<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Implementing Repository Security Controls — API Reference

## GitHub Branch Protection API

```bash
# Get branch protection
gh api repos/{owner}/{repo}/branches/main/protection

# Set branch protection
gh api repos/{owner}/{repo}/branches/main/protection -X PUT \
  --input protection.json

# Require signed commits
gh api repos/{owner}/{repo}/branches/main/protection/required_signatures -X POST

# Enable status checks
gh api repos/{owner}/{repo}/branches/main/protection/required_status_checks -X PATCH \
  -f strict=true \
  -f contexts='["ci/build","ci/test"]'
```

## GitHub Security Features API

```bash
# Enable secret scanning
gh api repos/{owner}/{repo} -X PATCH \
  -f security_and_analysis='{"secret_scanning":{"status":"enabled"}}'

# Enable push protection
gh api repos/{owner}/{repo} -X PATCH \
  -f security_and_analysis='{"secret_scanning_push_protection":{"status":"enabled"}}'

# Enable Dependabot
gh api repos/{owner}/{repo}/vulnerability-alerts -X PUT

# Enable dependency graph
gh api repos/{owner}/{repo} -X PATCH \
  -f security_and_analysis='{"dependency_graph":{"status":"enabled"}}'
```

## Secret Scanning Tools

```bash
# GitLeaks — scan repository
gitleaks detect --source . --verbose --report-path gitleaks-report.json

# GitLeaks — pre-commit hook
gitleaks protect --staged

# TruffleHog
trufflehog git file://. --only-verified --json

# GitHub secret scanning alerts
gh api repos/{owner}/{repo}/secret-scanning/alerts --jq '.[].secret_type'
```

## Commit Signing

```bash
# GPG setup
gpg --full-generate-key
git config --global user.signingkey <KEY_ID>
git config --global commit.gpgsign true

# SSH signing
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub

# Verify commits
git log --show-signature
git verify-commit HEAD
```

## Repository Security Checklist

| Control | GitHub Setting | Severity |
|---------|--------------|----------|
| Branch protection | Settings → Branches | Critical |
| Required reviews (≥2) | Branch protection rules | High |
| Dismiss stale reviews | Branch protection rules | Medium |
| Require CODEOWNERS | Branch protection rules | High |
| Signed commits | Branch protection rules | Medium |
| Secret scanning | Settings → Security | High |
| Push protection | Settings → Security | High |
| Dependabot alerts | Settings → Security | Medium |
| Force push disabled | Branch protection rules | High |
| Delete branch disabled | Branch protection rules | Low |
