GitHub: Push Rules in Rulesets Now Support Path Exceptions

What shipped? GitHub added path-level exception patterns to push rules inside rulesets.

What changed? Push rules in rulesets (organization and repository level) now support a path_exceptions field. You write a rule that blocks, say, all .exe or .env files across your repo, then list specific paths where that restriction should not apply — a /tools/ directory that legitimately ships binaries, or a /infra/ folder with environment templates. The exception is per-rule, not a separate bypass.

This ships alongside the existing scope and file-type conditions. It's the composability piece that was missing: before this, you either blocked a pattern everywhere or wrote multiple narrowly scoped rules with overlapping conditions. Now a single rule covers the general case and the exceptions sit inline.

Why a builder cares? Granular push rules reduce the friction between security policy and legitimate workflow — no more PRs to exempt a directory, no more --no-verify workarounds that bypass everything.