Managing rulesets for repositories in your organization

You can edit, monitor, and delete existing rulesets to alter how people can interact with repositories in your organization.

Who can use this feature?

Organization owners and users with the "Manage organization ref update rules and rulesets" permission can manage rulesets at the organization level.

In this article

About managing rulesets for an organization

After creating a ruleset at the organization level, you can make changes to the ruleset to alter how people can interact with the targeted repositories. For example, you can add rules to better protect the branches or tags in those repositories, or you can switch your ruleset from "Evaluate" mode to "Active" after testing its effects on the contributor experience for your repositories. Organizational rulesets that apply to branches of a repository will no longer allow the repository administrator to rename branches of the targeted repository or change the default branch to another branch. Repository administrators may create and delete branches so long as they have the appropriate permissions.

You can use the REST and GraphQL APIs to manage rulesets. For more information, see "REST API endpoints for rules" and "Mutations."

Note

Anyone with read access to a repository can view the active rulesets operating on that repository.

Editing a ruleset

You can edit a ruleset to change parts of the ruleset, such as the name, bypass permissions, or rules. You can also edit a ruleset to change its status, such as if you want to enable or temporarily disable a ruleset.

  1. In the upper-right corner of GitHub, select your profile photo, then click Your organizations.

  2. Next to the organization, click Settings.

  3. In the left sidebar, in the "Code, planning, and automation" section, click Repository, then click Rulesets.

    Screenshot of an organization's settings page. In the sidebar, a link labeled "Rulesets" is outlined in orange.

  4. On the "Rulesets" page, click the name of the ruleset you want to edit.

  5. Change the ruleset as required. For information on the available rules, see "Available rules for rulesets."

  6. At the bottom of the page, click Save changes.

Deleting a ruleset

Tip

If you want to temporarily disable a ruleset but do not want to delete it, you can set the ruleset's status to "Disabled." For more information, see "Editing a ruleset."

  1. In the upper-right corner of GitHub, select your profile photo, then click Your organizations.

  2. Next to the organization, click Settings.

  3. In the left sidebar, in the "Code, planning, and automation" section, click Repository, then click Rulesets.

    Screenshot of an organization's settings page. In the sidebar, a link labeled "Rulesets" is outlined in orange.

  4. Click the name of the ruleset you want to delete.

  5. To the right of the ruleset's name, select , then click Delete ruleset.

    Screenshot of the page for editing a ruleset. Below a button labeled with three dots, an option labeled "Delete ruleset" is outlined in orange.

Viewing insights for rulesets

You can view insights for rulesets to see how rulesets are affecting the repositories in your organization. On the "Rule Insights" page, you will see a timeline of the following user actions. You can use filters to find what you're looking for.

  • Actions that have been checked against one or more rulesets and passed.
  • Actions that have been checked against one or more rulesets and failed.
  • Actions where someone has bypassed one or more rulesets.

If a ruleset is running in "Evaluate" mode, you can see actions that would have passed or failed if the ruleset had been active.

Screenshot of the "Rule Insights" page. Three actions are listed: one marked "pass," one marked "bypass," and one marked "fail" with an "evaluate" label.

  1. In the upper-right corner of GitHub, select your profile photo, then click Your organizations.

  2. Next to the organization, click Settings.

  3. In the left sidebar, in the "Code, planning, and automation" section, click Repository, then click Rule insights.

    Screenshot of an organization's settings page. In the sidebar, a link labeled "Rule insights" is outlined in orange.

  4. On the "Rule insights" page, use the dropdown menus at the top of the page to filter the actions by ruleset, repository, actor, and time period.

  5. To see which specific rules failed or required a bypass, click , then expand the name of the ruleset.

    Screenshot of the "Rule Insights" page. To the right of an event labeled "octocat created not-allowed," an icon of three horizontal dots is outlined in orange.