main.tf

resource "github_organization_ruleset" "main_protection" {
  name        = "main-protection"
  target      = "branch"
  enforcement = "active"

  conditions {
    ref_name {
      include = var.protected_branches
      exclude = []
    }

    repository_name {
      include = var.protected_repos
      exclude = []
    }
  }

  rules {
    deletion = true
    non_fast_forward = true
    required_linear_history = true
    update = true

    pull_request {
      required_approving_review_count = 1
      dismiss_stale_reviews_on_push   = true
      require_code_owner_review       = true
      require_last_push_approval      = true
      required_review_thread_resolution = true
    }
  }

  bypass_actors {
    actor_type = "OrganizationAdmin"
    bypass_mode = "always"
  }
}