Shared presets¶

These four files separate account identity from reusable policy. Both root configurations import the same project-type and security presets.

Organization root¶

org.octoform.yml

# One of two owners sharing the same presets — this one is an organisation.
# Compare with personal.octoform.yml: both import the exact same two files,
# and neither preset had to be written with either owner in mind.
#
# `org-name` is a placeholder — try it against your own organisation:
#   export GITHUB_TOKEN=...
#   octoform plan --config org.octoform.yml --type npm-package

owner: org-name

classify:
  rules:
    - when: { file_exists: package.json }
      type: npm-package

imports:
  - presets/npm-library.yml
  - presets/security-baseline.yml

Download YAML

Personal-account root¶

personal.octoform.yml

# The other of the two owners — a personal account this time. Same presets,
# same result: the presets know about project types and security settings,
# never about who owns the repositories.
#
# `your-username` is a placeholder — try it against your own account:
#   export GITHUB_TOKEN=...
#   octoform plan --config personal.octoform.yml --type npm-package

owner: your-username

classify:
  rules:
    - when: { file_exists: package.json }
      type: npm-package

imports:
  - presets/npm-library.yml
  - presets/security-baseline.yml

Download YAML

Project-type preset¶

presets/npm-library.yml

# A preset: policy for one project type, with no owner of its own. Not runnable
# by itself — `octoform` requires an owner somewhere in the chain, and this
# file deliberately has none, so that importing it into the wrong account is
# impossible by construction rather than by remembering not to.
types:
  npm-package:
    environments:
      - name: npm
    rulesets:
      - name: version-branches
        target_branches: ['v*.x']
        required_approvals: 1
        required_checks: [verify]
        block_force_push: true
        block_deletion: true

Download YAML

Security preset¶

presets/security-baseline.yml

# A second preset, orthogonal to the first: settings that apply regardless of
# project type. Imported alongside npm-library.yml to show that presets
# compose — each contributes what it knows about, and neither needs to know
# the other exists.
defaults:
  security:
    vulnerability_alerts: true
    automated_security_fixes: true
    private_vulnerability_reporting: true
  merge:
    delete_branch_on_merge: true

Download YAML

Composition rules¶

Imports resolve relative to the file that declares them. A reusable preset can omit owner, while the resolved root configuration must supply one. Policies merge by documented precedence; omission remains unmanaged and does not erase an unrelated value contributed by another preset.

Keep imported files in the same reviewed change as their roots. A plan should be regenerated whenever a preset changes because every importing owner can receive a different effective policy.