fix: apply org-level settings before loading repository configurations

Author: madkoo

lib/plugins/branches.js

@@ -5,10 +5,18 @@ const Overrides = require('./overrides')
 const ignorableFields = []
 const previewHeaders = { accept: 'application/vnd.github.hellcat-preview+json,application/vnd.github.luke-cage-preview+json,application/vnd.github.zzzax-preview+json' }
 const overrides = {
-  'contexts': {
-    'action': 'reset',
-    'type': 'array'
-  },
+  contexts: {
+    action: 'reset',
+    type: 'array'
+  }
+}
+
+// GitHub API requires these fields to be present in updateBranchProtection calls
+// See: https://docs.github.com/rest/branches/branch-protection#update-branch-protection
+const requiredBranchProtectionDefaults = {
+  required_status_checks: null,
+  enforce_admins: null,
+  restrictions: null
 }
 
 module.exports = class Branches extends ErrorStash {
@@ -73,7 +81,7 @@ module.exports = class Branches extends ErrorStash {
                   resArray.push(new NopCommand(this.constructor.name, this.repo, null, results))
                 }
 
-                Object.assign(params, branch.protection, { headers: previewHeaders })
+                Object.assign(params, requiredBranchProtectionDefaults, branch.protection, { headers: previewHeaders })
 
                 if (this.nop) {
                   resArray.push(new NopCommand(this.constructor.name, this.repo, this.github.repos.updateBranchProtection.endpoint(params), 'Add Branch Protection'))
@@ -83,7 +91,7 @@ module.exports = class Branches extends ErrorStash {
                 return this.github.repos.updateBranchProtection(params).then(res => this.log.debug(`Branch protection applied successfully ${JSON.stringify(res.url)}`)).catch(e => { this.logError(`Error applying branch protection ${JSON.stringify(e)}`); return [] })
               }).catch((e) => {
                 if (e.status === 404) {
-                  Object.assign(params, Overrides.removeOverrides(overrides, branch.protection, {}), { headers: previewHeaders })
+                  Object.assign(params, requiredBranchProtectionDefaults, Overrides.removeOverrides(overrides, branch.protection, {}), { headers: previewHeaders })
                   if (this.nop) {
                     resArray.push(new NopCommand(this.constructor.name, this.repo, this.github.repos.updateBranchProtection.endpoint(params), 'Add Branch Protection'))
                     return Promise.resolve(resArray)

lib/settings.js

@@ -46,6 +46,9 @@ class Settings {
     const settings = new Settings(nop, context, context.repo(), config, ref)
 
     try {
+      // Apply org-level settings (e.g., rulesets) first, matching syncAll behavior
+      await settings.updateOrg()
+
       for (const repo of repos) {
         settings.repo = repo
         await settings.loadConfigs(repo)