feat(rulesets): add automatic Copilot code review for gitflow develop branch

rulesets.tf

@@ -392,3 +392,39 @@ resource "github_organization_ruleset" "org_gitflow_develop" {
     }
   }
 }
+
+# Git-flow Copilot code review — automatic Copilot review on PRs into
+# develop only (not main) for opted-in repos.
+#
+# develop-only, not org_gitflow_base's main+develop pattern: develop is the
+# high-volume integration branch where feature PRs land; main on gitflow
+# repos is release/hotfix-only and low-volume. Unlike the native rulesets
+# above, Copilot review bills per review in AI credits — scoping to develop
+# and setting review_on_push = false bound that to roughly one review per PR,
+# on the branch that actually needs it.
+resource "github_organization_ruleset" "org_gitflow_copilot_review" {
+  name        = "org-gitflow-copilot-review"
+  target      = "branch"
+  enforcement = var.org_gitflow_copilot_review_enforcement
+
+  conditions {
+    ref_name {
+      include = ["refs/heads/develop"]
+      exclude = []
+    }
+    repository_property {
+      include = [{
+        name            = "gitflow"
+        property_values = ["true"]
+        source          = "custom"
+      }]
+    }
+  }
+
+  rules {
+    copilot_code_review {
+      review_on_push             = false
+      review_draft_pull_requests = false
+    }
+  }
+}

variables.tf

@@ -166,6 +166,31 @@ variable "org_gitflow_develop_enforcement" {
   }
 }
 
+variable "org_gitflow_copilot_review_enforcement" {
+  description = <<-EOT
+    Enforcement mode for automatic Copilot code review on git-flow repos'
+    develop branch only (not main, which is release-only and low-volume).
+    Binds only local.gitflow_repos via the gitflow custom property.
+
+    Cost note: unlike the native rulesets in this repo, Copilot code review
+    bills per review in AI credits — it is the one ruleset here that costs
+    money to run. review_on_push = false caps it at roughly one review per
+    PR. Current rates and the org's seat position are point-in-time facts
+    that belong in the PR that changes them, not in this description.
+
+    One of: disabled, evaluate, active. Defaults to "active" — new rulesets
+    apply enabled per the convention; set to "disabled" with `-var` to stop
+    the spend without a code change.
+  EOT
+  type        = string
+  default     = "active"
+
+  validation {
+    condition     = contains(["disabled", "evaluate", "active"], var.org_gitflow_copilot_review_enforcement)
+    error_message = "org_gitflow_copilot_review_enforcement must be one of: disabled, evaluate, active."
+  }
+}
+
 variable "org_push_protection_enforcement" {
   description = <<-EOT
     Enforcement mode for the org-wide push-protection ruleset (native