docs: repository setup for 3-ruleset branch protection design#75
docs: repository setup for 3-ruleset branch protection design#75hdamker wants to merge 9 commits intocamaraproject:release-automationfrom
Conversation
…ject#71) Consolidate 3 rulesets into 1 combined release-snapshot-protection ruleset with GitHub App bypass, 2 required approvals, and required_reviewers for the release-management_reviewers team. Update CODEOWNERS guidance to reflect removal of legacy /CHANGELOG.md lines. Update verification checklist.
|
@tanjadegroot @Kevsy @rartych @albertoramosmonagas this documentation of the needed setup within an API Repository for the Release Automation is worth a review (the resulting file, not the changes). Note: The setup will be done by the campaign and script described in camaraproject/project-administration#132 camaraproject/project-administration#133 (and for new repositories via the Template_API_Repository). ReleaseTest repo to come. |
Replace ambiguous "four-eyes review" with explicit "two distinct people must approve" per PR review feedback.
Revert D-008: keep /CHANGELOG.md and /CHANGELOG.MD lines in CODEOWNERS to prevent unreviewed changes to the legacy changelog file during Phase 1 migration. RM reviewer assignment on snapshot branches is additionally enforced via ruleset required_reviewers.
Document 3-way CHANGELOG.md handling: unchanged template placeholders are deleted, repos with real content get forward-reference notes, and repos without CHANGELOG.md get a fresh index. Update verification checklist accordingly.
tanjadegroot
left a comment
tanjadegroot
left a comment
There was a problem hiding this comment.
looks great !
/LGTM
|
One after review thought: who should apply/check the repo configuration and when ? |
Replace the manual setup/verification framing with a clear statement that the configuration is applied automatically by the onboarding campaign and admin tooling. Add reference to Template_API_Repository update after rollout (tooling#82).
@tanjadegroot good point, I clarified this in 2490fdf and created new #82 for the backlog after the roll-out of release automation:
Note: I will keep the PR open until the configuration and the release-automation-onboarding workflow (camaraproject/project-administration#134) is tested e2e. |
hdamker
force-pushed
the
71-repository-setup
branch
from
a6820c1 to
2490fdf
Compare
The update rule is unnecessary and blocks PR merges for non-bypass actors. The pull_request rule prevents direct pushes and enforces review gates. Updated description, rules list, JSON example, and verification checklist.
Document the release-pointer-protection and pre-release-pointer-protection rulesets that protect pointer branches created after publication. Update intro, verification checklist, and add API payloads. Relates to camaraproject/ReleaseManagement#393
|
Update: Added pointer branch protection rulesets to This adds documentation for two new rulesets that protect pointer branches created after publication:
Context: camaraproject/ReleaseManagement#393, implementation in #93. |
…payload The canonical Template_API_Repository ruleset includes both OrganizationAdmin and Integration bypass actors. The JSON payload example was missing OrganizationAdmin.
hdamker
changed the title
- Add OrganizationAdmin to snapshot-protection bypass actors table (matches canonical ruleset and JSON payload) - Fix release-plan.yaml example: correct field names (commonalities_release, identity_consent_management_release, target_api_version, target_api_status) and values - Update last-updated date
4 participants
What type of PR is this?
What this PR does / why we need it:
Updates
repository-setup.mdto reflect the consolidated ruleset design:release-snapshot-protectionrulesetcamara-release-automationGitHub Apprequired_reviewersfor therelease-management_reviewersteam with 2 required approvals/CHANGELOG.mdlines are removed by the onboarding campaign, RM reviewer enforcement moves to the rulesetThe canonical ruleset has been created manually in
Template_API_Repository(ID: 12904446) and this document matches it exactly.Which issue(s) this PR fixes:
Fixes #71
Special notes for reviewers:
The JSON payload in the document was extracted from the actual ruleset in Template_API_Repository. The
required_reviewersfield is a beta feature in the GitHub Rulesets API but is functional and available in the UI.Changelog input
Additional documentation
This section can be blank.