User request → What type of rules?
    │
    ├─ Branch Protection (legacy) → See references/branch-protection.md
    │   └─ Single branch, simple rules
    │
    ├─ Rulesets (modern) → See assets/rulesets/
    │   ├─ Multiple branches/tags
    │   ├─ Organization-wide rules
    │   └─ More granular control
    │
    ├─ Code Review → See references/codeowners.md
    │   ├─ CODEOWNERS file
    │   └─ Required reviewers
    │
    └─ Security Policies → See references/security.md
        ├─ SECURITY.md
        ├─ Dependabot
        └─ Secret scanning

# View current branch protection
gh api repos/{owner}/{repo}/branches/main/protection

# View rulesets
gh api repos/{owner}/{repo}/rulesets

# Apply ruleset from JSON
gh api repos/{owner}/{repo}/rulesets \
  --method POST \
  --input ruleset.json

# Using gh CLI
gh api repos/{owner}/{repo}/rulesets --method POST --input - << 'EOF'
{
  "name": "Protect main",
  "target": "branch",
  "enforcement": "active",
  "conditions": {
    "ref_name": {
      "include": ["refs/heads/main"],
      "exclude": []
    }
  },
  "rules": [
    {"type": "pull_request", "parameters": {
      "required_approving_review_count": 1,
      "dismiss_stale_reviews_on_push": true,
      "require_last_push_approval": true
    }},
    {"type": "required_status_checks", "parameters": {
      "required_status_checks": [
        {"context": "ci"}
      ],
      "strict_required_status_checks_policy": true
    }}
  ]
}
EOF

gh api repos/{owner}/{repo}/rulesets --method POST --input - << 'EOF'
{
  "name": "Signed commits",
  "target": "branch",
  "enforcement": "active",
  "conditions": {
    "ref_name": {
      "include": ["~DEFAULT_BRANCH"],
      "exclude": []
    }
  },
  "rules": [
    {"type": "required_signatures"}
  ]
}
EOF

gh api repos/{owner}/{repo}/rulesets --method POST --input - << 'EOF'
{
  "name": "Protect releases",
  "target": "tag",
  "enforcement": "active",
  "conditions": {
    "ref_name": {
      "include": ["refs/tags/v*"],
      "exclude": []
    }
  },
  "rules": [
    {"type": "creation"},
    {"type": "deletion"}
  ]
}
EOF