DerEchteAlec
7644dec3a3
* BLD - add GitHub contribution and release automation * BLD - restrict dev merges to maintainers * BLD - add automated review and PR test resources * DOC - require AI governance checks * FIX - pin patched nanoid dependency * TRY - trigger webhook delivery * TRY - verify webhook routing * TRY - rerun pull request checks
Repository rulesets
These JSON files are import-ready repository rulesets for sky-systems/sky_phone.
Activation order
- Merge the governance files and workflows into the default
devbranch. - Let
CI,Automated code review, andPull request policyrun once so GitHub registers the check names. - Open Settings > Rules > Rulesets > New ruleset > Import a ruleset.
- Import
protect-dev.json, review its target and required checks, then activate it. - Import
protect-release-tags.json, review the numeric tag pattern, then activate it. - Open a test pull request and confirm all five required checks and the test-resource comment are reported before relying on the ruleset.
protect-dev.json blocks deletion and force pushes, restricts all updates of dev to the built-in Maintain role, requires one approval, dismisses stale reviews, requires approval after the last push, resolves review conversations, and requires the Repository policy, Frontend, CodeQL, Dependency review, and Pull request policy checks. Maintainers can bypass rules only through a pull request, so they cannot use this bypass for a direct push to dev.
Successful pull requests receive a 14-day test-resource artifact containing the deployable sky_phone folder and built NUI. Pull request test resource link runs after CI and maintains one download comment in the pull request. It does not check out, download, or execute pull-request content with its write-capable token.
protect-release-tags.json accepts stable numeric semantic versions such as 0.2.0, rejects a leading v, and makes created tags immutable.
The built-in repository Maintain role uses RepositoryRole actor ID 2. Its branch bypass is limited to pull requests and is what permits maintainers to merge; its tag bypass is always available so maintainers can create and recover releases. Changing the committed JSON alone does not update an already imported ruleset.
Rulesets are GitHub settings, not live configuration files. Committing or editing these JSON files does not activate or update protection automatically; an administrator must import or reconcile them in GitHub.