Branch Protection Rulesets for Conventional Commits

Created: July 7, 2026
Updated: July 8, 2026

Cloud Ops Works templates can now manage a GitHub Ruleset that checks commit messages for Conventional Commits. This guide explains what the switch does, when to enforce it, which GitHub plans support it, and how to roll it out through direct template usage or terraform-module-github-repo-management.

The short version: keep normal branch protection enabled, create the Ruleset in evaluate mode first, watch the results, and only then turn on blocking enforcement.

What changed

The Blueprint owners action reads four branch-protection settings from .cloudopsworks/cloudopsworks-ci.yaml when config.branchProtection is enabled:

config:
  branchProtection: true
  conventionalCommitsEnabled: true
  enforceConventionalCommits: false
  enforceCustomCommitsPattern: false
  enforceCustomCommitsPatternRegex: "PROJECT-[0-9]+"

How the GitHub Ruleset behaves

When enabled, the Blueprint creates or updates a repository Ruleset named commit-message-rules. It targets branches and adds a commit-message pattern rule.

The default format is Conventional Commits:

feat: add payment retry flow
fix(api): handle timeout response
docs: update deployment guide

If a custom pattern is enabled, the custom text is expected after the Conventional Commit type. With this configuration:

enforceCustomCommitsPattern: true
enforceCustomCommitsPatternRegex: "PROJECT-[0-9]+"

This message matches:

feat: PROJECT-123 add payment retry flow

This one does not match the current Blueprint pattern, because the type must come first:

PROJECT-123 feat: add payment retry flow

Recommended rollout

1. Keep branchProtection: true.
2. Set conventionalCommitsEnabled: true.
3. Keep enforceConventionalCommits: false for the first rollout. GitHub can evaluate the rule without interrupting delivery.
4. Review the messages that would fail the Ruleset.
5. Switch enforceConventionalCommits: true only after the team is ready for blocking enforcement.
6. Add enforceCustomCommitsPattern: true only when the team has agreed on the exact extra policy.

This sequence avoids turning a formatting cleanup into an unexpected release blocker.

GitHub plan requirement

Rulesets are a GitHub-hosted feature, so repository visibility and account plan matter.

GitHub documents repository rulesets as available for:

• public repositories on GitHub Free and GitHub Free for organizations;
• public and private repositories on GitHub Pro, GitHub Team, and GitHub Enterprise Cloud.

In practical terms, a private repository needs a paid plan that includes Rulesets: GitHub Pro for a personal repository, or GitHub Team / GitHub Enterprise Cloud for an organization repository.

The user or token applying the Ruleset also needs repository admin access or a custom role with permission to edit repository rules.

Reference: GitHub Docs: About rulesets.

Direct template rollout

Use direct template settings when the repository already owns its .cloudopsworks/cloudopsworks-ci.yaml file:

• Add the Ruleset keys with safe defaults.
• Commit the template update without enabling enforcement.
• Let the repository build and deploy normally.
• Turn on enforcement in a later change after the team has reviewed the results.

For current template tags and Blueprint channel notes, see Available Blueprint Versions. The Ruleset-enabled wave includes Blueprint v5.10.73 and the latest template releases published on July 7, 2026.

Terraform module rollout

Use terraform-module-github-repo-management when repository creation and Cloud Ops Works CI/CD files are generated from Terraform. That keeps the policy repeatable instead of hand-editing each repository.

Example input shape:

repositories:
  - name: "payments-api"
    language: "java"
    blueprint: "v5.10"
    cicd_config:
      branch:
        protectionEnabled: true
        conventionalCommitsEnabled: true
      enforce:
        conventionalCommitsEnforced: false
        customCommitsPatternEnabled: true
        customCommitsPatternRegex: "PROJECT-[0-9]+"
        customCommitsPattern: "PROJECT-[0-9]+"

During the July 7 rollout, set both customCommitsPatternRegex and customCommitsPattern when using a custom pattern. Newer templates fall back between the two names, while some same-day tags expect customCommitsPatternRegex explicitly.

The generated repository should end up with the same effective Cloud Ops Works config:

config:
  branchProtection: true
  conventionalCommitsEnabled: true
  enforceConventionalCommits: false
  enforceCustomCommitsPattern: true
  enforceCustomCommitsPatternRegex: "PROJECT-[0-9]+"

Recommended Terraform sequence:

1. Upgrade to terraform-module-github-repo-management v1.4.7 or newer.
2. Use templates that include cloudopsworks-ci.yaml.tftpl and the Ruleset variables.
3. Apply with conventionalCommitsEnforced: false first.
4. Review the GitHub Ruleset and any evaluate-mode findings.
5. Flip conventionalCommitsEnforced: true once the team is ready.

Common mistakes to avoid

• Do not enable conventionalCommitsEnabled while branchProtection is disabled; the Blueprint Ruleset step is tied to branch protection.
• Do not start with blocking enforcement if the repository has an older commit-message habit.
• Do not assume GitHub Free covers Rulesets in private repositories.
• Do not add a custom pattern unless the team agrees on the exact message order.
• Do not hand-edit generated repositories when Terraform owns their CI/CD configuration.

Who should use this

Use the Ruleset when you want consistent commit history, cleaner changelog input, and predictable release notes.

Keep it in evaluate mode, or skip it, when a repository has many external contributors, unusual merge commit formats, or a GitHub plan that does not support Rulesets for that repository type.