fix(governance): complete ruleset routing and validation

Add organization rule-suite routing and current filters, harden schema
validation, and keep scope metadata usable for fixed-scope tokens and
library callers.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: SamMorrowDrums

README.md

@@ -897,6 +897,7 @@ The following sets of tools are available:
   - `actor_name`: The handle for the GitHub user account to filter rule suites on. Used by the 'list_rule_suites' method. (string, optional)
   - `branch`: Branch name. Required for the 'get_rules_for_branch' method. (string, optional)
   - `enterprise`: Enterprise slug. Required when level is 'enterprise'. (string, optional)
+  - `evaluate_status`: Filter rule suites by ruleset evaluation mode. Used by the 'list_rule_suites' method. (string, optional)
   - `includes_parents`: Include rulesets configured at higher levels that also apply. Defaults to true. Used by the 'get' and 'list' methods at the repository level. (boolean, optional)
   - `level`: The level at which the ruleset is configured:
     - 'repository': A ruleset on a single repository (requires 'owner' and 'repo').
@@ -906,14 +907,15 @@ The following sets of tools are available:
     - 'get': Get a specific ruleset by ID (requires 'ruleset_id'). Supported at every level.
     - 'list': List all rulesets. Supported at every level.
     - 'get_rules_for_branch': Get all rules that apply to a branch (requires 'branch'). Repository level only.
-    - 'list_rule_suites': List rule suites, the evaluations of rules against pushes. Repository level only.
-    - 'get_rule_suite': Get a specific rule suite by ID (requires 'rule_suite_id'). Repository level only. (string, required)
+    - 'list_rule_suites': List rule suites, the evaluations of rules against pushes. Repository and organization levels only.
+    - 'get_rule_suite': Get a specific rule suite by ID (requires 'rule_suite_id'). Repository and organization levels only. (string, required)
   - `org`: Organization name. Required when level is 'organization'. (string, optional)
   - `owner`: Repository owner. Required when level is 'repository'. (string, optional)
   - `page`: Page number for pagination (min 1) (number, optional)
   - `perPage`: Results per page for pagination (min 1, max 100) (number, optional)
   - `ref`: The name of the ref (branch, tag, etc.) to filter rule suites by. Used by the 'list_rule_suites' method. (string, optional)
   - `repo`: Repository name. Required when level is 'repository'. (string, optional)
+  - `repository_name`: Repository name to filter rule suites by. Used by the 'list_rule_suites' method at the organization level. (string, optional)
   - `rule_suite_id`: Rule suite ID. Required for the 'get_rule_suite' method. (number, optional)
   - `rule_suite_result`: The rule suite result to filter by. Used by the 'list_rule_suites' method. (string, optional)
   - `ruleset_id`: Ruleset ID. Required for the 'get' method. (number, optional)

pkg/github/__toolsnaps__/create_repository_ruleset.snap

@@ -10,6 +10,7 @@
       "bypass_actors": {
         "description": "The actors that can bypass the rules in this ruleset",
         "items": {
+          "additionalProperties": false,
           "properties": {
             "actor_id": {
               "description": "The ID of the actor that can bypass a ruleset",
@@ -39,6 +40,9 @@
               "type": "string"
             }
           },
+          "required": [
+            "actor_type"
+          ],
           "type": "object"
         },
         "type": "array"
@@ -88,6 +92,7 @@
       "rules": {
         "description": "An array of rules within the ruleset. Each rule is an object with a 'type' (e.g. 'creation', 'deletion', 'non_fast_forward', 'required_signatures', 'pull_request', 'required_status_checks') and, for rules that need configuration, a 'parameters' object",
         "items": {
+          "additionalProperties": false,
           "properties": {
             "parameters": {
               "description": "Parameters for rule types that require additional configuration",

pkg/github/__toolsnaps__/repository_ruleset_read.snap

@@ -4,7 +4,7 @@
     "readOnlyHint": true,
     "title": "Read repository rulesets"
   },
-  "description": "Read rulesets and rule suites at the repository, organization, or enterprise level. Select the level with the 'level' parameter and the operation with the 'method' parameter.",
+  "description": "Read rulesets at the repository, organization, or enterprise level, and rule suites at the repository or organization level. Select the level with the 'level' parameter and the operation with the 'method' parameter.",
   "inputSchema": {
     "properties": {
       "actor_name": {
@@ -19,6 +19,15 @@
         "description": "Enterprise slug. Required when level is 'enterprise'.",
         "type": "string"
       },
+      "evaluate_status": {
+        "description": "Filter rule suites by ruleset evaluation mode. Used by the 'list_rule_suites' method.",
+        "enum": [
+          "all",
+          "active",
+          "evaluate"
+        ],
+        "type": "string"
+      },
       "includes_parents": {
         "description": "Include rulesets configured at higher levels that also apply. Defaults to true. Used by the 'get' and 'list' methods at the repository level.",
         "type": "boolean"
@@ -33,7 +42,7 @@
         "type": "string"
       },
       "method": {
-        "description": "Operation to perform:\n- 'get': Get a specific ruleset by ID (requires 'ruleset_id'). Supported at every level.\n- 'list': List all rulesets. Supported at every level.\n- 'get_rules_for_branch': Get all rules that apply to a branch (requires 'branch'). Repository level only.\n- 'list_rule_suites': List rule suites, the evaluations of rules against pushes. Repository level only.\n- 'get_rule_suite': Get a specific rule suite by ID (requires 'rule_suite_id'). Repository level only.",
+        "description": "Operation to perform:\n- 'get': Get a specific ruleset by ID (requires 'ruleset_id'). Supported at every level.\n- 'list': List all rulesets. Supported at every level.\n- 'get_rules_for_branch': Get all rules that apply to a branch (requires 'branch'). Repository level only.\n- 'list_rule_suites': List rule suites, the evaluations of rules against pushes. Repository and organization levels only.\n- 'get_rule_suite': Get a specific rule suite by ID (requires 'rule_suite_id'). Repository and organization levels only.",
         "enum": [
           "get",
           "list",
@@ -70,6 +79,10 @@
         "description": "Repository name. Required when level is 'repository'.",
         "type": "string"
       },
+      "repository_name": {
+        "description": "Repository name to filter rule suites by. Used by the 'list_rule_suites' method at the organization level.",
+        "type": "string"
+      },
       "rule_suite_id": {
         "description": "Rule suite ID. Required for the 'get_rule_suite' method.",
         "type": "number"