setup-layer-b.sh

#!/usr/bin/env bash
# Arm Layer B: a branch ruleset (require PR, no force-push, no deletion) on the
# default branch, applied via gh api from .github/rulesets/main.json.
# Expected HTTP 403 on free private repos (rulesets need public or Pro): the
# rule is armed-in-code but inert here; default branch held by PR discipline.
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PAYLOAD="${SCRIPT_DIR}/../.github/rulesets/main.json"
command -v gh >/dev/null 2>&1 || { echo "ERROR: gh not found" >&2 ; exit 1 ; }
gh auth status >/dev/null 2>&1 || { echo "ERROR: gh not authenticated" >&2 ; exit 1 ; }
[ -f "${PAYLOAD}" ] || { echo "ERROR: payload missing: ${PAYLOAD}" >&2 ; exit 1 ; }
REPO="$(gh repo view --json nameWithOwner --jq .nameWithOwner)"
echo "Applying Layer B ruleset to: ${REPO}"
gh api "repos/${REPO}/rulesets" -X POST --input "${PAYLOAD}"