To some it might seem weird, but in cases like this having even your repository configuration in Configuration management makes sense, for example using Terrafo

To some it might seem weird, but in cases like this having even your repository configuration in Configuration management makes sense, for example using Terraform[0]. Of course you have a chicken-egg problem for that first repo that actually contains your CI code. But if you just apply common sense that problem doesn't really exist. With repositories it is just so easy for little configuration drift to slip in. A branch you forgot to protect. A user/group that should no longer have write permissions, etc. [0] https://www.terraform.io/docs/providers/github/r/branch_protection.html https://www.terraform.io/docs/providers/github/r/branch_prot... https://www.terraform.io/docs/providers/type/vcs-index.html https://www.terraform.io/docs/providers/type/vcs-index.html