chore: sync upstream, configure hacktron, and automate deployment

.github/repos/hacktron.yml

@@ -0,0 +1,44 @@
+repository:
+  name: hacktron
+  private: true
+  allow_squash_merge: true
+  allow_merge_commit: true
+  allow_rebase_merge: true
+
+branches:
+  - name: main
+    protection:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+        dismiss_stale_reviews: true
+        require_code_owner_reviews: true
+        require_last_push_approval: true
+        bypass_pull_request_allowances:
+          users: []
+          teams:
+            - core
+          apps: []
+      required_status_checks: null
+      enforce_admins: true
+      restrictions:
+        users: []
+        teams:
+          - core
+        apps: []
+      required_linear_history: false
+      allow_force_pushes: true
+      allow_deletions: false
+
+  - name: staging
+    protection:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+        dismiss_stale_reviews: false
+        require_code_owner_reviews: false
+        require_last_push_approval: false
+      required_status_checks: null
+      enforce_admins: false
+      restrictions: null
+      required_linear_history: false
+      allow_force_pushes: false
+      allow_deletions: false

docs/github-settings/4. teams.md

@@ -48,5 +48,33 @@ teams:
     permission: maintain
 ```
 
+</td></tr>
+<tr><td>
+<p>&emsp;<code>exclude</code><span style="color:gray;">&emsp;<i>array</i>&emsp;</span></p>
+<p>Exclude a list of repos for this team. The team is applied to every repo in scope except those whose names match one of these glob patterns.</p>
+</td><td style="vertical-align:top">
+
+```yaml
+teams:
+  - name: SuperFriends
+    permission: maintain
+    exclude:
+      - secret-repo
+```
+
+</td></tr>
+<tr><td>
+<p>&emsp;<code>include</code><span style="color:gray;">&emsp;<i>array</i>&emsp;</span></p>
+<p>Include a list of repos for this team. The team is applied only to repos whose names match one of these glob patterns.</p>
+</td><td style="vertical-align:top">
+
+```yaml
+teams:
+  - name: SuperFriends
+    permission: maintain
+    include:
+      - public-*
+```
+
 </td></tr>
 </table>

docs/sample-settings/settings.yml

@@ -161,6 +161,16 @@ teams:
   - name: globalteam
     permission: push
     visibility: closed
+  - name: docs-team
+    permission: pull
+    # You can include a list of repos for this team and only those repos would have this team
+    include:
+      - actions-demo
+  - name: ops-team
+    permission: push
+    # You can exclude a list of repos for this team and all repos except these repos would have this team
+    exclude:
+      - actions-demo
 
 # Branch protection rules
 # See https://docs.github.com/en/rest/branches/branch-protection?apiVersion=2026-03-10#update-branch-protection for available options

helm/safe-settings/README.md

@@ -37,6 +37,7 @@ A Helm chart for Kubernetes
 | nodeSelector | object | `{}` |  |
 | podAnnotations | object | `{}` |  |
 | podSecurityContext | object | `{}` |  |
+| priorityClassName | string | `""` | Priority class name for the pod. |
 | replicaCount | int | `1` |  |
 | resources | object | `{}` |  |
 | securityContext.allowPrivilegeEscalation | bool | `false` |  |

helm/safe-settings/templates/deployment.yaml

@@ -78,3 +78,6 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if .Values.priorityClassName }}
+      priorityClassName: {{ .Values.priorityClassName }}
+      {{- end }}

helm/safe-settings/values.yaml

@@ -98,6 +98,8 @@ tolerations: []
 
 affinity: {}
 
+priorityClassName: ""
+
 deploymentConfig:
   restrictedRepos:
     exclude:

lib/settings.js

@@ -370,14 +370,19 @@ ${this.results.reduce((x, y) => {
         const RepoPlugin = Settings.PLUGINS.repository
 
         const archivePlugin = new Archive(this.nop, this.github, repo, repoConfig, this.log)
-        const { shouldArchive, shouldUnarchive } = await archivePlugin.getState()
+        const { isArchived, shouldArchive, shouldUnarchive } = await archivePlugin.getState()
 
         if (shouldUnarchive) {
           this.log.debug(`Unarchiving repo ${repo.repo}`)
           const unArchiveResults = await archivePlugin.sync()
           this.appendToResults(unArchiveResults)
         }
 
+        if (isArchived && !shouldUnarchive) {
+          this.log.debug(`Skipping repo/child plugin updates for archived repo ${repo.repo}`)
+          return
+        }
+
         const repoResults = await new RepoPlugin(this.nop, this.github, repo, repoConfig, this.installation_id, this.log, this.errors).sync()
         this.appendToResults(repoResults)
 

package.json

@@ -49,7 +49,7 @@
     "eslint-plugin-promise": "^6.6.0",
     "http-status-codes": "^2.2.0",
     "jest": "^29.5.0",
-    "jest-junit": "^16.0.0",
+    "jest-junit": "^17.0.0",
     "jest-when": "^3.5.2",
     "lockfile-lint": "^4.14.0",
     "nock": "^14.0.1",