Can you exclude file paths for Github ruleset?

[KevyVo]

Can you exclude file paths for Github ruleset?

Body

I am seeking guidance on configuring push protection rules for the main branch of my repository. Specifically, I aim to enforce push restrictions across the branch while permitting a GitHub bot, GoReleaserBot, to push updates to a designated folder and select files. I was thinking of using github ruleset.

Current Challenge:

Due to security considerations, creating a dedicated bot account is not preferable. Additionally, since GoReleaserBot is an external entity, adding it to the bypass list is not feasible.

Objective:

Implement push protection rules that:
1. Restrict push access to the entire main branch.
2. Allow push operations to (maybe file path restriction can help?):
• A specific folder (e.g., releases/).
• Specific files (e.g., CHANGELOG.md, version.txt).

Inquiry:

Is there a method to configure GitHub’s push protection rules to block all push operations except for those targeting the specified folder and files? If so, could you provide guidance or resources on how to implement such a configuration?

Your insights and recommendations would be greatly appreciated.

[MegaMind1212]

Hey there! so you want to block all pushes but let GoReleaserBot update releases/, CHANGELOG.md, and version.txt, right? Since you can’t add the bot to the bypass list or make a new account for it, here’s a simple way to do it.

Set up a ruleset to block direct pushes to main by requiring a pull request—go to Settings > Rules > Rulesets, make a new branch ruleset for refs/heads/main, and turn on "Require a pull request before merging." That’ll stop all direct pushes.

Then, since GoReleaserBot can’t bypass that, let’s use a GitHub Actions workflow to handle its updates. It’ll catch the bot’s changes, make a PR for those specific paths, and auto-merge it. Just add this to .github/workflows/goreleaser-bot.yml:

yaml

name: Handle GoReleaserBot Updates
on:
push:
branches:
- main
paths:
- 'releases/**'
- 'CHANGELOG.md'
- 'version.txt'
jobs:
create-pr:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- run: |
git checkout -b bot-update-$(date +%s)
git add releases/ CHANGELOG.md version.txt
git commit -m "GoReleaserBot: Update releases, CHANGELOG.md, version.txt [skip ci]"
git push origin bot-update-$(date +%s)
gh pr create --title "GoReleaserBot: Update releases and files" --body "Automated update by GoReleaserBot" --base main --head bot-update-$(date +%s)
gh pr merge --auto --squash
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

This way, the bot’s changes to those paths get through via a PR, but everything else is blocked. Should work like a charm—let me know if you need a hand!

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬