rulesets: add default branch protection for all repositories

[wolfgangwalther]

This adds a default branch protection ruleset for all (existing and future) repositories in the NixOS org. It only targets the default branch and disallows deletion and force pushes.

This seems like a reasonable default and I doubt that any repositories depend on being able to do either of that. And if they do, it's doubtful, whether these repositories are in the right place in the NixOS org.

This needs to be imported on the organization level, via Settings -> Repository -> Rulesets.

[wolfgangwalther]

I tried adding to the export.bash script to also export this default ruleset, but it seems like API access is only enabled for GitHub Teams:

% gh api /orgs/infinisil-test-org/rulesets
gh: Upgrade to GitHub Team to enable this feature. (HTTP 403)

Thus I can't test what the response looks like etc.

Since this is only a single rule, maybe exporting it once is not too bad. Alternatively, @infinisil, you could look into that and adjust the export script accordingly.

[infinisil]

I just did a survey of force pushes in the last year. Results:

• nixos-homepage: A force push from @thilobillerbeck to main on 2025-09-09, and two others on 2025-05-25
• nixpkgs-merge-bot: A force push from @Scriptkiddi to main on 2025-01-04
• nixpkgs-committers: Two force pushes from @infinisil to main on 2025-07-07
• SC-election-2025: Force pushes (like this) by @ners up to 2025-09-14

[infinisil]

For my force pushes, that's when I set up the repo. I wouldn't have had any problem with being blocked from force pushing.

[wolfgangwalther]

We are certainly OK with not being able to force-push for nixpkgs-merge-bot.

[infinisil]

Btw I updated the links above to use the .. compare, not the ... compare, because only the former displays changes between force pushes correctly.

[wolfgangwalther]

Even without explicit feedback otherwise, I don't think these force pushes are required per-se for the mentioned repos. Personally, I'd feel confident to still go ahead with this.

[zimbatm]

We will need better tooling for applying rulesets before expanding this to all the repos. Otherwise it's going to be too much overhead for the org team.

[wolfgangwalther]

No, this is an org-wide default branch protection ruleset, that will be applied once at the org level and will then apply to every repo's default branch only. It is very basic and not much work.

[infinisil]

Let's go for this, needs approval from another org owner though

[zimbatm]

Alright, in that case sounds good 👍

[infinisil]

Applied