Add GitHub rulesets and merge queue skill and migration prompt

promptbook/prompts.json

@@ -859,6 +859,26 @@
       ],
       "formatNotes": "All three. Point the tool at `.github/dependabot.yml` or the Renovate config, every `pom.xml` or `build.gradle(.kts)` and `gradle/libs.versions.toml`, the Dockerfiles, `.github/workflows/`, and CODEOWNERS, and paste the output of `gh api repos/{owner}/{repo}/branches/main/protection` (or the ruleset) so required checks are known. Copilot: dependency-updates path instructions plus those files in agent mode (or save it as `.github/prompts/configure-grouped-dependency-updates.prompt.md`). Claude Code: the dependency-update-automation-guardrails skill plus the files. Codex: AGENTS.md dependency updates section, then the diff.",
       "body": "Task: Configure grouped, scheduled dependency updates with release-age delays and a narrow, check-gated auto-merge for this repository. Cover Maven or Gradle, GitHub Actions, and Docker. Finish with a minimal diff, a grouping plan, and a test that proves a failing or high-risk update does not merge.\n\nContext placeholders (fill from the repo or ask only if missing):\n- Bot: {{BOT}}  (Dependabot, Renovate, or \"recommend one\"; one bot per ecosystem)\n- Build: {{BUILD}}  (Maven with spring-boot-starter-parent, Maven with the spring-boot-dependencies BOM, or Gradle with version catalog and the Spring Boot plugin)\n- Manifest locations: {{MANIFESTS}}  (e.g. /, /services/*, Dockerfiles in /docker and /services/*/)\n- Other ecosystems: {{OTHER_ECOSYSTEMS}}  (docker-compose, helm, terraform, or none)\n- Schedule and timezone: {{SCHEDULE}}  (e.g. weekly, Monday 09:00, Asia/Kolkata)\n- Release-age delay: {{COOLDOWN}}  (e.g. 5 days patch/minor, 14 days for auto-merged and major)\n- Auto-merge scope: {{AUTOMERGE_SCOPE}}  (e.g. patch and minor of Maven plugins, test libraries, GitHub Actions, image digests; or \"none\")\n- Never auto-merge: {{NEVER_AUTOMERGE}}  (e.g. majors, Spring Boot minors, spring-security, nimbus-jose-jwt, jackson, JDBC drivers)\n- Required checks on main: {{REQUIRED_CHECKS}}  (e.g. build, test, dependency-scan; or \"unknown\")\n- Merge method and queue: {{MERGE_METHOD}}  (merge, squash, or rebase; merge queue yes or no)\n- Private registries: {{REGISTRIES}}  (e.g. Azure Artifacts Maven feed, ACR; or none)\n\nRequirements:\n\n1. Inventory\n   - Table: ecosystem | manifest paths | covered by (Dependabot, Renovate, none) | pinned (actions by SHA, images by digest, yes or no) | open bot PRs today | oldest open bot PR\n   - Flag: ecosystems with no coverage, the same manifest covered by two bots, `@v4`-style or branch refs in `uses:`, `latest` or tag-only base images, managed-version overrides without a reason, literal registry credentials\n\n2. Groups and schedule\n   - Per ecosystem: a tooling and test group (patch and minor), a runtime library group (patch and minor), a Spring Boot group (`org.springframework.boot:*` plus the Boot Gradle plugin; Renovate `group:springBoot`), majors ungrouped\n   - Security updates: own group with `applies-to: security-updates` (Dependabot) or default vulnerability handling (Renovate); never blocked by a version group\n   - Order Dependabot groups from most specific to most general\n   - {{SCHEDULE}} with explicit timezone; `open-pull-requests-limit` (Dependabot) or `prConcurrentLimit` and `prHourlyLimit` (Renovate) between 3 and 5\n   - Use `directories` globs or Renovate defaults for {{MANIFESTS}}; `exclude-paths` for fixtures\n\n3. Release-age delay\n   - Dependabot: `cooldown` with `default-days` and semver-specific days from {{COOLDOWN}}; `exclude` for internal group IDs\n   - Renovate: `minimumReleaseAge` per rule, `internalChecksFilter: \"strict\"`, `waitForAllUpdates: true` on groups\n   - Longer delay for anything inside {{AUTOMERGE_SCOPE}}; state that security updates bypass it\n\n4. Pinning\n   - Separate commit: pin every `uses:` to a full commit SHA with a `# vX.Y.Z` comment; pin base images as `image:tag@sha256:<digest>`\n   - Renovate: extend `config:best-practices` (or add `helpers:pinGitHubActionDigests` and `docker:pinDigests`)\n   - Don't invent SHAs or digests: resolve them with `gh api repos/<owner>/<action>/commits/<tag> --jq .sha` and `docker buildx imagetools inspect <image>:<tag>`, or leave a placeholder and list it\n\n5. Spring Boot\n   - Let Boot and its BOM move managed libraries; list every existing override with its reason; propose removing the ones Boot already covers\n   - Boot patch inside auto-merge only if {{AUTOMERGE_SCOPE}} says so and the test suite covers startup and integration; Boot minor and major never auto-merge\n   - Gradle: keep the Boot plugin and `org.springframework.boot` platform in the same group\n\n6. Auto-merge gate\n   - Confirm {{REQUIRED_CHECKS}} via `gh api repos/{owner}/{repo}/branches/main/protection` or the rulesets API; if none are required, stop and output the ruleset change instead of enabling auto-merge\n   - Confirm repository \"Allow auto-merge\" is on (`gh repo view --json autoMergeAllowed`)\n   - Dependabot: `.github/workflows/dependabot-auto-merge.yml` on `pull_request` only; `if` on `github.event.pull_request.user.login == 'dependabot[bot]'` and the repository name; job-level `contents: write`, `pull-requests: write`; `dependabot/fetch-metadata` pinned by SHA; `gh pr merge --auto --{{MERGE_METHOD}}` only when `update-type` and `dependency-names` fall within {{AUTOMERGE_SCOPE}} and outside {{NEVER_AUTOMERGE}}; no checkout, no scripts, no secrets\n   - Renovate: `packageRules` with `matchUpdateTypes`, `matchPackageNames` or `matchManagers`, `automerge: true`; explicit `automerge: false` rule for {{NEVER_AUTOMERGE}} placed after it\n   - Merge queue: document that `GITHUB_TOKEN` cannot enqueue and that a GitHub App token is needed\n\n7. Registries and secrets\n   - {{REGISTRIES}} as Dependabot `registries` with `${{secrets.NAME}}` or OIDC (`tenant-id`, `client-id`), or Renovate `hostRules` with encrypted values; list the Dependabot secrets to create, without values\n\n8. Ownership and validation\n   - CODEOWNERS for the bot config and the auto-merge workflow\n   - CI step for Renovate: `npx --yes --package renovate -- renovate-config-validator --strict`\n   - Majors ignored only with a comment and a tracking issue\n\n9. Proof\n   - Push a failing test to a patch-group branch: it must not merge\n   - A major and a Spring Boot minor: no auto-merge, reviewers requested\n   - A security update: opens even during cooldown and outside the schedule\n\nConstraints:\n- Minimal diff. Don't change application code, build plugins, or CI jobs beyond pinning and the auto-merge workflow.\n- Never use `pull_request_target`, never check out PR code in the auto-merge job, and never grant workflow-level write permissions.\n- Don't enable auto-merge on a branch without required checks.\n- Don't invent SHAs, digests, group IDs, secret names, or check names; use placeholders and state assumptions.\n- Optimize for GitHub Copilot, Claude Code, and Codex: give concrete diffs and a checklist.\n\nOutput format:\n1. Inventory table with flagged issues\n2. Grouping plan: group | ecosystem | matches | update types | cooldown | auto-merge yes or no | why\n3. Patch: bot config, pinning commit, auto-merge workflow or Renovate rules, CODEOWNERS, validator step\n4. Branch protection or ruleset changes needed (as `gh api` commands to review, not to run)\n5. Proof plan with expected results\n6. Risks and follow-ups (e.g. overrides to remove, majors to plan)\n\nStart with the inventory. Pin before you automate, and gate before you auto-merge.\n"
+    },
+    {
+      "id": "migrate-branch-protection-to-rulesets",
+      "title": "Migrate Branch Protection to Rulesets with a Merge Queue",
+      "whenToUse": "Move a repository's classic branch and tag protection into rulesets stored as code: export the current rules, inventory required checks, fix path-filtered workflows with a gate job and merge_group triggers, write default-branch and release-tag ruleset files with a merge queue if warranted, add an apply process and a weekday drift check, and prove that failing, unapproved, force-pushed, and tag-moving changes are blocked.",
+      "tools": [
+        "copilot",
+        "claude-code",
+        "codex"
+      ],
+      "tags": [
+        "github",
+        "rulesets",
+        "merge-queue",
+        "devsecops",
+        "github-actions",
+        "developer-workflow"
+      ],
+      "formatNotes": "All three. Point the tool at `.github/workflows/`, CODEOWNERS, and any existing `.github/rulesets/` or Terraform, and paste the output of `gh api repos/{owner}/{repo}/rulesets`, `gh api repos/{owner}/{repo}/branches/main/protection`, and `gh pr checks <recent-green-pr>`. Copilot: rulesets path instructions plus those files in agent mode (or save it as `.github/prompts/migrate-branch-protection-to-rulesets.prompt.md`). Claude Code: the github-rulesets-merge-queue-guardrails skill plus the files. Codex: AGENTS.md branch rules section, then the diff. The prompt outputs commands to review; it never applies rules itself.",
+      "body": "Task: Move this repository's branch and tag protection into rulesets stored as code, make every required check reliable, and add a merge queue if it is warranted. Finish with ruleset files, workflow fixes, an apply and drift-check process, and a proof plan.\n\nContext placeholders (fill from the repo or ask only if missing):\n- Repository: {{OWNER_REPO}}\n- Plan and owner type: {{PLAN}}  (personal, organization on Team, or Enterprise Cloud; decides whether evaluate mode and org rulesets exist)\n- Default branch and release branches: {{BRANCHES}}  (e.g. main, release/*)\n- Release tag pattern: {{TAG_PATTERN}}  (e.g. v*)\n- Required reviews: {{REVIEWS}}  (e.g. 1 approval, code owners, last-push approval)\n- Checks that must pass: {{CHECKS}}  (e.g. build, test, dependency-scan, CodeQL; or \"discover from a recent PR\")\n- Merge method: {{MERGE_METHOD}}  (merge, squash, or rebase)\n- Merge queue: {{MERGE_QUEUE}}  (yes, no, or \"recommend\")\n- Bypass needs: {{BYPASS}}  (e.g. release app for tags, platform team on PRs only; or none)\n- Apply method: {{APPLY}}  (gh api from a reviewed PR, or Terraform integrations/github)\n\nRequirements:\n\n1. Current state\n   - Export with `gh api repos/{{OWNER_REPO}}/rulesets` (and each `rulesets/{id}`) and `gh api repos/{{OWNER_REPO}}/branches/<branch>/protection`\n   - Table: target | source (classic or ruleset) | rule | setting | gap\n   - Flag: force push or deletion allowed, no PR rule, admins exempt by default, required checks with no app pinned, tags unprotected, bypass actors with `always`\n\n2. Check inventory\n   - From `gh pr checks` on a recent green PR and `.github/workflows/`: check name | workflow file | job id | app | triggers | path or branch filters | matrix\n   - Flag required candidates that are path-filtered, renamed recently, duplicated across workflows, or missing `merge_group`\n\n3. Workflow fixes (separate commit, merged first)\n   - Unfiltered `pull_request` and `merge_group` triggers on required workflows; move path logic into a `changes` job with a SHA-pinned filter action\n   - A final gate job (e.g. `ci-ok`) with `needs:` on all required jobs, `if: always()`, failing when any need failed or was cancelled\n   - Stable, unique job `name:` values; no secrets or deploy steps that run only on `merge_group`\n\n4. Ruleset files\n   - `.github/rulesets/default-branch.json`: conditions with `~DEFAULT_BRANCH` (plus {{BRANCHES}}), `deletion`, `non_fast_forward`, `pull_request` from {{REVIEWS}} with `dismiss_stale_reviews_on_push`, `require_last_push_approval`, `required_review_thread_resolution`, `allowed_merge_methods` [{{MERGE_METHOD}}]; `required_status_checks` with the gate job and `integration_id: 15368` for Actions checks\n   - `.github/rulesets/release-tags.json`: target `tag`, include `refs/tags/{{TAG_PATTERN}}`, `creation`, `update`, `deletion`; bypass only the release actor from {{BYPASS}}\n   - Merge queue (if {{MERGE_QUEUE}}): `merge_queue` with `merge_method`, `grouping_strategy: ALLGREEN`, `max_entries_to_build`, `min_entries_to_merge`, `max_entries_to_merge`, `min_entries_to_merge_wait_minutes`, `check_response_timeout_minutes` from CI duration; set `strict_required_status_checks_policy: false`\n   - `bypass_actors`: only {{BYPASS}}, `pull_request` mode for people and teams; explain any `exempt`\n   - `enforcement: evaluate` first if {{PLAN}} is Enterprise, otherwise a staged rollout note\n   - Terraform equivalent if {{APPLY}} is Terraform\n\n5. Apply and drift\n   - Apply script or workflow: POST on first create, PUT by id after; run from a reviewed merge with a token that has Administration write; never from a PR branch\n   - Scheduled drift workflow on weekdays: fetch live rulesets, normalize (drop `id`, `node_id`, `_links`, `created_at`, `updated_at`, `current_user_can_bypass`, `source`), diff, open or update one issue; no automatic re-apply\n   - CODEOWNERS for `.github/rulesets/` and both workflows\n\n6. Migration\n   - Order: workflow fixes, rulesets active, `gh ruleset check <branch>` verified, then delete classic protection\n   - Note that both systems apply while they overlap\n\n7. Proof\n   - PR with failing test: blocked; PR with no approval: blocked; author pushing after approval: approval required again\n   - Direct push and force push to the default branch: rejected\n   - Non-release actor creating or moving a `{{TAG_PATTERN}}` tag: rejected\n   - With a queue: two PRs merge in order; a failing PR is removed; a docs-only PR still gets a green gate\n\nConstraints:\n- Do not apply rulesets or delete classic protection; output files and the commands to review.\n- Don't invent actor ids, team ids, app ids (other than 15368 for GitHub Actions), or check names; use placeholders and list what must be looked up.\n- Minimal workflow diff; do not change build logic.\n- Never give a human `always` bypass, and never let automation enqueue with `GITHUB_TOKEN`.\n- Optimize for GitHub Copilot, Claude Code, and Codex: give concrete files and a checklist.\n\nOutput format:\n1. Current-state table with gaps\n2. Check inventory table with flags\n3. Patch: workflow fixes, ruleset JSON (or Terraform), apply and drift workflows, CODEOWNERS\n4. Migration steps with the exact `gh` commands to review\n5. Proof plan with expected results\n6. Risks and follow-ups (e.g. checks to rename, bypass to remove, org-level rules to propose)\n\nStart with the export. Fix the checks before you require them, and require them before you queue.\n"
     }
   ]
 }