/gh-protect

GitHub repo name. Auto-resolved from `git remote get-url origin` when omitted.

Boost this command

thettwe@thettwe

GitHub

From plugin

nyann

641 skills41 commands3 hooks

Install

> /plugin marketplace add thettwe/nyann
> /plugin install nyann@nyann-plugins

How it fires

How this command gets triggered: by you, by Claude, or both.

Fires itselfClaude auto-loads it when your prompt matches the work.
You can call itInvoke it directly when you want it.
Slash command/gh-protect

Context preview

What this command does when you run it.

GitHub repo name. Auto-resolved from `git remote get-url origin` when omitted.

Command definition

gh-protect.md

name: nyann:gh-protect
description: >
  Audit or apply GitHub branch protection, tag rulesets, signing
  requirements, and repo settings based on the active profile.
arguments:
  - name: profile
    description: Override the active profile name. Defaults to the profile resolved from preferences or CLAUDE.md markers.
    optional: true
  - name: check
    description: Audit-only mode (read-only). Shows drift between profile expectations and GitHub state. This is always run first even when applying.
    optional: true
  - name: owner
    description: GitHub owner. Auto-resolved from `git remote get-url origin` when omitted.
    optional: true
  - name: repo
    description: GitHub repo name. Auto-resolved from `git remote get-url origin` when omitted.
    optional: true

**Plugin root:** This is a Claude Code plugin, NOT a CLI tool. Do NOT search via `which`, `npm list`, `pip list`, or `brew list`. This file is at `<plugin_root>/commands/`. All scripts: `<plugin_root>/bin/`. Read the matching `skills/*/SKILL.md` for the full flow.

/nyann:gh-protect

Wraps `bin/gh-integration.sh`. Two modes:

| Mode | What happens | |---|---| | `--check` (default) | Read-only audit. Emits a ProtectionAudit JSON showing drift between profile expectations and GitHub state. | | apply (on confirmation after audit) | Tightens branch protection, tag rulesets, and repo settings to match the profile. Never downgrades stricter remote rules. |

When to invoke

After changing `.github` fields in your profile → audit and apply.
Periodic check that protection hasn't drifted → audit only.
After bootstrap if protection wasn't applied (e.g. `gh` was missing

at bootstrap time) → apply now.

Output

**Audit**: ProtectionAudit JSON (`schemas/protection-audit.schema.json`)

with per-branch, per-rule drift classification (critical / warn / ok).

**Apply**: GhIntegrationResult JSON

(`schemas/gh-integration-result.schema.json`) with `applied[]`, `noop[]`, `errors[]`.

Requires

`gh` CLI installed and authenticated (`gh auth status`).
Repository must have a GitHub remote.

@thettweView Command

See all 41 commands in nyann