feat: add branch protection configuration file

[Copilot]

Branch protection rules were configured manually in the GitHub UI, creating risk of drift and loss during repository operations. This adds version-controlled protection rules via Probot Settings App.

Changes

• .github/settings.yml: Branch protection configuration for main

  • 12 required status checks covering build (Node 18/20/22), linting, type checking, test coverage, examples, security scans (CodeQL, Trivy)
  • 1 required approval
  • Enforce up-to-date branches (strict: true)
  • Repository settings (merge options, security features)

• CONTRIBUTING.md: Document branch protection requirements and settings file usage

Configuration

branches:
  - name: main
    protection:
      required_pull_request_reviews:
        required_approving_review_count: 1
      required_status_checks:
        strict: true
        contexts:
          - "Build and Lint (Node 18)"
          - "Build and Lint (Node 20)"
          - "Build and Lint (Node 22)"
          - "ESLint"
          - "TypeScript Type Check"
          - "Test Coverage Report"
          - "Test Examples"
          - "Analyze (javascript-typescript)"
          - "Analyze (actions)"
          - "Scan Agent Container"
          - "Scan Squid Container"
          - "pr-title"

Status check names verified against workflow job definitions. Settings managed by Probot Settings App.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[plan] add branch protection configuration file</issue_title>
<issue_description>## Objective

Create a .github/settings.yml file to codify branch protection rules for the main branch, making required status checks version controlled.

Context

Currently, branch protection rules are configured manually in the GitHub UI. This creates risks:

• Settings can drift over time
• Configuration is lost during repository transfers
• No audit trail for changes to protection rules

Approach

1. Create .github/settings.yml file
2. Define protection rules for main branch:
   • Require status checks: Build and Lint (Node 18, 20, 22), Test Coverage, TypeScript Type Check, Test Examples, CodeQL, Trivy Container Scan
   • Require 1 approving review
   • Enforce up-to-date branches before merge
3. Document the configuration in README or CONTRIBUTING.md

Files to Create/Modify

• Create: .github/settings.yml
• Update: README.md or CONTRIBUTING.md (document the settings file)

Acceptance Criteria

• .github/settings.yml exists with comprehensive branch protection rules
• All currently required status checks are included
• PR review requirements are specified
• Configuration is documented for maintainers

References

• Probot Settings App: https://github.com/probot/settings
• Current workflows: .github/workflows/*.yml (for status check names)
  Related to [plan] improve ci/cd pipeline and quality gates #348

AI generated by Plan Command for discussion #345

Comments on the Issue (you are @copilot in this section)

• Fixes [plan] add branch protection configuration file #349

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.