Release

.github/rulesets/README.md

@@ -0,0 +1,19 @@
+# GitHub Ruleset Snapshots
+
+These files snapshot the current GitHub repository rulesets as exported via `gh api`. GitHub does not read rules from this directory; updates still need to be applied through the Ruleset UI or API. Keep these files in sync to audit drift.
+
+## Refresh commands
+
+```
+GH_TOKEN=<token_with_repo_admin> gh api repos/open-hax/codex/rulesets/10200441 > .github/rulesets/release.json
+GH_TOKEN=<token_with_repo_admin> gh api repos/open-hax/codex/rulesets/10223971 > .github/rulesets/main.json
+```
+
+After refreshing, commit changes. CI (`.github/workflows/ruleset-drift.yml`) fetches live rulesets, strips volatile fields (`created_at`, `updated_at`, `bypass_actors`, `current_user_can_bypass`), normalizes with `jq -S .`, and diffs against these snapshots; it fails on structural drift only.
+
+## Notes
+
+- `release` ruleset applies to the default branch (currently `dev`); strict required checks enforced.
+- `main` ruleset applies to `refs/heads/main`; strict_required_status_checks_policy is false.
+- If we rename `dev` again, update the default branch and the `release` ruleset target accordingly, then refresh these snapshots.
+- CI drift check already fetches live rulesets and diffs against snapshots.

.github/rulesets/main.json

@@ -0,0 +1,71 @@
+{
+  "id": 10223971,
+  "name": "main",
+  "target": "branch",
+  "source_type": "Repository",
+  "source": "open-hax/codex",
+  "enforcement": "active",
+  "conditions": { "ref_name": { "exclude": [], "include": ["refs/heads/main"] } },
+  "rules": [
+    { "type": "deletion" },
+    { "type": "non_fast_forward" },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": false,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [
+          { "context": "Test (20.x)", "integration_id": 15368 },
+          { "context": "Test (22.x)", "integration_id": 15368 },
+          { "context": "Lint & Typecheck", "integration_id": 15368 },
+          { "context": "CodeRabbit", "integration_id": 347564 }
+        ]
+      }
+    },
+    {
+      "type": "copilot_code_review",
+      "parameters": { "review_on_push": true, "review_draft_pull_requests": true }
+    },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": false,
+        "required_reviewers": [],
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": true,
+        "automatic_copilot_code_review_enabled": true,
+        "allowed_merge_methods": ["merge", "squash", "rebase"]
+      }
+    },
+    { "type": "code_quality", "parameters": { "severity": "errors" } },
+    {
+      "type": "code_scanning",
+      "parameters": {
+        "code_scanning_tools": [
+          {
+            "tool": "CodeQL",
+            "security_alerts_threshold": "high_or_higher",
+            "alerts_threshold": "errors"
+          }
+        ]
+      }
+    },
+    {
+      "type": "copilot_code_review_analysis_tools",
+      "parameters": { "tools": [{ "name": "CodeQL" }, { "name": "ESLint" }] }
+    }
+  ],
+  "node_id": "RRS_lACqUmVwb3NpdG9yec5AmajgzgCcAWM",
+  "created_at": "2025-11-20T12:56:31.538-06:00",
+  "updated_at": "2025-11-20T13:34:49.695-06:00",
+  "bypass_actors": [
+    { "actor_id": null, "actor_type": "OrganizationAdmin", "bypass_mode": "always" }
+  ],
+  "current_user_can_bypass": "always",
+  "_links": {
+    "self": { "href": "https://api.github.com/repos/open-hax/codex/rulesets/10223971" },
+    "html": { "href": "https://github.com/open-hax/codex/rules/10223971" }
+  }
+}

.github/rulesets/release.json

@@ -0,0 +1,55 @@
+{
+  "id": 10200441,
+  "name": "release",
+  "target": "branch",
+  "source_type": "Repository",
+  "source": "open-hax/codex",
+  "enforcement": "active",
+  "conditions": { "ref_name": { "exclude": [], "include": ["~DEFAULT_BRANCH"] } },
+  "rules": [
+    { "type": "deletion" },
+    { "type": "non_fast_forward" },
+    {
+      "type": "copilot_code_review",
+      "parameters": { "review_on_push": true, "review_draft_pull_requests": false }
+    },
+    {
+      "type": "code_scanning",
+      "parameters": {
+        "code_scanning_tools": [
+          {
+            "tool": "CodeQL",
+            "security_alerts_threshold": "high_or_higher",
+            "alerts_threshold": "errors"
+          }
+        ]
+      }
+    },
+    { "type": "code_quality", "parameters": { "severity": "errors" } },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [
+          { "context": "Lint & Typecheck", "integration_id": 15368 },
+          { "context": "CodeRabbit", "integration_id": 347564 },
+          { "context": "Test (20.x)", "integration_id": 15368 },
+          { "context": "Test (22.x)", "integration_id": 15368 }
+        ]
+      }
+    }
+  ],
+  "node_id": "RRS_lACqUmVwb3NpdG9yec5AmajgzgCbpXk",
+  "created_at": "2025-11-20T02:14:51.195-06:00",
+  "updated_at": "2025-11-20T12:58:18.002-06:00",
+  "bypass_actors": [
+    { "actor_id": null, "actor_type": "OrganizationAdmin", "bypass_mode": "always" },
+    { "actor_id": 5, "actor_type": "RepositoryRole", "bypass_mode": "always" }
+  ],
+  "current_user_can_bypass": "always",
+  "_links": {
+    "self": { "href": "https://api.github.com/repos/open-hax/codex/rulesets/10200441" },
+    "html": { "href": "https://github.com/open-hax/codex/rules/10200441" }
+  }
+}

.github/workflows/ci.yml

@@ -107,7 +107,7 @@ jobs:
       - lint
       - test
     if: >-
-      ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && startsWith(github.event.head_commit.message, 'chore: release v') }}
+      ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && (startsWith(github.event.head_commit.message, 'chore: release v') || startsWith(github.event.head_commit.message, 'hotfix: release v')) }}
     permissions:
       contents: write
     env:

.github/workflows/codeql.yml

@@ -0,0 +1,32 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [dev, main]
+  pull_request:
+    branches: [dev, main]
+  schedule:
+    - cron: "24 21 * * 5"
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: javascript
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3