Ruleset Governance

Ruleset Governance

Use this skill for GitHub branch, tag, and push ruleset design.

Workflow

1. Inspect current branch protection, rulesets, default branch, required checks, bypass actors, and repository risk tier.
2. Choose the lightest rule that protects the repo without slowing solo development.
3. Prefer evaluate or warn-first rollout for broad org changes unless the user explicitly asks for enforcement.
4. Apply strict rules only where checks are stable and recovery paths are clear.
5. Re-read ruleset state after changes.

Recommended Solo-Developer Baseline

• Block force pushes and branch deletion on main.
• Require status checks only when validation is stable and available to the repository.
• Allow owner/admin bypass for emergency recovery.
• Do not require pull requests or PR reviews for single-developer repositories.
• Consider mandatory PR review only when a repo has external contributors or production-critical deploy gates.
• Do not require checks from a CI system that the repository has not adopted.

Decision Rules

• Do not require signed commits org-wide without confirming the user's signing setup.
• Do not require a check that is flaky, missing, or named inconsistently.
• Do not require runner-backed checks if the repo does not have reliable runner capacity.
• Do not apply release/tag restrictions to repos that do not publish releases.
• Keep ruleset names explicit: main-safety, release-tags, push-hygiene.

References

• GitHub ruleset rule types: references/ruleset-baseline.md

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: ravisingh11
• Source: ravisingh11/agent-safe-engineering
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.