You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
refactor(governance): consolidate ruleset tools with dynamic scope challenges
Rebase onto main (which now includes #3128's per-call OAuth scope checks)
and redesign the ruleset tools around that API instead of the old
tool-name-keyed challenge middleware that motivated splitting by level.
- Collapse the 5 level-specific tools (repository_ruleset_read,
organization_repository_ruleset_read, create_repository_ruleset,
create_organization_repository_ruleset, create_enterprise_repository_ruleset)
into 2: repository_ruleset_read and create_repository_ruleset. Both take a
"level" argument (repository/organization/enterprise) and use
scopes.DynamicChallenge to return the exact repo / read:org / admin:org /
read:enterprise / admin:enterprise challenge for that call, using the scope
hierarchy so a broader granted scope still satisfies the challenge.
- A missing or unrecognized "level" (or a non-string value) returns no
challenge so normal handler argument validation produces the error,
instead of prompting for scopes on a malformed call.
- Keep repository_ruleset_read and create_repository_ruleset as separate
tools since ReadOnlyHint-based read-only filtering depends on that split.
- Add enterprise-level "get" and "list" read support (list issued directly
via GET /enterprises/{enterprise}/rulesets, matching the existing rule
suite pattern, since go-github has no typed wrapper for it) so all three
levels have symmetric read coverage.
- Re-add read:enterprise/admin:enterprise to pkg/scopes as opt-in
(non-default) OAuth scopes, alongside admin:org which no tool had
previously requested, and register them in oauthScopeDefinitions so they
are advertised in OAuth protected-resource metadata.
- Fetch the "law" toolset icon into the new icons_data_uris.txt embed
(required_icons.txt already listed it) and bump go-github v87 -> v89 to
match main.
- Update README/toolsnaps via script/generate-docs and UPDATE_TOOLSNAPS.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
-`bypass_actors`: The actors that can bypass the rules in this ruleset (object[], optional)
892
-
-`conditions`: Conditions for when this ruleset applies, e.g. {"ref_name": {"include": ["refs/heads/main"], "exclude": []}} (object, optional)
893
-
-`enforcement`: The enforcement level of the ruleset. 'evaluate' allows admins to test rules before enforcing them (string, required)
894
-
-`enterprise`: Enterprise slug (string, required)
895
-
-`name`: The name of the ruleset (string, required)
896
-
-`rules`: An array of rules within the ruleset. Each rule is an object with a 'type' (e.g. 'creation', 'deletion', 'non_fast_forward', 'required_signatures', 'pull_request', 'required_status_checks') and, for rules that need configuration, a 'parameters' object (object[], required)
897
-
-`target`: The target of the ruleset. Defaults to 'branch' (string, optional)
-`bypass_actors`: The actors that can bypass the rules in this ruleset (object[], optional)
902
-
-`conditions`: Conditions for when this ruleset applies, e.g. {"ref_name": {"include": ["refs/heads/main"], "exclude": []}} (object, optional)
903
-
-`enforcement`: The enforcement level of the ruleset. 'evaluate' allows admins to test rules before enforcing them (string, required)
904
-
-`name`: The name of the ruleset (string, required)
905
-
-`org`: Organization name (string, required)
906
-
-`rules`: An array of rules within the ruleset. Each rule is an object with a 'type' (e.g. 'creation', 'deletion', 'non_fast_forward', 'required_signatures', 'pull_request', 'required_status_checks') and, for rules that need configuration, a 'parameters' object (object[], required)
907
-
-`target`: The target of the ruleset. Defaults to 'branch' (string, optional)
-`bypass_actors`: The actors that can bypass the rules in this ruleset (object[], optional)
912
892
-`conditions`: Conditions for when this ruleset applies, e.g. {"ref_name": {"include": ["refs/heads/main"], "exclude": []}} (object, optional)
913
893
-`enforcement`: The enforcement level of the ruleset. 'evaluate' allows admins to test rules before enforcing them (string, required)
894
+
-`enterprise`: Enterprise slug. Required when level is 'enterprise'. (string, optional)
895
+
-`level`: The level at which the ruleset is configured:
896
+
- 'repository': A ruleset on a single repository (requires 'owner' and 'repo').
897
+
- 'organization': A ruleset covering repositories in an organization (requires 'org').
898
+
- 'enterprise': A ruleset covering repositories across an enterprise (requires 'enterprise'). (string, required)
914
899
-`name`: The name of the ruleset (string, required)
915
-
-`owner`: Repository owner (string, required)
916
-
-`repo`: Repository name (string, required)
900
+
-`org`: Organization name. Required when level is 'organization'. (string, optional)
901
+
-`owner`: Repository owner. Required when level is 'repository'. (string, optional)
902
+
-`repo`: Repository name. Required when level is 'repository'. (string, optional)
917
903
-`rules`: An array of rules within the ruleset. Each rule is an object with a 'type' (e.g. 'creation', 'deletion', 'non_fast_forward', 'required_signatures', 'pull_request', 'required_status_checks') and, for rules that need configuration, a 'parameters' object (object[], required)
918
-
-`target`: The target of the ruleset. Defaults to 'branch' (string, optional)
- 'get': Get a specific repository ruleset by ID (requires 'ruleset_id').
925
-
- 'list': List all repository rulesets for the organization. (string, required)
926
-
-`org`: Organization name (string, required)
927
-
-`page`: Page number for pagination (min 1) (number, optional)
928
-
-`perPage`: Results per page for pagination (min 1, max 100) (number, optional)
929
-
-`ruleset_id`: Ruleset ID. Required for the 'get' method. (number, optional)
904
+
-`target`: The target of the ruleset. Defaults to 'branch'. 'repository' is only valid for 'organization' and 'enterprise' level rulesets. (string, optional)
-`actor_name`: The handle for the GitHub user account to filter rule suites on. Used by the 'list_rule_suites' method. (string, optional)
934
909
-`branch`: Branch name. Required for the 'get_rules_for_branch' method. (string, optional)
935
-
-`includes_parents`: Include rulesets configured at higher levels that also apply. Defaults to true. Used by the 'get' and 'list' methods. (boolean, optional)
910
+
-`enterprise`: Enterprise slug. Required when level is 'enterprise'. (string, optional)
911
+
-`includes_parents`: Include rulesets configured at higher levels that also apply. Defaults to true. Used by the 'get' and 'list' methods at the repository level. (boolean, optional)
912
+
-`level`: The level at which the ruleset is configured:
913
+
- 'repository': A ruleset on a single repository (requires 'owner' and 'repo').
914
+
- 'organization': A ruleset covering repositories in an organization (requires 'org').
915
+
- 'enterprise': A ruleset covering repositories across an enterprise (requires 'enterprise'). (string, required)
936
916
-`method`: Operation to perform:
937
-
- 'get': Get a specific ruleset by ID (requires 'ruleset_id').
938
-
- 'list': List all rulesets for the repository.
939
-
- 'get_rules_for_branch': Get all rules that apply to a branch (requires 'branch').
940
-
- 'list_rule_suites': List rule suites, the evaluations of rules against pushes.
941
-
- 'get_rule_suite': Get a specific rule suite by ID (requires 'rule_suite_id'). (string, required)
942
-
-`owner`: Repository owner (string, required)
917
+
- 'get': Get a specific ruleset by ID (requires 'ruleset_id'). Supported at every level.
918
+
- 'list': List all rulesets. Supported at every level.
919
+
- 'get_rules_for_branch': Get all rules that apply to a branch (requires 'branch'). Repository level only.
920
+
- 'list_rule_suites': List rule suites, the evaluations of rules against pushes. Repository level only.
921
+
- 'get_rule_suite': Get a specific rule suite by ID (requires 'rule_suite_id'). Repository level only. (string, required)
922
+
-`org`: Organization name. Required when level is 'organization'. (string, optional)
923
+
-`owner`: Repository owner. Required when level is 'repository'. (string, optional)
943
924
-`page`: Page number for pagination (min 1) (number, optional)
944
925
-`perPage`: Results per page for pagination (min 1, max 100) (number, optional)
945
926
-`ref`: The name of the ref (branch, tag, etc.) to filter rule suites by. Used by the 'list_rule_suites' method. (string, optional)
946
-
-`repo`: Repository name(string, required)
927
+
-`repo`: Repository name. Required when level is 'repository'. (string, optional)
947
928
-`rule_suite_id`: Rule suite ID. Required for the 'get_rule_suite' method. (number, optional)
948
929
-`rule_suite_result`: The rule suite result to filter by. Used by the 'list_rule_suites' method. (string, optional)
949
930
-`ruleset_id`: Ruleset ID. Required for the 'get' method. (number, optional)
Copy file name to clipboardExpand all lines: pkg/github/__toolsnaps__/create_repository_ruleset.snap
+26-7Lines changed: 26 additions & 7 deletions
Original file line number
Diff line number
Diff line change
@@ -1,8 +1,10 @@
1
1
{
2
2
"annotations": {
3
+
"idempotentHint": false,
4
+
"readOnlyHint": false,
3
5
"title": "Create repository ruleset"
4
6
},
5
-
"description": "Create a new ruleset for a repository",
7
+
"description": "Create a new ruleset at the repository, organization, or enterprise level",
6
8
"inputSchema": {
7
9
"properties": {
8
10
"bypass_actors": {
@@ -50,16 +52,33 @@
50
52
],
51
53
"type": "string"
52
54
},
55
+
"enterprise": {
56
+
"description": "Enterprise slug. Required when level is 'enterprise'.",
57
+
"type": "string"
58
+
},
59
+
"level": {
60
+
"description": "The level at which the ruleset is configured:\n- 'repository': A ruleset on a single repository (requires 'owner' and 'repo').\n- 'organization': A ruleset covering repositories in an organization (requires 'org').\n- 'enterprise': A ruleset covering repositories across an enterprise (requires 'enterprise').",
61
+
"enum": [
62
+
"repository",
63
+
"organization",
64
+
"enterprise"
65
+
],
66
+
"type": "string"
67
+
},
53
68
"name": {
54
69
"description": "The name of the ruleset",
55
70
"type": "string"
56
71
},
72
+
"org": {
73
+
"description": "Organization name. Required when level is 'organization'.",
74
+
"type": "string"
75
+
},
57
76
"owner": {
58
-
"description": "Repository owner",
77
+
"description": "Repository owner. Required when level is 'repository'.",
59
78
"type": "string"
60
79
},
61
80
"repo": {
62
-
"description": "Repository name",
81
+
"description": "Repository name. Required when level is 'repository'.",
63
82
"type": "string"
64
83
},
65
84
"rules": {
@@ -83,18 +102,18 @@
83
102
"type": "array"
84
103
},
85
104
"target": {
86
-
"description": "The target of the ruleset. Defaults to 'branch'",
105
+
"description": "The target of the ruleset. Defaults to 'branch'. 'repository' is only valid for 'organization' and 'enterprise' level rulesets.",
0 commit comments