ContentsTap to jump to a section＋
- Bulk import works within a repository; it does not automatically migrate an entire organization.
- Evaluate observes without blocking; Disabled likewise does not enforce like Active.
- Retain old protection during validation and review bypass permissions and actual status-check names.
Preview a bulk conversion of source-control protections
GitHub announced bulk conversion of a repository’s branch protection rules to rulesets on October 20, 2026. Administrators can preview proposed rulesets and choose enforcement before creation. Validate on sample repositories and retain original protection until scope and permissions are confirmed.
Branch protection constrains changes through reviews and checks. Rulesets group such conditions and can overlap on one branch. The announcement extends an existing single-rule conversion, rather than introducing rulesets for the first time.
The potential benefit is less manual policy reconstruction and a preview step. The action concerns the selected repository, not an automatic organization-wide migration or a guarantee that existing exceptions are appropriate.
One source rule can produce several rulesets
The new import dialog shows proposed rulesets, already-covered protections and behavior warnings. One source rule may split into multiple rulesets to preserve behavior, so ruleset count does not equal protected-branch count.
Choose proposed items and supported enforcement states, then decide whether to keep originals. GitHub warns against deleting old protection until replacements are Active and verified: Evaluate and Disabled do not block changes.
Friday Works recommends comparing behavior—reviews, exact checks, bypass actors and targeted branch patterns—rather than names. Test nested release-branch names as well as main.
Evaluation and enforcement serve different purposes
Evaluate can observe impact without enforcement, subject to plan and ruleset availability. Do not assume every repository offers it. Read access allows viewing applicable rules; editing needs appropriate administrative or custom permissions.
Keeping an old rule alongside an Active ruleset can require changes to satisfy both. This reduces gaps but may cause unexpected blocking when conditions differ. Define the transition owner, support path and exit criteria.
The inline figure is genuine GitHub configuration for Require code scanning results. Compare the actual tool and alert thresholds during acceptance; the demo does not prove a customer enabled CodeQL or completed migration.
Validate allowed and blocked actions on a sample repository
Use authorized sample cases for sufficient reviews/checks, missing reviews, missing checks and actors with or without bypass. Never force-push or delete production branches merely to demonstrate protection.
Record baseline configuration and results before removing originals. Confirm replacements are Active, target intended branches and do not widen app bypass. Stop further conversions if a sample differs. Successful object creation is not proof of equivalent enforcement.
The genuine GitHub Docs cover shows sample team-test Rulesets with Team test Active and three rules targeting one branch. It is the scope/status view, not the new import dialog. Both images are ©GitHub, CC BY4.0, original capture dates unspecified, resized and framed only.
References
Sources used in this guide
We prioritise official guidance and primary technical sources. Visit each source for full context and the latest updates.
- Bulk conversion announcement —20 October 2026GitHub ↗︎
- Conversion procedure and preserving original protection; maintained documentationGitHub Docs ↗︎
- Ruleset availability, permissions and enforcement states; maintained documentationGitHub Docs ↗︎
- Actual GitHub Docs demo UI, © GitHub, CC BY 4.0; original date unspecified, checked 22 October 2026; resize/framing onlyGitHub ↗︎
- GitHub Docs CC BY 4.0 license, full notice retainedGitHub ↗︎
- CC BY 4.0Creative Commons ↗︎
- Actual GitHub Docs demo UI, © GitHub, CC BY 4.0; original date unspecified, checked 22 October 2026; resize/framing onlyGitHub ↗︎