feat: add pr-quality ruleset support to apply-rulesets.sh by don-petry · Pull Request #80 · petry-projects/.github

don-petry · 2026-04-06T18:46:51Z

Summary

Adds build_pr_quality_ruleset_json() to scripts/apply-rulesets.sh that builds the standard pr-quality ruleset payload per standards/github-settings.md
Updates apply_rulesets() to create/update the pr-quality ruleset on each target repo alongside code-quality
Removes stale TODO note from standards/github-settings.md about this gap

Ruleset configuration:

Setting	Value
Target branch	Default branch (`~DEFAULT_BRANCH`)
Enforcement	Active
Required approving reviews	1
Dismiss stale reviews on push	Yes
Require code owner review	Yes
Require last push approval	Yes
Required review thread resolution	Yes
Linear history (squash-only)	Yes (`required_linear_history` rule)
Force pushes	Blocked
Branch deletion	Blocked
Bypass: OrgAdmin	Always
Bypass: dependabot-automerge-petry	pull_request events

Usage — apply with an admin token after merging:

# Apply to this repo
GH_TOKEN=<admin-token> ./scripts/apply-rulesets.sh .github

# Apply to all org repos
GH_TOKEN=<admin-token> ./scripts/apply-rulesets.sh --all

The compliance finding won't close until the ruleset is actually created on the repo by running the script with an admin token.

Closes #48

Generated with Claude Code

Adds build_pr_quality_ruleset_json() function and updates apply_rulesets() to create/update the pr-quality ruleset on each repo, per the standard defined in standards/github-settings.md. Ruleset enforces: - 1 required approving review - Dismiss stale reviews on push - Require code owner review - Require last push approval - All review threads resolved before merge - Linear history (squash-only merges) - No force pushes, no branch deletion Bypass actors: OrganizationAdmin (always), dependabot-automerge-petry (pull_request). Also removes stale TODO note from standards/github-settings.md about pr-quality support being missing from the script. Closes #48 Co-authored-by: don-petry <don-petry@users.noreply.github.com>

coderabbitai · 2026-04-06T18:48:18Z

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 14 minutes and 26 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 14 minutes and 26 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 7545eb15-f2fd-4705-b78d-b5412547e16e

📥 Commits

Reviewing files that changed from the base of the PR and between 2d51eb8 and 1c778b6.

📒 Files selected for processing (2)

scripts/apply-rulesets.sh
standards/github-settings.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch claude/issue-48-20260406-1842

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

sonarqubecloud · 2026-04-06T18:52:41Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds support to manage a pr-quality repository ruleset via scripts/apply-rulesets.sh, aligning automated ruleset application with the documented GitHub settings standard.

Changes:

Added build_pr_quality_ruleset_json() to generate the pr-quality ruleset payload.
Updated apply_rulesets() to create/update the pr-quality ruleset alongside code-quality.
Updated the standards doc to reflect that both rulesets are now applied via the script.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
standards/github-settings.md	Updates guidance to reflect that `apply-rulesets.sh` now applies both `pr-quality` and `code-quality`.
scripts/apply-rulesets.sh	Adds JSON payload builder and create/update logic for the new `pr-quality` ruleset.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-06T18:53:14Z

+    bypass_actors: [
+      {
+        actor_id: 0,
+        actor_type: "OrganizationAdmin",
+        bypass_mode: "always"
+      },
+      {
+        actor_id: 3167543,
+        actor_type: "Integration",
+        bypass_mode: "pull_request"
+      }


The bypass actor for the Integration is hard-coded to actor_id=3167543, which is brittle (IDs can differ across orgs/enterprise instances and are hard to validate/recover if changed). To make the script reliably applicable across repos/environments, resolve the integration ID dynamically (e.g., via GitHub API lookup by slug/name) or accept it as a configurable input (env var/flag) and fail with a clear message if it can’t be resolved.

Copilot · 2026-04-06T18:53:14Z

+  local pr_quality_id
+  pr_quality_id=$(echo "$existing_rulesets" | jq -r '.[] | select(.name == "pr-quality") | .id' 2>/dev/null || echo "")
+


If multiple rulesets with the same name exist, this jq expression can return multiple IDs (newline-separated), which would produce an invalid endpoint in the subsequent PUT request. Consider constraining this to a single ID (e.g., selecting the first match) and optionally detecting/reporting duplicates explicitly so the script behaves deterministically.

Suggested change

local pr_quality_id

pr_quality_id=$(echo "$existing_rulesets" | jq -r '.[] | select(.name == "pr-quality") | .id' 2>/dev/null || echo "")

local pr_quality_match_count

pr_quality_match_count=$(echo "$existing_rulesets" | jq -r '[.[] | select(.name == "pr-quality")] | length' 2>/dev/null || echo "0")

local pr_quality_id

pr_quality_id=$(echo "$existing_rulesets" | jq -r '[.[] | select(.name == "pr-quality") | .id][0] // empty' 2>/dev/null || echo "")

if [ "$pr_quality_match_count" -gt 1 ]; then

err " Found multiple pr-quality rulesets for $ORG/$repo; refusing to continue because the target ruleset is ambiguous"

return 1

fi

Copilot · 2026-04-06T18:53:14Z

+          required_review_thread_resolution: true
+        }
+      },
+      { type: "required_linear_history" },


The PR description states 'Linear history (squash-only)'. The required_linear_history ruleset enforces no merge commits (linear history) but does not enforce 'squash-only' specifically (rebases can still yield a linear history depending on repo merge settings). Either adjust the wording in the PR description/standards to 'linear history' or add/ensure separate repo settings enforcement for allowed merge methods if 'squash-only' is required.

don-petry · 2026-04-06T18:55:16Z

CI is green ✅ — all checks pass (Lint, ShellCheck, CodeQL, SonarCloud, Agent Security Scan).

Copilot left 3 inline comments but its review state is COMMENTED (not CHANGES_REQUESTED). No blockers.

@don-petry — ready for your review and merge. After merging, run the script with an admin token to create the ruleset and resolve the compliance finding:

GH_TOKEN=<admin-token> ./scripts/apply-rulesets.sh .github

Copilot AI review requested due to automatic review settings April 6, 2026 18:46

don-petry mentioned this pull request Apr 6, 2026

Compliance: missing-pr-quality #48

Closed

Copilot AI reviewed Apr 6, 2026

View reviewed changes

Copilot started reviewing on behalf of don-petry April 6, 2026 18:53 View session

don-petry merged commit 67997b1 into main Apr 6, 2026
28 checks passed

don-petry deleted the claude/issue-48-20260406-1842 branch April 6, 2026 20:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add pr-quality ruleset support to apply-rulesets.sh#80

feat: add pr-quality ruleset support to apply-rulesets.sh#80
don-petry merged 1 commit intomainfrom
claude/issue-48-20260406-1842

don-petry commented Apr 6, 2026

Uh oh!

coderabbitai Bot commented Apr 6, 2026

Rate limit exceeded

Uh oh!

sonarqubecloud Bot commented Apr 6, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 6, 2026

Uh oh!

Copilot AI Apr 6, 2026

Uh oh!

Copilot AI Apr 6, 2026

Uh oh!

don-petry commented Apr 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		local pr_quality_id
		pr_quality_id=$(echo "$existing_rulesets" \| jq -r '.[] \| select(.name == "pr-quality") \| .id' 2>/dev/null \|\| echo "")

-  local pr_quality_id
-  pr_quality_id=$(echo "$existing_rulesets" | jq -r '.[] | select(.name == "pr-quality") | .id' 2>/dev/null || echo "")
+  local pr_quality_match_count
+  pr_quality_match_count=$(echo "$existing_rulesets" | jq -r '[.[] | select(.name == "pr-quality")] | length' 2>/dev/null || echo "0")
+  local pr_quality_id
+  pr_quality_id=$(echo "$existing_rulesets" | jq -r '[.[] | select(.name == "pr-quality") | .id][0] // empty' 2>/dev/null || echo "")
+  if [ "$pr_quality_match_count" -gt 1 ]; then
+    err "  Found multiple pr-quality rulesets for $ORG/$repo; refusing to continue because the target ruleset is ambiguous"
+    return 1
+  fi

Conversation

don-petry commented Apr 6, 2026

Summary

Uh oh!

coderabbitai Bot commented Apr 6, 2026

Rate limit exceeded

Uh oh!

sonarqubecloud Bot commented Apr 6, 2026

Quality Gate passed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

don-petry commented Apr 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants