admin: GitHub App control-plane lane (ghapp/repo-admin) #81
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| { | ||
| "name": "protect-main-release-only", | ||
| "target": "branch", | ||
| "enforcement": "active", | ||
| "conditions": { | ||
| "ref_name": { | ||
| "include": [ | ||
| "refs/heads/main" | ||
| ], | ||
| "exclude": [] | ||
| } | ||
| }, | ||
| "rules": [ | ||
| { | ||
| "type": "pull_request", | ||
| "parameters": { | ||
| "allowed_merge_methods": [ | ||
| "squash", | ||
| "rebase" | ||
| ], | ||
| "dismiss_stale_reviews_on_push": true, | ||
| "require_code_owner_review": false, | ||
| "require_last_push_approval": false, | ||
| "required_approving_review_count": 0, | ||
|
primeinc marked this conversation as resolved.
|
||
| "required_review_thread_resolution": true | ||
| } | ||
| }, | ||
| { | ||
| "type": "required_status_checks", | ||
| "parameters": { | ||
| "strict_required_status_checks_policy": true, | ||
| "required_status_checks": [ | ||
| { | ||
| "context": "head matches main" | ||
| }, | ||
| { | ||
| "context": "only allowed files" | ||
| }, | ||
| { | ||
| "context": "token + install" | ||
| }, | ||
| { | ||
| "context": "src branch allowed" | ||
| }, | ||
| { | ||
| "context": "DoNotMergeYet absent" | ||
| }, | ||
| { | ||
| "context": "all gates pass" | ||
| }, | ||
| { | ||
| "context": "workflows valid" | ||
| }, | ||
| { | ||
| "context": "build succeeds" | ||
| } | ||
| ] | ||
| } | ||
| }, | ||
| { | ||
| "type": "required_linear_history" | ||
| }, | ||
| { | ||
| "type": "non_fast_forward" | ||
| }, | ||
| { | ||
| "type": "deletion" | ||
| } | ||
| ], | ||
| "bypass_actors": [] | ||
|
There was a problem hiding this comment. The PR description mentions an "App bypass" and provides a specific App ID ( "bypass_actors": [
{
"actor_id": 3663316,
"actor_type": "Integration",
"bypass_mode": "always"
}
]
Owner
Author
There was a problem hiding this comment. Brief explicitly says: "Tracked JSON must not hardcode numeric App IDs." Bypass actor is rendered at runtime from |
||
| } | ||
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,59 @@ | ||||||
| { | ||||||
| "name": "protect-next", | ||||||
| "target": "branch", | ||||||
| "enforcement": "active", | ||||||
| "conditions": { | ||||||
| "ref_name": { | ||||||
| "include": [ | ||||||
| "refs/heads/next" | ||||||
| ], | ||||||
| "exclude": [] | ||||||
| } | ||||||
| }, | ||||||
| "rules": [ | ||||||
| { | ||||||
| "type": "pull_request", | ||||||
| "parameters": { | ||||||
| "allowed_merge_methods": [ | ||||||
| "squash", | ||||||
| "rebase" | ||||||
| ], | ||||||
| "dismiss_stale_reviews_on_push": true, | ||||||
| "require_code_owner_review": false, | ||||||
| "require_last_push_approval": false, | ||||||
| "required_approving_review_count": 0, | ||||||
|
There was a problem hiding this comment. Similar to the
Suggested change
Owner
Author
There was a problem hiding this comment. Same as protect-main:24 — brief says solo-owner; review_count=0 is correct. See reply on PRRT_kwDOPMjo5M6A9i1m. Not changing. Leaving open for human review.
primeinc marked this conversation as resolved.
|
||||||
| "required_review_thread_resolution": true | ||||||
| } | ||||||
| }, | ||||||
| { | ||||||
| "type": "required_status_checks", | ||||||
| "parameters": { | ||||||
| "strict_required_status_checks_policy": true, | ||||||
| "required_status_checks": [ | ||||||
| { | ||||||
| "context": "DoNotMergeYet absent" | ||||||
| }, | ||||||
| { | ||||||
| "context": "all gates pass" | ||||||
| }, | ||||||
| { | ||||||
| "context": "workflows valid" | ||||||
| }, | ||||||
| { | ||||||
| "context": "build succeeds" | ||||||
| } | ||||||
| ] | ||||||
| } | ||||||
| }, | ||||||
| { | ||||||
| "type": "required_linear_history" | ||||||
| }, | ||||||
| { | ||||||
| "type": "non_fast_forward" | ||||||
| }, | ||||||
| { | ||||||
| "type": "deletion" | ||||||
| } | ||||||
| ], | ||||||
| "bypass_actors": [] | ||||||
|
There was a problem hiding this comment. The "bypass_actors": [
{
"actor_id": 3663316,
"actor_type": "Integration",
"bypass_mode": "always"
}
]
Owner
Author
There was a problem hiding this comment. Same as protect-main:64 — brief says "Tracked JSON must not hardcode numeric App IDs." Bypass actor rendered at runtime in 00e. See reply on PRRT_kwDOPMjo5M6A9i1r. Not changing. Leaving open for human review. |
||||||
| } | ||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Setting
required_approving_review_countto0effectively disables mandatory peer reviews for themainbranch. For a production-critical branch, it is highly recommended to require at least one approval to ensure code quality and prevent accidental or malicious unreviewed changes.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Brief explicitly says: "No
require_code_owner_reviewunless a real separate reviewer/team exists. It does not." The repo is solo-owner with no team layer. With one actor,required_approving_review_count: 1is unsatisfiable (the PR author can't self-approve), so a value of 1 would block every merge. The brief-aligned shape is review_count=0; merge-time governance comes from required_status_checks (gate, build, workflow-lint, do-not-merge-yet, main-release-guard, admin-branch-sync-guard) plus the App's bypass_actor for the few cases that need it. Not changing. Leaving open for human review.