From a8146ba12788b34ed75921f09720fde16d89e355 Mon Sep 17 00:00:00 2001
From: Dafydd Jones <dafydd@techneg.it>
Date: Sun, 2 Aug 2026 12:22:25 +0100
Subject: [PATCH 1/3] feat(admin-safe-settings): add auto-merge settings

---
 admin-safe-settings/suborgs/baseline.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/admin-safe-settings/suborgs/baseline.yml b/admin-safe-settings/suborgs/baseline.yml
index aada0f3..8c5760a 100644
--- a/admin-safe-settings/suborgs/baseline.yml
+++ b/admin-safe-settings/suborgs/baseline.yml
@@ -20,6 +20,17 @@ environments:
       - name: SAFE_SETTINGS_APP_ID
         value: '3020872'
 
+repository:
+  # As we use `semantic-release` throughout the formulas, which means every
+  # commit message is important, we disallow squash merging so that commit
+  # messages are not inadvertently destroyed.
+  # In addition, Renovate defaults to squash merging unless the repository
+  # settings disallows it.
+  allow_squash_merge: false
+
+  # Allow auto-merging to allow Renovate to work more efficiently
+  allow_auto_merge: true
+
 rulesets:
   - name: Prevent destruction of the default branch
     target: branch

From eb31ddb11a8958ad04c00fa99e58c9687de28864 Mon Sep 17 00:00:00 2001
From: Dafydd Jones <dafydd@techneg.it>
Date: Sun, 2 Aug 2026 12:42:00 +0100
Subject: [PATCH 2/3] feat(admin-safe-settings): add rule to require 1 approval
 for all PRs

* [renovate-approve](https://github.com/apps/renovate-approve) can be used for automated approval
  of Renovate PRs
---
 admin-safe-settings/suborgs/baseline.yml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/admin-safe-settings/suborgs/baseline.yml b/admin-safe-settings/suborgs/baseline.yml
index 8c5760a..8d4964a 100644
--- a/admin-safe-settings/suborgs/baseline.yml
+++ b/admin-safe-settings/suborgs/baseline.yml
@@ -58,3 +58,19 @@ rulesets:
             - context: Release / Collect results
               integration_id: 15368
           strict_required_status_checks_policy: false
+  - name: Require PR approvals before updating the default branch
+    target: branch
+    enforcement: active
+    conditions:
+      ref_name:
+        include:
+          - ~DEFAULT_BRANCH
+        exclude: []
+    rules:
+      - type: pull_request
+        parameters:
+          dismiss_stale_reviews_on_push: false
+          require_code_owner_review: false
+          require_last_push_approval: true
+          required_approving_review_count: 1
+          required_review_thread_resolution: true

From 17959b09374f514f557746c93ab2f3a3ed153243 Mon Sep 17 00:00:00 2001
From: Dafydd Jones <dafydd@techneg.it>
Date: Sun, 2 Aug 2026 12:45:47 +0100
Subject: [PATCH 3/3] fix(formula-safe-settings): apply formula settings only
 to currently-managed formulas

---
 formula-safe-settings/deployment-settings.yml | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 formula-safe-settings/deployment-settings.yml

diff --git a/formula-safe-settings/deployment-settings.yml b/formula-safe-settings/deployment-settings.yml
new file mode 100644
index 0000000..5c39e93
--- /dev/null
+++ b/formula-safe-settings/deployment-settings.yml
@@ -0,0 +1,9 @@
+restrictedRepos:
+  include:
+    - nginx-formula
+    - openssh-formula
+    - postfix-formula
+    - salt-formula
+    - syslog-ng-formula
+    - template-formula
+    - vault-formula