[zoeyrose]

Summary

Ordinary ruleset updates currently replace live payloads with templates that omit writable GitHub PR/CI controls, while equivalent state still produces redundant writes. Preserve the reviewed compatible controls, reject unknown restrictions, and plan updates only for real managed-policy drift.

Implementation / behavior

• Share the strict publisher/audit comparison in lib/ruleset-policy.jq. Normalize the ignored OrganizationAdmin.actor_id, supported array ordering, and the existing reviewed compatible API extensions.
• Preserve live empty required_reviewers, all three allowed_merge_methods, require_extra_approval_for_unattributed_changes: true, and do_not_enforce_on_create: false in replacement payloads. Other extension values, unknown fields, and additional rules such as deployment gates require manual review instead of being discarded.
• Verify an existing ordinary ruleset's ID, name, and source; compare the complete final reread before PUT and refuse observed concurrent edits. Recognize response-only current_user_can_bypass without weakening that full-document fence. Existing specialized security-restoration fences remain in place and its compatible CI field is preserved.
• Skip converged repository merge defaults and organization workflow permissions. Queue installation and verification still precede relaxed required CI.

The inspected inventory's publisher plan drops from 50 to 8 proposed operations, eliminating 21 redundant repository PATCHes, one workflow-permissions PUT, and 20 equivalent ruleset PUTs. The remaining proposals cover Pathfinder defaults/CI, Playtester queue/CI, two shared scope changes, and two configured stale-rule retirements. The separate repository-properties proposal is outside this count.

Validation

• Passed the new comparison/preservation fixtures, full publisher policy-scope tests, audit fixtures, pagination, merge-queue, specialized security, and required-CI/maintenance-retirement tests.
• Passed schema validation, Bash syntax, ShellCheck, actionlint, and git diff --check; lint ran in the pinned build image with read-only source and no network.
• Completed a guarded read-only live publisher plan. Exact final-head replay of that captured API snapshot reproduced the same eight proposals.
• Independent full review plus fix-delta review cleared bbf4aa63d2dda1aabde3b93155cd6165091e4215. The review's P2 concerning response-only bypass metadata was fixed and covered by KEEP, PUT, and concurrency regression cases.

Limitations / follow-up

No live settings were changed by this work. None of the eight proposals, the separate properties change, or the configured retirements has current owner authorization for application. Review fresh identities, payloads, producer evidence, and ordering before any separately authorized apply.

The final reread detects observed races; it is not an atomic API compare-and-swap. The final-head plan replay uses captured responses, not a second live read. Remote CI and live PR readiness remain separate delivery gates.

[zoeyrose]

Reviewed head: bbf4aa63d2dda1aabde3b93155cd6165091e4215.
Base: 9e5aa0cbeda41ac55307f712df8a42f6729a790e.

A fresh-context independent reviewer inspected the complete eleven-file change through a1aac815b2fc30a45dfd4ae768856d93dc90a996, the affected publisher/audit paths, ruleset templates, repository guidance, tests, and the source-only recovery constraints. Review covered correctness, writable-field preservation, unknown restrictions, ownership and concurrent-edit fences, failure propagation, security-restoration and queue interactions, and documentation. The reviewer then inspected the three-file fix delta through the exact head above. No actionable findings remain in the reviewed scope.

Finding and disposition:

• P2 — response-only caller-bypass metadata rejected valid repository rulesets. policy_body omitted current_user_can_bypass from its metadata exclusions, causing a valid KEEP or update to fail closed. Fixed in bbf4aa63d2dda1aabde3b93155cd6165091e4215: exclude that documented response field from the writable body, retain it in complete-state reread comparison, and add ordinary KEEP/PUT, metadata-race, and specialized security-restoration coverage. Independent delta review verified the fix and found no new defects. No findings were declined.

Validation evidence:

• Comparison/preservation, publisher policy-scope, audit, pagination, merge-queue, specialized security, and required-CI/maintenance-retirement fixtures passed. Comparison and specialized security suites passed after the final fix.
• Schema, Bash syntax, ShellCheck, actionlint, and diff checks passed. The reviewer independently ran the comparison/security/pagination suites during full review and reran the comparison suite, original metadata reproducer, syntax, and delta diff checks for the fix.
• A guarded read-only live plan completed with eight proposals instead of the previous fifty; exact final-head replay of the captured API responses reproduced those eight operations. The final metadata-only fix does not alter the audited normalization or the observed organization-rule payloads. The replay is snapshot evidence, not a fresh live-state assertion.

The compatible writable PR/CI fields remain preserved, unknown or conflicting restrictions fail closed, and no live settings were changed. The remaining configured policy and retirement proposals are not owner-authorized applies. This receipt attests to the exact reviewed source and stated local evidence; remote CI, current branch freshness, unresolved PR threads, and live readiness require their separate checks.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

None

[github-actions]

🎉 This PR is included in version 2.26.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀