@@ -184,31 +184,31 @@ rulesets:
   # place — the next sync will strip it anyway.
   - name: protect-default-branch
     target: branch
-    enforcement: active        # always enforced — overriding this is discouraged
+    enforcement: active # always enforced — overriding this is discouraged
     conditions:
       ref_name:
         include:
-          - "~DEFAULT_BRANCH"   # special selector: whatever the default branch is
+          - '~DEFAULT_BRANCH' # special selector: whatever the default branch is
         exclude: []
     # Intentionally empty — see the SECURITY note above. Do not add actors.
     bypass_actors: []
     rules:
-      - type: deletion          # block branch deletion
-      - type: non_fast_forward  # block force-push
+      - type: deletion # block branch deletion
+      - type: non_fast_forward # block force-push
 
   # ---- 2. PR required (0 reviews) ----
   - name: require-pr
     target: branch
-    enforcement: 'active'    # uncomment to lock this ruleset on in this repo
+    enforcement: 'active' # uncomment to lock this ruleset on in this repo
     conditions:
       ref_name:
-        include: ["~DEFAULT_BRANCH"]
+        include: ['~DEFAULT_BRANCH']
         exclude: []
     bypass_actors:
       # Repo admins can bypass (always = prompts at push/merge time, not silent exempt).
       # Repos can add more actors (other teams, integrations).
       - actor_id: 5
-        actor_type: RepositoryRole   # 1=read 2=triage 3=write 4=maintain 5=admin
+        actor_type: RepositoryRole # 1=read 2=triage 3=write 4=maintain 5=admin
         bypass_mode: always
       # automation-nsheaps GitHub App — actor_id is substituted from 2549081
 
@@ -247,7 +247,7 @@ rulesets:
           # above) so merge commits remain usable for non-default-branch
           # merges. If GitHub is not sent this parameter it backfills all
           # three methods, which is why omitting it is not equivalent.
-          allowed_merge_methods: ["squash", "rebase"]
+          allowed_merge_methods: ['squash', 'rebase']
 
   # ---- 3. Review required — 1 reviewer (active by default) ----
   - name: require-1-review
@@ -256,13 +256,13 @@ rulesets:
     # enforcement: 'active'
     conditions:
       ref_name:
-        include: ["~DEFAULT_BRANCH"]
+        include: ['~DEFAULT_BRANCH']
         exclude: []
     bypass_actors:
       # Repo admins can bypass (always = prompts at push/merge time, not silent exempt).
       # Repos can add more actors (other teams, integrations).
       - actor_id: 5
-        actor_type: RepositoryRole   # 1=read 2=triage 3=write 4=maintain 5=admin
+        actor_type: RepositoryRole # 1=read 2=triage 3=write 4=maintain 5=admin
         bypass_mode: always
       # automation-nsheaps GitHub App — actor_id is substituted from 2549081
 
@@ -341,13 +341,13 @@ rulesets:
     # enforcement: 'active'    # uncomment (and remove the disabled line above) to enable
     conditions:
       ref_name:
-        include: ["~DEFAULT_BRANCH"]
+        include: ['~DEFAULT_BRANCH']
         exclude: []
     bypass_actors:
       # Repo admins can bypass (always = prompts at push/merge time, not silent exempt).
       # Repos can add more actors (other teams, integrations).
       - actor_id: 5
-        actor_type: RepositoryRole   # 1=read 2=triage 3=write 4=maintain 5=admin
+        actor_type: RepositoryRole # 1=read 2=triage 3=write 4=maintain 5=admin
         bypass_mode: always
       # automation-nsheaps GitHub App — actor_id is substituted from 2549081