chore(rulesets): repoint apply-rulesets + bootstrap to .github fleet source (#575)

[don-petry]

Summary

Repoints the codified applier + bootstrap orchestrator to source the org-wide fleet rulesets (code-quality, pr-quality) from petry-projects/.github (relocated there in the companion PR petry-projects/.github#577), and removes the local copies. release-channel-tags stays repo-local. Repo boundary codified in #576.

Implements AC #1 (the .github-private side), AC #2 (repoint + dedupe), and AC #3 (migration safety) of petry-projects/.github#575.

⚠️ Merge order: land petry-projects/.github#577 first — this PR's applier resolves the fleet JSONs from that repo's standards/rulesets/.

Design decisions (made on best judgment while author was away — flag in review if you'd prefer otherwise)

The two apply-rulesets.sh copies are divergent generations, not literal duplicates: .github's is a detection-based builder (referenced by the recently-delivered pr-limits ADR #505); this repo's is the file-driven codified applier (#889) that actually consumes the JSONs. I took the issue's "clearly delineate roles" path rather than a risky physical merge:

Decision	Choice
Dedupe	Codified applier stays here (with its tests), repointed. The .github detection-based copy is left untouched to avoid disturbing #505 — its retirement/annotation is flagged as an open follow-up, not done unilaterally.
Fleet JSON resolution	FLEET_RULESETS_DIR local-checkout override → else gh contents-API fetch from STANDARDS_REPO (default petry-projects/.github). Mirrors seed-repo-template.sh's _fetch_standard. Consistent with the tool already requiring gh admin API access.
release-channel-tags on new repos	No longer applied to bootstrapped repos (was applied to all — 3 rulesets). It protects .github-private's own pr-review/** + dev-lead/** tags only. New repos now get exactly the 2 fleet rulesets.

Changes

• apply-rulesets.sh — fleet mode (materialize from .github) is the default when RULESETS_DIR is unset; release-channel-tags applied via explicit RULESETS_DIR=.github/rulesets. Removed dead SCRIPT_DIR local default.
• bootstrap-new-repo.sh — step_rulesets applies the 2 fleet rulesets; comments/labels updated for the boundary.
• Removed .github/rulesets/{code-quality,pr-quality}.json (moved to .github).
• Tests — test_apply_rulesets.bats (+3 fleet-mode tests, release-channel-tags now passes RULESETS_DIR); test_bootstrap_new_repo.bats (fleet fixture in setup; dropped the JSON shape assertions now owned by .github; asserts exactly 2 fleet rulesets, never release-channel-tags). 24/24 bats pass, shellcheck --severity=warning -x clean.
• new-repo-validation.md — 3 → 2 ruleset(s); source-of-truth now petry-projects/.github.

Migration safety (AC #3) — proven

• Relocated JSONs are byte-identical to the pre-move copies.
• A live --dry-run against petry-projects/.github-private, sourcing the relocated files, resolves them and updates the existing rulesets in place (PUT by id — code-quality 16142164, pr-quality 16142042), never delete/recreate:

  update ruleset 'code-quality' (id 16142164) ...  [dry-run] PUT ...
  update ruleset 'pr-quality'  (id 16142042) ...  [dry-run] PUT ...
  [apply-rulesets] done (2 ruleset(s))
  

• code-quality live == file (no-op).

⚠️ Pre-existing drift (out of scope — flagging, not fixing)

pr-quality on .github-private has a file-vs-live delta that predates this PR: live require_last_push_approval: true + required_reviewers: [], vs the codified JSON's require_last_push_approval: false (+ automatic_copilot_code_review_enabled: false). The origin/main JSON (byte-identical to the relocated copy) carries the same values, so this move introduces no new drift. Changing what the checks do is explicitly out of scope for #575 — recommend a separate follow-up to reconcile the codified pr-quality with the intended .github-private policy.

Part of #575. Follows #576.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Bootstrapping now applies only the two sanctioned fleet rulesets from the shared standards source.
  • Rule application supports both repo-local and fleet-managed modes, with dry-run behavior preserved.
• Bug Fixes
  • Updated validation and automation to avoid creating or applying the legacy release-channel-tags ruleset during standard bootstrap flows.
• Documentation
  • Clarified bootstrap and ruleset source guidance to match the new shared ruleset setup.
• Tests
  • Expanded coverage for fleet-mode and dry-run rule application, including missing-source error handling.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 17490f7f-a477-43ef-8c84-e07dedab4ae9

📥 Commits

Reviewing files that changed from the base of the PR and between 687a93e and 565b5c3.

📒 Files selected for processing (7)

• .github/rulesets/code-quality.json
• .github/rulesets/pr-quality.json
• docs/bootstrap/new-repo-validation.md
• scripts/apply-rulesets.sh
• scripts/bootstrap-new-repo.sh
• tests/test_apply_rulesets.bats
• tests/test_bootstrap_new_repo.bats

---

📝 Walkthrough

Walkthrough

Local ruleset JSON files (code-quality, pr-quality) are removed. apply-rulesets.sh gains fleet mode, fetching ruleset definitions from a standards repo (petry-projects/.github) instead of local files, defaulting RULESETS_DIR to empty. bootstrap-new-repo.sh forces fleet mode via RULESETS_DIR="". Docs and tests are updated accordingly.

Changes

Fleet-sourced rulesets migration

Layer / File(s)	Summary
Local ruleset removal .github/rulesets/code-quality.json, .github/rulesets/pr-quality.json	Both ruleset JSON files defining branch protection/quality checks are deleted from the repo.
Fleet-mode fetch logic scripts/apply-rulesets.sh	Adds _materialize_fleet_dir and _cleanup_fleet_tmpdir to fetch code-quality/pr-quality JSON from STANDARDS_REPO via gh api, defaults RULESETS_DIR to empty, and changes fleet-mode file selection to iterate a fixed FLEET_RULESETS list.
Bootstrap orchestration wiring scripts/bootstrap-new-repo.sh	Updates docs and step_rulesets to export RULESETS_DIR="", forcing fleet mode and applying only pr-quality and code-quality (excluding release-channel-tags).
Validation docs update docs/bootstrap/new-repo-validation.md	Updates DRY_RUN walkthrough to show two rulesets applied and points source paths to standards/rulesets/ in petry-projects/.github.
Test coverage for local and fleet modes tests/test_apply_rulesets.bats, tests/test_bootstrap_new_repo.bats	Adds RULESETS_DIR/FLEET_RULESETS_DIR fixtures, new fleet-mode tests for apply-rulesets.sh, and updated bootstrap orchestration assertions confirming only the two fleet rulesets are applied.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Bootstrap as bootstrap-new-repo.sh
  participant Apply as apply-rulesets.sh
  participant GH as gh api
  participant Standards as petry-projects/.github

  Bootstrap->>Apply: run with RULESETS_DIR=""
  Apply->>Apply: detect unset RULESETS_DIR
  Apply->>GH: fetch code-quality.json, pr-quality.json
  GH->>Standards: read standards/rulesets/*.json
  Standards-->>GH: base64-encoded content
  GH-->>Apply: decoded JSON files in temp dir
  Apply->>Apply: apply pr-quality and code-quality rulesets
  Apply-->>Bootstrap: report "done (2 ruleset(s))"

Loading

Possibly related issues

• pr-quality ruleset fails to create (HTTP 422): unsupported automatic_copilot_code_review_enabled param #1027: Removal of pr-quality ruleset creation path directly relates to reported creation failure for pr-quality.json.
• Relocate org-wide compliance rulesets (code-quality, pr-quality) from .github-private to .github/standards/rulesets/ .github#575: Both changes concern the same code-quality/pr-quality rulesets and the apply-rulesets.sh tooling that now sources them from a fleet standards repo.
• Fleet coverage + secret-scan backfill: prerequisite for requiring them in code-quality (#575 follow-up) .github#581: Modifies the same fleet code-quality.json ruleset and its application flow, though this PR removes the local config rather than adding checks.

Possibly related PRs

• petry-projects/.github-private#972: Both PRs modify the step_rulesets invocation in bootstrap-new-repo.sh for applying pr-quality/code-quality rulesets.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/repoint-rulesets-575

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-07-02T15:36:47Z.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

- 0 Security Hotspots
- No actionable findings
**CI Status:** All checks passing (no Tier 1 blockers)
- SonarCloud: ✅ success
- CodeQL, ShellCheck, Lint, agent validation: all ✅
- No failed, timed_out, or action_required checks
**Review threads:** None open
---
## Summary
**No changes needed.** The SonarCloud quality gate has passed with zero new issues. All CI checks are green, and there are no open review threads or Tier 1 blockers. The PR is ready.

[gemini-code-assist]

Code Review

This pull request centralizes the organization-wide fleet rulesets (code-quality and pr-quality) by moving them to the petry-projects/.github repository and updating the bootstrap and ruleset application scripts to fetch them dynamically. The local ruleset JSON files have been removed, and the test suites have been updated to mock and verify this new fleet-mode orchestration. The review feedback highlights two important robustness improvements: explicitly propagating failures from mktemp -d inside _materialize_fleet_dir since set -e is suspended during its execution, and guarding grep -c in the test suite with || true to prevent premature test failures when zero matches are found.

[Copilot]

Pull request overview

This PR repoints .github-private’s codified ruleset applier and new-repo bootstrapper to source the org-wide “fleet” rulesets (code-quality, pr-quality) from petry-projects/.github (standards/rulesets/), removing the now-redundant local JSON copies while keeping release-channel-tags repo-local.

Changes:

• Update scripts/apply-rulesets.sh to default to “fleet mode” (materialize code-quality/pr-quality from petry-projects/.github) when RULESETS_DIR is unset; require explicit RULESETS_DIR to apply release-channel-tags.
• Update scripts/bootstrap-new-repo.sh (and tests/docs) so bootstrap applies exactly the two fleet rulesets and never applies release-channel-tags.
• Remove local .github/rulesets/{code-quality,pr-quality}.json and adjust tests/docs accordingly.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
scripts/apply-rulesets.sh	Adds fleet-mode materialization from petry-projects/.github when RULESETS_DIR is unset.
scripts/bootstrap-new-repo.sh	Updates bootstrap ruleset step messaging/behavior to apply only fleet rulesets.
tests/test_apply_rulesets.bats	Adds fleet-mode coverage and makes local release-channel-tags application explicitly pass RULESETS_DIR.
tests/test_bootstrap_new_repo.bats	Shifts validation from local JSON shape checks to orchestration assertions (2 fleet rulesets, not release-channel-tags).
docs/bootstrap/new-repo-validation.md	Updates validation transcript and source-of-truth references to petry-projects/.github standards rulesets.
.github/rulesets/pr-quality.json	Removed local copy (now owned by petry-projects/.github).
.github/rulesets/code-quality.json	Removed local copy (now owned by petry-projects/.github).

[don-petry]

Dev-Lead — fix-reviews (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Superseded by automated re-review at 33cece12bf2fe09e4f893187cd6fea8219ee5f6e — click to expand prior review.

Review — fix requested (cycle 1/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: MEDIUM
Reviewed commit: 02cbaade718a80907f68498d7631809a93fcd449
Review mode: triage-approved (single reviewer)

Summary

Repoints the codified ruleset applier + bootstrap orchestrator to source the org-wide fleet rulesets (code-quality, pr-quality) from petry-projects/.github and removes the local JSON copies; release-channel-tags stays repo-local. The change itself is well-built and well-tested, but it has a hard cross-repo merge-order dependency: companion PR petry-projects/.github#577 (which creates standards/rulesets/ in .github) is still OPEN, and the fleet source path currently 404s. Escalating to hold approval until #577 lands — this is a sequencing hold, not a code-quality objection.

Linked issue analysis

No same-repo closing issue. Implements AC #1 (.github-private side), AC #2 (repoint + dedupe), and AC #3 (migration safety) of petry-projects/.github#575 (open epic; verified). The PR substantively addresses the issue: fleet JSONs removed here, applier defaults to fleet mode sourcing STANDARDS_REPO (petry-projects/.github), bootstrap applies exactly the 2 fleet rulesets and no longer applies release-channel-tags to new repos (consistent with the boundary codified in #576). Migration safety (AC #3) is proven in the PR body: byte-identical JSONs, live dry-run showing PUT-by-id in-place updates (no delete/recreate).

Findings

Blocking (sequencing, not code):

1. Unmet merge-order dependency — the PR's own description says "land chore(rulesets): relocate code-quality + pr-quality to standards/rulesets/ (#575) .github#577 first". Verified: advisory-bot gate strands PRs forever: pushedDate=null disables both absent-bot timeout fallbacks #577 is still open, and repos/petry-projects/.github/contents/standards/rulesets returns 404. Until it merges, any fleet-mode invocation of apply-rulesets.sh (the new default, used by bootstrap-new-repo.sh step 3) fails with could not fetch standards/rulesets/<name>.json. No scheduled workflow invokes the applier, so the blast radius is manual runs + new-repo bootstraps — but auto-approving could enable merge automation to land this prematurely. Re-review and approve once .github#577 is merged.

Non-blocking observations (code is sound):

• _materialize_fleet_dir correctly validates each fetched file with [ -s ] and errors clearly; temp dir cleanup is trap-registered.
• Fleet mode applies an explicit allowlist (FLEET_RULESETS=(code-quality pr-quality)), not a *.json glob — addresses the earlier Copilot finding about stray files in a local checkout.
• step_rulesets forces RULESETS_DIR="" so an inherited env var can't re-enable applying repo-local rulesets to bootstrapped repos — addresses the second Copilot finding.
• All 5 prior review threads (gemini, copilot) are resolved; the two non-outdated ones are verifiably fixed at this head SHA.
• Ruleset content is unchanged (byte-identical relocation); bypass actors, required checks, and enforcement are untouched, so no policy change rides along.
• Pre-existing pr-quality file-vs-live drift is transparently flagged as out of scope with a recommended follow-up — reasonable.
• Secret scan: run_secret_scanning MCP tool unavailable in this session; gitleaks CI check is green. Diff contains no credential-like content (only already-public ruleset JSON removals).

CI status

All checks green at 02cbaad: shellcheck, ShellCheck, Lint, bats (24/24), unit-tests, CodeQL (actions+python), SonarCloud quality gate passed, agent-shield, Agent Security Scan, gitleaks, holdout-guard, template-drift, gh-aw-compile, validate-agent-profiles, guard, review/review. Dependency-audit ecosystem jobs skipped (no matching ecosystems). mergeStateStatus=BEHIND (branch behind main; auto-rebase machinery exists).

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 33cece12bf2fe09e4f893187cd6fea8219ee5f6e
Review mode: triage-approved (single reviewer)

Summary

Re-review after the cycle-1 sequencing hold. The single blocking finding — companion PR petry-projects/.github#577 not yet merged — is now resolved: #577 merged 2026-07-02T23:24Z and standards/rulesets/ in petry-projects/.github serves both fleet JSONs (verified via the contents API). The PR's own files are unchanged since the prior review (the only new commit is a merge of main into the branch), so the prior code analysis stands. All CI green at 33cece1, all 5 review threads resolved. Approving.

Linked issue analysis

No same-repo closing issue. Implements AC #1 (.github-private side), AC #2 (repoint + dedupe), and AC #3 (migration safety) of petry-projects/.github#575. Fleet JSONs removed here; the applier defaults to fleet mode sourcing STANDARDS_REPO (petry-projects/.github, now populated by the merged #577); bootstrap applies exactly the 2 fleet rulesets and no longer applies the repo-local release-channel-tags to new repos (consistent with the boundary codified in #576).

Findings

Prior blocking finding — RESOLVED:

1. Unmet merge-order dependency — petry-projects/.github#577 is merged (2026-07-02T23:24Z, ab54917d). Verified repos/petry-projects/.github/contents/standards/rulesets now serves code-quality.json + pr-quality.json, so fleet-mode apply-rulesets.sh (and bootstrap step 3) resolves its source. The sequencing hold is cleared.

New verification this cycle (informational, non-blocking):

• Compared the merged fleet JSONs against the local copies this PR deletes: code-quality.json is byte-identical; pr-quality.json differs in one field — fleet has require_last_push_approval: true vs local false. This is the pre-existing file-vs-live drift the PR body already flags: the live pr-quality ruleset on this repo has true (verified via the rulesets API), so #577 landed with the drift reconciled toward live. Net effect: applying the fleet ruleset here is a no-op vs production, and the stale local file is the copy being deleted. The PR body's "byte-identical" claim is now slightly stale for pr-quality, but the substance is strictly better — no new drift, and the flagged drift is resolved in the owning repo. New bootstrapped repos inherit require_last_push_approval: true, a policy decision now owned by petry-projects/.github as intended by #575/#576.

Carried from prior review (code is sound, unchanged since 02cbaad):

• _materialize_fleet_dir validates each fetched file ([ -s ]), errors clearly, trap-registered temp-dir cleanup.
• Fleet mode applies an explicit allowlist (FLEET_RULESETS=(code-quality pr-quality)), not a *.json glob.
• step_rulesets forces RULESETS_DIR="" so an inherited env var can't re-enable repo-local rulesets on bootstrapped repos.
• All 5 review threads (gemini ×2, copilot ×3) are resolved.
• Secret scan: run_secret_scanning MCP tool unavailable in this session; gitleaks CI check is green and the diff contains no credential-like content (removals of already-public ruleset JSON + shell/test/doc changes).

CI status

All checks green at 33cece1: shellcheck, ShellCheck, Lint, bats, unit-tests, CodeQL (actions+python), SonarCloud quality gate passed, agent-shield, Agent Security Scan, gitleaks, holdout-guard, template-drift, gh-aw-compile, validate-agent-profiles, guard, review/review, Compile agentic workflows, CodeRabbit. Dependency-audit ecosystem jobs skipped (no matching ecosystems). mergeStateStatus=BEHIND (branch behind main; auto-rebase machinery exists).

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud