references",
					"title": "Environment secret scopes",
					"x-tombi-additional-key-label": "environment_name"
				}
			},
			"additionalProperties": false,
			"description": "Assign secret groups to GitHub secret scopes (actions, dependabot, codespaces, environments)",
			"title": "Secret scopes"
		},
		"VariableScopes": {
			"type": "object",
			"properties": {
				"actions": {
					"type": "array",
					"items": {
						"type": "string"
					},
					"description": "Variable groups to sync as GitHub Actions repository variables",
					"title": "Action variable groups",
					"examples": [["common"]]
				},
				"environments": {
					"type": "object",
					"additionalProperties": {
						"type": "array",
						"items": {
							"type": "string"
						},
						"description": "Variable groups to sync as environment variables",
						"title": "Environment variable groups"
					},
					"description": "Map of environment names to variable group references",
					"title": "Environment variable scopes",
					"x-tombi-additional-key-label": "environment_name"
				}
			},
			"additionalProperties": false,
			"description": "Assign variable groups to GitHub variable scopes (actions, environments)",
			"title": "Variable scopes"
		},
		"Cleanup": {
			"type": "object",
			"properties": {
				"secrets": {
					"allOf": [
						{
							"$ref": "#/$defs/CleanupSecrets"
						}
					],
					"title": "Secrets cleanup",
					"description": "Controls cleanup of secrets by scope"
				},
				"variables": {
					"allOf": [
						{
							"$ref": "#/$defs/CleanupVariables"
						}
					],
					"title": "Variables cleanup",
					"description": "Controls cleanup of variables by scope"
				},
				"rulesets": {
					"allOf": [
						{
							"$ref": "#/$defs/CleanupScope"
						}
					],
					"title": "Clean up rulesets",
					"description": "Delete repository rulesets not declared in any referenced ruleset group",
					"default": false
				},
				"environments": {
					"allOf": [
						{
							"$ref": "#/$defs/CleanupScope"
						}
					],
					"title": "Clean up environments",
					"description": "Delete repository environments not declared in config",
					"default": false
				}
			},
			"additionalProperties": false,
			"description": "Controls deletion of resources not declared in config. All disabled by default.",
			"title": "Cleanup configuration",
			"x-taplo": {
				"links": {
					"key": "https://github.com/spencerbeggs/reposets/blob/main/docs/cleanup.md"
				}
			}
		},
		"CleanupSecrets": {
			"type": "object",
			"properties": {
				"actions": {
					"allOf": [
						{
							"$ref": "#/$defs/CleanupScope"
						}
					],
					"title": "Clean up Actions secrets",
					"description": "Delete Actions secrets not declared in any referenced secret group",
					"default": false
				},
				"dependabot": {
					"allOf": [
						{
							"$ref": "#/$defs/CleanupScope"
						}
					],
					"title": "Clean up Dependabot secrets",
					"description": "Delete Dependabot secrets not declared in any referenced secret group",
					"default": false
				},
				"codespaces": {
					"allOf": [
						{
							"$ref": "#/$defs/CleanupScope"
						}
					],
					"title": "Clean up Codespaces secrets",
					"description": "Delete Codespaces secrets not declared in any referenced secret group",
					"default": false
				},
				"environments": {
					"allOf": [
						{
							"$ref": "#/$defs/CleanupScope"
						}
					],
					"title": "Clean up environment secrets",
					"description": "Delete environment secrets not declared in any referenced secret group",
					"default": false
				}
			},
			"additionalProperties": false,
			"description": "Controls deletion of secrets by scope (Actions, Dependabot, Codespaces, environments).",
			"title": "Secrets cleanup configuration"
		},
		"CleanupScope": {
			"anyOf": [
				{
					"type": "boolean"
				},
				{
					"type": "object",
					"required": ["preserve"],
					"properties": {
						"preserve": {
							"type": "array",
							"items": {
								"type": "string"
							},
							"description": "Resource names that should never be deleted during cleanup",
							"title": "Preserve list",
							"examples": [["LEGACY_TOKEN", "DEPLOY_KEY"]]
						}
					},
					"additionalProperties": false
				}
			],
			"description": "Controls cleanup for a single resource scope. false disables cleanup, true enables full cleanup, or specify names to preserve.",
			"title": "Cleanup scope"
		},
		"CleanupVariables": {
			"type": "object",
			"properties": {
				"actions": {
					"allOf": [
						{
							"$ref": "#/$defs/CleanupScope"
						}
					],
					"title": "Clean up Actions variables",
					"description": "Delete Actions variables not declared in any referenced variable group",
					"default": false
				},
				"environments": {
					"allOf": [
						{
							"$ref": "#/$defs/CleanupScope"
						}
					],
					"title": "Clean up environment variables",
					"description": "Delete environment variables not declared in any referenced variable group",
					"default": false
				}
			},
			"additionalProperties": false,
			"description": "Controls deletion of variables by scope (Actions, environments).",
			"title": "Variables cleanup configuration"
		}
	},
	"x-tombi-toml-version": "v1.1.0"
}