ci: self-healing branch-protection + tag/release protection

[CameronBrooks11]

Summary

All 15 org repos currently have classic main protection applied and current
(verified live 2026-06-26) via scripts/apply-branch-protection.sh, required
check ok. The gap is not missing protection — it's that enforcement is
manual and incomplete:

1. No drift-healing automation. The script is run by hand; nothing re-asserts
   it on a schedule, so protection drift is invisible until someone notices.
2. Tags/releases are unprotected, even though providers publish versioned
   releases (tag deletion/force-push is currently possible).

Org is on GitHub Free, so org-level rulesets aren't available — we stay on the
per-repo scripted classic-protection approach, but make it self-healing.

Scope

• Scheduled drift-healing workflow in .github that re-runs
  apply-branch-protection.sh (or asserts + diffs) across the REPOS list on a
  cron, and reports/fails on drift. Avoid passive compliance reporting — the run
  should re-apply, not just observe.
  • Needs an admin-scoped PAT secret (the default GITHUB_TOKEN can't PUT
    branch protection org-wide). Decision: store an admin PAT as an org/repo
    secret for this workflow. (owner: provision the secret.)
• Extend the script to protect tags/releases (tag protection rules:
  block deletion + force-push on v* tags at minimum).
• Keep the ok required-check contract intact (renaming/removing it permanently
  blocks PRs — see script comments).

Out of scope / deferred

• Revisiting the solo-dev 0 required approvals + enforce_admins posture —
  intentional for now; revisit when more contributors join.
• Paying for GitHub Team to get real org rulesets — not now.

Acceptance

• A scheduled workflow re-asserts branch protection across all listed repos and
  surfaces drift loudly.
• v* tags are protected against deletion/force-push.
• New-repo onboarding still means "add to the REPOS list" (documented).

[CameronBrooks11]

Design findings surfaced by the operator-ui archival

Archiving anolis-operator-ui (operator-ui sunset) broke apply-branch-protection.sh: archived repos reject branches/main/protection PUTs with 403, and the script treats any non-2xx as fail=1 → exit 1. Patched minimally in #95 (drop the repo from the list), but it exposes root causes this rework should address:

1. Hand-maintained REPOS list drifts. Every onboard/archive needs a manual edit. Enumerate dynamically instead — gh repo list anolishq --no-archived --json name — so the list is self-maintaining and archived repos are auto-excluded. This is the same drift problem from the other direction.
2. No archived-repo guard. Even if a list is kept, query isArchived (or pass --no-archived) and skip — archived repos cannot be protected by design, so the next archival shouldn't break the run.
3. Failure semantics are too coarse. A 403 (archived), a transient API error, and a renamed/missing repo all look identical (FAILED, exit 1). The drift-healing run should distinguish skipped (archived/expected) from genuinely failed, and report per-repo.

Acceptance for the rework should include: dynamic repo discovery, archived exclusion, and per-repo skip-vs-fail reporting — not just the scheduled re-assert + tag protection already listed.

[CameronBrooks11]

Mechanism merged — #105 (activation pending)

PR #105 is merged and green on main. What shipped:

• branch-protection-heal.yml — weekly cron (0 6 * * 3) + workflow_dispatch; re-asserts (not just reports) main branch protection and the release-tag ruleset across all enrolled repos. Fails fast with an actionable message if the admin PAT secret is missing.
• Release-tag protection via a per-repo ruleset protect-version-tags (the classic tag-protection API is retired → rulesets, free on public repos). Blocks deletion + force-push.
  • Pattern is refs/tags/v*.* (dotted), deliberately not v*. The shared-actions release flow re-points the moving bare-major aliases v1/v2 with git tag -f; a v* rule would have blocked that and broken org-wide action pinning. Immutable release tags always carry a dot (v2.4, v0.2.7); the aliases never do. This also means no bypass actor is needed.
• Archived guard + per-repo skip/fail — OK / SKIPPED (archived) / FAILED; exits non-zero only on genuine failure (fixes the operator-ui breakage that chore: drop archived anolis-operator-ui from branch-protection list #95 patched).
• Reconciliation report — enumerates non-archived public org repos and flags any not enrolled. Enrollment stays an explicit REPOS edit (dynamic discovery, explicit enforcement) because auto-requiring ok on a repo that lacks it would permanently block its PRs — confirmed as the intended trade-off.

Remaining (owner)

Provision the BRANCH_PROTECTION_PAT secret on anolishq/.github — fine-grained PAT with Administration: read/write on all anolishq repos (or classic PAT with repo). The default GITHUB_TOKEN cannot write protection/rulesets cross-repo. Once set, a workflow_dispatch run applies protection + tag rulesets org-wide. Keeping this issue open until that first run is green.

Scope note: the run heals idempotently (re-asserts every time) rather than GET+diffing to report setting-level drift; enrollment drift is surfaced. Setting-level drift-diff can be a follow-up if wanted.

[CameronBrooks11]

Activated & verified — closing ✅

BRANCH_PROTECTION_PAT provisioned (fine-grained, org anolishq, All repositories, Repository → Administration: read/write). First workflow_dispatch run of branch-protection-heal.yml is green:

OK: 14   SKIPPED: 0   FAILED: 0
all non-archived public org repos are enrolled.

Independently verified the tag rulesets are live and correct (spot-checked .github, anolis, anolis-provider-ezo, renovate-config — representative of actions/provider/core/config repos):

• exactly 1 protect-version-tags ruleset per repo (no duplicate accumulation)
• target=tag, enforcement=active, include=["refs/tags/v*.*"], rules=[deletion, non_fast_forward], bypass_actors=0

The v*.* pattern excludes the moving bare-major aliases (v1/v2), so the shared-actions git tag -f release flow is unaffected.

Acceptance met: scheduled workflow re-asserts protection across all listed repos and surfaces enrollment drift loudly (weekly cron + on-demand); v* release tags protected against deletion and force-push; onboarding = "add to REPOS" (documented in README). Delivered in #105.

Follow-up left as a conscious scope call (not blocking): the heal run re-asserts idempotently rather than GET+diffing to report setting-level drift. Can file separately if that reporting is wanted later.