chore: add develop branch-protection ruleset and applier

scripts/apply-develop-ruleset.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+#
+# Apply the branch ruleset that protects `develop`.
+# Run this ONCE, AFTER the repository has been made public
+# (rulesets are unavailable on free private repos).
+#
+# Usage:  bash scripts/apply-develop-ruleset.sh
+#
+set -euo pipefail
+
+REPO="NoiXdev/s3Manager"
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+JSON="$DIR/develop-ruleset.json"
+
+# --- Verify the GitHub Actions integration id in the JSON -------------------
+# The bypass actor with actor_type "Integration" must be the "GitHub Actions"
+# app so the release workflow's CHANGELOG push to develop is not blocked.
+# 15368 is the GitHub Actions app id on github.com. If your push from the
+# release workflow ever gets rejected by the ruleset, confirm the id below
+# matches what the repo UI shows under:
+#   Settings -> Rules -> Rulesets -> protect-develop -> Bypass list -> "GitHub Actions"
+echo "Applying ruleset to $REPO from $JSON ..."
+
+# Create the ruleset (fails if one named 'protect-develop' already exists).
+gh api -X POST "repos/$REPO/rulesets" --input "$JSON"
+
+echo
+echo "Done. Verify with:"
+echo "  gh api repos/$REPO/rulesets --jq '.[] | {id, name, enforcement}'"

scripts/develop-ruleset.json

@@ -0,0 +1,49 @@
+{
+  "name": "protect-develop",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["refs/heads/develop"],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [
+    {
+      "actor_id": 5,
+      "actor_type": "RepositoryRole",
+      "bypass_mode": "always"
+    },
+    {
+      "actor_id": 15368,
+      "actor_type": "Integration",
+      "bypass_mode": "always"
+    }
+  ],
+  "rules": [
+    { "type": "deletion" },
+    { "type": "non_fast_forward" },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": false,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": false,
+        "automatic_copilot_code_review_enabled": false,
+        "allowed_merge_methods": ["merge", "squash", "rebase"]
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": false,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [
+          { "context": "Lint & Test" }
+        ]
+      }
+    }
+  ]
+}