Allow only rebase and squash merges

README.md

@@ -218,6 +218,10 @@ Removing a repository from the YAML archives it instead of deleting it. Every re
 
 Every repository is managed with `delete_branch_on_merge = true`, so GitHub deletes a pull request's head branch once it is merged. A deleted branch can be restored from its pull request.
 
+### Merge Methods
+
+Every repository allows rebase and squash merges only, merge commits are off. A squash merge commit takes its title and message from the commits, not the pull request: a single-commit pull request squashes into its commit subject, so it passes the [ruleset](#rulesets) commit message pattern. A multi-commit pull request squash defaults to the pull request title; edit it or rebase instead.
+
 ### Secret Scanning
 
 Every repository is managed with secret scanning and push protection enabled, so GitHub alerts on committed secrets and blocks pushes containing them. Non-provider patterns and validity checks are not managed.

terraform/modules/repository/main.tf

@@ -7,9 +7,14 @@ resource "github_repository" "this" {
   topics       = var.repository.topics
 
   # Properties
-  archive_on_destroy     = true
-  delete_branch_on_merge = true
-  is_template            = var.repository.is_template
+  archive_on_destroy          = true
+  allow_merge_commit          = false
+  allow_rebase_merge          = true
+  allow_squash_merge          = true
+  squash_merge_commit_title   = "COMMIT_OR_PR_TITLE"
+  squash_merge_commit_message = "COMMIT_MESSAGES"
+  delete_branch_on_merge      = true
+  is_template                 = var.repository.is_template
 
   # advanced_security omitted: setting it errors on public repositories.
   security_and_analysis {

terraform/modules/repository/tests/repository.tftest.hcl

@@ -34,6 +34,16 @@ run "name_only" {
     error_message = "Repository must delete branches on merge."
   }
 
+  assert {
+    condition     = !github_repository.this.allow_merge_commit && github_repository.this.allow_rebase_merge && github_repository.this.allow_squash_merge
+    error_message = "Repository must allow rebase and squash merges only."
+  }
+
+  assert {
+    condition     = github_repository.this.squash_merge_commit_title == "COMMIT_OR_PR_TITLE" && github_repository.this.squash_merge_commit_message == "COMMIT_MESSAGES"
+    error_message = "Squash merge commit must take its title and message from the commits."
+  }
+
   assert {
     condition     = github_repository.this.security_and_analysis[0].secret_scanning[0].status == "enabled"
     error_message = "Repository must enable secret scanning."