[svg153]

Summary

Hardens version-pinned releases by adding an importable repository ruleset recipe for immutable v* tags, derived from GitHub's official github/ruleset-recipes tag protection example.

Reuse-first design

GitHub's official tag-rulesets/prevent-tag-delete.json already provides:

• target: tag;
• active enforcement;
• deletion protection;
• non_fast_forward protection.

This repository changes only what its release contract requires:

• scope the rule to refs/tags/v* rather than all tags;
• add GitHub's update rule so an existing release tag cannot be moved through an ordinary ref update either.

New release creation remains allowed.

Files

• .github/rulesets/immutable-release-tags.json — importable repo-level recipe;
• scripts/validate-release-ruleset.py — exact deterministic validation of target/protections/no default bypass;
• scripts/manage-release-ruleset.sh — idempotent admin helper (status / apply), create-or-update by ruleset name;
• docs/release-hardening.md — provenance, UI import, CLI application and verification steps;
• CI validates the recipe and helper syntax without requiring administration credentials.

Administrative boundary

The live repository currently has no rulesets. Creating/updating a repository ruleset requires Administration: write (or an equivalent custom ruleset-edit role), which the current connector intentionally does not have.

This PR does not add an admin token or self-modifying repository policy to CI. After merge, a repository administrator can either import the JSON from Settings → Rules → Rulesets or run:

scripts/manage-release-ruleset.sh apply

The helper creates the named ruleset when absent, updates it in place when present, and then verifies live state.

Why

GitHub CLI 2.98.0 now executes gh skill publish --dry-run successfully for this repository but warns that no active tag protection ruleset exists. The repository recommends release-pinned installs such as v1.2.2, so release tags should not be mutable after publication.

Traceability

Refs #32
Related Agent Plugin pilot: #28

References

• https://github.com/github/ruleset-recipes/blob/main/tag-rulesets/prevent-tag-delete.json
• https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository
• https://docs.github.com/en/rest/repos/rules