The rules are as follows:
If there is a community moderator election, a link to it appears in the bulletin.
Events can be created with a start date and time, an end date and time, a simple title, and a link to something somewhere on the network. Current or upcoming events are listed, with those starting or ending nearest to the current time shown first.
If there are fewer than 4 events, blog posts from the Stack Exchange blog are added to the list. A maximum of two posts will be shown, and only those posted in the past n days, where n is currently 10 on International versions of Stack Overflow, and 5 everywhere else. International sites have their own feeds on the company blog and do not list posts from the main English feed.
If there are still fewer than 4 items listed, then featured meta posts are shown.
If there are still under 4 items, the rest of the space is filled with hot discussion questions not marked status-completed, scoring at least 3 and posted within the past two weeks. These are picked semi-randomly. (Note that the timing, score and tags can be adjusted per-site to suit the needs of each community)
If there are any featured or hot meta posts, at least 1 will always be added to the list, even if it pushes the length over 4.
Additionally, up to 2 featured posts from Meta Stack Exchange will appear in the community bulletins of all main sites (but no child meta sites). These are also labeled "meta". Note that these will appear in addition to all of the other stuff listed above, so the list of community bulletin posts might appear longer than usual, depending on the individual site circumstances.
The URLs are checked at each stage to prevent duplicate items from being displayed (so that, for instance, a hot discussion post with the featured tag linked to a scheduled event won't ever fill 3 of the 4 slots). Items are considered identical if the URL and Title match or if they both point to the same question or answer on any Stack Exchange site (so that changing the title of a hot meta post linked from a scheduled event won't inadvertently result in it appearing twice).