security: protect ruleset-sync environment

.github/workflows/bootstrap-environment.yml

@@ -0,0 +1,56 @@
+# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+name: Bootstrap privileged environment
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '.github/workflows/bootstrap-environment.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  configure:
+    name: Configure ruleset-sync
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    environment: ruleset-sync
+    timeout-minutes: 10
+
+    steps:
+      - name: Authenticate GitHub App
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.RULESET_APP_CLIENT_ID }}
+          private-key: ${{ secrets.RULESET_APP_PRIVATE_KEY }}
+          owner: LibreSign
+          repositories: .github
+          permission-administration: write
+
+      - name: Protect ruleset-sync environment
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          set -euo pipefail
+          gh api --method PUT             -H 'Accept: application/vnd.github+json'             -H 'X-GitHub-Api-Version: 2026-03-10'             repos/LibreSign/.github/environments/ruleset-sync             --input - <<'JSON'
+          {
+            "wait_timer": 0,
+            "prevent_self_review": false,
+            "reviewers": [{"type": "User", "id": 1079143}],
+            "deployment_branch_policy": {
+              "protected_branches": false,
+              "custom_branch_policies": true
+            }
+          }
+          JSON
+
+          policies="$(gh api             -H 'Accept: application/vnd.github+json'             -H 'X-GitHub-Api-Version: 2026-03-10'             repos/LibreSign/.github/environments/ruleset-sync/deployment-branch-policies)"
+          if ! jq -e '.branch_policies | any(.name == "main")' <<< "$policies" >/dev/null; then
+            gh api --method POST               -H 'Accept: application/vnd.github+json'               -H 'X-GitHub-Api-Version: 2026-03-10'               repos/LibreSign/.github/environments/ruleset-sync/deployment-branch-policies               -f name=main               -f type=branch
+          fi