Add CI/CD workflows with self-hosted runners, privacy/policy docs, and repository rulesets

[Copilot]

Establishes automated workflows, governance documentation, and repository protection for the BUIP archive.

Workflows

Install & Validation (.github/workflows/install.yml)

• Dependency installation with caching (Node.js, Python)
• Recursive markdown linting (**/*.md)
• Repository structure validation
• Runs on: [self-hosted, linux]

Security Scanning (.github/workflows/security.yml)

• Dependency review on PRs
• Secret detection with configurable patterns (.github/security-patterns.yml)
• Link validation (.github/markdown-link-check.json)
• File permission auditing
• Commit signature verification
• Weekly scheduled scans (Mon 9AM UTC)

Both workflows use explicit permissions: {contents: read} blocks.

Repository Rulesets

Branch Protection (.github/rulesets/main-branch-protection.json)

• 1 required approval, stale review dismissal
• Required status checks: install-dependencies, lint-markdown, validate-structure
• Enforces: linear history, signed commits, no force-push, no deletion

Tag Protection (.github/rulesets/tag-protection.json)

• Protects v* and release-* patterns
• Prevents unauthorized creation/modification/deletion

Documentation

• PRIVACY.md - Data handling, GDPR compliance, CI/CD privacy
• POLICY.md - Code of conduct, contribution process, BUIP submission, security policy
• .github/IMPLEMENTATION_GUIDE.md - Runner setup, ruleset deployment (UI/CLI/API)
• .github/workflows/README.md - Workflow architecture and maintenance
• .github/rulesets/README.md - Ruleset configuration reference

Configuration

Security patterns externalized to .github/security-patterns.yml for maintainability:

secret_patterns:
  - pattern: "github_pat_[a-zA-Z0-9]{22}_[a-zA-Z0-9]{59}"
    description: "GitHub Personal Access Token"
    severity: "critical"

Allowed email domains configurable:

allowed_email_patterns:
  - "bitcoinunlimited.info"
  - "bitco.in"

Deployment

Maintainers must:

1. Configure self-hosted runner with [self-hosted, linux] labels
2. Apply rulesets via Settings → Rules → Rulesets (import JSON files)
3. Verify workflows execute on next push/PR

Original prompt

Create and manage install workflows with self hosted runners and configure privacy.md and policy.md, apply advanced rulesets for protection

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Yaketh (Kushmanmb)]

Kushmanmb.eth