From fb88e3a7baa7b75570faddaf4a7e75e24da0a2f7 Mon Sep 17 00:00:00 2001 From: UnstoppableMango Date: Sun, 4 Oct 2026 20:22:54 -0500 Subject: [PATCH 1/3] feat(github): rename unmango/github to unmango/scm Drop the import options and repoName from the scm repository. The repo takes its resource name, and its description, topics, squash title, and main ruleset converge to the PublicRepo defaults. Before merging, the Pulumi Cloud OIDC issuer policy must accept the repository claim unmango/scm as well as unmango/github. Co-Authored-By: Claude Opus 5.5 (1M context) --- github/repos.ts | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/github/repos.ts b/github/repos.ts index cad5b2c..5020c00 100644 --- a/github/repos.ts +++ b/github/repos.ts @@ -158,22 +158,10 @@ export const pkgs = new PublicRepo('pkgs', { vulnerabilityAlerts: false, }); -// Keep the Pulumi resource name as "scm"; repoName holds the current GitHub name until the rename lands. export const scm = new PublicRepo('scm', { - repoName: 'github', description: 'unmango source control infrastructure', topics: ['pulumi', 'iac', 'github'], githubChecks: ['pulumi'], - // This repository already exists. ignoreChanges keeps the import from failing - // on settings that differ from the PublicRepo defaults. - repoOptions: { - import: 'github', - ignoreChanges: ['description', 'topics', 'squashMergeCommitTitle'], - }, - rulesetOptions: { - import: 'github:1269371', - ignoreChanges: ['rules'], - }, }); export const slip = new PublicRepo('slip', { From 474100f36bafb349d15e67de084d049954bcf9f9 Mon Sep 17 00:00:00 2001 From: UnstoppableMango Date: Sun, 4 Oct 2026 22:16:53 -0500 Subject: [PATCH 2/3] docs: point the Hercules CI badge at unmango/scm Co-Authored-By: Claude Opus 5.5 (1M context) --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index edc173a..95dbd2c 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # unmango/scm -[![Hercules CI](https://hercules-ci.com/api/v1/site/github/account/unmango/project/github/badge)](https://hercules-ci.com/github/unmango/github) +[![Hercules CI](https://hercules-ci.com/api/v1/site/github/account/unmango/project/scm/badge)](https://hercules-ci.com/github/unmango/scm) Source control infrastructure for unmango as code. Repositories, branch protection, and settings managed via [Pulumi](https://www.pulumi.com/). From 440b19039d50f84761bec65d20a3cd2790c4c307 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 15 Oct 2026 02:36:47 +0000 Subject: [PATCH 3/3] fix(github): delete vulnerability alerts before replacing them Renaming a repository replaces its RepositoryVulnerabilityAlerts, since repository is ForceNew. Pulumi creates the replacement first, and the old resource's delete then calls DisableVulnerabilityAlerts on the old name, which GitHub redirects to the renamed repository, leaving alerts off. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01Gu1fsgPoSjzivKdmyAosTc --- github/components/repo.ts | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/github/components/repo.ts b/github/components/repo.ts index 2d64cf2..e3abfb8 100644 --- a/github/components/repo.ts +++ b/github/components/repo.ts @@ -41,7 +41,12 @@ export abstract class Repo extends ComponentResource { const vulnerabilityAlerts = new gh.RepositoryVulnerabilityAlerts(name, { repository: repo.name, enabled: args.vulnerabilityAlerts, - }, { parent: this }); + }, { + parent: this, + // Renaming the repository replaces this resource. Created first, the old + // one's delete would disable alerts again through GitHub's rename redirect. + deleteBeforeReplace: true, + }); this.repo = repo; this.vulnerabilityAlerts = vulnerabilityAlerts;