Install
$ agentstack add skill-boettiger-lab-agent-skills-github-rulesets ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
GitHub Repository Rulesets
Apply branch-protection rulesets and merge settings to repos. Two profiles available:
| Profile | Approvals | Dismiss stale reviews | Use for | |---|---|---|---| | standard | 0 | no | smaller / solo projects | | strict | 1 | yes | larger / team projects |
Both profiles enforce: require PR, block deletion, block force push, squash-merge-only, delete branch on merge.
How to apply
Run the shell script directly:
/home/cboettig/.claude/skills/github-rulesets/apply-ruleset.sh OWNER/REPO [standard|strict]
Or use gh one-liners directly:
Squash-merge-only + delete branch on merge
gh api -X PATCH repos/OWNER/REPO -f allow_squash_merge=true -f allow_merge_commit=false -f allow_rebase_merge=false -f delete_branch_on_merge=true --silent
Create/apply the ruleset
# standard (no approval required):
gh api -X POST repos/OWNER/REPO/rulesets --input /home/cboettig/.claude/skills/github-rulesets/ruleset-standard.json --silent
# strict (1 approval, dismiss stale):
gh api -X POST repos/OWNER/REPO/rulesets --input /home/cboettig/.claude/skills/github-rulesets/ruleset-strict.json --silent
Update an existing ruleset
# Find the ruleset ID:
gh api repos/OWNER/REPO/rulesets --jq '.[].id'
# Update it:
gh api -X PUT repos/OWNER/REPO/rulesets/RULESET_ID --input /home/cboettig/.claude/skills/github-rulesets/ruleset-standard.json --silent
What each ruleset does
The JSON payloads at ruleset-standard.json and ruleset-strict.json create a ruleset named default-branch-protection targeting ~DEFAULT_BRANCH with these rules:
deletion— prevents branch deletionnon_fast_forward— blocks force pushespull_request— requires a PR to merge (approval count and stale-review settings vary by profile)
The apply-ruleset.sh script is idempotent: it updates an existing ruleset with the same name rather than creating duplicates.
Notes
- Rulesets require the caller to have admin access to the repo.
- The
~DEFAULT_BRANCHref pattern automatically targets whatever the repo's default branch is (main, master, etc.). - Repo-level merge settings (squash-only) are separate from rulesets and set via
PATCH repos/OWNER/REPO.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: boettiger-lab
- Source: boettiger-lab/agent-skills
- License: BSD-3-Clause
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.