[CI] Add ruleset JSON requiring lint-done on protected branches

.github/rulesets/README.md

@@ -0,0 +1,29 @@
+# Repository rulesets
+
+Source-of-truth JSON for branch rulesets applied to `pytorch/rl`.
+
+These files are **not** auto-applied by GitHub. They live here so the configuration
+is reviewable, version-controlled, and reproducible. To apply a ruleset:
+
+```bash
+gh api -X POST repos/pytorch/rl/rulesets --input .github/rulesets/<file>.json
+```
+
+To update an existing ruleset, fetch its id and `PUT`:
+
+```bash
+gh api repos/pytorch/rl/rulesets -q '.[] | select(.name=="<name>") | .id'
+gh api -X PUT repos/pytorch/rl/rulesets/<id> --input .github/rulesets/<file>.json
+```
+
+To delete:
+
+```bash
+gh api -X DELETE repos/pytorch/rl/rulesets/<id>
+```
+
+## Current rulesets
+
+- `lint-required.json` — gates merges into `main` / `nightly` / `release/*` on
+  the `lint-done` aggregator from `.github/workflows/lint.yml` and the existing
+  `Meta CLA Check`.

.github/rulesets/lint-required.json

@@ -0,0 +1,24 @@
+{
+  "name": "Require lint on protected branches",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["refs/heads/main", "refs/heads/nightly", "refs/heads/release/*"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": false,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [
+          { "context": "lint-done" },
+          { "context": "Meta CLA Check", "integration_id": 1425812 }
+        ]
+      }
+    }
+  ]
+}