rulesets: remove the duplicate pull_request rule in org ruleset 17988999

Refs: #12284

Owner: Automation Lanes. This is a settings change, not code. Automation Lanes applies it only after checking that it removes nothing but a duplicate and loosens nothing.

Summary

On main, two organization rulesets each carry a pull_request rule (GET repos/melodic-software/claude-code-plugins/rules/branches/main, read 2026-11-02):

Ruleset	`dismiss_stale_reviews_on_push`	Other parameters
17988999	false	squash only, 0 approvals, thread resolution required, extra approval for unattributed changes
24475076	true	the same

GitHub applies the stricter value of each parameter when several rules apply, so the effective rule is ruleset 24475076's. Ruleset 17988999's pull_request rule duplicates it. This affects every repository the two organization rulesets target, not only this one. Source: audit comment, gate #16.

The measured cost is none. This slice removes a second place where the same setting must be kept in step.

Done when

Both rulesets' targets (repositories and branches) are listed, and every target of 17988999's pull_request rule is also covered by 24475076's with equal or stricter values. Otherwise the stricter values are carried into the kept rule first.
The duplicate pull_request rule is removed through the repository that manages organization rulesets (github-iac), not by hand.
rules/branches/main read after the change shows one pull_request rule, with values equal to or stricter than today's on every parameter.

Proposed work class: work-class: scoped
Basis: automated intake triage; the lanes App applied this class.

Size: Small
Complexity: Low
Uncertainty: Knowable
Flags: none
Blocked by: none

Understood: two organization rulesets (17988999 and 24475076) both carry a pull_request rule on main. The effective rule is the stricter one, from 24475076. You want the duplicate in 17988999 removed through github-iac. First, you want to confirm that every target of 17988999 is also covered by 24475076 with equal or stricter values. After the change, rules/branches/main should show one pull_request rule that is no looser than today's.

The scope and done-when are exact, so nothing is missing. I found no open duplicate.

_{Automated triage, applied by the lanes App.}

No description provided.

The work-resolve-issue lane stopped on this issue (manual-external): the run reports the work needs a manual step on external state, one of pr-pipeline.yaml's attended classes, which needs the owner present.
It added attended and removed agent-ready: the step needs the owner present, and it waits on no decision from a person.

In the run's words:

manual-external: the change is to live organization rulesets 17988999 and 24475076 (external GitHub state). Per the issue, it is applied through the separate github-iac repository by the Automation Lanes owner, who first checks the rulesets' live targets and then reads rules/branches/main after the change. This lane can change only the claude-code-plugins checkout, cannot read or write the github-iac repository, and has no GitHub API access for reading the rulesets' targets or the branch rules. No done-when item can be met or checked from here.

What the run says it did not do:

Listing both rulesets' targets and comparing 17988999's pull_request parameters against 24475076's: needs the live GitHub org rulesets API, which this lane cannot call
Removing the pull_request rule from ruleset 17988999 in github-iac: a separate repository outside this lane's checkout, owned by Automation Lanes
Reading rules/branches/main after the change to confirm one pull_request rule with equal or stricter values: needs live API access after the github-iac change is applied
Tidy, review and verify steps skipped: no change was made

Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/41494965421

Once the step is done, a listed human removes attended and adds agent-ready again.

Closing: the rule is not a duplicate. Read live today (gh api orgs/melodic-software/rulesets/<id>):

Ruleset	Repositories	Bypass	`dismiss_stale_reviews_on_push`
17988999 `base`	`~ALL`	none	false
24475076 `trust-root`	azure-iac, claude-code-plugins, pr-pipeline-sandbox, standards	OrganizationAdmin (pull_request)	true

Every other pull_request parameter is equal.

The first Done-when item fails: 17988999 covers every repository and 24475076 covers four. None of the ways to remove one of the two rules is a plain duplicate removal:

Remove base's rule. Every repository outside those four loses squash-only and required thread resolution. On the four, trust-root's admin bypass then becomes effective. That loosens a control.
Remove trust-root's rule. The four trust roots lose dismiss_stale_reviews_on_push. That also loosens a control.
Carry dismiss_stale_reviews_on_push: true into base, then drop trust-root's rule. That tightens every repository in the org. It is a scope change, not the zero-cost cleanup this issue describes.

The two rules express "base everywhere, stricter on the trust roots" with the fewest moving parts, so both stay. Nothing was changed. Whether to consolidate them in the hardening pass is the owner's call.

Agent choice (GitHub Support hub, option (a)), not an owner answer: no control changes.

Navigation Menu

Repository navigation

rulesets: remove the duplicate pull_request rule in org ruleset 17988999 #12438

Summary

Done when

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

rulesets: remove the duplicate pull_request rule in org ruleset 17988999 #12438

Description

Summary

Done when

Activity

github-actions commented on Nov 2, 2026

github-actions commented on Nov 2, 2026

github-actions commented on Nov 2, 2026

melodic-automation-lanes commented on Nov 2, 2026

kyle-sexton commented on Nov 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions