0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 10:59:59 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 5.5 b2c2fe7703 docs(github): match branch protection docs to the live ruleset

The contributor docs described repository settings that are not in
place. security.md marked "Require status checks", "Require branch to
be up to date" and "Require signed commits" as enforced, but the active
ruleset `Main` has no required_status_checks and no required_signatures
rule, and the separate `Signed` ruleset is disabled. repository.md
listed Dependabot alerts, security and version updates, secret scanning
and push protection as disabled although all of them are on, and its
summary repeated the two rules that are not enforced. branch.md claimed
branch protection enforces the branch naming rules, while only the PR
validation run checks the prefix. Three pages still described a hadolint
SARIF job in call-lint.yml that no longer exists, which hid that nothing
uploads the Hadolint results the ruleset asks for.

The pages now state what the ruleset and the repository settings
enforce today, name the policy pages for rules that are policy only,
and record that no workflow uploads Hadolint results.

Scorecard alerts 472, 504 and 505 depend on repository settings and
process and stay open; 507 and 539 are no longer reported on main.

Refs #853

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-28 22:39:16 +01:00

1.5 KiB

Raw Permalink Blame History

Repository Settings 🔧

See also branch.md for branch protection rules.

Dependency Management 📦

Dependency Graph ✅

👉 Dependency insights are available under Insights → Dependency graph

Dependabot Alerts ✅

👉 Known vulnerabilities in dependencies are reported as Dependabot alerts

Dependabot Security Updates ✅

👉 Dependabot opens PRs that bump vulnerable dependencies to a fixed release

Dependabot Version Updates ✅

👉 Dependabot opens upgrade PRs for the ecosystems listed in dependabot.yml

Code Scanning (Global) 🔬

CodeQL ✅

👉 Security issues may be detected automatically

Copilot Autofix ✅

👉 Suggested fixes may appear

Secret Protection 🔐

For GHCR authentication configuration see authentication.md.

Secret Scanning ✅

👉 Committed secrets are detected and reported as secret scanning alerts

Push Protection ✅

👉 Pushes that contain a detected secret are blocked

Summary for Contributors 📋

You MUST:

Create a PR (no direct push)
Get 2 approvals
Get CODEOWNER approval (if applicable)
Resolve all comments
Re-approve after changes
Pass code scanning & quality checks

You MUST NOT:

Push directly to main
Force push
Merge without approvals

You MAY:

Create branches freely
Use merge commits

All rules above are currently enforced on main.

1.5 KiB Raw Permalink Blame History