Apply a GitHub Team organization ruleset baseline

[TusanHomichi]

Existing issue check

• Searched ConaryLabs/.github and Conary issues for GitHub Team, organization rulesets, branch protection, and required-reviewer work on 2026-07-25.
• No existing issue owns organization-wide repository protection.

Current audit

ConaryLabs is on GitHub Team with four public repositories and one private repository. Conary already has an active repository ruleset on main requiring pull requests, resolved review threads, and the fmt, clippy, workspace-tests, docs-truth, and frontends checks; it also blocks deletion/non-fast-forward updates and has secret scanning plus push protection enabled.

Because Conary is public, Team does not materially change its Actions-minute, environment, CODEOWNERS, or repository-rules availability. The useful upgrade-specific capability is an organization-level ruleset that can cover public and private repositories, including Cairn and future repositories. Team also permits push rulesets for private/internal repositories.

The current CLI credential has read:org, repo, and workflow, but not admin:org; organization-ruleset API calls therefore cannot be applied from the current session until that scope is explicitly granted.

Outcome

Every active ConaryLabs repository inherits a small, visible, non-bypass-by-accident baseline while repository-specific CI requirements remain local to each project.

Scope

• organization branch ruleset targeting the default branch of active repositories
• block branch deletion and non-fast-forward updates
• require a pull request and resolution of review threads
• retain repository-specific required checks rather than pretending every repo has Conary's jobs
• define an explicit, narrow emergency bypass actor/mode and audit its use
• protect release tags from deletion/non-fast-forward updates using exact per-project tag grammars
• assess a private-repository push ruleset for oversized files and credential/build-output paths without blocking legitimate artifacts
• leave archived Mira excluded
• document the effective organization baseline in this repository

Deliberate non-goal

Do not require an approving human review while the organization has one active maintainer. That would add no independent review and would normalize bypassing the rule. Add approval-count/CODEOWNERS enforcement when a second accountable reviewer exists.

Acceptance criteria

• The applying credential has the narrow admin:org authority needed to manage organization rulesets.
• The organization ruleset is first created in evaluate mode and its insights are checked against active repository workflows.
• Conary, Timeshift, .github, Cairn, and newly created repositories receive the default-branch baseline; archived Mira is excluded.
• Repository-specific status checks continue to apply and Conary's current Protect main ruleset is not weakened or duplicated inconsistently.
• Exact release-tag protections are active for repositories that publish releases.
• Any private-repository push rules are proven against current paths before active enforcement.
• The final active ruleset JSON and effective targets are captured as sanitized evidence in the issue.
• A read-only audit confirms direct default-branch pushes, deletion, and force-push are rejected while ordinary issue-backed PR flow remains usable.

Sources

• GitHub Team pricing/features: https://github.com/pricing
• Organization rulesets: https://docs.github.com/en/organizations/managing-organization-settings/creating-rulesets-for-repositories-in-your-organization
• Repository rulesets: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets