branch-ruleset-setuplisted

# Skill: branch-ruleset-setup Configures a **repository ruleset** (not classic branch protection) named `main` targeting the default branch (`~DEFAULT_BRANCH`). Everything runs through the `gh` CLI with the ruleset passed as **inline JSON via heredoc** — never create a ruleset JSON file in the repo. Run this when asked to "protect main", set up branch protection / a branch ruleset, or as the branch-protection slice of a release/supply-chain audit (see the sibling skill **`release-audit`**). Precondition: `gh auth status` must be authenticated with **admin** rights on the target repo. ## Phase 0 — Ensure a referenceable CI check exists A required status check only makes sense if the CI job actually exists. Never hardcode the check name — detect it: ```bash ls .github/workflows/ 2>/dev/null grep -rl "pull_request" .github/workflows/ 2>/dev/null ``` - **A `pull_request`-triggered workflow exists** → note its job name (= the status-check `context`). If the job is called `ci` or `test` instead of `build`, use that name below. - **No workflow exists** → create a minimal one first, commit it to the default branch, and let it run **at least once** so the check context exists. Example (`.github/workflows/build.yml` — adapt steps to the repo's actual stack): ```yaml name: Build on: pull_request: branches: [main] jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 - uses: actions/setup-node@v6 with: