The importable API payloads are in .github/rulesets/. The dev ruleset requires
reviewed pull requests. Environment rulesets permit fast-forward updates and
require CI, CodeQL, integration, and (for pprd/prod) load/security aggregate checks.
They forbid deletion and non-fast-forward updates and have no bypass actors.
The promotion workflow enforces dev → test → pprd → prod at one validated commit
SHA. It requires explicit production confirmation by katbose before updating prod.
Mergify manages PRs into dev; environment updates do not use Mergify queues or PRs.
Safe activation order
Do not activate the supplied Rulesets before every named external check has
run at least once. Requiring a check that has never registered can block all
merges.
- Install the Mergify, Socket, and Codecov GitHub Apps for this repository.
- Merge the workflow/configuration bootstrap to
prod so Mergify can read
.mergify.yml from the default branch.
- Run CI, CodeQL, Codecov, Socket, and Mergify checks on a test PR.
- Import the three JSON payloads in Settings -> Rules -> Rulesets.
- Confirm each target branch and required check name, then activate the Rulesets.
- Disable the old
protect main branch Ruleset after the replacements are active.
- Enable Merge commits and Squash merging, disable rebase merging, and
leave GitHub native auto-merge and merge queue disabled. Keep automatic branch
deletion disabled during bootstrap; persistent branches must never be deleted.
GitHub Actions contexts use the job name, such as CI Success, without the
workflow prefix displayed in parts of GitHub’s UI. Verify names through the
check-runs API before activation. See Mergify’s GitHub Actions guidance.
Use Ruleset evaluation mode first if it is available on the repository plan. Verify
one complete promotion before switching all policies to active enforcement. 