diff --git a/.gds/repository.yaml b/.gds/repository.yaml index 4354703..69f2110 100644 --- a/.gds/repository.yaml +++ b/.gds/repository.yaml @@ -33,7 +33,7 @@ product: path: "scripts" policy: - profiles: ["repository-default", "public-module"] + profiles: ["repository-default", "public-module", "continuous-development"] rollout_ring: "standard" git: @@ -47,7 +47,7 @@ verification: commands: test: ["scripts/validate_module.sh"] required: ["test"] - required_contexts: ["test"] + required_contexts: [] agent: context_profile: "project-default" diff --git a/.github/rulesets/branch-main.json b/.github/rulesets/branch-main.json index 113a143..842eeaf 100644 --- a/.github/rulesets/branch-main.json +++ b/.github/rulesets/branch-main.json @@ -18,14 +18,6 @@ "required_review_thread_resolution": true, "allowed_merge_methods": ["merge"] } - }, - { - "type": "required_status_checks", - "parameters": { - "strict_required_status_checks_policy": true, - "do_not_enforce_on_create": false, - "required_status_checks": [{"context": "test"}] - } } ] } diff --git a/CHANGELOG.md b/CHANGELOG.md index 6ad2148..737faa4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,9 @@ Versioning. ## [Unreleased] +- Select continuous-development so ordinary merge does not wait on the + `test` GitHub required check; local `verification.required` stays. + - Publish unsuccessful completed self-workflow attempts as unassigned, repository-local CI evidence; preserve actual conclusions and exact attempts. diff --git a/scripts/validate_module.sh b/scripts/validate_module.sh index 259374b..cda85be 100755 --- a/scripts/validate_module.sh +++ b/scripts/validate_module.sh @@ -23,12 +23,18 @@ for line in ( if line not in anchor: raise SystemExit(f"public module anchor lacks {line!r}") ruleset = json.loads(Path(".github/rulesets/branch-main.json").read_text()) -checks = [] -for rule in ruleset.get("rules", []): - if rule.get("type") == "required_status_checks": - checks = [row["context"] for row in rule["parameters"]["required_status_checks"]] -if checks != ["test"] or ruleset.get("bypass_actors") != []: - raise SystemExit("public ruleset does not require the exact test context without bypass") +rule_types = [rule.get("type") for rule in ruleset.get("rules", [])] +if ( + "continuous-development" not in anchor + or " required_contexts: []" not in anchor + or ruleset.get("bypass_actors") != [] + or "required_status_checks" in rule_types + or set(rule_types) != {"deletion", "non_fast_forward", "pull_request", "required_signatures"} +): + raise SystemExit( + "public ruleset must keep signatures/PR/deletion/non-fast-forward " + "without required checks or bypass" + ) workflow = Path(".github/workflows/ci.yml").read_text(encoding="utf-8") if "runs-on: ubuntu-latest" not in workflow or "pull_request_target" in workflow or "secrets:" in workflow: raise SystemExit("public CI runner or trust boundary drifted")