[vitormattos]

Objective

Use LibreCode's existing GitHub Governance engine for organization-standard protection on public repositories, while keeping repository-specific rules and CI rollout independently reviewable.

Changes

Reusable CI gate (agent-skills)

• Replace the repository-specific agent-skills-ci policy with reusable required-ci-gate-active.
• Reuse the same Require CI contract as the existing disabled required-ci-gate, changing only enforcement.
• Select the active policy for LibreCodeCoop/agent-skills, whose ci-required check was verified on the merged agent-skills#1. Inherit protected-branches from organization defaults.
• Leave release-tool and nextcloud-docker-development on the disabled gate; do not globally activate CI requirements.

Opt-in automatic baseline onboarding

• Add github-governance-auto-onboard.yml, scheduled twice hourly and manually dispatchable, disabled until AUTO_RULESET_ONBOARDING_ENABLED=true.
• Read-only discovery selects initialized public repositories that have no rulesets, without changing existing custom/institutional rulesets or archived/private repos.
• For each candidate, mint a repository-scoped, short-lived GitHub App token in dedicated ruleset-auto-onboard environment and invoke the existing reviewed github-governance action with onboard-only=true.
• Engine preflight checks existing rulesets and classic protection again before creating a missing default policy. Ambiguous/protected repositories are skipped for manual review; no global Apply, rule replacement, metadata update or CI enforcement.

Validation

• Local unit tests: 102 passed on the PR branch.
• Upstream source checks, render checks, workflow policy checker and git diff --check: passed.
• Read-only scan against LibreCodeCoop: one candidate without ruleset, akaunting-field-studio; existing rulesets left untouched. No remote rules were changed.
• Commits signed with Git Signing MCP, verified cryptographically with DCO.
• GitHub CI and independent PR review remain required.

Activation / governance restrictions

Do not merge automatically or apply any ruleset as part of this PR.

After reviewing and merging the code:

1. Create restricted ruleset-auto-onboard environment on main, using a dedicated GitHub App credential (AUTO_RULESET_APP_CLIENT_ID variable, AUTO_RULESET_APP_PRIVATE_KEY secret). Administration write and Contents read are needed; tokens are restricted per repository.
2. Independently review credentials, installation scope and environment protections; then set AUTO_RULESET_ONBOARDING_ENABLED=true as a repository variable.
3. Dispatch once and confirm only the missing default rule was created; review failures or exceptions before trusting its schedule.
4. Separately plan and approve a repository-scoped ruleset-sync Apply for agent-skills (onboard_only=false) to activate Require CI. That existing protected environment is not altered by this PR.

The scheduled job cannot guarantee immediate protection from the moment a repository is created, and private repositories remain outside the GitHub Free support scope.

Nextcloud translation bot regression audit

Historical incidents: LibreSign/libresign#8399, #9172, LibreCodeCoop/profile_fields#148 and LibreCodeCoop/extract#148.

• The actor is nextcloud-bot (GitHub ID 20296731), requiring bypass_mode: always for direct Transifex pushes.
• Verified live GitHub rulesets: LibreSign/libresign allows this actor in both active rulesets (Protect default and stable branches and Require LibreSign DCO); LibreCodeCoop/profile_fields and LibreCodeCoop/extract allow it in their active branch-protection rulesets.
• Observed recent successful nextcloud-bot translation commits in all three repositories, including LibreSign on November 4, 2026.
• No LibreSign governance/workflow configuration is changed by this PR. The LibreCode default protected-branches and conditions.when.file_exists=appinfo/info.xml conditional bypass remain unchanged.
• Automatic onboarding selects only LibreCodeCoop public repositories with no rulesets and, for new Nextcloud apps, the pinned engine's conditional marker supplies the bot's direct-push bypass before creating the default rule. The engine's onboarding tests cover both the successful bypass and rejection of extra active DCO rules that would block it.
• Added tests/test_nextcloud_translation_bot_contract.py (5 regression tests) covering default inheritance, explicit Nextcloud bot bypass, absence of an unconditional CI/DCO gate, scoping of the active CI policy, and creation-only LibreCode provisioning. Full Python suite now has 102 passing tests locally.

Safety boundary: a future independently added CI/DCO ruleset could still block direct pushes if it lacks the same bot bypass. Such policy changes must be reviewed separately. This PR neither modifies existing rulesets nor activates the new provisioning workflow automatically.

[vitormattos]

Post-merge governance verification (2026-11-04)

Completed follow-ups:

• Merged LibreCodeCoop/github-governance PRs chore: sync workflow catalog #39, chore: sync workflow catalog #40, chore: sync workflow catalog #41 and chore: sync workflow catalog #43, and LibreCodeCoop/.github PRs feat(governance): reuse CI gate and stage automatic baseline onboarding #106, fix(governance): use read-only content token for protected Apply #108 and chore(governance): pin integrated engine across governance workflows #109 (regular merge commits; no squash).
• Both governance workflows now pin integrated engine commit 1f0e4a80cf44cd6762eb3d0144200fd51fc2b07d.
• Apply #41886547508 created the common baseline only for akaunting-field-studio; verified active.
• Apply #41886891794 created Require CI only for agent-skills, requiring its verified ci-required check; existing default-branch ruleset unchanged.
• Full read-only plan #41887238806 succeeded with zero confirmed DRIFT. It still reports 130 UNVERIFIED bypass actor lists because the read-only token cannot inspect those protected fields; they must not be treated as either failures or conclusive privileged verification.
• Previously observed nextcloud-bot (20296731) always bypass remains in the active rules for LibreSign/libresign, LibreCodeCoop/profile_fields and LibreCodeCoop/extract.

Automatic onboarding remains safely disabled:

• ruleset-auto-onboard environment exists with deployment limited to protected branches.
• Repository variable AUTO_RULESET_ONBOARDING_ENABLED=false.
• The environment does not yet have the dedicated GitHub App AUTO_RULESET_APP_CLIENT_ID and AUTO_RULESET_APP_PRIVATE_KEY credentials. GitHub does not allow reading/copying existing environment secrets, and the privileged ruleset-sync credentials were not weakened or transferred.
• A safe manual dispatch of the disabled automatic workflow #41887652694 finished skipped, as expected.

No PRs remain open in these two repositories. The remaining operational activation requires provisioning the dedicated App credentials, reviewing the granted administration permission and then explicitly enabling AUTO_RULESET_ONBOARDING_ENABLED; do not activate it without the secret.