fix: repoint the six org required-workflow rulesets off reusable-workflows (blocks its archival)

[devantler]

🤖 Generated by the Daily AI Engineer

Problem

All six org "Require workflows to pass" rulesets still source their required workflow from the legacy reusable-workflows repo (repository_id: 1022337231) — an org-level consumer class the actions#425 migration verifications missed (they only checked uses: pins in consumer workflow files). This means reusable-workflows is still load-bearing for every gated PR in the org, and archiving it (actions#425 AC3) is blocked until these repoint to actions (repository_id: 948529001).

Live state (verified 2026-07-10):

Ruleset	id	Required workflow	Targeting	Equivalent on actions@main
… - EnableAutoMerge	3716878	enable-auto-merge.yaml	custom prop EnableAutoMerge=true	✅ exists
… - DependencyReview	17213449	dependency-review.yaml	(no property filter)	✅ exists
… - ScanGitHubActions	14426226	scan-for-workflow-vulnerabilities.yaml	custom prop ScanGitHubActions=true	✅ exists
… for .NET	3716863	run-dotnet-tests.yaml	system prop language=C#	✅ exists
… for Go	10320335	validate-go-project.yaml	system prop language=Go	✅ exists
… - LintDocumentation	10320296	lint-documentation.yaml	empty include → targets no repos	❌ missing in both repos

LintDocumentation is doubly inert: the workflow file exists in neither reusable-workflows nor actions, and its repository_property.include is empty, so it matches no repos — pure config debt.

Proposed direction

These rulesets are Observe-only imports in deploy/organization-rulesets/ (per that dir's README, promoting an import past Observe risks wiping live rules via the provider's lossy round-trip), so the sanctioned write path is the same one that created them: the org admin's UI/API. Hence maintainer one-clicks (each fetches the live ruleset fresh, swaps only the repository_id, and PUTs the full object back — same-path workflows all exist on actions@main):

for id in 3716878 17213449 14426226 3716863 10320335; do
  gh api "orgs/devantler-tech/rulesets/$id" \
    | jq '.rules[0].parameters.workflows[0].repository_id = 948529001
          | {name,target,enforcement,conditions,bypass_actors,rules}' \
    | gh api -X PUT "orgs/devantler-tech/rulesets/$id" --input -
done

And delete the inert LintDocumentation ruleset:

gh api -X DELETE orgs/devantler-tech/rulesets/10320296

Verify afterwards (should print 948529001 five times and 404 for 10320296):

for id in 3716878 17213449 14426226 3716863 10320335; do
  gh api "orgs/devantler-tech/rulesets/$id" --jq '.rules[0].parameters.workflows[0].repository_id'
done

Risk is low: the five workflows have identical paths on actions@main and have been the live implementations since the actions v7–v9 merge; the swap changes only which repo the required run is sourced from. If any repo's PR checks wedge after the swap, the same PUT with 1022337231 reverts it.

Rough size

S — five idempotent PUTs + one DELETE, org-admin-only (agent cannot and should not write org rulesets imperatively). Merge-order gate: this must land before reusable-workflows is archived; the archival PR will reference this issue.

Part of actions#425; unblocks monorepo#1964 downstream.

[coderabbitai]

🔗 Related PRs

#74 - feat(rulesets): require the CodeRabbit review status check org-wide [merged]
#75 - revert(rulesets): drop the provider-uncreatable CodeRabbit required-check ruleset [merged]
#76 - fix(ci): release revert commits so reverts reach the cluster [merged]
#79 - feat(labels): bring devantler-tech/monorepo under declarative IssueLabels management [merged]
#80 - ci: repoint reusable workflows to devantler-tech/actions v8.0.0 [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[devantler]

🤖 Generated by the Daily AI Engineer

Status update — urgency downgraded from blocking to cleanup debt, with live evidence. #90 merged (16:18Z) and Crossplane archived reusable-workflows before these one-clicks ran; I probed the failure mode empirically: dependency-review (a ruleset-required workflow sourced from the now-archived repo) executed and passed on wedding-app#174 at 16:23:33Z — required workflows from an archived repo still resolve and run, so no gated PR is broken.

What remains true: the five rulesets now reference workflow files that are frozen forever (read-only repo) — any future change to those required workflows is impossible until the rulesets repoint to actions, and the inert LintDocumentation ruleset (10320296) is still pure config debt. The one-click PUTs + DELETE in this issue's body remain the fix, now at cleanup priority.

[devantler]

🤖 Generated by the Daily AI Engineer

Status: #90 merged and Crossplane has reconciled — devantler-tech/reusable-workflows is now archived (isArchived: true, verified live). Referencing workflows from an archived repo keeps working (archival only disables triggers inside the repo; consumers fetch the file read-only — zizmor even has a dedicated lint for exactly this pattern because it works), so nothing is broken while the six rulesets still point at the archived source.

The one-click PUTs in this issue remain wanted as cleanup: the archived source is frozen, so any future patch to those six required workflows is only possible after the repoint to devantler-tech/actions.

[devantler]

🤖 Generated by the Daily AI Engineer

Live update — this is now a merge-safety blocker, not cleanup-only debt.

KSail #6042 was a human-authored promoted PR. Its CodeRabbit pre-merge state remained not-posted and fresh current-head bot reviews had only been requested, but required-workflow run 29162215382 armed auto-merge at 17:46Z and app/ksail-bot merged it at 18:09Z.

Live ruleset inspection confirms Require workflows to pass before merging - EnableAutoMerge (3716878) still sources repository_id: 1022337231 from archived reusable-workflows. The archived and actions@main copies are currently identical: both run the privileged approval and gh pr merge --auto --squash path for every non-draft PR, including humans.

Therefore repointing alone is insufficient. The safe rollout order is:

1. land actions#545, restricting the privileged job to the explicit trusted-bot allowlist;
2. repoint the org required-workflow ruleset to actions using this issue's admin path;
3. verify a human-authored promoted PR stays unarmed and a trusted-bot PR remains eligible.

The automation remains fail-closed: it did not mutate the organization ruleset.

[devantler]

🤖 Generated by the Daily AI Assistant.

Rollout dependency recorded from devantler-tech/actions#545:

1. Land and release fix(auto-merge): restrict privileged workflow to trusted bots actions#546, which restricts the privileged auto-merge job to the explicit trusted-bot allowlist.
2. Repoint the organization required-workflow ruleset from the archived reusable-workflows source to the fixed actions workflow.
3. Verify a human-authored non-draft PR completes the required workflow with the privileged job skipped and is not auto-armed.
4. Verify an allowlisted trusted-bot PR remains eligible for approval and auto-merge.

Do not repoint before step 1; the current actions@main workflow still contains the same human-author bypass until #546 lands.

[devantler]

🤖 Generated by the Daily AI Engineer

Follow-up to the #6042 evidence: draft actions#546 correctly closes the human-author boundary, but it intentionally does not yet make trusted-bot timing safe. KSail bot PR #6058 was auto-armed at 18:10Z with zero reviews/pre-merge result and merged at 18:30Z when CodeQL finished.

That remaining state-machine defect is now actions#548. Repointing to actions after #546 lands is still an immediate improvement because human PRs will skip the privileged job and the archived source is eliminated. It is not the end state: #548 must also land before trusted-bot auto-merge satisfies the full current-head review/pre-merge contract.