From 1629d15a1948127dcf39fd79ee3a8616d5266c19 Mon Sep 17 00:00:00 2001
From: Daniel Elskamp <ich@dginx.de>
Date: Fri, 12 Jun 2026 05:32:31 +0200
Subject: [PATCH] chore: add develop branch-protection ruleset and applier
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Ruleset (to apply once the repo is public — rulesets are unavailable on
free private repos) requires PRs + a passing `Lint & Test` check on develop,
blocks deletion/force-push, and bypasses the GitHub Actions bot so the
release workflow's CHANGELOG push to develop keeps working.
---
 scripts/apply-develop-ruleset.sh | 29 +++++++++++++++++++
 scripts/develop-ruleset.json     | 49 ++++++++++++++++++++++++++++++++
 2 files changed, 78 insertions(+)
 create mode 100755 scripts/apply-develop-ruleset.sh
 create mode 100644 scripts/develop-ruleset.json

diff --git a/scripts/apply-develop-ruleset.sh b/scripts/apply-develop-ruleset.sh
new file mode 100755
index 0000000..c753c52
--- /dev/null
+++ b/scripts/apply-develop-ruleset.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+#
+# Apply the branch ruleset that protects `develop`.
+# Run this ONCE, AFTER the repository has been made public
+# (rulesets are unavailable on free private repos).
+#
+# Usage:  bash scripts/apply-develop-ruleset.sh
+#
+set -euo pipefail
+
+REPO="NoiXdev/s3Manager"
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+JSON="$DIR/develop-ruleset.json"
+
+# --- Verify the GitHub Actions integration id in the JSON -------------------
+# The bypass actor with actor_type "Integration" must be the "GitHub Actions"
+# app so the release workflow's CHANGELOG push to develop is not blocked.
+# 15368 is the GitHub Actions app id on github.com. If your push from the
+# release workflow ever gets rejected by the ruleset, confirm the id below
+# matches what the repo UI shows under:
+#   Settings -> Rules -> Rulesets -> protect-develop -> Bypass list -> "GitHub Actions"
+echo "Applying ruleset to $REPO from $JSON ..."
+
+# Create the ruleset (fails if one named 'protect-develop' already exists).
+gh api -X POST "repos/$REPO/rulesets" --input "$JSON"
+
+echo
+echo "Done. Verify with:"
+echo "  gh api repos/$REPO/rulesets --jq '.[] | {id, name, enforcement}'"
diff --git a/scripts/develop-ruleset.json b/scripts/develop-ruleset.json
new file mode 100644
index 0000000..f8f8005
--- /dev/null
+++ b/scripts/develop-ruleset.json
@@ -0,0 +1,49 @@
+{
+  "name": "protect-develop",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["refs/heads/develop"],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [
+    {
+      "actor_id": 5,
+      "actor_type": "RepositoryRole",
+      "bypass_mode": "always"
+    },
+    {
+      "actor_id": 15368,
+      "actor_type": "Integration",
+      "bypass_mode": "always"
+    }
+  ],
+  "rules": [
+    { "type": "deletion" },
+    { "type": "non_fast_forward" },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": false,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": false,
+        "automatic_copilot_code_review_enabled": false,
+        "allowed_merge_methods": ["merge", "squash", "rebase"]
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": false,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [
+          { "context": "Lint & Test" }
+        ]
+      }
+    }
+  ]
+}