chore: add monorepo desired-repo-settings and audit script

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: agjs

.github/desired-repo-settings.json

@@ -0,0 +1,33 @@
+{
+  "description": "Desired GitHub settings for boringstack-xyz/boringstack (monorepo). Applied via scripts/audit-repo-settings.sh — operator runs the printed commands.",
+  "security_and_analysis": {
+    "secret_scanning": "enabled",
+    "secret_scanning_push_protection": "enabled",
+    "dependabot_security_updates": "enabled"
+  },
+  "merge": {
+    "delete_branch_on_merge": true,
+    "allow_squash_merge": true,
+    "allow_merge_commit": false,
+    "allow_rebase_merge": false
+  },
+  "branch_protection_main": {
+    "required_status_check_contexts": [
+      "dep vuln scan (osv + audit)",
+      "docker compose config (all overlay combinations)",
+      "gitleaks secret scan",
+      "semgrep SAST",
+      "shellcheck (scripts/)",
+      "tofu fmt + validate",
+      "typecheck + lint + test",
+      "validate",
+      "yamllint (compose + workflows)"
+    ],
+    "required_approving_review_count": 0,
+    "dismiss_stale_reviews": true,
+    "required_linear_history": true,
+    "required_signatures": true,
+    "allow_force_pushes": false,
+    "allow_deletions": false
+  }
+}

AGENTS.md

@@ -8,6 +8,7 @@ Single repository: `apps/api`, `apps/ui`, `apps/docs`, `infra/compose`, `infra/b
 bun run regen   # cross-app generators (ACL, OpenAPI, lint-meta, docs JSON)
 bun run check   # drift checks before push
 ./setup.sh --up # boot local dev stack
+./scripts/audit-repo-settings.sh # diff GitHub repo settings vs .github/desired-repo-settings.json
 ```
 
 ## Layout

apps/api/.github/desired-repo-settings.json

@@ -1,4 +1,5 @@
 {
+  "_deprecated": "Use monorepo canonical file: /.github/desired-repo-settings.json and scripts/audit-repo-settings.sh",
   "description": "Desired GitHub settings for this repo. Applied via scripts/ci/audit-repo-settings.sh — operator runs the printed commands.",
   "security_and_analysis": {
     "secret_scanning": "enabled",

apps/api/scripts/ci/audit-repo-settings.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 #
+# DEPRECATED: use monorepo canonical script at scripts/audit-repo-settings.sh
+#
 # Diff this repo's GitHub settings against the desired-state file. Prints
 # fully copy-pasteable `gh api ...` commands for every drift. No auto-apply
 # — the operator runs the printed commands. Exit 0 if clean, 1 if any drift.

apps/docs/.github/desired-repo-settings.json

@@ -1,4 +1,5 @@
 {
+  "_deprecated": "Use monorepo canonical file: /.github/desired-repo-settings.json and scripts/audit-repo-settings.sh",
   "description": "Desired GitHub settings for this repo (the boringstack-xyz org's .github docs repo). Applied via scripts/audit-repo-settings.sh; operator runs the printed commands.",
   "security_and_analysis": {
     "secret_scanning": "enabled",

apps/docs/scripts/audit-repo-settings.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 #
+# DEPRECATED: use monorepo canonical script at scripts/audit-repo-settings.sh
+#
 # Diff this repo's GitHub settings against the desired-state file. Prints
 # fully copy-pasteable `gh api ...` commands for every drift. No auto-apply
 # the operator runs the printed commands. Exit 0 if clean, 1 if any drift.

apps/ui/.github/desired-repo-settings.json

@@ -1,4 +1,5 @@
 {
+  "_deprecated": "Use monorepo canonical file: /.github/desired-repo-settings.json and scripts/audit-repo-settings.sh",
   "description": "Desired GitHub settings for this repo. Applied via scripts/ci/audit-repo-settings.sh — operator runs the printed commands.",
   "security_and_analysis": {
     "secret_scanning": "enabled",

apps/ui/scripts/ci/audit-repo-settings.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 #
+# DEPRECATED: use monorepo canonical script at scripts/audit-repo-settings.sh
+#
 # Diff this repo's GitHub settings against the desired-state file. Prints
 # fully copy-pasteable `gh api ...` commands for every drift. No auto-apply
 # — the operator runs the printed commands. Exit 0 if clean, 1 if any drift.

infra/bootstrap/.github/desired-repo-settings.json

@@ -1,4 +1,5 @@
 {
+  "_deprecated": "Use monorepo canonical file: /.github/desired-repo-settings.json and scripts/audit-repo-settings.sh",
   "description": "Desired GitHub settings for this repo. Applied via scripts/audit-repo-settings.sh — operator runs the printed commands.",
   "security_and_analysis": {
     "secret_scanning": "enabled",

infra/bootstrap/scripts/audit-repo-settings.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 #
+# DEPRECATED: use monorepo canonical script at scripts/audit-repo-settings.sh
+#
 # Diff this repo's GitHub settings against the desired-state file. Prints
 # fully copy-pasteable `gh api ...` commands for every drift. No auto-apply
 # — the operator runs the printed commands. Exit 0 if clean, 1 if any drift.