From 53e8997983b8be3ce55b133515cbca40b536958b Mon Sep 17 00:00:00 2001
From: Daniel Elskamp <ich@dginx.de>
Date: Fri, 12 Jun 2026 05:41:19 +0200
Subject: [PATCH] chore: correct develop ruleset to match what the API accepts

The first version failed against the rulesets API:
- the GitHub Actions Integration bypass actor is rejected on user-owned
  repos (must be added via the UI instead)
- `automatic_copilot_code_review_enabled` is not a valid pull_request param

Removes both; documents the one-time UI step for the GitHub Actions bypass.
This matches the active `protect-develop` ruleset.
---
 scripts/apply-develop-ruleset.sh | 14 +++++++-------
 scripts/develop-ruleset.json     |  6 ------
 2 files changed, 7 insertions(+), 13 deletions(-)

diff --git a/scripts/apply-develop-ruleset.sh b/scripts/apply-develop-ruleset.sh
index c753c52..f6c35f6 100755
--- a/scripts/apply-develop-ruleset.sh
+++ b/scripts/apply-develop-ruleset.sh
@@ -12,13 +12,13 @@ REPO="NoiXdev/s3Manager"
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 JSON="$DIR/develop-ruleset.json"
 
-# --- Verify the GitHub Actions integration id in the JSON -------------------
-# The bypass actor with actor_type "Integration" must be the "GitHub Actions"
-# app so the release workflow's CHANGELOG push to develop is not blocked.
-# 15368 is the GitHub Actions app id on github.com. If your push from the
-# release workflow ever gets rejected by the ruleset, confirm the id below
-# matches what the repo UI shows under:
-#   Settings -> Rules -> Rulesets -> protect-develop -> Bypass list -> "GitHub Actions"
+# --- GitHub Actions bypass (manual, one-time) -------------------------------
+# The release workflow pushes CHANGELOG.md directly to develop, which the
+# `pull_request` rule blocks. The GitHub Actions bot cannot be added as a
+# bypass actor via the API on a user-owned (non-org) repo, so add it once in
+# the UI after running this script:
+#   Settings -> Rules -> Rulesets -> protect-develop -> Bypass list
+#     -> Add bypass -> GitHub Actions -> mode "Always" -> Save
 echo "Applying ruleset to $REPO from $JSON ..."
 
 # Create the ruleset (fails if one named 'protect-develop' already exists).
diff --git a/scripts/develop-ruleset.json b/scripts/develop-ruleset.json
index f8f8005..7627155 100644
--- a/scripts/develop-ruleset.json
+++ b/scripts/develop-ruleset.json
@@ -13,11 +13,6 @@
       "actor_id": 5,
       "actor_type": "RepositoryRole",
       "bypass_mode": "always"
-    },
-    {
-      "actor_id": 15368,
-      "actor_type": "Integration",
-      "bypass_mode": "always"
     }
   ],
   "rules": [
@@ -31,7 +26,6 @@
         "require_code_owner_review": false,
         "require_last_push_approval": false,
         "required_review_thread_resolution": false,
-        "automatic_copilot_code_review_enabled": false,
         "allowed_merge_methods": ["merge", "squash", "rebase"]
       }
     },