Add table github_organization_ruleset

[romain-pix-cyber]

Problem : Steampipe allows to query the ruleset from individual repositories but not rulesets defined at the organization level.

This PR solves the issue with a new table github_organization_ruleset :

• New table mirrors github_repository_ruleset but scoped to an organization via
  organization(login: $org) GraphQL path
• Reuses existing Rule, BypassActor, Conditions models
• Includes docs at docs/tables/github_organization_ruleset.md

Example query results

list of rulesets

Details

select
  name,
  enforcement,
  created_at
from
  github_organization_ruleset
where
  organization = 'my-org';

Results

+--------------------+-------------+---------------------------+
| name               | enforcement | created_at                |
+--------------------+-------------+---------------------------+
| Corp-Rule-Infra    | EVALUATE    | 2026-02-06T10:47:41+01:00 |
| Branch protection | DISABLED    | 2025-07-18T11:38:12+02:00 |
+--------------------+-------------+---------------------------+

Details of a ruleset

```sql select name, r->>'id' as rule_id, r->>'type' as rule_type, r->>'parameters' as rule_parameters from github_organization_ruleset, jsonb_array_elements(rules) as r where organization = 'my-org' and name = 'Corp-Rule-Infra'; ```

Results

``` +----------------+----------------------+------------------+---------------------------------------> | name | rule_id | rule_type | rule_parameters > +----------------+----------------------+------------------+---------------------------------------> | Corp-Rule-Infra | RRU_kwDOAL8SuM4E07XQ | NON_FAST_FORWARD | {"Type": "", "UpdateParameters": {"upd> | | | | "", "operator": ""}, "CommitAuthorEmai> | Corp-Rule-Infra | RRU_kwDOAL8SuM4E07XS | PULL_REQUEST | {"Type": "PullRequestParameters", "Upd> | | | | : false, "pattern": "", "operator": ""> +----------------+----------------------+------------------+---------------------------------------> ~ ```

Get bypass actors for a specific ruleset

```sql select name, b->>'id' as bypass_actor_id, b->>'deploy_key' as deploy_key, b->>'bypass_mode' as bypass_mode, b->>'repository_role_name' as repository_role_name, b->>'repository_role_database_id' as repository_role_database_id from github_organization_ruleset, jsonb_array_elements(bypass_actors) as b where organization = 'my-org' and name = 'Corp-Rule-Infra'; ```

Results

``` +----------------+--------------------------------------+------------+-------------+----------------------+-----------------------------+ | name | bypass_actor_id | deploy_key | bypass_mode | repository_role_name | repository_role_database_id | +----------------+--------------------------------------+------------+-------------+----------------------+-----------------------------+ | Corp-Rule-Infra | MDE1Ol[...]jc4OTcw | false | ALWAYS | | 0 | +----------------+--------------------------------------+------------+-------------+----------------------+-----------------------------+ ```

List rulesets with specific enforcement levels

```sql select name, enforcement from github_organization_ruleset where organization = 'my-org' and enforcement = 'EVALUATE'; ```

Results

``` +----------------+-------------+ | name | enforcement | +----------------+-------------+ | Corp-Rule-Infra | EVALUATE | +----------------+-------------+ ```

List all rulesets created after a specific date

```sql select name, created_at from github_organization_ruleset where organization = 'my-org' and created_at > '2026-01-01T00:00:00Z'; ```

Results

``` +----------------+---------------------------+ | name | created_at | +----------------+---------------------------+ | Corp-Rule-Infra | 2026-02-06T10:47:41+01:00 | +----------------+---------------------------+ ```

List rulesets with pull request parameters

```sql select id, name, r -> 'parameters' ->> 'Type' as type, r -> 'parameters' -> 'PullRequestParameters' ->> 'require_code_owner_review' as require_code_owner_review, r -> 'parameters' -> 'PullRequestParameters' ->> 'required_approving_review_count' as required_approving_review_count from github_organization_ruleset, jsonb_array_elements(rules) as r where organization = 'my-org' and (r -> 'parameters' ->> 'Type') = 'PullRequestParameters'; ```

Results

``` +-----------------------------+--------------------+-----------------------+---------------------------+---------------------------------+ | id | name | type | require_code_owner_review | required_approving_review_count | +-----------------------------+--------------------+-----------------------+---------------------------+---------------------------------+ | RRS_lA[...]zgBnx1U | Branch protection | PullRequestParameters | false | 1 | | RRS_lA[...]zgC_Erg | Corp-Rule-Infra | PullRequestParameters | false | 1 | +-----------------------------+--------------------+-----------------------+---------------------------+---------------------------------+ ```

List rulesets with required status check parameters

```sql select id, name, r -> 'parameters' ->> 'Type' as type, r -> 'parameters' -> 'RequiredStatusChecksParameters' ->> 'required_status_checks' as required_status_checks from github_organization_ruleset, jsonb_array_elements(rules) as r where organization = 'my-org' and (r -> 'parameters' ->> 'Type') = 'RequiredStatusChecksParameters'; ```

Results

``` +----+------+------+------------------------+ | id | name | type | required_status_checks | +----+------+------+------------------------+ +----+------+------+------------------------+ ```

I used AI to generate most of the code following the documentation, then reviewed and verified manually the compilation and the results.

[cbruno10]

@romain-pix-cyber Thanks for raising this PR! I've added a few suggestions, and can you please also share the results of running each of the example queries (just for 1 engine is ok), as some of them seem like they wouldn't return the expected set of rows.

[cbruno10]

Could you wrap this in commonColumns(...)? Almost every table in the plugin adds the standard login_id column via commonColumns(), and it looks like this was copied from github_repository_ruleset, which is one of the few tables that accidentally omits it.

For instance: https://github.com/turbot/steampipe-plugin-github/blob/main/github/table_github_organization.go#L113

[cbruno10]

Is d *plugin.QueryData used, do we need it?

Also, for this function and getAdditionalOrgBypassActors, can we order the args to be consistent between the 2 functions?

[cbruno10]

Can you please double check the required permissions? Reading organization rulesets generally needs organization Administration (Read-only), or admin:org for a classic PAT, not Members (Read-only).

[romain-pix-cyber]

Sorry I doubled-checked this doc : according to the documentation, Reading organization rulesets even needs Administration (Write) for fine-grained Personal Access Tokens.
My own testing confirms this is indeed needed for access with PAT.

[cbruno10]

Looking at the GraphQL schema, the values would be uppercase for enforcement, e.g., EVALUATE, DISABLED. Does this example return rows as expected?

[romain-pix-cyber]

Indeed, the example needs to be uppercase. By re-running through all of them as you asked I corrected this issue as well.
I provided two different example values in the two engine examples

[romain-pix-cyber]

Hi @cbruno10 , thank you for your feedback, I fixed your remarks in the latest commit

[cbruno10]

Thanks @romain-pix-cyber for the new table! We're planning a new plugin version in the next week or so, so we'll include this table with it.