set-default-ruleset

Set GitHub Branch Ruleset

You are tasked with creating or updating a GitHub branch ruleset to protect the default branch.

Process

1. Get Repository Information

# Get repository details
gh repo view --json name,owner,defaultBranchRef

# Get existing rulesets (if any)
gh api repos/{owner}/{repo}/rulesets --jq '.[] | {id, name, enforcement}'

2. Check Available GitHub Actions

Run this to discover available workflow job names that can be used as status checks:

# List workflow files
gh api repos/{owner}/{repo}/actions/workflows --jq '.workflows[] | {name: .name, path: .path}'

# For each workflow, you can inspect jobs by reading the workflow file

Also check the repository's .github/workflows/ directory to understand job names.

3. Ask User for Configuration

Use AskUserQuestion to ask the user:

Question 1: Protection Type

• "Use Status Checks (require CI jobs to pass)" - Default, recommended if GitHub Actions exist
• "Use Code Scanning Results (require security analysis)" - Use GitHub Advanced Security code scanning

If Status Checks selected and GitHub Actions exist:

Question 2: Which Status Checks to Require Present the discovered workflow job names and ask which ones to require. Common patterns:

• Build/Test jobs (e.g., "Test and Build", "CI")
• Lint/Format jobs (e.g., "Format and Lint", "Lint")

If no GitHub Actions exist: Inform the user that no GitHub Actions were found, so status checks will be skipped. The ruleset will only enforce deletion and non-fast-forward rules.

4. Create the Ruleset

Use the GitHub API to create the ruleset:

gh api repos/{owner}/{repo}/rulesets \
  --method POST \
  --input - << 'EOF'
{
  "name": "Protect default branch",
  "target": "branch",
  "enforcement": "active",
  "bypass_actors": [],
  "conditions": {
    "ref_name": {
      "exclude": [],
      "include": ["~DEFAULT_BRANCH"]
    }
  },
  "rules": [
    {
      "type": "deletion"
    },
    {
      "type": "non_fast_forward"
    },
    {
      "type": "required_status_checks",
      "parameters": {
        "do_not_enforce_on_create": false,
        "strict_required_status_checks_policy": false,
        "required_status_checks": [
          {
            "context": "Format and Lint",
            "integration_id": 15368
          },
          {
            "context": "Test and Build",
            "integration_id": 15368
          }
        ]
      }
    }
  ]
}
EOF