GitHub CLI

Protection patterns for GitHub CLI operations including repo deletion, visibility changes, and secret management

The github check group covers destructive GitHub CLI (gh) operations that can permanently delete repositories, releases, and break CI/CD pipelines.

GitHub checks

Delete repository


ID	`github:repo_delete`
Severity	Critical

Permanently deletes a repository and all its data — code, issues, pull requests, and wiki.

# Triggers
gh repo delete
gh repo delete myorg/myrepo
gh repo delete --yes

Archive repository


ID	`github:repo_archive`
Severity	High

Archiving makes a repository read-only, which can break CI/CD workflows and prevent merges.

# Triggers
gh repo archive
gh repo archive myorg/myrepo

# Does NOT trigger
gh repo unarchive myorg/myrepo

Rename repository


ID	`github:repo_rename`
Severity	High

Renaming breaks all existing clone URLs, CI/CD references, and bookmarks.

# Triggers
gh repo rename new-name
gh repo rename --yes new-name

Change repository visibility


ID	`github:repo_change_visibility`
Severity	High

Changing visibility can expose private code publicly or break access for external contributors.

# Triggers
gh repo edit --visibility private
gh repo edit --visibility public
gh repo edit myorg/myrepo --visibility internal

# Does NOT trigger
gh repo edit --description "new description"
gh repo edit --homepage "https://example.com"

Delete release


ID	`github:release_delete`
Severity	High

Deleting a release removes it and all its assets permanently.

# Triggers
gh release delete v1.0.0
gh release delete v1.0.0 --yes
gh release delete v1.0.0 --cleanup-tag

# Does NOT trigger
gh release list
gh release create v1.0.0

Delete secret


ID	`github:secret_delete`
Severity	High

Deleting a secret can break CI/CD pipelines that depend on it.

# Triggers
gh secret delete MY_SECRET
gh secret delete MY_SECRET --org myorg
gh secret delete MY_SECRET --env production

# Does NOT trigger
gh secret list
gh secret set MY_SECRET

Delete variable


ID	`github:variable_delete`
Severity	High

Deleting a variable can break CI/CD pipelines that depend on it.

# Triggers
gh variable delete MY_VAR
gh variable delete MY_VAR --org myorg
gh variable delete MY_VAR --env staging

# Does NOT trigger
gh variable list
gh variable set MY_VAR

Summary table

ID	Command	Severity
`github:repo_delete`	`gh repo delete`	Critical
`github:repo_archive`	`gh repo archive`	High
`github:repo_rename`	`gh repo rename`	High
`github:repo_change_visibility`	`gh repo edit --visibility`	High
`github:release_delete`	`gh release delete`	High
`github:secret_delete`	`gh secret delete`	High
`github:variable_delete`	`gh variable delete`	High