From d5d348ec62963e04989edab0e7777d6f332cdc47 Mon Sep 17 00:00:00 2001
From: "Marcus R. Brown" <contact@marcusrbrown.com>
Date: Mon, 18 Mar 2024 00:39:26 -0700
Subject: [PATCH] ci(workflows): simplify CI and add Update Repo Settings

---
 .github/settings.yml                        | 18 ++++++++++++++++++
 .github/workflows/ci.yaml                   |  2 +-
 .github/workflows/renovate.yaml             |  6 +++++-
 .github/workflows/update-repo-settings.yaml | 16 ++++++++++++++++
 4 files changed, 40 insertions(+), 2 deletions(-)
 create mode 100644 .github/settings.yml
 create mode 100644 .github/workflows/update-repo-settings.yaml

diff --git a/.github/settings.yml b/.github/settings.yml
new file mode 100644
index 0000000..bd0fe23
--- /dev/null
+++ b/.github/settings.yml
@@ -0,0 +1,18 @@
+---
+_extends: .github:common-settings.yaml
+
+repository:
+  name: works
+  description: '@bfra-me tools and components'
+  topics: works, bfra-me, tools, components, tsconfig, semantic-release
+
+branches:
+  - name: main
+    protection:
+      required_status_checks:
+        strict: true
+        contexts: ['Test', 'Renovate / Renovate']
+      enforce_admins: true
+      required_pull_request_reviews: null
+      restrictions: null
+      required_linear_history: true
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 08df328..49501d5 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -5,7 +5,6 @@ name: CI
 'on':
   merge_group:
   push:
-    branches: [main, 'renovate/**']
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
   workflow_dispatch:
@@ -64,6 +63,7 @@ jobs:
           application_id: ${{ secrets.APPLICATION_ID }}
           application_private_key: ${{ secrets.APPLICATION_PRIVATE_KEY }}
           permissions: 'contents:write, issues:write, pull_requests:write'
+          revoke_token: true
       - name: Setup Git user
         run: |
           git config --global user.email '118100583+bfra-me[bot]@users.noreply.github.com'
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
index 33d499d..c735173 100644
--- a/.github/workflows/renovate.yaml
+++ b/.github/workflows/renovate.yaml
@@ -16,11 +16,15 @@ name: Renovate
         required: false
         type: boolean
         default: false
+  workflow_run:
+    workflows: ['CI']
+    branches: ['renovate/**']
+    types: [completed]
 
 jobs:
   renovate:
     name: Renovate
     secrets: inherit
-    uses: bfra-me/.github/.github/workflows/renovate.yaml@v1.8.2
+    uses: bfra-me/.github/.github/workflows/renovate.yaml@v1
     with:
       print_config: ${{ inputs.print_config || false }}
diff --git a/.github/workflows/update-repo-settings.yaml b/.github/workflows/update-repo-settings.yaml
new file mode 100644
index 0000000..1da7a40
--- /dev/null
+++ b/.github/workflows/update-repo-settings.yaml
@@ -0,0 +1,16 @@
+# Update repository settings to match the definitions in .github/settings.yml.
+---
+name: Update Repo Settings
+
+'on':
+  push:
+    branches: [main]
+  schedule:
+    - cron: '02 18 * * *' # 18:02 UTC = 11:02 AM PST
+  workflow_dispatch:
+
+jobs:
+  update-repo-settings:
+    name: Update Repo Settings
+    secrets: inherit
+    uses: bfra-me/.github/.github/workflows/update-repo-settings.yaml@v1