docs(ruleset): fix documentation errors in ruleset resources

- Add missing allowed_merge_methods field to pull_request section
- Fix merge_queue fields from Required to Optional with defaults
- Fix actor_id to show Optional with note about DeployKey
- Add DeployKey to actor_type enum list
- Add protected field to conditions.repository_name
- Fix required_code_scanning_tool anchor link
- Remove duplicate do_not_enforce_on_create

Author: deiga

website/docs/r/organization_ruleset.html.markdown

@@ -85,15 +85,15 @@ resource "github_organization_ruleset" "example_push" {
     file_path_restriction {
       restricted_file_paths = [".github/workflows/*", "*.env"]
     }
-    
+
     max_file_size {
       max_file_size = 100  # 100 MB
     }
-    
+
     max_file_path_length {
       max_file_path_length = 255
     }
-    
+
     file_extension_restriction {
       restricted_file_extensions = ["*.exe", "*.dll", "*.so"]
     }
@@ -220,25 +220,27 @@ The `rules` block supports the following:
 
 - `review_draft_pull_requests` - (Optional) (Boolean) Copilot automatically reviews draft pull requests before they are marked as ready for review. Defaults to `false`.
 
-* `required_reviewers` - (Optional) (Block List) Require specific reviewers to approve pull requests. Note: This feature is in beta. (see [below for nested schema](#rules.pull_request.required_reviewers))
+- `allowed_merge_methods` - (Required) (List of String, Min: 1) Array of merge methods to be allowed. Allowed values include `merge`, `squash`, and `rebase`. At least one must be enabled.
+
+- `required_reviewers` - (Optional) (Block List) Require specific reviewers to approve pull requests. Note: This feature is in beta. (see [below for nested schema](#rulespull_requestrequired_reviewers))
 
 #### rules.pull_request.required_reviewers ####
 
-* `reviewer` - (Required) (Block List, Max: 1) The reviewer that must review matching files. (see [below for nested schema](#rules.pull_request.required_reviewers.reviewer))
+- `reviewer` - (Required) (Block List, Max: 1) The reviewer that must review matching files. (see [below for nested schema](#rulespull_requestrequired_reviewersreviewer))
 
-* `file_patterns` - (Required) (List of String) File patterns (fnmatch syntax) that this reviewer must approve.
+- `file_patterns` - (Required) (List of String) File patterns (fnmatch syntax) that this reviewer must approve.
 
-* `minimum_approvals` - (Required) (Number) Minimum number of approvals required from this reviewer. Set to 0 to make approval optional.
+- `minimum_approvals` - (Required) (Number) Minimum number of approvals required from this reviewer. Set to 0 to make approval optional.
 
 #### rules.pull_request.required_reviewers.reviewer ####
 
-* `id` - (Required) (Number) The ID of the reviewer (Team ID).
+- `id` - (Required) (Number) The ID of the reviewer (Team ID).
 
-* `type` - (Required) (String) The type of reviewer. Currently only `Team` is supported.
+- `type` - (Required) (String) The type of reviewer. Currently only `Team` is supported.
 
 #### rules.required_status_checks ####
 
-- `required_check` - (Required) (Block Set, Min: 1) Status checks that are required. Several can be defined. (see [below for nested schema](#rulesrequired_status_checks.required_check))
+- `required_check` - (Required) (Block Set, Min: 1) Status checks that are required. Several can be defined. (see [below for nested schema](#rulesrequired_status_checksrequired_check))
 
 - `strict_required_status_checks_policy` - (Optional) (Boolean) Whether pull requests targeting a matching branch must be tested with the latest code. This setting will not take effect unless at least one status check is enabled. Defaults to `false`.
 
@@ -306,7 +308,7 @@ The `rules` block supports the following:
 
 #### bypass_actors ####
 
-- `actor_id` - (Required) (Number) The ID of the actor that can bypass a ruleset.
+- `actor_id` - (Optional) (Number) The ID of the actor that can bypass a ruleset. Some actor types such as `DeployKey` do not have an ID.
 
 - `actor_type` (String) The type of actor that can bypass a ruleset. Can be one of: `RepositoryRole`, `Team`, `Integration`, `OrganizationAdmin`.
 
@@ -339,8 +341,8 @@ One of `repository_id` and `repository_name` must be set for the rule to target
 #### conditions.repository_name ####
 
 - `exclude` - (Required) (List of String) Array of repository names or patterns to exclude. The condition will not pass if any of these patterns match.
-
 - `include` - (Required) (List of String) Array of repository names or patterns to include. One of these patterns must match for the condition to pass. Also accepts `~ALL` to include all repositories.
+- `protected` - (Optional) (Boolean) Whether renaming of target repositories is prevented. Defaults to `false`.
 
 ## Attributes Reference
 

website/docs/r/repository_ruleset.html.markdown

@@ -70,15 +70,15 @@ resource "github_repository_ruleset" "example_push" {
     file_path_restriction {
       restricted_file_paths = [".github/workflows/*", "*.env"]
     }
-    
+
     max_file_size {
       max_file_size = 100  # 100 MB
     }
-    
+
     max_file_path_length {
       max_file_path_length = 255
     }
-    
+
     file_extension_restriction {
       restricted_file_extensions = ["*.exe", "*.dll", "*.so"]
     }
@@ -193,19 +193,19 @@ The `rules` block supports the following:
 
 #### rules.merge_queue ####
 
-- `check_response_timeout_minutes` - (Required) (Number)Maximum time for a required status check to report a conclusion. After this much time has elapsed, checks that have not reported a conclusion will be assumed to have failed. Defaults to `60`.
+- `check_response_timeout_minutes` - (Optional) (Number) Maximum time for a required status check to report a conclusion. After this much time has elapsed, checks that have not reported a conclusion will be assumed to have failed. Defaults to `60`.
 
-- `grouping_strategy` - (Required) (String)When set to ALLGREEN, the merge commit created by merge queue for each PR in the group must pass all required checks to merge. When set to HEADGREEN, only the commit at the head of the merge group, i.e. the commit containing changes from all of the PRs in the group, must pass its required checks to merge. Can be one of: ALLGREEN, HEADGREEN. Defaults to `ALLGREEN`.
+- `grouping_strategy` - (Optional) (String) When set to `ALLGREEN`, the merge commit created by merge queue for each PR in the group must pass all required checks to merge. When set to `HEADGREEN`, only the commit at the head of the merge group, i.e. the commit containing changes from all of the PRs in the group, must pass its required checks to merge. Can be one of: `ALLGREEN`, `HEADGREEN`. Defaults to `ALLGREEN`.
 
-- `max_entries_to_build` - (Required) (Number) Limit the number of queued pull requests requesting checks and workflow runs at the same time. Defaults to `5`.
+- `max_entries_to_build` - (Optional) (Number) Limit the number of queued pull requests requesting checks and workflow runs at the same time. Defaults to `5`.
 
-- `max_entries_to_merge` - (Required) (Number) Limit the number of queued pull requests that will be merged together in a group. Defaults to `5`.
+- `max_entries_to_merge` - (Optional) (Number) Limit the number of queued pull requests that will be merged together in a group. Defaults to `5`.
 
-- `merge_method` - (Required) (String) Method to use when merging changes from queued pull requests. Can be one of: MERGE, SQUASH, REBASE. Defaults to `MERGE`.
+- `merge_method` - (Optional) (String) Method to use when merging changes from queued pull requests. Can be one of: `MERGE`, `SQUASH`, `REBASE`. Defaults to `MERGE`.
 
-- `min_entries_to_merge` - (Required) (Number) The minimum number of PRs that will be merged together in a group. Defaults to `1`.
+- `min_entries_to_merge` - (Optional) (Number) The minimum number of PRs that will be merged together in a group. Defaults to `1`.
 
-- `min_entries_to_merge_wait_minutes` - (Required) (Number) The time merge queue should wait after the first PR is added to the queue for the minimum group size to be met. After this time has elapsed, the minimum group size will be ignored and a smaller group will be merged. Defaults to `5`.
+- `min_entries_to_merge_wait_minutes` - (Optional) (Number) The time merge queue should wait after the first PR is added to the queue for the minimum group size to be met. After this time has elapsed, the minimum group size will be ignored and a smaller group will be merged. Defaults to `5`.
 
 #### rules.pull_request ####
 
@@ -222,21 +222,23 @@ The `rules` block supports the following:
 
 - `review_draft_pull_requests` - (Optional) (Boolean) Copilot automatically reviews draft pull requests before they are marked as ready for review. Defaults to `false`.
 
-* `required_reviewers` - (Optional) (Block List) Require specific reviewers to approve pull requests. Note: This feature is in beta. (see [below for nested schema](#rules.pull_request.required_reviewers))
+- `allowed_merge_methods` - (Required) (List of String, Min: 1) Array of merge methods to be allowed. Allowed values include `merge`, `squash`, and `rebase`. At least one must be enabled.
+
+- `required_reviewers` - (Optional) (Block List) Require specific reviewers to approve pull requests. Note: This feature is in beta. (see [below for nested schema](#rulespull_requestrequired_reviewers))
 
 #### rules.pull_request.required_reviewers ####
 
-* `reviewer` - (Required) (Block List, Max: 1) The reviewer that must review matching files. (see [below for nested schema](#rules.pull_request.required_reviewers.reviewer))
+- `reviewer` - (Required) (Block List, Max: 1) The reviewer that must review matching files. (see [below for nested schema](#rulespull_requestrequired_reviewersreviewer))
 
-* `file_patterns` - (Required) (List of String) File patterns (fnmatch syntax) that this reviewer must approve.
+- `file_patterns` - (Required) (List of String) File patterns (fnmatch syntax) that this reviewer must approve.
 
-* `minimum_approvals` - (Required) (Number) Minimum number of approvals required from this reviewer. Set to 0 to make approval optional.
+- `minimum_approvals` - (Required) (Number) Minimum number of approvals required from this reviewer. Set to 0 to make approval optional.
 
 #### rules.pull_request.required_reviewers.reviewer ####
 
-* `id` - (Required) (Number) The ID of the reviewer (Team ID).
+- `id` - (Required) (Number) The ID of the reviewer (Team ID).
 
-* `type` - (Required) (String) The type of reviewer. Currently only `Team` is supported.
+- `type` - (Required) (String) The type of reviewer. Currently only `Team` is supported.
 
 #### rules.required_deployments ####
 
@@ -296,7 +298,7 @@ The `rules` block supports the following:
 
 #### bypass_actors ####
 
-- `actor_id` - (Number) The ID of the actor that can bypass a ruleset. If `actor_type` is `Integration`, `actor_id` is a GitHub App ID. App ID can be obtained by following instructions from the [Get an App API docs](https://docs.github.com/en/rest/apps/apps?apiVersion=2022-11-28#get-an-app)
+- `actor_id` - (Optional) (Number) The ID of the actor that can bypass a ruleset. If `actor_type` is `Integration`, `actor_id` is a GitHub App ID. App ID can be obtained by following instructions from the [Get an App API docs](https://docs.github.com/en/rest/apps/apps?apiVersion=2022-11-28#get-an-app). Some actor types such as `DeployKey` do not have an ID.
 
 - `actor_type` (String) The type of actor that can bypass a ruleset. Can be one of: `RepositoryRole`, `Team`, `Integration`, `OrganizationAdmin`, `DeployKey`.
 
@@ -312,7 +314,9 @@ The `rules` block supports the following:
 
 #### conditions ####
 
-- `ref_name` - (Required) (Block List, Min: 1, Max: 1) (see [below for nested schema](#conditionsref_name))
+- `ref_name` - (Optional) (Block List, Max: 1) Required for `branch` and `tag` targets. Must NOT be set for `push` targets. (see [below for nested schema](#conditionsref_name))
+
+~> **Note:** For `push` targets, do not include `ref_name` in conditions. Push rulesets operate on file content, not on refs. The `conditions` block is optional for push targets.
 
 #### conditions.ref_name ####