From 284477476c80ef09b0c8a3b22aa03451624e7138 Mon Sep 17 00:00:00 2001 From: Michael Mainer Date: Wed, 30 Aug 2023 13:05:15 -0700 Subject: [PATCH 1/3] - add matrix build check --- .github/workflows/ci_validation.yml | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci_validation.yml b/.github/workflows/ci_validation.yml index ddcfe9883..8f490a3f0 100644 --- a/.github/workflows/ci_validation.yml +++ b/.github/workflows/ci_validation.yml @@ -21,10 +21,10 @@ jobs: node-version: ${{ matrix.node-version }} - name: Install dependencies run: npm ci - + - name: Build for node 16, 18 & 20 run: npm run build - + - name: Run unit tests run: npm test @@ -33,3 +33,17 @@ jobs: run: | npm ci npm test + + # The check-build-matrix returns success if all matrix jobs in build are successful; otherwise, it returns a failure. + # Use this as a PR status check for GitHub Policy Service instead of individual matrix entry checks. + check-build-matrix: + runs-on: ubuntu-latest + needs: build + if: always() + steps: + - name: All build matrix options are successful + if: ${{ !(contains(needs.*.result, 'failure')) }} + run: exit 0 + - name: One or more build matrix options failed + if: ${{ contains(needs.*.result, 'failure') }} + run: exit 1 \ No newline at end of file From 9997a3b63a32da86d5a8c5789b0e9c8173b12fad Mon Sep 17 00:00:00 2001 From: Michael Mainer Date: Wed, 30 Aug 2023 13:23:11 -0700 Subject: [PATCH 2/3] chore: update branch protection rules * All dev and main branches must have policy * Require status checks to pass before merging * Require code owner approvals of all changes in main/master and dev branches * Require re-approval after new commits --- ...graph-sdk-javascript-branch-protection.yml | 58 ++++++++----------- 1 file changed, 23 insertions(+), 35 deletions(-) diff --git a/.github/policies/msgraph-sdk-javascript-branch-protection.yml b/.github/policies/msgraph-sdk-javascript-branch-protection.yml index 500cd58b8..17b826f89 100644 --- a/.github/policies/msgraph-sdk-javascript-branch-protection.yml +++ b/.github/policies/msgraph-sdk-javascript-branch-protection.yml @@ -10,7 +10,7 @@ configuration: branchProtectionRules: - branchNamePattern: dev - # This branch pattern applies to the following branches as of 06/12/2023 10:31:16: + # This branch pattern applies to the following branches as of 08/30/2023: # dev # Specifies whether this branch can be deleted. boolean @@ -30,14 +30,12 @@ configuration: # Are commits required to be signed. boolean. TODO: all contributors must have commit signing on local machines. requiresCommitSignatures: false # Are conversations required to be resolved before merging? boolean - requiresConversationResolution: false + requiresConversationResolution: true # Are merge commits prohibited from being pushed to this branch. boolean requiresLinearHistory: false # Required status checks to pass before merging. Values can be any string, but if the value does not correspond to any existing status check, the status check will be stuck on pending for status since nothing exists to push an actual status requiredStatusChecks: - - build (16.x) - - build (18.x) - - build (20.x) + - check-build-matrix # Require branches to be up to date before merging. Requires requiredStatusChecks. boolean requiresStrictStatusChecks: true # Indicates whether there are restrictions on who can push. boolean. Should be set with whoCanPush. @@ -46,7 +44,7 @@ configuration: restrictsReviewDismissals: false - branchNamePattern: master - # This branch pattern applies to the following branches as of 06/12/2023 10:31:16: + # This branch pattern applies to the following branches as of 08/30/2023: # master # Specifies whether this branch can be deleted. boolean @@ -66,14 +64,12 @@ configuration: # Are commits required to be signed. boolean. TODO: all contributors must have commit signing on local machines. requiresCommitSignatures: false # Are conversations required to be resolved before merging? boolean - requiresConversationResolution: false + requiresConversationResolution: true # Are merge commits prohibited from being pushed to this branch. boolean requiresLinearHistory: false # Required status checks to pass before merging. Values can be any string, but if the value does not correspond to any existing status check, the status check will be stuck on pending for status since nothing exists to push an actual status requiredStatusChecks: - - build (16.x) - - build (18.x) - - build (20.x) + - check-build-matrix # Require branches to be up to date before merging. Requires requiredStatusChecks. boolean requiresStrictStatusChecks: true # Indicates whether there are restrictions on who can push. boolean. Should be set with whoCanPush. @@ -82,7 +78,7 @@ configuration: restrictsReviewDismissals: false - branchNamePattern: 3.0.0 - # This branch pattern applies to the following branches as of 06/12/2023 10:31:16: + # This branch pattern applies to the following branches as of 08/30/2023: # 3.0.0 # Specifies whether this branch can be deleted. boolean @@ -90,22 +86,20 @@ configuration: # Specifies whether forced pushes are allowed on this branch. boolean allowsForcePushes: false # Specifies whether new commits pushed to the matching branches dismiss pull request review approvals. boolean - dismissStaleReviews: false + dismissStaleReviews: true # Specifies whether admins can overwrite branch protection. boolean isAdminEnforced: false # Require review from Code Owners. Requires requiredApprovingReviewsCount. boolean - requireCodeOwnersReview: false + requireCodeOwnersReview: true # Are commits required to be signed. boolean. TODO: all contributors must have commit signing on local machines. requiresCommitSignatures: false # Are conversations required to be resolved before merging? boolean - requiresConversationResolution: false + requiresConversationResolution: true # Are merge commits prohibited from being pushed to this branch. boolean requiresLinearHistory: false # Required status checks to pass before merging. Values can be any string, but if the value does not correspond to any existing status check, the status check will be stuck on pending for status since nothing exists to push an actual status requiredStatusChecks: - - build (16.x) - - build (18.x) - - build (20.x) + - check-build-matrix # Require branches to be up to date before merging. Requires requiredStatusChecks. boolean requiresStrictStatusChecks: true # Indicates whether there are restrictions on who can push. boolean. Should be set with whoCanPush. @@ -114,7 +108,7 @@ configuration: restrictsReviewDismissals: false - branchNamePattern: support/v2 - # This branch pattern applies to the following branches as of 06/12/2023 10:31:16: + # This branch pattern applies to the following branches as of 08/30/2023: # support/v2 # Specifies whether this branch can be deleted. boolean @@ -122,7 +116,7 @@ configuration: # Specifies whether forced pushes are allowed on this branch. boolean allowsForcePushes: false # Specifies whether new commits pushed to the matching branches dismiss pull request review approvals. boolean - dismissStaleReviews: false + dismissStaleReviews: true # Specifies whether admins can overwrite branch protection. boolean isAdminEnforced: false # Indicates whether "Require a pull request before merging" is enabled. boolean @@ -130,18 +124,16 @@ configuration: # Specifies the number of pull request reviews before merging. int (0-6). Should be null/empty if PRs are not required requiredApprovingReviewsCount: 1 # Require review from Code Owners. Requires requiredApprovingReviewsCount. boolean - requireCodeOwnersReview: false + requireCodeOwnersReview: true # Are commits required to be signed. boolean. TODO: all contributors must have commit signing on local machines. requiresCommitSignatures: false # Are conversations required to be resolved before merging? boolean - requiresConversationResolution: false + requiresConversationResolution: true # Are merge commits prohibited from being pushed to this branch. boolean requiresLinearHistory: false # Required status checks to pass before merging. Values can be any string, but if the value does not correspond to any existing status check, the status check will be stuck on pending for status since nothing exists to push an actual status requiredStatusChecks: - - build (16.x) - - build (18.x) - - build (20.x) + - check-build-matrix # Require branches to be up to date before merging. Requires requiredStatusChecks. boolean requiresStrictStatusChecks: true # Indicates whether there are restrictions on who can push. boolean. Should be set with whoCanPush. @@ -150,7 +142,7 @@ configuration: restrictsReviewDismissals: false - branchNamePattern: v2/dev - # This branch pattern applies to the following branches as of 06/12/2023 10:31:16: + # This branch pattern applies to the following branches as of 08/30/2023: # v2/dev # Specifies whether this branch can be deleted. boolean @@ -175,9 +167,7 @@ configuration: requiresLinearHistory: false # Required status checks to pass before merging. Values can be any string, but if the value does not correspond to any existing status check, the status check will be stuck on pending for status since nothing exists to push an actual status requiredStatusChecks: - - build (16.x) - - build (18.x) - - build (20.x) + - check-build-matrix # Require branches to be up to date before merging. Requires requiredStatusChecks. boolean requiresStrictStatusChecks: false # Indicates whether there are restrictions on who can push. boolean. Should be set with whoCanPush. @@ -186,7 +176,7 @@ configuration: restrictsReviewDismissals: false - branchNamePattern: main - # This branch pattern applies to the following branches as of 06/12/2023 10:31:16: + # This branch pattern applies to the following branches as of 08/30/2023: # main # Specifies whether this branch can be deleted. boolean @@ -194,7 +184,7 @@ configuration: # Specifies whether forced pushes are allowed on this branch. boolean allowsForcePushes: false # Specifies whether new commits pushed to the matching branches dismiss pull request review approvals. boolean - dismissStaleReviews: false + dismissStaleReviews: true # Specifies whether admins can overwrite branch protection. boolean isAdminEnforced: false # Indicates whether "Require a pull request before merging" is enabled. boolean @@ -202,18 +192,16 @@ configuration: # Specifies the number of pull request reviews before merging. int (0-6). Should be null/empty if PRs are not required requiredApprovingReviewsCount: 1 # Require review from Code Owners. Requires requiredApprovingReviewsCount. boolean - requireCodeOwnersReview: false + requireCodeOwnersReview: true # Are commits required to be signed. boolean. TODO: all contributors must have commit signing on local machines. requiresCommitSignatures: false # Are conversations required to be resolved before merging? boolean - requiresConversationResolution: false + requiresConversationResolution: true # Are merge commits prohibited from being pushed to this branch. boolean requiresLinearHistory: false # Required status checks to pass before merging. Values can be any string, but if the value does not correspond to any existing status check, the status check will be stuck on pending for status since nothing exists to push an actual status requiredStatusChecks: - - build (16.x) - - build (18.x) - - build (20.x) + - check-build-matrix # Require branches to be up to date before merging. Requires requiredStatusChecks. boolean requiresStrictStatusChecks: true # Indicates whether there are restrictions on who can push. boolean. Should be set with whoCanPush. From 9186f19e2a56a5086f239ff09d59d2482cb7deaf Mon Sep 17 00:00:00 2001 From: Michael Mainer Date: Wed, 30 Aug 2023 13:25:57 -0700 Subject: [PATCH 3/3] - add CodeQL check --- .../policies/msgraph-sdk-javascript-branch-protection.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/policies/msgraph-sdk-javascript-branch-protection.yml b/.github/policies/msgraph-sdk-javascript-branch-protection.yml index 17b826f89..a82e58857 100644 --- a/.github/policies/msgraph-sdk-javascript-branch-protection.yml +++ b/.github/policies/msgraph-sdk-javascript-branch-protection.yml @@ -36,6 +36,7 @@ configuration: # Required status checks to pass before merging. Values can be any string, but if the value does not correspond to any existing status check, the status check will be stuck on pending for status since nothing exists to push an actual status requiredStatusChecks: - check-build-matrix + - CodeQL # Require branches to be up to date before merging. Requires requiredStatusChecks. boolean requiresStrictStatusChecks: true # Indicates whether there are restrictions on who can push. boolean. Should be set with whoCanPush. @@ -70,6 +71,7 @@ configuration: # Required status checks to pass before merging. Values can be any string, but if the value does not correspond to any existing status check, the status check will be stuck on pending for status since nothing exists to push an actual status requiredStatusChecks: - check-build-matrix + - CodeQL # Require branches to be up to date before merging. Requires requiredStatusChecks. boolean requiresStrictStatusChecks: true # Indicates whether there are restrictions on who can push. boolean. Should be set with whoCanPush. @@ -100,6 +102,7 @@ configuration: # Required status checks to pass before merging. Values can be any string, but if the value does not correspond to any existing status check, the status check will be stuck on pending for status since nothing exists to push an actual status requiredStatusChecks: - check-build-matrix + - CodeQL # Require branches to be up to date before merging. Requires requiredStatusChecks. boolean requiresStrictStatusChecks: true # Indicates whether there are restrictions on who can push. boolean. Should be set with whoCanPush. @@ -134,6 +137,7 @@ configuration: # Required status checks to pass before merging. Values can be any string, but if the value does not correspond to any existing status check, the status check will be stuck on pending for status since nothing exists to push an actual status requiredStatusChecks: - check-build-matrix + - CodeQL # Require branches to be up to date before merging. Requires requiredStatusChecks. boolean requiresStrictStatusChecks: true # Indicates whether there are restrictions on who can push. boolean. Should be set with whoCanPush. @@ -168,6 +172,7 @@ configuration: # Required status checks to pass before merging. Values can be any string, but if the value does not correspond to any existing status check, the status check will be stuck on pending for status since nothing exists to push an actual status requiredStatusChecks: - check-build-matrix + - CodeQL # Require branches to be up to date before merging. Requires requiredStatusChecks. boolean requiresStrictStatusChecks: false # Indicates whether there are restrictions on who can push. boolean. Should be set with whoCanPush. @@ -202,6 +207,7 @@ configuration: # Required status checks to pass before merging. Values can be any string, but if the value does not correspond to any existing status check, the status check will be stuck on pending for status since nothing exists to push an actual status requiredStatusChecks: - check-build-matrix + - CodeQL # Require branches to be up to date before merging. Requires requiredStatusChecks. boolean requiresStrictStatusChecks: true # Indicates whether there are restrictions on who can push. boolean. Should be set with whoCanPush.