ci: adopt ruleset merge protection and pass owner-authored PRs

[loadinglucian]

What

Companion to Bigpixelrocket/php-bin#61.

• .github/workflows/protected-controls.yml: owner-authored PRs now pass. A solo owner cannot approve their own PR, so the exact-head owner-review requirement was unsatisfiable for owner-authored changes and always ended in an administrative bypass. The short-circuit sits before the readiness-record exemption, so it cannot widen what the automation identity may merge; all non-owner authors still require the exact-head owner approval.
• docs/repository-settings.md: documents the protect_main ruleset model (installed by php-bin's configure script) with repository administrators as bypass actors in pull_request mode, replacing classic branch protection and its enforce_admins toggle.
• test/test_autorelease.py: pins the owner short-circuit's position relative to the automation exemption.

Notes

• protected-controls.yml runs on pull_request_target, so the owner-pass behavior takes effect only after this merges; this PR itself shows the old red-by-design failure.
• Admin-state snapshot will be refreshed once the ruleset migration has been applied.

Verification

./scripts/test.sh passes (23 tests).

Summary by CodeRabbit

• New Features

  • Updated repository controls to support streamlined handling of owner-authored changes.
  • Added comprehensive main-branch protections, including pull requests, required reviews and checks, resolved threads, linear history, and safeguards against force pushes and branch deletion.
  • Updated protected-path validation and approval requirements.

• Documentation

  • Updated repository settings documentation and administrative state records to reflect the new controls.

• Tests

  • Added regression coverage for protected-control evaluation.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 34 seconds

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c5fd16f3-0af8-4213-b5c6-ea075f0257be

📥 Commits

Reviewing files that changed from the base of the PR and between a2a760d and 31a8ff5.

📒 Files selected for processing (2)

• docs/admin-state/mise-php-after.json
• docs/repository-settings.md

📝 Walkthrough

Walkthrough

The pull request replaces classic branch protection with the protect_main ruleset, updates the repository state snapshot, and adds an owner-authored pass path to protected-controls.yml with a source-order regression test.

Changes

Protected controls and repository ruleset

Layer / File(s)	Summary
Repository ruleset policy .github/workflows/protected-controls.yml, docs/repository-settings.md, docs/admin-state/mise-php-after.json	The repository defines the protect_main ruleset with required pull requests, CODEOWNER review, resolved threads, required checks, linear history, and blocked force pushes and deletion. Classic branch protection is removed. The state snapshot records the ruleset and disables workflow approval permission.
Owner-authored protected-controls flow .github/workflows/protected-controls.yml, test/test_autorelease.py	Owner-authored protected-path changes pass after the no-protected-path check and before the autorelease exemption. A regression test verifies this source order.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• Bigpixelrocket/mise-php#27: Both changes update protected-controls.yml and test/test_autorelease.py.
• Bigpixelrocket/mise-php#13: Both changes modify protected-path enforcement for owner-authored changes.
• Bigpixelrocket/mise-php#8: Both changes modify owner and CODEOWNER approval behavior in protected-controls.yml.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the changes and testing, but it omits the required Summary and Security sections and most Verification checklist items.	Add the required Summary, Verification, and Security sections, and address each checklist item from the repository template.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the ruleset migration and owner-authored pull request behavior change.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/ruleset-merge-protection

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/admin-state/mise-php-after.json`:
- Around line 94-113: Update the rulesets snapshot entry in mise-php-after.json
to include the effective configuration fields conditions, rules, and
bypass_actors, rather than metadata alone. Normalize these values consistently
with the repository settings snapshot so changes to protected-branch controls
are detected.

In `@docs/repository-settings.md`:
- Around line 19-24: Update the protected controls documentation to explicitly
exempt protected readiness/*.json changes produced by the trusted
github-actions[bot] readiness flow, while retaining the exact-head loadinglucian
approval requirement for other authors and protected paths.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 46097159-f265-4987-b930-60c875f09be8

📥 Commits

Reviewing files that changed from the base of the PR and between 7263fa0 and a2a760d.

📒 Files selected for processing (4)

• .github/workflows/protected-controls.yml
• docs/admin-state/mise-php-after.json
• docs/repository-settings.md
• test/test_autorelease.py