Enforce repository policies across forge providers (GitHub, etc.). Runs on a schedule, discovers repositories matching allow/deny filters, and applies configured policies.

Usage

forge-enforce serve --host 127.0.0.1:3000

Requires FE_CONFIG_DIR (or --config-dir) pointing to a directory of TOML config files, one per forge.

Configuration

Each file in the config directory defines a forge connection. Example (github.com.toml):

# Schedule: pick one
# schedule.cron = "0 * * * * *"
# schedule.interval = "60"        # minutes (default)
schedule.once = true

# Repository filters (regex patterns)
allow = ["^canopy-.*$"]
deny  = ["^infrastructure-.*$", "^canopy-data-gateway$"]

# Forge connection
[github]
credentials.token_env = "GITHUB_ACCESS_TOKEN"
organisation = "understory-io"

# Policies to enforce
[policies]
squash_merge_only.enabled = true

Fields

Field	Description
`schedule`	`cron`, `interval` (minutes), or `once`
`allow`	Regex list of repository names to include (default: `.*`)
`deny`	Regex list of repository names to exclude (default: none)
`[github]`	GitHub forge config: `credentials` and `organisation`
`credentials`	`token = "..."` or `token_env = "ENV_VAR"`
`[policies]`	Policy rules to enforce on matched repositories
`squash_merge_only.enabled`	Require squash merges only