chore: flag rulesets visibility gap to governance team

[sonupreetam]

Context

The governance scan reports (2026-08-14, 2026-08-21) return HTTP 403 on the organization rulesets endpoint and rate the area as Not Assessed. Because org-level rulesets are not visible, the scan falls back to the legacy branch protection API, which reports 4 of 10 repos as unprotected.

Our safe-settings configuration (safe-settings/settings.yml) already defines an org-level ruleset (safe-settings: code repos) that enforces:

• Required PR reviews (1 approver)
• Dismiss stale reviews on push
• Code owner review required
• Last push approval required
• Block force push and deletion

This ruleset covers all 8 managed repos (containerfile, dewey, gaze, homebrew-tap, intake-kit, replicator, unbound-force, website). The branch protection findings in the scan are likely false negatives caused by the visibility gap, not actual missing protections.

Root Cause

The redhat-github-governance app lacks the organization_administration: read permission, which is required to read org-level rulesets via the API. This is acknowledged in the scan report's own caveats and open questions:

Without organization_administration: read permission, this scan cannot verify whether PR-before-merge requirements, status check enforcement, or other branch protection rules are applied via organization rulesets.

Action

1. Verify locally: Confirm the org-level ruleset is active at Settings > Rules > Rulesets
2. Notify the governance team: Contact the redhat-gh-governance team to flag that:
   • unbound-force uses org-level rulesets via safe-settings (not legacy branch protection)
   • The 403 on the rulesets endpoint causes false-negative branch protection findings
   • Granting organization_administration: read to the governance app would resolve the visibility gap
3. Document: Note the gap so future scan reviews can account for it until the governance app permission is updated

Acceptance Criteria

• Org-level ruleset verified as active in GitHub UI
• Governance team notified about the rulesets visibility gap
• Future scan reports show rulesets as assessed (once the governance app permission is updated)