Fix/token permissions id 20260911

.github/rulesets/Immutable-Tags.json

@@ -0,0 +1,19 @@
+{
+  "name": "Immutable-Tags",
+  "target": "tag",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~ALL"],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [],
+  "rules": [
+    {"type": "creation"},
+    {"type": "deletion"},
+    {"type": "non_fast_forward"},
+    {"type": "update"},
+    {"type": "required_signatures"}
+  ]
+}

.github/rulesets/Optimus-Branch.json

@@ -0,0 +1,44 @@
+{
+  "name": "Optimus-Branch",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~DEFAULT_BRANCH"],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [],
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    },
+    {
+      "type": "required_signatures"
+    },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 2,
+        "dismiss_stale_reviews_on_push": true,
+        "require_code_owner_review": true,
+        "require_last_push_approval": true,
+        "required_review_thread_resolution": true,
+        "require_extra_approval_for_unattributed_changes": true,
+        "required_reviewers": [],
+        "allowed_merge_methods": []
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": []
+      }
+    }
+  ]
+}

.github/settings.yml

@@ -105,21 +105,3 @@ labels:
 
 # ─── Branch Protection ─────────────────────────────────────────────────────────
 
-branches:
-  - name: "main"
-    protection:
-      required_pull_request_reviews:
-        required_approving_review_count: 1
-        dismiss_stale_reviews: true
-        require_code_owner_reviews: true
-      required_status_checks:
-        strict: true
-        contexts:
-          - "hypatia-scan"
-          - "codeql"
-          - "openssf-compliance"
-      enforce_admins: true
-      required_signatures: true
-      restrictions: null
-      allow_force_pushes: false
-      allow_deletions: false

.github/workflows/dependabot-automerge.yml

@@ -1,4 +1,4 @@
 # SPDX-License-Identifier: MPL-2.0
 # // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 # SPDX-License-Identifier: MPL-2.0
 #
@@ -42,7 +42,7 @@
     types: [opened, reopened, synchronize]
 permissions:
   actions: read
-  contents: write # needed to enable auto-merge
+  contents: read # needed to enable auto-merge
   pull-requests: write # needed to approve
   # NB: keep narrow — do NOT add secrets: read or id-token: write here.
 jobs:

.github/workflows/rhodibot.yml

@@ -22,7 +22,7 @@ on:
     types: [completed]
 permissions:
   actions: read
-  contents: write
+  contents: read
   pull-requests: write
 jobs:
   rhodibot: