feat: add GitHub sane defaults CLI

.github/workflows/ci.yml

@@ -0,0 +1,23 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run check
+      - run: npm run dry
+      - run: npm run mutate
+      - run: npx -y @simpledoc/simpledoc check
+      - run: git diff --check

.gitignore

@@ -0,0 +1,4 @@
+node_modules/
+dist/
+coverage/
+.DS_Store

.prettierrc.json

@@ -0,0 +1,6 @@
+{
+  "printWidth": 100,
+  "semi": true,
+  "singleQuote": false,
+  "trailingComma": "none"
+}

AGENTS.md

@@ -0,0 +1,39 @@
+# AGENTS.md
+
+These instructions apply to this repository.
+
+## Slophammer Standards
+
+This repository follows the TypeScript guidance from
+`dutifuldev/slophammer/docs/AGENT_ENTRYPOINT.md`.
+
+## Local Checks
+
+Before finishing a change, run:
+
+```sh
+npm run format
+npm run lint
+npm run typecheck
+npm test
+npm run coverage
+npm run build
+npx -y @simpledoc/simpledoc check
+git diff --check
+```
+
+`npm run check` runs the formatter, linter, type checker, tests, coverage, and
+build.
+
+## TypeScript Rules
+
+- Keep `strict: true` and related strict compiler options enabled.
+- Do not use explicit `any`.
+- Validate unknown GitHub API responses at the boundary before using them.
+- Keep planning logic independent from network IO.
+- Add or update focused tests for every behavior change.
+
+## Dependencies
+
+Avoid runtime dependencies unless they remove meaningful complexity. Prefer the
+Node.js standard library and GitHub REST APIs for this CLI.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Dutiful Development
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,76 @@
+# github-sane-defaults
+
+Apply repeatable GitHub repository defaults and branch rulesets.
+
+## Install
+
+```sh
+npm install -g @dutifuldev/github-sane-defaults
+```
+
+Or run without installing:
+
+```sh
+npx @dutifuldev/github-sane-defaults plan --org dutifuldev --repo scratch
+```
+
+## Authentication
+
+The CLI reads tokens in this order:
+
+1. `--token`
+2. `GITHUB_TOKEN`
+3. `GH_TOKEN`
+4. `gh auth token`
+
+The token must have repository administration access for the target
+repositories.
+
+## Usage
+
+Preview changes for one repository:
+
+```sh
+github-sane-defaults plan --org dutifuldev --repo scratch
+```
+
+Apply changes to one repository:
+
+```sh
+github-sane-defaults apply --org dutifuldev --repo scratch
+```
+
+Apply changes to every non-archived repository in an organization:
+
+```sh
+github-sane-defaults apply --org dutifuldev --all
+```
+
+## Defaults
+
+Repository settings:
+
+- merge commits disabled
+- squash merge enabled
+- rebase merge enabled
+- auto-merge enabled
+- update branch button enabled
+- delete branch on merge enabled
+- squash commit title set to the pull request title
+- squash commit message set to the pull request body
+
+Default branch ruleset:
+
+- block branch deletion
+- block force pushes
+- require linear history
+
+The ruleset is named `github-sane-defaults: default branch` and targets the
+repository default branch.
+
+## Development
+
+```sh
+npm install
+npm run check
+```

eslint.config.mjs

@@ -0,0 +1,39 @@
+import js from "@eslint/js";
+import tseslint from "typescript-eslint";
+
+export default tseslint.config(
+  {
+    ignores: ["dist/**", "coverage/**", "eslint.config.mjs"]
+  },
+  js.configs.recommended,
+  ...tseslint.configs.strictTypeChecked,
+  ...tseslint.configs.stylisticTypeChecked,
+  {
+    languageOptions: {
+      parserOptions: {
+        projectService: true,
+        tsconfigRootDir: import.meta.dirname
+      }
+    },
+    rules: {
+      "@typescript-eslint/consistent-type-definitions": ["error", "type"],
+      "@typescript-eslint/no-explicit-any": "error",
+      "@typescript-eslint/no-floating-promises": "error",
+      "@typescript-eslint/no-misused-promises": "error",
+      "@typescript-eslint/no-unsafe-assignment": "error",
+      "@typescript-eslint/no-unsafe-call": "error",
+      "@typescript-eslint/no-unsafe-member-access": "error",
+      "@typescript-eslint/no-unsafe-return": "error",
+      "@typescript-eslint/switch-exhaustiveness-check": "error",
+      complexity: ["error", 8],
+      "max-lines": ["error", { max: 800, skipBlankLines: true, skipComments: true }],
+      "max-lines-per-function": ["error", { max: 80, skipBlankLines: true, skipComments: true }]
+    }
+  },
+  {
+    files: ["tests/**/*.ts"],
+    rules: {
+      "max-lines-per-function": ["error", { max: 120, skipBlankLines: true, skipComments: true }]
+    }
+  }
+);