sync-rulesets.yml

name: Sync branch rulesets

on:
  push:
    branches: [main]
    paths:
      - '.github/rulesets/**'
  schedule:
    - cron: '17 6 * * 1'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: sync-rulesets
  cancel-in-progress: false

jobs:
  sync:
    name: "Apply rulesets"
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v5
        with:
          persist-credentials: false

      - name: Sync rulesets via API
        env:
          GH_TOKEN: ${{ secrets.RULESET_ADMIN_TOKEN }}
          OWNER: ${{ github.repository_owner }}
          REPO: ${{ github.event.repository.name }}
        run: |
          set -euo pipefail

          if [ -z "${GH_TOKEN:-}" ]; then
            echo "::error::RULESET_ADMIN_TOKEN secret is not set. Cannot manage rulesets."
            echo "Create a fine-grained PAT with administration:write scope and store it as a repo secret."
            exit 1
          fi

          ALL_RULESETS=$(gh api --paginate "/repos/$OWNER/$REPO/rulesets")

          while IFS= read -r -d '' file; do
            NAME=$(jq -r '.name // empty' "$file")
            if [ -z "$NAME" ]; then
              echo "::error::Ruleset file '$file' is missing a non-empty .name field"
              exit 1
            fi
            echo "Processing ruleset: $NAME (from $file)"

            EXISTING_ID=$(jq -r --arg name "$NAME" \
              '[.[] | select(.name == $name) | .id] | first // empty' <<<"$ALL_RULESETS")

            if [ -n "$EXISTING_ID" ]; then
              RESULT_ID=$(gh api --method PUT "/repos/$OWNER/$REPO/rulesets/$EXISTING_ID" \
                --input "$file" --jq '.id')
              echo "Updated ruleset '$NAME' (id=$RESULT_ID)"
            else
              RESULT_ID=$(gh api --method POST "/repos/$OWNER/$REPO/rulesets" \
                --input "$file" --jq '.id')
              echo "Created ruleset '$NAME' (id=$RESULT_ID)"
            fi
          done < <(find .github/rulesets -type f -name '*.json' -print0)