From 4943fa86c99e3c03355f2ad91bcab43a005d88da Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Wed, 8 Apr 2026 01:53:33 +0000
Subject: [PATCH] fix: add code-quality ruleset maintenance script
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds .github/scripts/apply-code-quality-ruleset.sh — an idempotent
script that creates or updates the required `code-quality` repository
ruleset for petry-projects/markets.

The ruleset itself has already been created directly via the GitHub API
(ruleset id 14805963) and is now active on the default branch, enforcing
these required status checks:
  - SonarCloud
  - Analyze (actions)  (CodeQL, actions ecosystem)
  - claude-code / claude

The script serves as a repo-local reference and allows re-creation if
the ruleset is ever accidentally deleted or needs updating.

Closes #51

Co-authored-by: don-petry <don-petry@users.noreply.github.com>
---
 .github/scripts/apply-code-quality-ruleset.sh | 73 +++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 .github/scripts/apply-code-quality-ruleset.sh

diff --git a/.github/scripts/apply-code-quality-ruleset.sh b/.github/scripts/apply-code-quality-ruleset.sh
new file mode 100644
index 00000000..db4d477b
--- /dev/null
+++ b/.github/scripts/apply-code-quality-ruleset.sh
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# apply-code-quality-ruleset.sh — Idempotently create/update the code-quality ruleset
+#
+# This script creates (or updates) the `code-quality` repository ruleset that
+# enforces required status checks on the default branch of petry-projects/markets.
+#
+# Required status checks configured (derived from actual CI check run names):
+#   - SonarCloud          sonarcloud.yml, job: sonarcloud (name: SonarCloud)
+#   - Analyze (actions)   codeql.yml, job: analyze (name: Analyze), language: actions
+#   - claude-code / claude  claude.yml, calling job: claude-code → reusable job: claude
+#
+# Standard reference:
+#   https://github.com/petry-projects/.github/blob/main/standards/github-settings.md#code-quality--required-checks-ruleset-all-repositories
+#
+# Usage:
+#   GH_TOKEN=<admin-token> bash .github/scripts/apply-code-quality-ruleset.sh
+#
+# The org-level script (petry-projects/.github/scripts/apply-rulesets.sh) is the
+# canonical tool for managing rulesets across all repos. This script exists as a
+# repo-local reference and fallback for the markets repository specifically.
+
+set -euo pipefail
+
+REPO="petry-projects/markets"
+RULESET_NAME="code-quality"
+
+if [ -z "${GH_TOKEN:-}" ]; then
+  echo "ERROR: GH_TOKEN is required with administration:write scope" >&2
+  exit 1
+fi
+
+export GH_TOKEN
+
+# Fetch existing rulesets
+EXISTING_ID=$(gh api "repos/$REPO/rulesets" \
+  --jq ".[] | select(.name == \"$RULESET_NAME\") | .id" 2>/dev/null || true)
+
+PAYLOAD=$(jq -n '{
+  name: "code-quality",
+  target: "branch",
+  enforcement: "active",
+  conditions: {
+    ref_name: {
+      include: ["~DEFAULT_BRANCH"],
+      exclude: []
+    }
+  },
+  rules: [
+    {
+      type: "required_status_checks",
+      parameters: {
+        strict_required_status_checks_policy: true,
+        required_status_checks: [
+          {context: "SonarCloud"},
+          {context: "Analyze (actions)"},
+          {context: "claude-code / claude"}
+        ]
+      }
+    }
+  ],
+  bypass_actors: []
+}')
+
+if [ -n "$EXISTING_ID" ]; then
+  echo "Updating existing $RULESET_NAME ruleset (id=$EXISTING_ID) ..."
+  echo "$PAYLOAD" | gh api -X PUT "repos/$REPO/rulesets/$EXISTING_ID" --input - > /dev/null
+  echo "Done — ruleset updated: https://github.com/$REPO/rules/$EXISTING_ID"
+else
+  echo "Creating $RULESET_NAME ruleset ..."
+  RESULT=$(echo "$PAYLOAD" | gh api -X POST "repos/$REPO/rulesets" --input -)
+  NEW_ID=$(echo "$RESULT" | jq -r '.id')
+  echo "Done — ruleset created: https://github.com/$REPO/rules/$NEW_ID"
+fi