chore: add release tag protection ruleset for code repos

safe-settings/settings.yml

@@ -7,20 +7,15 @@
 # See MAINTAINING.md for the full tool boundary.
 #
 # MIGRATION NOTE: Existing repo-level rulesets (created manually via the
-# GitHub UI) use inconsistent names across repos. Safe-settings creates
-# NEW org-level rulesets alongside the existing ones. GitHub evaluates
-# all active rulesets and the most restrictive rule wins, so this is
-# safe. After verifying the org-level rulesets work correctly, the old
-# repo-level rulesets should be deleted manually.
+# GitHub UI) are being replaced by safe-settings managed rulesets.
+# GitHub evaluates all active rulesets and the most restrictive rule
+# wins, so both can coexist during migration. After verifying the
+# safe-settings rulesets work correctly, the old repo-level rulesets
+# should be deleted manually.
 #
-# Current repo-level rulesets to clean up after migration:
-#   complyctl:                       general-rules (active), verify-1-approver (disabled)
-#   complytime-collector-components: Default Protection (active)
-#   complytime-policies:             general-rules (disabled)
-#   complytime-providers:            branch-protection (active)
-#   org-infra:                       Branch Protection (active)
-#   community:                       Branch Protection (active)
-#   website:                         general-rules (active)
+# Remaining repo-level rulesets to clean up:
+#   complypack:  tags (active) — replaced by "release tag protection"
+#   complytime:  main (active) — replaced by repos/complytime.yml
 #
 # Excluded from safe-settings management:
 #   complyscribe:              archived
@@ -172,3 +167,34 @@ rulesets:
           require_code_owner_review: true
           require_last_push_approval: false
           required_review_thread_resolution: false
+
+  # Ruleset for tag protection — prevent deletion or modification
+  # of release tags. Protects supply chain integrity by ensuring
+  # published version tags remain immutable. Replaces the manual
+  # "tags" ruleset on complypack (id=18348763).
+  - name: "safe-settings: release tag protection"
+    target: tag
+    enforcement: active
+
+    conditions:
+      ref_name:
+        include:
+          - "refs/tags/v*"
+        exclude: []
+      repository_name:
+        include:
+          - complyctl
+          - complypack
+          - complytime-collector-components
+          - complytime-policies
+          - complytime-providers
+          - homebrew-tap
+          - org-infra
+        exclude: []
+
+    rules:
+      # Prevent deletion of release tags.
+      - type: deletion
+
+      # Prevent force-pushing release tags to a different commit.
+      - type: non_fast_forward