BLD - add GitHub contribution and release automation (#3)

* BLD - add GitHub contribution and release automation * BLD - restrict dev merges to maintainers * BLD - add automated review and PR test resources * DOC - require AI governance checks * FIX - pin patched nanoid dependency * TRY - trigger webhook delivery * TRY - verify webhook routing * TRY - rerun pull request checks
2026-08-29 01:08:59 +00:00 · 2026-08-19 15:26:50 +02:00
parent c766cb5044
commit 7644dec3a3
19 changed files with 1173 additions and 4 deletions
@@ -0,0 +1,22 @@
+# Repository rulesets
+
+These JSON files are import-ready repository rulesets for `sky-systems/sky_phone`.
+
+## Activation order
+
+1. Merge the governance files and workflows into the default `dev` branch.
+2. Let `CI`, `Automated code review`, and `Pull request policy` run once so GitHub registers the check names.
+3. Open **Settings > Rules > Rulesets > New ruleset > Import a ruleset**.
+4. Import `protect-dev.json`, review its target and required checks, then activate it.
+5. Import `protect-release-tags.json`, review the numeric tag pattern, then activate it.
+6. Open a test pull request and confirm all five required checks and the test-resource comment are reported before relying on the ruleset.
+
+`protect-dev.json` blocks deletion and force pushes, restricts all updates of `dev` to the built-in `Maintain` role, requires one approval, dismisses stale reviews, requires approval after the last push, resolves review conversations, and requires the `Repository policy`, `Frontend`, `CodeQL`, `Dependency review`, and `Pull request policy` checks. Maintainers can bypass rules only through a pull request, so they cannot use this bypass for a direct push to `dev`.
+
+Successful pull requests receive a 14-day test-resource artifact containing the deployable `sky_phone` folder and built NUI. `Pull request test resource link` runs after `CI` and maintains one download comment in the pull request. It does not check out, download, or execute pull-request content with its write-capable token.
+
+`protect-release-tags.json` accepts stable numeric semantic versions such as `0.2.0`, rejects a leading `v`, and makes created tags immutable.
+
+The built-in repository `Maintain` role uses `RepositoryRole` actor ID `2`. Its branch bypass is limited to pull requests and is what permits maintainers to merge; its tag bypass is always available so maintainers can create and recover releases. Changing the committed JSON alone does not update an already imported ruleset.
+
+Rulesets are GitHub settings, not live configuration files. Committing or editing these JSON files does not activate or update protection automatically; an administrator must import or reconcile them in GitHub.
@@ -0,0 +1,68 @@
+{
+  "name": "Protect the default development branch",
+  "target": "branch",
+  "source_type": "Repository",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~DEFAULT_BRANCH"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    },
+    {
+      "type": "update",
+      "parameters": {
+        "update_allows_fetch_and_merge": false
+      }
+    },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "allowed_merge_methods": ["merge", "squash", "rebase"],
+        "dismiss_stale_reviews_on_push": true,
+        "require_code_owner_review": false,
+        "require_last_push_approval": true,
+        "required_approving_review_count": 1,
+        "required_review_thread_resolution": true
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "do_not_enforce_on_create": true,
+        "required_status_checks": [
+          {
+            "context": "Repository policy"
+          },
+          {
+            "context": "Frontend"
+          },
+          {
+            "context": "CodeQL"
+          },
+          {
+            "context": "Dependency review"
+          },
+          {
+            "context": "Pull request policy"
+          }
+        ],
+        "strict_required_status_checks_policy": true
+      }
+    }
+  ],
+  "bypass_actors": [
+    {
+      "actor_id": 2,
+      "actor_type": "RepositoryRole",
+      "bypass_mode": "pull_request"
+    }
+  ]
+}
@@ -0,0 +1,36 @@
+{
+  "name": "Protect semantic release tags",
+  "target": "tag",
+  "source_type": "Repository",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~ALL"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    },
+    {
+      "type": "tag_name_pattern",
+      "parameters": {
+        "name": "Numeric semantic version without v prefix",
+        "negate": false,
+        "operator": "regex",
+        "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+\\n?$"
+      }
+    }
+  ],
+  "bypass_actors": [
+    {
+      "actor_id": 2,
+      "actor_type": "RepositoryRole",
+      "bypass_mode": "always"
+    }
+  ]
+}