Comprehensive branch protection configuration patterns with enforcement automation. Security tiers, IaC at scale, GitHub App enforcement, audit reporting, and bypass controls.
Automates GitHub branch protection enforcement using Terraform modules and a monitoring GitHub App. Triggers on configuration drift detection to automatically restore security policies and generate audit evidence for compliance.
/plugin marketplace add adaptive-enforcement-lab/claude-skills/plugin install enforce@ael-skillsThis skill inherits all available tools. When active, it can use any tool Claude has access to.
examples.mdreference.mdscripts/example-1.mermaidscripts/example-2.shgraph TD
T[Terraform Module] -->|Applies| BP[Branch Protection Rules]
GA[GitHub App] -->|Monitors| BP
GA -->|Detects| DRIFT[Configuration Drift]
DRIFT -->|Triggers| REM[Automated Remediation]
REM -->|Restores| BP
BP -->|Enforces| PR[Pull Requests]
PR -->|Generates| AUDIT[Audit Evidence]
%% Ghostty Hardcore Theme
style T fill:#a7e22e,color:#1b1d1e
style GA fill:#65d9ef,color:#1b1d1e
style DRIFT fill:#f92572,color:#1b1d1e
style BP fill:#fd971e,color:#1b1d1e
Key Components:
Start with Security Tiers to select the appropriate protection level for your repositories.
Manual (single repository):
gh api --method PUT \
repos/org/repo/branches/main/protection \
--input protection-config.json
Automated (organization-wide):
Deploy GitHub App Enforcement to detect drift and maintain compliance.
Implement Audit Evidence patterns for compliance reporting.
Multiple enforcement layers: local configuration, drift detection, audit verification.
Don't document the policy. Enforce it automatically.
Standard, Enhanced, Maximum tiers prevent both under-protection and over-restriction.
GitHub API provides tamper-proof evidence of all enforcement actions.
Bypass controls with approval workflows, time-boxing, and automatic re-enablement.
Most organizations have branch protection policies. Few enforce them consistently.
The Problem:
The Solution:
Automated enforcement with multiple defense layers:
Different repositories require different protection levels.
| Tier | Use Case | Enforcement Level |
|---|---|---|
| Standard | Internal tools, documentation | Required reviews, basic status checks |
| Enhanced | Production services, customer-facing apps | Multi-reviewer, comprehensive checks, code owners |
| Maximum | Security-critical, compliance-regulated | Full enforcement, no admin bypass, mandatory signing |
Right-Sized Security
Not all repositories need maximum protection. Documentation repos can use Standard tier. Production infrastructure requires Maximum tier. Choose based on blast radius.
See Security Tiers for detailed configuration templates.
graph TD
T[Terraform Module] -->|Applies| BP[Branch Protection Rules]
GA[GitHub App] -->|Monitors| BP
GA -->|Detects| DRIFT[Configuration Drift]
DRIFT -->|Triggers| REM[Automated Remediation]
REM -->|Restores| BP
BP -->|Enforces| PR[Pull Requests]
PR -->|Generates| AUDIT[Audit Evidence]
%% Ghostty Hardcore Theme
style T fill:#a7e22e,color:#1b1d1e
style GA fill:#65d9ef,color:#1b1d1e
style DRIFT fill:#f92572,color:#1b1d1e
style BP fill:#fd971e,color:#1b1d1e
Key Components:
This section covers comprehensive branch protection enforcement:
Start with Security Tiers to select the appropriate protection level for your repositories.
Manual (single repository):
gh api --method PUT \
repos/org/repo/branches/main/protection \
--input protection-config.json
Automated (organization-wide):
Deploy GitHub App Enforcement to detect drift and maintain compliance.
Implement Audit Evidence patterns for compliance reporting.
See reference.md for additional techniques and detailed examples.
See examples.md for code examples.
See reference.md for complete documentation.
Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems. Create original algorithmic art rather than copying existing artists' work to avoid copyright violations.
Applies Anthropic's official brand colors and typography to any sort of artifact that may benefit from having Anthropic's look-and-feel. Use it when brand colors or style guidelines, visual formatting, or company design standards apply.
Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations.