mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 19:56:53 +00:00
kevinveenbirkenbachandClaude Opus 5.5
b2c2fe7703
The contributor docs described repository settings that are not in place. security.md marked "Require status checks", "Require branch to be up to date" and "Require signed commits" as enforced, but the active ruleset `Main` has no required_status_checks and no required_signatures rule, and the separate `Signed` ruleset is disabled. repository.md listed Dependabot alerts, security and version updates, secret scanning and push protection as disabled although all of them are on, and its summary repeated the two rules that are not enforced. branch.md claimed branch protection enforces the branch naming rules, while only the PR validation run checks the prefix. Three pages still described a hadolint SARIF job in call-lint.yml that no longer exists, which hid that nothing uploads the Hadolint results the ruleset asks for. The pages now state what the ruleset and the repository settings enforce today, name the policy pages for rules that are policy only, and record that no workflow uploads Hadolint results. Scorecard alerts 472, 504 and 505 depend on repository settings and process and stay open; 507 and 539 are no longer reported on main. Refs #853 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
251 lines
4.5 KiB
Markdown
251 lines
4.5 KiB
Markdown
# Branch Protection 🔒
|
|
|
|
See also [repository.md](../repository.md) for repository-wide security settings.
|
|
|
|
## Enforcement 🔒
|
|
|
|
- Ruleset `Main` is **Enabled (Enforced)**
|
|
|
|
👉 **Meaning for contributors:**
|
|
|
|
- Every rule marked ✅ in this document is **actively enforced** on the default branch (`main`).
|
|
- Rules marked ❌ are not part of the ruleset and block nothing.
|
|
- Contributors MUST comply; violations will block pushes/merges.
|
|
|
|
---
|
|
|
|
## Bypass 🚪
|
|
|
|
- Organization admins and repository admins can always bypass rules
|
|
|
|
👉 **Meaning for contributors:**
|
|
|
|
- Normal contributors MUST follow all rules
|
|
- Admins MAY merge without approvals or checks
|
|
|
|
---
|
|
|
|
## Branch Target 🎯
|
|
|
|
- Applies to: **`main` (default branch)**
|
|
|
|
👉 **Meaning for contributors:**
|
|
|
|
- All rules apply when targeting `main`.
|
|
- Feature branches are NOT restricted until a PR targets `main`.
|
|
|
|
---
|
|
|
|
## Restrictions 🚫
|
|
|
|
### Restrict Updates ✅
|
|
|
|
- Direct pushes are blocked
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- You MUST NOT push directly to `main`
|
|
- You MUST use a Pull Request (PR)
|
|
|
|
---
|
|
|
|
### Restrict Deletions ✅
|
|
|
|
- Protected branch cannot be deleted
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- You MUST NOT delete the main branch
|
|
|
|
---
|
|
|
|
### Restrict Creations ❌
|
|
|
|
- Branch creation is allowed
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- You MAY create branches freely
|
|
|
|
---
|
|
|
|
## Pull Request Requirements 📋
|
|
|
|
### Require Pull Request ✅
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- You MUST open a PR to merge into `main`
|
|
- Direct commits to `main` are rejected
|
|
|
|
---
|
|
|
|
### Required Approvals: 2 ✅
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- You MUST get **2 approvals** before merging
|
|
- Self-approval does not count
|
|
|
|
---
|
|
|
|
### Dismiss Stale Approvals ✅
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- If you push new commits:
|
|
|
|
- Previous approvals are INVALIDATED
|
|
- You MUST get approvals again
|
|
|
|
---
|
|
|
|
### Require Code Owner Reviews ✅
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- If you modify owned files:
|
|
|
|
- A CODEOWNER MUST approve
|
|
- PR cannot be merged without them
|
|
|
|
---
|
|
|
|
### Require Approval of Most Recent Push ✅
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- After your last commit:
|
|
|
|
- Someone ELSE MUST approve again
|
|
- You CANNOT approve your own changes
|
|
|
|
---
|
|
|
|
### Require Conversation Resolution ✅
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- All review comments MUST be resolved
|
|
- Open discussions block merging
|
|
|
|
---
|
|
|
|
### Require Review from Specific Teams ❌
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- No fixed team is always required
|
|
- Only CODEOWNERS matter
|
|
|
|
---
|
|
|
|
## Merge Strategy 🔀
|
|
|
|
### Allowed Merge Method: Merge ✅
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- PRs are merged using merge commits
|
|
- History MAY become non-linear
|
|
|
|
---
|
|
|
|
### Require Linear History ❌
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- Merge commits ARE allowed
|
|
- You MAY see branching history
|
|
|
|
---
|
|
|
|
### Require Merge Queue ❌
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- PRs can be merged immediately after approval
|
|
- No automatic queueing
|
|
|
|
---
|
|
|
|
## Status Checks (CI/CD) ❌
|
|
|
|
### Require Status Checks to Pass ❌
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- The ruleset names no required check, so a failing or missing CI run does not block the merge.
|
|
- CI in your fork still MUST be green before you open the PR, see [pull-request.md](../../../artefact/git/pull-request.md).
|
|
|
|
---
|
|
|
|
### Require Branch to Be Up-To-Date ❌
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- The ruleset does not block merging a branch that is behind `main`.
|
|
- Your branch still MUST be up to date with `main`, see [pull-request.md](../../../artefact/git/pull-request.md).
|
|
|
|
---
|
|
|
|
## Security 🔐
|
|
|
|
### Require Signed Commits ❌
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- The ruleset `Main` does not reject unsigned commits.
|
|
- The ruleset `Signed`, which requires signed commits on `main`, is disabled.
|
|
|
|
---
|
|
|
|
### Block Force Pushes ✅
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- You MUST NOT rewrite history on protected branches
|
|
- `git push --force` is blocked
|
|
|
|
---
|
|
|
|
## Code Scanning 🔬
|
|
|
|
### Require Code Scanning Results ✅
|
|
|
|
Configured tools:
|
|
|
|
- CodeQL (High severity)
|
|
- Hadolint (High severity)
|
|
|
|
No workflow uploads Hadolint results to code scanning. Hadolint checks `Dockerfile` as `lint-dockerfile` inside `make lint` and writes no SARIF.
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- PR MUST NOT introduce high-severity issues
|
|
- Otherwise merge is blocked
|
|
|
|
---
|
|
|
|
## Code Quality 🏆
|
|
|
|
### Require Code Quality Results ✅
|
|
|
|
- Threshold: Warnings and higher
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- You MUST fix code quality issues before merge
|
|
|
|
---
|
|
|
|
## Copilot Review 🤖
|
|
|
|
### Automatically Request Copilot Review ✅
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- Copilot may automatically review your PR
|
|
- It may comment on issues
|
|
- It does not replace human approvals
|