mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5.5
dd955a71a6
The 16.0.0 entry pkgmgr wrote on top of CHANGELOG.md uses "-" bullets while every older entry uses "*". MD004's default "consistent" style takes the marker of the first list in a file, so lint-markdown reported 400 MD004 findings in CHANGELOG.md and the pre-push gate refused the release push. MD004 is now pinned to "dash", the marker pkgmgr and the changelog skill write, and make autoformat (markdownlint-cli2 --fix) converted the lists of the 72 files that still used "*". Only list markers changed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
259 lines
4.1 KiB
Markdown
259 lines
4.1 KiB
Markdown
# Branch Protection 🔒
|
|
|
|
See also [repository.md](../repository.md) for repository-wide security settings.
|
|
|
|
## Enforcement 🔒
|
|
|
|
- Ruleset is **Enabled (Enforced)**
|
|
|
|
👉 **Meaning for contributors:**
|
|
|
|
- All rules in this document are **actively enforced** on the default branch (`main`).
|
|
- Contributors MUST comply; violations will block pushes/merges.
|
|
|
|
---
|
|
|
|
## Bypass 🚪
|
|
|
|
- Organization admins and repository admins can always bypass rules
|
|
|
|
👉 **Meaning for contributors:**
|
|
|
|
- Normal contributors MUST follow all rules
|
|
- Admins MAY merge without approvals or checks
|
|
|
|
---
|
|
|
|
## Branch Target 🎯
|
|
|
|
- Applies to: **`main` (default branch)**
|
|
|
|
👉 **Meaning for contributors:**
|
|
|
|
- All rules apply when targeting `main`.
|
|
- Feature branches are NOT restricted until a PR targets `main`.
|
|
|
|
---
|
|
|
|
## Restrictions 🚫
|
|
|
|
### Restrict Updates ✅
|
|
|
|
- Direct pushes are blocked
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- You MUST NOT push directly to `main`
|
|
- You MUST use a Pull Request (PR)
|
|
|
|
---
|
|
|
|
### Restrict Deletions ✅
|
|
|
|
- Protected branch cannot be deleted
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- You MUST NOT delete the main branch
|
|
|
|
---
|
|
|
|
### Restrict Creations ❌
|
|
|
|
- Branch creation is allowed
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- You MAY create branches freely
|
|
|
|
---
|
|
|
|
## Pull Request Requirements 📋
|
|
|
|
### Require Pull Request ✅
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- You MUST open a PR to merge into `main`
|
|
- Direct commits to `main` are rejected
|
|
|
|
---
|
|
|
|
### Required Approvals: 2 ✅
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- You MUST get **2 approvals** before merging
|
|
- Self-approval does not count
|
|
|
|
---
|
|
|
|
### Dismiss Stale Approvals ✅
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- If you push new commits:
|
|
|
|
- Previous approvals are INVALIDATED
|
|
- You MUST get approvals again
|
|
|
|
---
|
|
|
|
### Require Code Owner Reviews ✅
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- If you modify owned files:
|
|
|
|
- A CODEOWNER MUST approve
|
|
- PR cannot be merged without them
|
|
|
|
---
|
|
|
|
### Require Approval of Most Recent Push ✅
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- After your last commit:
|
|
|
|
- Someone ELSE MUST approve again
|
|
- You CANNOT approve your own changes
|
|
|
|
---
|
|
|
|
### Require Conversation Resolution ✅
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- All review comments MUST be resolved
|
|
- Open discussions block merging
|
|
|
|
---
|
|
|
|
### Require Review from Specific Teams ❌
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- No fixed team is always required
|
|
- Only CODEOWNERS matter
|
|
|
|
---
|
|
|
|
## Merge Strategy 🔀
|
|
|
|
### Allowed Merge Method: Merge ✅
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- PRs are merged using merge commits
|
|
- History MAY become non-linear
|
|
|
|
---
|
|
|
|
### Require Linear History ❌
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- Merge commits ARE allowed
|
|
- You MAY see branching history
|
|
|
|
---
|
|
|
|
### Require Merge Queue ❌
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- PRs can be merged immediately after approval
|
|
- No automatic queueing
|
|
|
|
---
|
|
|
|
## Status Checks (CI/CD) ✅
|
|
|
|
### Require Status Checks to Pass ✅
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- Your PR MUST pass CI before merging
|
|
|
|
---
|
|
|
|
### Required Checks: NONE ⚠️
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- Currently, no checks are enforced
|
|
- Effectively: nothing blocks merge here
|
|
|
|
---
|
|
|
|
### Require Branch to Be Up-To-Date ✅
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- You MUST update your branch before merging
|
|
- Typically via:
|
|
|
|
- merge `main`
|
|
- or rebase
|
|
|
|
---
|
|
|
|
## Security 🔐
|
|
|
|
### Require Signed Commits ✅
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- All commits MUST be signed (GPG/SSH)
|
|
- Unsigned commits will be rejected
|
|
|
|
---
|
|
|
|
### Block Force Pushes ✅
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- You MUST NOT rewrite history on protected branches
|
|
- `git push --force` is blocked
|
|
|
|
---
|
|
|
|
## Code Scanning 🔬
|
|
|
|
### Require Code Scanning Results ✅
|
|
|
|
Configured tools:
|
|
|
|
- CodeQL (High severity)
|
|
- Hadolint (High severity)
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- PR MUST NOT introduce high-severity issues
|
|
- Otherwise merge is blocked
|
|
|
|
---
|
|
|
|
## Code Quality 🏆
|
|
|
|
### Require Code Quality Results ✅
|
|
|
|
- Threshold: Warnings and higher
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- You MUST fix code quality issues before merge
|
|
|
|
---
|
|
|
|
## Copilot Review 🤖
|
|
|
|
### Automatically Request Copilot Review ✅
|
|
|
|
👉 **Contributor impact:**
|
|
|
|
- Copilot may automatically review your PR
|
|
- It may comment on issues
|
|
- It does not replace human approvals
|