Workspace settings > Rulesets
How to protect repository branches with reusable rulesets.
A ruleset is a named, reusable set of protection rules you apply to repository branches. You can bundle rules such as blocking force pushes, requiring signed commits, and enforcing branch naming conventions into a single ruleset and apply it consistently across multiple repositories.
Creating, editing, and deleting rulesets, and changing their enforcement status, requires workspace administrator permission.
Creating a ruleset
1) Go to Workspace settings > Rulesets. If no rulesets exist yet, the list is empty — create a new ruleset to get started.
2) Click New ruleset, enter a name, and create it. A newly created ruleset starts empty, with no rules or targets.
3) Click a ruleset in the list to open its detail view, where you manage its enforcement status, rules, targets, and applied repositories.
Enforcement status (Active / Evaluate / Disabled)
A ruleset has one of three enforcement statuses. To roll rules out safely on a live repository, we recommend validating in Evaluate mode first, then switching to Active.
Active: Rules are enforced. Operations that violate a rule are blocked.
Evaluate: A dry-run mode that only records violations without blocking. Use it to assess the impact of rules before enforcing them.
Disabled: The ruleset is turned off. No rules are evaluated or enforced.
Adding rules
Add rules in the Rules section of the ruleset detail view. When you pick a rule type, its enforcement point (push or merge) is determined automatically by the type, and some rules take an additional value (such as a minimum approval count or a name pattern). Common rules include:
Block direct push to protected branches, block force pushes, require linear history
Require signed commits, commit message / author email patterns, require verified committer
Branch / tag name patterns, require minimum approvals, require CI pipeline success, require a linked issue for merge
Applying to repositories (targets)
In the Targets section, choose where the ruleset applies. You can target all repositories in the workspace, a specific repository, or repositories matched by a name pattern, and you can narrow the scope with branch/tag patterns (for example, refs/heads/main or refs/tags/v*).
A workspace ruleset that targets all repositories is shown as a Default ruleset and applies to every repository in the workspace. A single repository can have several rulesets applied at once; when they overlap, the most restrictive rule wins.
Reviewing applied repositories
The Applied repositories section lists the repositories this ruleset currently governs. Click a repository to open it. Conversely, a repository's own settings show, read-only, which workspace rulesets are layered onto it.