fix(governance): support signed CI rulesets and GitHub App-bound checks

src/config-validation.ts

@@ -233,7 +233,7 @@ function validateRule(value: unknown, path: string): RulesetRule {
   const record = expectRecord(value, path);
   const type = expectString(record.type, `${path}.type`);
 
-  if (type === 'deletion' || type === 'non_fast_forward') {
+  if (type === 'deletion' || type === 'non_fast_forward' || type === 'required_signatures') {
     rejectUnknownKeys(record, path, ['type']);
     return { type };
   }
@@ -312,13 +312,19 @@ function validateRule(value: unknown, path: string): RulesetRule {
       rejectUnknownKeys(
         checkRecord,
         `${path}.parameters.required_status_checks[${index}]`,
-        ['context'],
+        ['context', 'integration_id'],
       );
       return {
         context: expectNonEmptyString(
           checkRecord.context,
           `${path}.parameters.required_status_checks[${index}].context`,
         ),
+        ...('integration_id' in checkRecord ? {
+          integration_id: expectNonNegativeInteger(
+            checkRecord.integration_id,
+            `${path}.parameters.required_status_checks[${index}].integration_id`,
+          ),
+        } : {}),
       };
     });
 
@@ -395,6 +401,13 @@ function expectBoolean(value: unknown, path: string): boolean {
   return value;
 }
 
+function expectNonNegativeInteger(value: unknown, path: string): number {
+  if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0) {
+    fail(path, 'must be a non-negative safe integer');
+  }
+  return value;
+}
+
 function expectNumber(value: unknown, path: string): number {
   if (typeof value !== 'number' || !Number.isFinite(value)) {
     fail(path, 'must be a finite number');

src/github-client.ts

@@ -392,7 +392,7 @@ function parseRule(value: unknown): RulesetRule {
     throw new Error('Invalid ruleset rule from GitHub');
   }
 
-  if (value.type === 'deletion' || value.type === 'non_fast_forward') {
+  if (value.type === 'deletion' || value.type === 'non_fast_forward' || value.type === 'required_signatures') {
     return { type: value.type };
   }
 
@@ -444,7 +444,11 @@ function parseRule(value: unknown): RulesetRule {
           if (!isRecord(check) || typeof check.context !== 'string') {
             throw new Error('Invalid required status check from GitHub');
           }
-          return { context: check.context };
+          const integrationId = check.integration_id;
+          if (integrationId !== undefined && (typeof integrationId !== 'number' || !Number.isSafeInteger(integrationId) || integrationId < 0)) {
+            throw new Error('Invalid required status check integration from GitHub');
+          }
+          return { context: check.context, ...(integrationId !== undefined ? { integration_id: integrationId } : {}) };
         })
       : [];
 

src/ruleset-normalizer.ts

@@ -72,5 +72,16 @@ export function rulesetsEqual(
   left: RepositoryRuleset,
   right: RepositoryRuleset,
 ): boolean {
-  return JSON.stringify(normalizeRuleset(left)) === JSON.stringify(normalizeRuleset(right));
+  const current = normalizeRuleset(left);
+  const desired = normalizeRuleset(right);
+  for (const rule of current.rules) {
+    if (rule.type !== 'required_status_checks') continue;
+    const expected = desired.rules.find((candidate) => candidate.type === 'required_status_checks');
+    if (expected?.type !== 'required_status_checks') continue;
+    rule.parameters.required_status_checks = rule.parameters.required_status_checks.map((check) => {
+      const wanted = expected.parameters.required_status_checks.find((candidate) => candidate.context === check.context);
+      return wanted?.integration_id === undefined ? { context: check.context } : check;
+    });
+  }
+  return JSON.stringify(current) === JSON.stringify(desired);
 }

src/types.ts

@@ -22,14 +22,14 @@ export type PullRequestRule = {
 export type RequiredStatusChecksRule = {
   type: 'required_status_checks';
   parameters: {
-    required_status_checks: Array<{ context: string }>;
+    required_status_checks: Array<{ context: string; integration_id?: number }>;
     strict_required_status_checks_policy: boolean;
     do_not_enforce_on_create: boolean;
   };
 };
 
 export type SimpleRule = {
-  type: 'deletion' | 'non_fast_forward';
+  type: 'deletion' | 'non_fast_forward' | 'required_signatures';
 };
 
 export type RulesetRule = PullRequestRule | RequiredStatusChecksRule | SimpleRule;

tests/config-validation.test.ts

@@ -102,4 +102,47 @@ describe('validateGovernanceConfig', () => {
     );
   });
 
+  it('accepts signed commits and bound required CI checks', () => {
+    const config = structuredClone(validConfig) as any;
+    config.policies.protected.rules.push({ type: 'required_signatures' });
+    config.policies.protected.rules.push({
+      type: 'required_status_checks',
+      parameters: {
+        required_status_checks: [{ context: 'PHPUnit', integration_id: 15368 }],
+        strict_required_status_checks_policy: true,
+        do_not_enforce_on_create: false,
+      },
+    });
+    expect(validateGovernanceConfig(config)).toEqual(config);
+  });
+
+  it('rejects invalid CI integration identifiers', () => {
+    const config = structuredClone(validConfig) as any;
+    config.policies.protected.rules.push({
+      type: 'required_status_checks',
+      parameters: {
+        required_status_checks: [{ context: 'PHPUnit', integration_id: 'invalid' }],
+        strict_required_status_checks_policy: true,
+        do_not_enforce_on_create: false,
+      },
+    });
+    expect(() => validateGovernanceConfig(config)).toThrow('integration_id');
+  });
+
+  it.each([-1, 1.5, Number.MAX_SAFE_INTEGER + 1])(
+    'rejects invalid numerical integration ID %s',
+    (integrationId) => {
+      const config = structuredClone(validConfig) as any;
+      config.policies.protected.rules.push({
+        type: 'required_status_checks',
+        parameters: {
+          required_status_checks: [{ context: 'PHPUnit', integration_id: integrationId }],
+          strict_required_status_checks_policy: true,
+          do_not_enforce_on_create: false,
+        },
+      });
+      expect(() => validateGovernanceConfig(config)).toThrow('integration_id');
+    },
+  );
+
 });

tests/ruleset-normalizer.test.ts

@@ -13,6 +13,29 @@ describe('normalizeRuleset', () => {
     expect(rulesetsEqual(current, protectedBranchesFixture)).toBe(true);
   });
 
+  it('compares integration-bound checks without drifting unbound configurations', () => {
+    const current = structuredClone(requiredCiFixture);
+    const desired = structuredClone(requiredCiFixture);
+    const currentRule = current.rules.find((rule) => rule.type === 'required_status_checks');
+    const desiredRule = desired.rules.find((rule) => rule.type === 'required_status_checks');
+    if (currentRule?.type !== 'required_status_checks' || desiredRule?.type !== 'required_status_checks') {
+      throw new Error('missing fixture checks');
+    }
+    currentRule.parameters.required_status_checks[0]!.integration_id = 15368;
+    expect(rulesetsEqual(current, desired)).toBe(true);
+    desiredRule.parameters.required_status_checks[0]!.integration_id = 15368;
+    expect(rulesetsEqual(current, desired)).toBe(true);
+    currentRule.parameters.required_status_checks[0]!.integration_id = 999;
+    expect(rulesetsEqual(current, desired)).toBe(false);
+  });
+
+  it('preserves required signatures as a managed rule', () => {
+    const ruleset = structuredClone(protectedBranchesFixture);
+    ruleset.rules.push({ type: 'required_signatures' });
+    expect(normalizeRuleset(ruleset).rules.some((rule) => rule.type === 'required_signatures')).toBe(true);
+    expect(rulesetsEqual(ruleset, protectedBranchesFixture)).toBe(false);
+  });
+
   it('preserves required status checks as managed policy', () => {
     const normalized = normalizeRuleset(requiredCiFixture);
     const rule = normalized.rules.find(